services:
  nginx:
    image: anssi/fcsc2025-web-track-db-front:latest
    read_only: true
    hostname: "track-db-front"
    container_name: "track-db-front"
    depends_on:
      postgrest:
        condition: service_healthy
    environment:
      - JWT_SECRET=jwt_secret
      - JWT_COOKIE_NAME=instancier_session
    ports:
      - "80:80"
    restart: always
    cap_drop:
      - all
    cap_add:
      - CAP_DAC_OVERRIDE
      - CAP_CHOWN
      - CAP_SETUID
      - CAP_SETGID
    # security_opt:
    #   - no-new-privileges # active for FCSC 2025
    tmpfs:
     - /usr/local/openresty/nginx/client_body_temp
     - /usr/local/openresty/nginx/proxy_temp
     - /usr/local/openresty/nginx/fastcgi_temp
     - /usr/local/openresty/nginx/uwsgi_temp
     - /usr/local/openresty/nginx/scgi_temp
     - /usr/local/openresty/nginx/logs/

  postgres:
    image: anssi/fcsc2025-web-track-db-postgres:latest
    read_only: true
    hostname: "track-db-postgres"
    container_name: "track-db-postgres"
    command: -c config_file=/etc/postgresql.conf
    environment:
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=posgres_password
      - POSTGRES_DB=db_template
      - DB_SCHEMA=public
    healthcheck:
      test: ["CMD-SHELL", "pg_isready", "-d", "$POSTGRES_DB"]
      interval: 1m30s
      timeout: 5s
      retries: 5
      start_period: 5s
    restart: always
    cap_drop:
      - all
    cap_add:
      - CAP_CHOWN
      - CAP_SETUID
      - CAP_SETGID
    # security_opt:
    #   - no-new-privileges # active for FCSC 2025
    tmpfs:
      - /var/lib/postgresql/data:uid=999,gid=999
      - /var/run/postgresql
      - /tmp

  postgrest:
    image: anssi/fcsc2025-web-track-db-postgrest:latest
    read_only: true
    hostname: "track-db-postgrest"
    container_name: "track-db-postgrest"
    environment:
      - POSTGRES_HOST=postgres
      - POSTGRES_PORT=5432
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=posgres_password
      - POSTGRES_DB=db_template
      - JWT_SECRET=jwt_secret
      - JWT_COOKIE_NAME=instancier_session
      - POW_DIFFICULTY=2
      - FLAG=FCSC{ecfc2902e59ee8ba3ada96bf1392a97abaefc3a7331e39f9587abf856695b2de}
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: wget -O /dev/null -q 127.0.0.1:1337 || exit 1
      interval: 1m30s
      timeout: 5s
      retries: 5
      start_period: 5s
    restart: always
    cap_drop:
      - all
    # security_opt:
    #   - no-new-privileges # active for FCSC 2025
    tmpfs:
      - /tmp
