# kuber derives the Kubernetes namespace and built image names from the current
# directory. Run kuber from the repository root that contains this file.

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
      target: runner
      # NEXT_PUBLIC_* values are embedded by `next build`, so pass them as
      # build args only when your Dockerfile declares matching ARG/ENV entries.
      # args:
      #   NEXT_PUBLIC_API_URL: https://api.example.com

    # Use `image` instead of `build` when an external registry already owns the
    # image lifecycle. A service should normally use one approach or the other.
    # image: registry.example.com/team/app:latest

    # If the app has a .env file, uncomment this. kuber reads it locally and
    # creates an `app-env` Kubernetes Secret; Docker never copies it.
    # env_file:
    #   - .env

    environment:
      NODE_ENV: production
      HOSTNAME: 0.0.0.0
      PORT: "3000"

    # Application data services are declared with kuber pseudo-volumes. They
    # inject credentials into app-env but do not mount a filesystem. Uncomment
    # `volumes` and only the services this application needs.
    # volumes:
    #   # Many applications need Postgres. This injects DATABASE_URL.
    #   - postgresql:app
    #   # Some applications also need object storage. This provisions an S3
    #   # key named app-assets and bucket named assets, then injects AWS/S3 env.
    #   - s3:app-assets/assets
    #
    #   # Filesystem persistence is uncommon for Next.js. Prefer Postgres or S3
    #   # unless the application specifically requires POSIX file access.
    #   # A file bind becomes a ConfigMap.
    #   - ./config/app.json:/app/config/app.json:ro
    #   # A directory bind or named volume becomes a PVC.
    #   - ./uploads:/app/uploads
    #   - cache(5Gi on 1 fast):/app/.next/cache

    ports:
      # A hostname creates an Ingress that routes to container port 3000.
      - app.example.com:3000

      # Other supported routing forms:
      # - "*.example.com:3000"
      # - admin.example.com:3000:protected
      # - admin.example.com:3000:protected(/admin,/api/internal)

    deploy:
      replicas: 1

    # !! You probably will not need this section in most deployments. !!
    # These Kubernetes container fields are merged into the generated
    # Deployment. TCP probes work without requiring a dedicated health route.
    x-container:
      readinessProbe:
        tcpSocket:
          port: 3000
        initialDelaySeconds: 5
        periodSeconds: 10
      livenessProbe:
        tcpSocket:
          port: 3000
        initialDelaySeconds: 15
        periodSeconds: 20
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          cpu: "1"
          memory: 512Mi
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: [ALL]
        runAsGroup: 1001
        runAsNonRoot: true
        runAsUser: 1001
        seccompProfile:
          type: RuntimeDefault