version: '3.8'

networks:
  maple-private-prod:
    external: true

volumes:
  redis-data:

secrets:
  redis_password:
    external: true

services:
  redis:
    image: redis:7-alpine
    hostname: redis
    networks:
      - maple-private-prod
    volumes:
      - redis-data:/data
    secrets:
      - redis_password
    # Command with password from secret
    command: >
      sh -c '
      redis-server
      --requirepass "$$(cat /run/secrets/redis_password)"
      --bind 0.0.0.0
      --port 6379
      --protected-mode no
      --save 900 1
      --save 300 10
      --save 60 10000
      --appendonly yes
      --appendfilename "appendonly.aof"
      --appendfsync everysec
      --maxmemory 512mb
      --maxmemory-policy allkeys-lru
      --loglevel notice
      --databases 16
      --timeout 300
      --tcp-keepalive 300
      --io-threads 2
      --io-threads-do-reads yes
      --slowlog-log-slower-than 10000
      --slowlog-max-len 128
      --activerehashing yes
      --maxclients 10000
      --rename-command FLUSHDB ""
      --rename-command FLUSHALL ""
      --rename-command CONFIG ""
      '
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.redis == true
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      resources:
        limits:
          memory: 768M
        reservations:
          memory: 512M
    healthcheck:
      test: ["CMD", "sh", "-c", "redis-cli -a $$(cat /run/secrets/redis_password) ping | grep PONG"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s