name: example

services:
  api:
    image: example/api:${IMAGE_TAG:-dev}
    environment:
      DATABASE_URL: postgres://app@db:5432/app
      DB_PASSWORD_FILE: /run/secrets/db_password
    depends_on:
      db:
        condition: service_healthy
    secrets: [db_password]
    networks: [app]

  db:
    image: postgres:18
    environment:
      POSTGRES_DB: app
      POSTGRES_USER: app
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s
    secrets: [db_password]
    volumes: [db-data:/var/lib/postgresql/data]
    networks: [app]

  adminer:
    image: adminer@sha256:983261ecc40a4aaf11e25aeda8ef821f5a43a9f024b3967c81cbcc0e6ce43ba3
    depends_on:
      db:
        condition: service_healthy
    ports: ["${ADMINER_PORT:-8080}:8080"]
    networks: [app]
    profiles: [debug]

volumes:
  db-data:

networks:
  app:
    # Internal network: services have no external gateway. Add a front network and publish a proxy/API explicitly when host access is required.
    internal: true

secrets:
  db_password:
    file: ./secret.example.txt