version: "3.7"

services:
  app_proxy:
    environment:
      APP_HOST: penpot_penpot-frontend_1
      APP_PORT: 8080
      # Можно рассмотреть возможность отключения аутентификации вообще. Penpot имеет собственную систему авторизации.
      PROXY_AUTH_WHITELIST: "/api/*"

  penpot-frontend:
    image: penpotapp/frontend:2.14.4@sha256:aecf5131c59a4cd25cebd97af1c8835eef6e25eb74cb2bf349b481a0afae4428
    volumes:
      - ${APP_DATA_DIR}/data/assets:/opt/data/assets
    environment:
      - PENPOT_FLAGS=enable-registration enable-login-with-password
    depends_on:
      - penpot-backend
      - penpot-exporter
    restart: on-failure

  penpot-backend:
    image: penpotapp/backend:2.14.4@sha256:6e2798b2c3ccd6730415db5f28030460d05fa8c01301b3b72ba3dc66af9e3c58
    # пользователь 1000:1000, чтобы избежать проблем с разрешениями при импорте библиотек и шаблонов.
    user: "1000:1000"
    volumes:
      - ${APP_DATA_DIR}/data/assets:/opt/data/assets
    environment:
      - PENPOT_FLAGS=enable-registration enable-login-with-password disable-email-verification disable-smtp enable-prepl-server disable-secure-session-cookies
      - PENPOT_DATABASE_URI=postgresql://penpot-postgres/penpot
      - PENPOT_DATABASE_USERNAME=penpot
      - PENPOT_DATABASE_PASSWORD=penpot
      - PENPOT_REDIS_URI=redis://penpot_penpot-valkey_1/0
      - PENPOT_ASSETS_STORAGE_BACKEND=assets-fs
      - PENPOT_STORAGE_ASSETS_FS_DIRECTORY=/opt/data/assets
      - PENPOT_TELEMETRY_ENABLED=false
      # PENPOT_PUBLIC_URI необходимо установить для отображения миниатюр во внешнем интерфейсе.
      - PENPOT_PUBLIC_URI=http://${DEVICE_DOMAIN_NAME}:${APP_PENPOT_UI_PORT}
    depends_on:
      - penpot-postgres
      - penpot-valkey
    restart: on-failure

  penpot-exporter:
    image: penpotapp/exporter:2.14.4@sha256:c5112cf3b54edf8911945042562d6f0be99ca047f1bc22573315e676a65030b5
    user: "1000:1000"
    environment:
      - PENPOT_PUBLIC_URI=http://penpot-frontend
      - PENPOT_REDIS_URI=redis://penpot_penpot-valkey_1/0
    restart: on-failure

  penpot-postgres:
    image: postgres:15@sha256:546445ad21cb5893c0997080b831ee45945e798c4359270e16413c8bd93575db
    user: "1000:1000"
    stop_signal: SIGINT
    volumes:
      - ${APP_DATA_DIR}/data/postgres:/var/lib/postgresql/data
    environment:
      - POSTGRES_INITDB_ARGS=--data-checksums
      - POSTGRES_DB=penpot
      - POSTGRES_USER=penpot
      - POSTGRES_PASSWORD=penpot
    restart: on-failure

  penpot-valkey:
    image: valkey/valkey:8.1.3@sha256:facc1d2c3462975c34e10fccb167bfa92b0e0dbd992fc282c29a61c3243afb11
    user: "1000:1000"
    restart: on-failure
    healthcheck:
      test: ["CMD-SHELL", "valkey-cli ping | grep PONG"]
      interval: 1s
      timeout: 3s
      retries: 5
      start_period: 3s