services:
  postgres:
    image: docker.io/library/postgres:16-alpine
    environment:
      POSTGRES_DB: broker
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d broker"]
      interval: 2s
      timeout: 3s
      retries: 30
    restart: unless-stopped

  # One-shot: applies migrations and creates/rotates the least-privilege
  # broker_admin/broker_runtime/broker_enqueue roles, then exits. The
  # broker service below only starts once this completes successfully.
  migrate:
    image: git.warky.dev/wdevs/pgsql-broker:latest
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - ./broker.docker.yaml:/etc/pgsql-broker/broker.yaml:ro
    environment:
      PGUSER: postgres
      PGPASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
      BROKER_ADMIN_PASSWORD: ${BROKER_ADMIN_PASSWORD:?set BROKER_ADMIN_PASSWORD in .env}
      BROKER_RUNTIME_PASSWORD: ${BROKER_RUNTIME_PASSWORD:?set BROKER_RUNTIME_PASSWORD in .env}
      BROKER_ENQUEUE_PASSWORD: ${BROKER_ENQUEUE_PASSWORD:?set BROKER_ENQUEUE_PASSWORD in .env}
    command: ["install", "--with-roles"]
    restart: "no"

  broker:
    image: git.warky.dev/wdevs/pgsql-broker:latest
    depends_on:
      migrate:
        condition: service_completed_successfully
    volumes:
      - ./broker.docker.yaml:/etc/pgsql-broker/broker.yaml:ro
    restart: unless-stopped

volumes:
  postgres-data: