services:
  pocket-id-db:
    container_name: pocket-id-db
    image: docker.io/library/postgres:18.3@sha256:5aa97b304990f15e4625725b124c47df65746ec249bd3e2fdf3cf9dbd458326d
    restart: unless-stopped
    environment:
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
      - PGDATA=/var/lib/postgresql/18/docker
    volumes:
      - ${APPDATA_PATH}/pocket-id/db:/var/lib/postgresql
    networks:
      - backend
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d ${POSTGRES_DB} -U ${POSTGRES_USER}"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s

  pocket-id:
    container_name: pocket-id
    image: ghcr.io/pocket-id/pocket-id:v2.3.0-distroless@sha256:85a7485108325e34679b0fbca0baeb8418401f6d6cf59944d50f3ec013aafd09
    restart: unless-stopped
    depends_on:
      pocket-id-db:
        condition: service_healthy
    read_only: true
    user: ${PUID}:${PGID}
    environment:
      - APP_URL=${APP_URL}
      - TRUST_PROXY=${TRUST_PROXY}
      - MAXMIND_LICENSE_KEY=${MAXMIND_LICENSE_KEY}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      - PUID=${PUID}
      - PGID=${PGID}
      - ANALYTICS_DISABLED=${ANALYTICS_DISABLED}
      - DB_PROVIDER=postgres
      - DB_CONNECTION_STRING=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@pocket-id-db:5432/${POSTGRES_DB}
    volumes:
      - ${APPDATA_PATH}/pocket-id/data:/app/data
    ports:
      - ${PORT}:1411
    networks:
      - frontend
      - backend
    healthcheck:
      test: [ "CMD", "/app/pocket-id", "healthcheck" ]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s

networks:
  frontend:
    external: true
  backend:
    external: true