# Use together with compose.prod.yaml. No database port is published on the web host.
services:
    core-db-tunnel:
        build:
            context: .
            dockerfile: docker/ssh-tunnel/Dockerfile
        image: moonwell-core-db-tunnel:local
        restart: unless-stopped
        init: true
        environment:
            CORE_SSH_HOST: '${CORE_SSH_HOST:?Set CORE_SSH_HOST in .env}'
            CORE_SSH_PORT: '${CORE_SSH_PORT:-22}'
            CORE_SSH_USER: '${CORE_SSH_USER:?Set CORE_SSH_USER in .env}'
            CORE_DB_HOST: '${CORE_DB_HOST:-127.0.0.1}'
            CORE_DB_PORT: '${CORE_DB_PORT:-13306}'
        volumes:
            - type: bind
              source: '${CORE_SSH_KEY_PATH:-/etc/moonwell/ssh-tunnel/id_ed25519}'
              target: /run/ssh/id_ed25519
              read_only: true
              bind:
                  create_host_path: false
            - type: bind
              source: '${CORE_SSH_KNOWN_HOSTS_PATH:-/etc/moonwell/ssh-tunnel/known_hosts}'
              target: /run/ssh/known_hosts
              read_only: true
              bind:
                  create_host_path: false
        networks:
            - sail
        healthcheck:
            test: ['CMD', 'nc', '-z', '-w', '2', '127.0.0.1', '3306']
            interval: 10s
            timeout: 3s
            retries: 3
            start_period: 15s
        read_only: true
        tmpfs:
            - /tmp
        security_opt:
            - no-new-privileges:true
        cap_drop:
            - ALL

    app:
        environment:
            VMANGOS_AUTH_DB_HOST: core-db-tunnel
            VMANGOS_AUTH_DB_PORT: '3306'
            VMANGOS_CHARACTERS_DB_HOST: core-db-tunnel
            VMANGOS_CHARACTERS_DB_PORT: '3306'
        depends_on:
            core-db-tunnel:
                condition: service_healthy