version: "3.8"

services:
  auth-api:
    image: ${REG}/library/auth-yes-api:latest
    env_file: .env
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-net"
      - "traefik.http.routers.auth-api.rule=Host(`${SYSTEM_DOMAIN}`)"
      - "traefik.http.routers.auth-api.entrypoints=websecure"
      - "traefik.http.routers.auth-api.tls=true"
      - "traefik.http.services.auth-api.loadbalancer.server.port=8000"
    expose:
      - "8000"
    depends_on:
      - auth-db
      - auth-valkey
    networks:
      - default
      - traefik-net
    volumes:
      - spire-socket:/var/run/spire:ro

  auth-db:
    image: acr.atyg.org/library/postgres:18-alpine
    environment:
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
    volumes:
      - auth-db-data:/var/lib/postgresql/data
    networks:
      - default

  auth-valkey:
    image: acr.atyg.org/valkey/valkey:8-alpine
    networks:
      - default

volumes:
  auth-db-data:
    driver: local
    driver_opts:
      type: none
      device: ${DB_DATA_PATH}
      o: bind
  spire-socket:
    name: spire-socket

networks:
  default:
    name: auth-internal-net
  traefik-net:
    external: true