docker-compose.yml

services:
  # Rewards Eligibility Oracle container
  rewards-eligibility-oracle:

    # Build the image from the Dockerfile in the current directory
    build: .

    # Set the container name
    container_name: rewards-eligibility-oracle

    # Set the image name
    image: ghcr.io/graphprotocol/rewards-eligibility-oracle:v0.4.5 # x-release-please-version

    volumes:
      # Mount data directory to store data
      - ./data:/app/data
      - ./logs:/app/logs

      # Mount config file as read-only
      - ./config.toml:/app/config.toml:ro

      # Mount service account key file for Google Cloud authentication
      - ./keys/service-account.json:/app/keys/service-account.json:ro

    environment:
      - RUN_ON_STARTUP=true
      
      # Setup enviroment variables
      # Environment variables go into process memory for this specific container only
      # Meaning they can't be accessed by other containers or processes outside of this container
      # More secure than storing secrets in a file that can be accessed by other containers or processes
      - GOOGLE_APPLICATION_CREDENTIALS=${GOOGLE_APPLICATION_CREDENTIALS}
      - BLOCKCHAIN_PRIVATE_KEY=${BLOCKCHAIN_PRIVATE_KEY}
      - ETHERSCAN_API_KEY=${ETHERSCAN_API_KEY}
      - ARBITRUM_API_KEY=${ARBITRUM_API_KEY}
      - STUDIO_API_KEY=${STUDIO_API_KEY}
      - STUDIO_DEPLOY_KEY=${STUDIO_DEPLOY_KEY}
      - SLACK_WEBHOOK_URL=${SLACK_WEBHOOK_URL}
      - OPSGENIE_API_KEY=${OPSGENIE_API_KEY}

    # Block processes from gaining higher privileges/capabilities
    security_opt:
      - no-new-privileges:true
    
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          memory: 512M

    # Restart policy
    restart: "on-failure"

    # Healthcheck to ensure the container is running
    healthcheck:
      test: ["CMD", "python", "-c", "import os, time; assert os.path.exists('/app/healthcheck') and time.time() - os.path.getmtime('/app/healthcheck') < 3600, 'Healthcheck failed'"]
      interval: 5m
      timeout: 30s
      retries: 3
      start_period: 1m

    # Prevent log files from growing indefinitely and consuming disk space
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"