services:
  app:
    build: .
    container_name: filedrop-app
    restart: always
    environment:
      - BOT_TOKENS=${BOT_TOKENS}
      - BOT_TOKEN=${BOT_TOKEN}
      - ADDITIONAL_BOT_TOKENS=${ADDITIONAL_BOT_TOKENS:-}
      - STORAGE_CHANNEL_ID=${STORAGE_CHANNEL_ID}
      - BASE_URL=${BASE_URL}
      - DATABASE_URL=${DATABASE_URL}
      - PORT=3000
      - NODE_ENV=production
      - LOG_LEVEL=info
      - TRUST_PROXY=true
      - BATCH_MAX_ITEMS=${BATCH_MAX_ITEMS:-20}
      - BATCH_MAX_SIZE_BYTES=${BATCH_MAX_SIZE_BYTES:-524288000}
      - MAX_REQUEST_BODY_BYTES=${MAX_REQUEST_BODY_BYTES:-2147483648}
      - TELEGRAM_CHUNK_SIZE_BYTES=${TELEGRAM_CHUNK_SIZE_BYTES:-20971520}
      - COMPRESS_CHUNKED_UPLOADS=${COMPRESS_CHUNKED_UPLOADS:-true}
      - CHUNK_COMPRESSION_MIN_SIZE_BYTES=${CHUNK_COMPRESSION_MIN_SIZE_BYTES:-4096}
      - RATE_LIMIT_WINDOW_MS=${RATE_LIMIT_WINDOW_MS:-60000}
      - RATE_LIMIT_MAX_REQUESTS=${RATE_LIMIT_MAX_REQUESTS:-30}
      - ADMIN_API_TOKEN=${ADMIN_API_TOKEN:-}
      - SESSION_COOKIE_NAME=${SESSION_COOKIE_NAME:-tu_session}
      - SESSION_COOKIE_MAX_AGE_SECONDS=${SESSION_COOKIE_MAX_AGE_SECONDS:-86400}
      - S3_ACCESS_KEY=${S3_ACCESS_KEY:-filedrop-admin}
      - S3_SECRET_KEY=${S3_SECRET_KEY}
      - S3_DEFAULT_REGION=${S3_DEFAULT_REGION:-us-east-1}
      - S3_VHOST_DOMAINS=${S3_VHOST_DOMAINS:-upload.asepharyana.my.id,asepharyana.web.id}
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp:size=4g,mode=1777
      - /usr/src/app/logs:size=64m,mode=1777
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M
    healthcheck:
      test:
        - CMD-SHELL
        - "bun -e \"fetch('http://localhost:3000/health').then(r => r.status === 200 ? process.exit(0) : process.exit(1))\""
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
    networks:
      - app-shared-net
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.filedrop.rule=Host(`upload.asepharyana.my.id`) || Host(`upload.asepharyana.web.id`) || Host(`asepharyana.web.id`) || HostRegexp(`{subhost:[a-z0-9][a-z0-9.-]+}.asepharyana.web.id`)"
      - "traefik.http.routers.filedrop.entrypoints=websecure"
      - "traefik.http.routers.filedrop.tls=true"
      - "traefik.http.routers.filedrop.tls.certresolver=cloudflare"
      - "traefik.http.services.filedrop.loadbalancer.server.port=3000"
      - "traefik.http.middlewares.filedrop-rl.ratelimit.average=300"
      - "traefik.http.middlewares.filedrop-rl.ratelimit.burst=100"
      - "traefik.http.middlewares.filedrop-rl.ratelimit.period=1m"
      - "traefik.http.middlewares.filedrop-buf.buffering.maxRequestBodyBytes=2147483648"
      - "traefik.http.routers.filedrop.middlewares=filedrop-rl@docker,filedrop-buf@docker"

networks:
  app-shared-net:
    name: app-shared-net
    external: true