services:
  rust-package-builder:
    build:
      context: .
    image: linuxiarz/rust-package-builder:latest
    environment:
      SOURCE_REPO: "${SOURCE_REPO:?SOURCE_REPO is required}"
      SOURCE_BRANCH: "${SOURCE_BRANCH:-master}"
      REPOSITORY_URL: "${REPOSITORY_URL:?REPOSITORY_URL is required}"
      POLL_INTERVAL: "${POLL_INTERVAL:-300}"
    volumes:
      - ./data:/var/lib/package-builder
      - ./gpg:/run/secrets/gpg:ro
    restart: unless-stopped

  repository-http:
    image: nginxinc/nginx-unprivileged:stable-alpine-slim
    ports:
      - "0.0.0.0:${HTTP_PORT:-18765}:8080"
    volumes:
      - ./data/repository:/srv/repository:ro
      - ./http/nginx.conf:/etc/nginx/nginx.conf:ro
    entrypoint: ["nginx", "-g", "daemon off;"]
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=16m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped