# The video worker on stein2 (#402), a compose project of its own beside the web stack:
#
#   docker compose -f tools/video/compose.yml up -d
#
# It works on the checkout itself (the folder nginx serves), as www-data like the PHP container, so
# the files it writes belong to the same user. It needs no network.
#
# ffmpeg reads files strangers uploaded, so the container is kept small (#427): the checkout is
# read-only and only data/videos can be written, there are no capabilities, and memory and processes
# have a ceiling. A broken decoder could fill that one folder, not change the API or the pages.
name: feuerwerk-video

services:
  feuerwerk-video:
    container_name: feuerwerk-video
    image: feuerwerk-video:latest
    restart: unless-stopped
    network_mode: none
    user: '33:33'
    working_dir: /srv/feuerwerk
    volumes:
      - ../..:/srv/feuerwerk:ro
      - ../../data/videos:/srv/feuerwerk/data/videos
    read_only: true
    tmpfs:
      - /tmp
    cap_drop: [ALL]
    security_opt: ['no-new-privileges:true']
    command: ['php', 'tools/video-worker.php', '/srv/feuerwerk/data']
    # A 1080p conversion takes all four cores otherwise, and the web stack shares them.
    cpus: 3
    mem_limit: 2g
    pids_limit: 256