convox.yml

appSettings:
  awsLogs:
    cwRetention: ${LOG_RETENTION_DAYS}
    disableRetention: false

# Vars shared by all services
environment:
  - DOMAIN # required (tailscale domain)
  - APP_SECRET_KEY # required
  - GOOGLE_CLIENT_ID # required
  - GOOGLE_CLIENT_SECRET # required
  - GOOGLE_ALLOWED_DOMAIN # required, e.g. example.com
  - ADMIN_USERS # comma-separated bootstrap admins
  - RACK_TOKEN # required API token for target rack
  - POSTMARK_API_TOKEN # optional email notifications
  - CONVOX_SECRET_ENV_VARS=DATABASE_URL
  # - GOOGLE_OAUTH_BASE_URL # optional; default Google; set to your OIDC issuer if needed
  # - POSTMARK_STREAM=outbound # optional stream
  # - POSTMARK_FROM # optional sender address
  # - COOKIE_SECURE=true # in prod
  # - DEV_MODE=false
  # - RACK_USERNAME=convox # optional; defaults to convox
  # WORM S3 anchor storage (set via Terraform)
  - AUDIT_HMAC_SECRET # Secret key used for HMAC-SHA256 cryptographic chain of audit logs
  - AUDIT_ANCHOR_BUCKET # S3 bucket name for WORM audit anchors
  - AUDIT_ANCHOR_CHAIN_ID # Chain identifier (typically rack alias, e.g., staging, eu, us)
  - AUDIT_ANCHOR_RETENTION_DAYS # Object Lock retention in days (default: 400)

services:
  gateway:
    # To deploy: Build locally and push to Docker Hub using scripts/build-and-push.sh
    # Then update the image tag below to the new version
    image: docker.io/docspringcom/rack-gateway:latest
    command: ./scripts/start-gateway.sh
    environment:
      - PORT=8080
      - PGSSLMODE=require
      - DATABASE_URL # Set via Terraform (app user connection)
    health: /api/v1/health
    internal: true
    port: 8080
    scale:
      count: 1
      cpu: 256
      memory: 256
    sticky: true
    volumes: []
    annotations:
      - eks.amazonaws.com/role-arn: "${IAM_ROLE_ARN}"

  admin:
    # Uses same image as gateway service
    image: docker.io/docspringcom/rack-gateway:latest
    command: echo "Use this service to run migrations, database admin tasks, etc."
    environment:
      - PORT=8080
      - PGSSLMODE=require
      - RGW_DATABASE_URL=${ADMIN_DATABASE_URL}
    scale:
      memory: 512
      cpu: 250
      count: 0

timers: {}