services:
  postgres:
    image: postgres:17-alpine
    container_name: infra-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
    secrets:
      - postgres_password
      - news_1440_password
    volumes:
      - pgdata:/var/lib/postgresql/data
      - ./init:/docker-entrypoint-initdb.d:ro
    networks:
      - infra
      - atproto
    # Port exposed for local debugging (using 5433 to avoid conflict with local postgres)
    ports:
      - "5433:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

secrets:
  postgres_password:
    file: ./secrets/postgres_password.txt
  news_1440_password:
    file: ./secrets/news_1440_password.txt

volumes:
  pgdata:

networks:
  infra:
    external: true
  atproto:
    name: atproto
    driver: bridge