name: void-bastion-online

services:
  postgres:
    image: postgres:16-alpine
    container_name: void-bastion-postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: nakama
      POSTGRES_USER: nakama
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - /mnt/user/appdata/void-bastion-online/postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U nakama -d nakama"]
      interval: 5s
      timeout: 5s
      retries: 12
    networks:
      - backend
    security_opt:
      - no-new-privileges:true

  nakama:
    image: registry.heroiclabs.com/heroiclabs/nakama:3.37.0
    container_name: void-bastion-nakama
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      NAKAMA_SERVER_KEY: ${NAKAMA_SERVER_KEY}
      NAKAMA_SESSION_KEY: ${NAKAMA_SESSION_KEY}
      NAKAMA_REFRESH_KEY: ${NAKAMA_REFRESH_KEY}
      NAKAMA_HTTP_KEY: ${NAKAMA_HTTP_KEY}
      NAKAMA_CONSOLE_PASSWORD: ${NAKAMA_CONSOLE_PASSWORD}
      NAKAMA_CONSOLE_USERNAME: ${NAKAMA_CONSOLE_USERNAME}
      NAKAMA_CONSOLE_SIGNING_KEY: ${NAKAMA_CONSOLE_SIGNING_KEY}
    entrypoint:
      - /bin/sh
      - -ec
      - |
        /nakama/nakama migrate up --database.address "nakama:$${POSTGRES_PASSWORD}@postgres:5432/nakama" &&
        exec /nakama/nakama \
        --name void-bastion \
        --database.address "nakama:$${POSTGRES_PASSWORD}@postgres:5432/nakama" \
        --logger.level INFO \
        --session.token_expiry_sec 7200 \
        --socket.server_key "$${NAKAMA_SERVER_KEY}" \
        --session.encryption_key "$${NAKAMA_SESSION_KEY}" \
        --session.refresh_encryption_key "$${NAKAMA_REFRESH_KEY}" \
        --runtime.http_key "$${NAKAMA_HTTP_KEY}" \
        --runtime.js_entrypoint "build/index.js" \
        --console.username "$${NAKAMA_CONSOLE_USERNAME}" \
        --console.signing_key "$${NAKAMA_CONSOLE_SIGNING_KEY}" \
        --console.password "$${NAKAMA_CONSOLE_PASSWORD}"
    volumes:
      - /mnt/user/appdata/void-bastion-online/nakama:/nakama/data
    ports:
      - "7350:7350"
      - "127.0.0.1:7351:7351"
    healthcheck:
      test: ["CMD", "/nakama/nakama", "healthcheck"]
      interval: 10s
      timeout: 5s
      retries: 12
    networks:
      - backend
    security_opt:
      - no-new-privileges:true

  postgres-backup:
    image: postgres:16-alpine
    container_name: void-bastion-postgres-backup
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PGPASSWORD: ${POSTGRES_PASSWORD}
    entrypoint:
      - /bin/sh
      - -ec
      - |
        while true; do
          pg_dump -h postgres -U nakama -d nakama -Fc -f "/backups/nakama-$$(date +%Y%m%d-%H%M%S).dump"
          find /backups -type f -name 'nakama-*.dump' -mtime +14 -delete
          sleep 86400
        done
    volumes:
      - /mnt/user/appdata/void-bastion-online/backups:/backups
    networks:
      - backend
    security_opt:
      - no-new-privileges:true

networks:
  backend:
    name: void-bastion-backend
    driver: bridge