services:
  mas-db:
    image: postgres:16-alpine
    container_name: mas-db
    restart: unless-stopped
    environment:
      - POSTGRES_USER=mas
      - POSTGRES_PASSWORD=3XRBtczkPrdbNgdJftKGWu7QwhT3
      - POSTGRES_DB=mas
    volumes:
      # LOCAL disk, never NFS (Known Issue #16)
      - /var/lib/mas-db:/var/lib/postgresql/data
    networks:
      - mas
    mem_limit: 256M
    memswap_limit: 256M
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U mas -d mas"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "3"

  mas:
    # NOTE: MAS tags are NOT v-prefixed (1.23.0), unlike Synapse (v1.159.0).
    # Distroless image - no shell, so no container healthcheck is possible.
    # Liveness is covered by the blackbox probe of https://auth.hobbs.farm/health.
    image: ghcr.io/element-hq/matrix-authentication-service:1.23.0
    container_name: mas
    restart: unless-stopped
    command: ["server", "--config", "/config/config.yaml"]
    volumes:
      - /mnt/docker-data/configs/mas:/config:ro
      # read-only synapse data dir: syn2mas reads homeserver.yaml from here
      - /var/lib/synapse:/synapse:ro
    ports:
      - "8020:8080"   # web: oauth / compat / discovery / human UI
      - "8021:8081"   # internal: /health only
    networks:
      - mas               # to mas-db
      - matrix-internal   # to synapse (admin API) and back
    depends_on:
      mas-db:
        condition: service_healthy
    mem_limit: 256M
    memswap_limit: 256M
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "3"

networks:
  mas:
    driver: bridge
  matrix-internal:
    external: true
    name: matrix_matrix-internal