# Opt-in server overlay for user-owned PostgreSQL sessions. Copy this file to a
# reviewed local override; it is intentionally not loaded by default Compose.
services:
  core:
    environment:
      THOTH_PUBLIC_EXPOSURE: "true"
      THT_SESSION_STORAGE: postgres
      THT_CONFIG: /app/harness/workspaces/server-sessions.yaml
      THT_SESSION_DB_HOST: ${THT_SESSION_DB_HOST:?set THT_SESSION_DB_HOST}
      THT_SESSION_DB_PORT: ${THT_SESSION_DB_PORT:-5432}
      THT_SESSION_DB_NAME: ${THT_SESSION_DB_NAME:?set THT_SESSION_DB_NAME}
      THT_SESSION_RUNTIME_USER: ${THT_SESSION_RUNTIME_USER:?set THT_SESSION_RUNTIME_USER}
      THT_SESSION_RUNTIME_PASSWORD_FILE: /run/secrets/session_runtime_password
      THT_SESSION_DB_SSLMODE: ${THT_SESSION_DB_SSLMODE:-verify-full}
      THT_SESSION_DB_SSLROOTCERT: /run/secrets/session_ca.pem
    secrets:
      - source: session_runtime_password
        target: session_runtime_password
      - source: session_ca
        target: session_ca.pem
    volumes:
      - ${THT_SERVER_WORKSPACE_CONFIG:?set THT_SERVER_WORKSPACE_CONFIG}:/app/harness/workspaces/server-sessions.yaml:ro

  # Run manually during the maintenance window. It is not a dependency of core,
  # so the application never gains the schema-changing migrator credential.
  session-migrate:
    image: thothii-core:local
    profiles: [session-migrate]
    entrypoint: [/app/docker/session-migrate.sh]
    environment:
      THT_SESSION_DB_HOST: ${THT_SESSION_DB_HOST:?set THT_SESSION_DB_HOST}
      THT_SESSION_DB_PORT: ${THT_SESSION_DB_PORT:-5432}
      THT_SESSION_DB_NAME: ${THT_SESSION_DB_NAME:?set THT_SESSION_DB_NAME}
      THT_SESSION_MIGRATOR_USER: ${THT_SESSION_MIGRATOR_USER:?set THT_SESSION_MIGRATOR_USER}
      THT_SESSION_MIGRATOR_PASSWORD_FILE: /run/secrets/session_migrator_password
      THT_SESSION_DB_SSLMODE: ${THT_SESSION_DB_SSLMODE:-verify-full}
      THT_SESSION_DB_SSLROOTCERT: /run/secrets/session_ca.pem
    secrets:
      - source: session_migrator_password
        target: session_migrator_password
      - source: session_ca
        target: session_ca.pem
    restart: "no"

secrets:
  session_runtime_password:
    file: ${THT_SESSION_RUNTIME_PASSWORD_SOURCE:?set THT_SESSION_RUNTIME_PASSWORD_SOURCE}
  session_migrator_password:
    file: ${THT_SESSION_MIGRATOR_PASSWORD_SOURCE:?set THT_SESSION_MIGRATOR_PASSWORD_SOURCE}
  session_ca:
    file: ${THT_SESSION_CA_SOURCE:?set THT_SESSION_CA_SOURCE}