name: who_need_help_external_boundaries

services:
  external-mock:
    image: ${EXTERNAL_BOUNDARY_MOCK_IMAGE:?Set EXTERNAL_BOUNDARY_MOCK_IMAGE}
    build:
      context: ops/external-boundaries
    environment:
      MOCK_OAUTH_CLIENT_ID: ${EXTERNAL_OAUTH_CLIENT_ID:?Set EXTERNAL_OAUTH_CLIENT_ID}
      MOCK_OAUTH_CLIENT_SECRET: ${EXTERNAL_OAUTH_CLIENT_SECRET:?Set EXTERNAL_OAUTH_CLIENT_SECRET}
      MOCK_PUSH_BEARER_TOKEN: ${EXTERNAL_PUSH_BEARER_TOKEN:?Set EXTERNAL_PUSH_BEARER_TOKEN}
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - >-
          import urllib.request;
          urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=1).read()
      interval: 1s
      timeout: 2s
      retries: 30
    user: "10001:10001"
    read_only: true
    tmpfs:
      - /tmp
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    networks: [boundary]
    restart: "no"

  boundary-check:
    image: ${EXTERNAL_BOUNDARY_APP_IMAGE:?Set EXTERNAL_BOUNDARY_APP_IMAGE}
    build:
      context: .
      target: release
    command:
      - /app/bin/who_need_help
      - eval
      - WhoNeedHelp.ExternalBoundaryDrill.run!()
    environment:
      APP_ROLE: migrate
      DATABASE_URL: ${EXTERNAL_DATABASE_URL:?Set EXTERNAL_DATABASE_URL}
      SECRET_KEY_BASE: ${EXTERNAL_SECRET_KEY_BASE:?Set EXTERNAL_SECRET_KEY_BASE}
      HANDOVER_SECRET: ${EXTERNAL_HANDOVER_SECRET:?Set EXTERNAL_HANDOVER_SECRET}
      PHX_HOST: boundary.local
      PHX_SCHEME: http
      PHX_URL_PORT: "80"
      GITHUB_OAUTH_CLIENT_ID: ${EXTERNAL_OAUTH_CLIENT_ID:?Set EXTERNAL_OAUTH_CLIENT_ID}
      GITHUB_OAUTH_CLIENT_SECRET: ${EXTERNAL_OAUTH_CLIENT_SECRET:?Set EXTERNAL_OAUTH_CLIENT_SECRET}
      GITHUB_OAUTH_BASE_URL: http://external-mock:8080
      GITHUB_OAUTH_AUTHORIZE_URL: http://external-mock:8080/oauth/authorize
      GITHUB_OAUTH_TOKEN_URL: http://external-mock:8080/oauth/token
      GITHUB_OAUTH_USER_URL: http://external-mock:8080/oauth/user
      GITHUB_OAUTH_HTTP_CONNECT_TIMEOUT_MS: "100"
      GITHUB_OAUTH_HTTP_RECEIVE_TIMEOUT_MS: "100"
      SMTP_RELAY: external-mock
      SMTP_PORT: "2525"
      SMTP_USERNAME: ""
      SMTP_PASSWORD: ""
      SMTP_AUTH: never
      SMTP_TLS: never
      SMTP_SSL: "false"
      EMAIL_FROM_NAME: Who Need Help boundary
      EMAIL_FROM_ADDRESS: boundary@example.invalid
      EXTERNAL_MOCK_BASE_URL: http://external-mock:8080
      EXTERNAL_SMTP_RELAY: external-mock
      EXTERNAL_PUSH_BEARER_TOKEN: ${EXTERNAL_PUSH_BEARER_TOKEN:?Set EXTERNAL_PUSH_BEARER_TOKEN}
    depends_on:
      external-mock:
        condition: service_healthy
    volumes:
      - ${EXTERNAL_BOUNDARY_OUTPUT_DIR:?Set EXTERNAL_BOUNDARY_OUTPUT_DIR}:/output
    user: "${EXTERNAL_BOUNDARY_HOST_UID:?Set EXTERNAL_BOUNDARY_HOST_UID}:${EXTERNAL_BOUNDARY_HOST_GID:?Set EXTERNAL_BOUNDARY_HOST_GID}"
    read_only: true
    tmpfs:
      - /tmp
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    networks: [boundary]
    restart: "no"

networks:
  boundary:
    internal: true