services:
  rustbox-package-builder:
    build:
      context: .
    image: rustbox/package-builder:local
    environment:
      SOURCE_REPO: "${SOURCE_REPO:?SOURCE_REPO is required}"
      SOURCE_BRANCH: "${SOURCE_BRANCH:-master}"
      REPOSITORY_URL: "${REPOSITORY_URL:?REPOSITORY_URL is required}"
      POLL_INTERVAL: "${POLL_INTERVAL:-300}"
      REPO_DISTRIBUTION: "${REPO_DISTRIBUTION:-stable}"
      REPO_COMPONENT: "${REPO_COMPONENT:-main}"
      PACKAGE_RELEASE: "${PACKAGE_RELEASE:-auto}"
      RUN_LINUX_TESTS: "${RUN_LINUX_TESTS:-compile}"
      MAX_GLIBC_VERSION: "${MAX_GLIBC_VERSION:-2.34}"
      BUILD_SUSE: "${BUILD_SUSE:-1}"
      RELEASE_RETENTION: "${RELEASE_RETENTION:-10}"
    volumes:
      - ./data:/var/lib/rustbox-package-builder
      - ./gpg:/run/secrets/gpg:ro
    restart: unless-stopped

  repository-dashboard:
    build:
      context: ./dashboard
    image: rustbox/repository-dashboard:local
    environment:
      REPOSITORY_ROOT: /srv/repository
      REPOSITORY_URL: "${REPOSITORY_URL:?REPOSITORY_URL is required}"
      REPO_DISTRIBUTION: "${REPO_DISTRIBUTION:-stable}"
      REPO_COMPONENT: "${REPO_COMPONENT:-main}"
    volumes:
      - ./data/repository:/srv/repository:ro
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped

  repository-http:
    depends_on:
      - repository-dashboard
    image: nginxinc/nginx-unprivileged:stable-alpine-slim
    ports:
      - "0.0.0.0:${HTTP_PORT:-18965}:8080"
    volumes:
      - ./data/repository:/srv/repository:ro
      - ./http/nginx.conf:/etc/nginx/nginx.conf:ro
    entrypoint: [ "nginx", "-g", "daemon off;" ]
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=16m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped