version: '3.7'

services:

  db:
    image: postgres:14
    restart: unless-stopped
    volumes:
      - db_data:/var/lib/postgresql/data
    ports:
      - 5432:5432
      # NOTE: if port 5432 are already in use locally, we'll also bind another port
      - 5433:5432
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: windmill
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U postgres" ]
      interval: 10s
      timeout: 5s
      retries: 5

  windmill:
    image: ghcr.io/windmill-labs/windmill:main
    # Set privileged to true if enabling nsjail
    privileged: false
    restart: unless-stopped
    ports:
      - 8000:8000
    environment:
      - DATABASE_URL=postgres://postgres:${DB_PASSWORD}@db/windmill?sslmode=disable
      - BASE_URL=http://${WM_BASE_URL}
      - BASE_INTERNAL_URL=http://localhost:8000
      - RUST_LOG=info
      - NUM_WORKERS=3
      - KEEP_JOB_DIR=false
      - DENO_PATH=/usr/bin/deno
      - PYTHON_PATH=/usr/local/bin/python3
      - METRICS_ADDR=false
      # for ease of use, nsjail which provide isolation in untrusted environment is disabled by default. 
      # To enable it, uncomment the following line, set the container as privileged and
      # rebuild the image with nsjail=true or use the enterprise edition
      # - DISABLE_NSJAIL=false
      # - DISABLE_NUSER=false
      # - NSJAIL_PATH=nsjail
    depends_on:
      db:
        condition: service_healthy
    # to mount the worker folder to debug,, KEEP_JOB_DIR=true and mount /tmp/windmill
    volumes:
      - worker_dependency_cache:/tmp/windmill/cache
      # - ./oauth.json/:/usr/src/app/oauth.json

  lsp:
    image: ghcr.io/windmill-labs/windmill-lsp:latest
    restart: unless-stopped
    ports:
      - 3001:3001

  caddy:
    image: caddy:2.5.2-alpine
    restart: unless-stopped
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
    ports:
      - 80:80
      - 443:443
    environment:
      - BASE_URL=${WM_BASE_URL}

volumes:
  db_data: null
  worker_dependency_cache: null