volumes:
  vault-secrets:
    driver_opts:
      type: tmpfs
      device: tmpfs
      o: "size=1m,mode=0777,uid=65532,gid=65532"
  projects-data:

services:
  vault-agent:
    image: hashicorp/vault:1.17
    command: agent -config=/vault-agent/agent.hcl
    cap_add:
      - IPC_LOCK
    volumes:
      - ./agent.hcl:/vault-agent/agent.hcl:ro
      - ./env_template.ctmpl:/vault-template/template.ctmpl:ro
      - ./../role_id:/vault-auth/role_id:ro
      - ./../wrapped_secret_id:/vault-auth/wrapped_secret_id:ro
      - vault-secrets:/vault-secrets
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - agent-net

  api:
    build:
      context: ..
      dockerfile: deployment/Dockerfile
    ports:
      - "8173:8000"
    group_add:
      - "100"
    volumes:
      - ./../projects-data:/projects
      - vault-secrets:/vault-secrets
    depends_on:
      vault-agent:
        condition: service_started
    networks:
      - agent-net

networks:
  agent-net:
    driver: bridge
    ipam:
      config:
        - subnet: 10.6.7.0/24