docker-compose.yml

version: '3.9'

# ── Usage ────────────────────────────────────────────────────────────────────
# 1. Copy .env.example → .env and fill in every value marked REQUIRED
# 2. docker compose --env-file ../.env up --build
# ─────────────────────────────────────────────────────────────────────────────

services:
  postgres:
    image: timescale/timescaledb-ha:pg16
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    ports:
      - "127.0.0.1:5432:5432"   # localhost only — never expose DB to public
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
      interval: 5s
      timeout: 5s
      retries: 10

  redis:
    image: redis:7-alpine
    ports:
      - "127.0.0.1:6379:6379"   # localhost only
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10

  api:
    build:
      context: ../apps/api
      dockerfile: Dockerfile
    ports:
      - "8000:8000"
    environment:
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      API_SECRET_KEY: ${API_SECRET_KEY}
      INTERNAL_SERVICE_TOKEN: ${INTERNAL_SERVICE_TOKEN}
      CEREBRAS_API_KEY: ${CEREBRAS_API_KEY}
      ENVIRONMENT: ${ENVIRONMENT:-production}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 10s
      timeout: 5s
      retries: 5

  worker:
    build:
      context: ../apps/api
      dockerfile: Dockerfile
    command: python -m worker.main
    environment:
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      CEREBRAS_API_KEY: ${CEREBRAS_API_KEY}
      API_SECRET_KEY: ${API_SECRET_KEY}
      ENVIRONMENT: ${ENVIRONMENT:-production}
    depends_on:
      api:
        condition: service_healthy
    restart: unless-stopped

  frontend:
    build:
      context: ..
      dockerfile: Dockerfile.frontend
      args:
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
    ports:
      - "3000:3000"
    environment:
      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
      NEXTAUTH_URL: ${NEXTAUTH_URL}
      AUTH_SECRET: ${AUTH_SECRET}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}
      ALLOWED_EMAILS: ${ALLOWED_EMAILS}
      ALLOWED_EMAIL_DOMAIN: ${ALLOWED_EMAIL_DOMAIN}
      DISABLE_DEV_LOGIN: ${DISABLE_DEV_LOGIN:-true}
      # auth.ts's provisionUser() needs one of these to call the backend's
      # /v1/internal/provision on sign-in — without it, sign-in "succeeds"
      # but silently never creates the user's org/project/API key.
      API_SECRET_KEY: ${API_SECRET_KEY}
      INTERNAL_SERVICE_TOKEN: ${INTERNAL_SERVICE_TOKEN}
    depends_on:
      api:
        condition: service_healthy

volumes:
  postgres_data:
  redis_data: