services:
  www:
    image: httpd
    volumes:
      - ./htdocs:/usr/local/apache2/htdocs/
      - ./conf/httpd.conf:/usr/local/apache2/conf/httpd.conf
    ports:
      - "${WWW_BIND_ADDRESS:-127.0.0.1}:${WWW_PORT:-8080}:80"
    depends_on:
      membership:
        condition: service_started
    networks:
      - frontend

  membership-db:
    image: postgres:17
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-membership}
      POSTGRES_USER: ${POSTGRES_USER:-membership}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
    volumes:
      - membership-db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 5s
      retries: 12
    restart: unless-stopped
    networks:
      - database

  membership-migrate:
    build: ./membership
    env_file: .env
    command: ["python", "manage.py", "migrate", "--noinput"]
    depends_on:
      membership-db:
        condition: service_healthy
    networks:
      - database

  membership:
    build: ./membership
    env_file: .env
    depends_on:
      membership-migrate:
        condition: service_completed_successfully
    restart: unless-stopped
    networks:
      - frontend
      - database
    # No published port: only the trusted Apache proxy can supply request headers.

  membership-worker:
    build: ./membership
    env_file: .env
    command: ["python", "manage.py", "sync_memberships", "--loop", "--interval", "60"]
    depends_on:
      membership-migrate:
        condition: service_completed_successfully
    restart: unless-stopped
    networks:
      - frontend
      - database

volumes:
  membership-db:

networks:
  frontend:
  database:
    internal: true