docker-compose.yml

# ProjectBook — full-stack self-host in one command.
#
#   docker compose up --build
#
# Boots Postgres + MongoDB + Redis, runs DB migrations, starts the Go API, and
# builds/serves the SvelteKit web app. Then open http://localhost:3000.
#
# This file lives in the BACKEND repo (projectbook-backend). It builds the web
# app from the FRONTEND repo, which it expects as a sibling folder named
# `projectbook`. If your web checkout is elsewhere, override WEB_CONTEXT:
#
#   WEB_CONTEXT=/path/to/projectbook docker compose up --build
#
# For anything beyond local/demo use, change PROJECTBOOK_PERMISSION_CONTEXT_SECRET
# below (any 96-hex-char string; generate with `openssl rand -hex 48`) and review
# the credentials.

name: projectbook

services:
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: projectbook
      POSTGRES_PASSWORD: projectbook
      POSTGRES_DB: projectbook
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U projectbook -d projectbook"]
      interval: 5s
      timeout: 5s
      retries: 12
    restart: unless-stopped

  mongo:
    image: mongo:7
    volumes:
      - mongodata:/data/db
    healthcheck:
      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping')"]
      interval: 5s
      timeout: 5s
      retries: 12
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    command: ["redis-server", "--appendonly", "yes"]
    volumes:
      - redisdata:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 12
    restart: unless-stopped

  # One-shot: applies all pending migrations, then exits. The API waits for this
  # to complete successfully before starting.
  migrate:
    build:
      context: .
      dockerfile: Dockerfile.migrate
    environment:
      POSTGRES_ENABLED: "true"
      POSTGRES_URL: postgres://projectbook:projectbook@postgres:5432/projectbook?sslmode=disable
    command: ["up"]
    depends_on:
      postgres:
        condition: service_healthy
    restart: "no"

  api:
    build:
      context: .
    environment:
      APP_PROFILE: dev
      APP_ENV: dev
      HTTP_ADDR: ":8080"
      # The browser only ever talks to the web app; the SvelteKit BFF calls the
      # API server-side. localhost:3000 is allowed for completeness.
      allowedOrigins: http://localhost:3000
      POSTGRES_ENABLED: "true"
      POSTGRES_URL: postgres://projectbook:projectbook@postgres:5432/projectbook?sslmode=disable
      REDIS_ENABLED: "true"
      REDIS_ADDR: redis:6379
      MONGO_ENABLED: "true"
      MONGO_URL: mongodb://mongo:27017
      MONGO_DB: projectbook
      AUTH_ENABLED: "true"
      AUTH_MODE: hybrid
      PROJECTBOOK_PERMISSION_CONTEXT_SECRET: ${PROJECTBOOK_PERMISSION_CONTEXT_SECRET:-590388b34bc2af24139645d9e86f5a5fef0fd061251781df4d6a32b8d8d6c977327af18c21b03eb2859b8b85e0cc47c6}
      # Email is off for local/self-host so no Resend key is needed.
      EMAIL_ENABLED: "false"
      WEB_APP_BASE_URL: http://localhost:3000
      RATELIMIT_ENABLED: "true"
      RATELIMIT_FAIL_OPEN: "true"
      CACHE_ENABLED: "true"
      CACHE_FAIL_OPEN: "true"
      PERMISSIONS_ENABLED: "true"
      METRICS_ENABLED: "false"
    ports:
      - "8080:8080"
    depends_on:
      postgres:
        condition: service_healthy
      mongo:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    restart: unless-stopped

  # One-shot helper: marks every existing account as email-verified.
  #
  #   docker compose run --rm verify
  #
  # Self-host runs with EMAIL_ENABLED=false, so the verification OTP is never
  # sent, and the web layer redirects unverified sessions to /auth/verify. Sign
  # up first, then run this once to get in. Not started by `up` — it is a manual
  # convenience for local/demo use only.
  verify:
    image: postgres:16-alpine
    profiles: ["tools"]
    environment:
      PGPASSWORD: projectbook
    entrypoint:
      - psql
      - -h
      - postgres
      - -U
      - projectbook
      - -d
      - projectbook
      - -v
      - ON_ERROR_STOP=1
      - -c
      - UPDATE users SET is_email_verified = true WHERE is_email_verified = false;
    depends_on:
      postgres:
        condition: service_healthy
    restart: "no"

  web:
    build:
      # Frontend repo, expected as a sibling folder named `projectbook` (the
      # folder `git clone` creates). Override WEB_CONTEXT if your checkout is
      # named or located differently, e.g. WEB_CONTEXT=../Web.
      context: ${WEB_CONTEXT:-../projectbook}
      args:
        PUBLIC_PROJECTBOOK_SITE_URL: http://localhost:3000
    environment:
      NODE_ENV: production
      HOST: 0.0.0.0
      PORT: "3000"
      # Server-to-server (BFF → API) inside the compose network.
      PROJECTBOOK_API_BASE_URL: http://api:8080/api/v1
      API_URL: http://api:8080
      PUBLIC_PROJECTBOOK_SITE_URL: ${PUBLIC_SITE_URL:-http://localhost:3000}
      # adapter-node derives its public origin from ORIGIN. Without it, SvelteKit
      # cannot match the Origin header on form POSTs and rejects every login with
      # "Cross-site POST form submissions are forbidden". Must equal the URL you
      # open in the browser, so override both when not on localhost:3000, e.g.
      #   PUBLIC_SITE_URL=https://pb.example.com docker compose up
      ORIGIN: ${PUBLIC_SITE_URL:-http://localhost:3000}
    ports:
      - "3000:3000"
    depends_on:
      - api
    restart: unless-stopped

volumes:
  pgdata:
  mongodata:
  redisdata: