compose.yaml

# Profiles: dev (api, worker, postgres, redis), test (tmpfs postgres/redis for integration tests),
# prod (api + worker against external Postgres/Redis). Values come from the untracked .env.
# Compose interpolates the whole file before filtering by profile, so JWT_ACCESS_SECRET and
# COOKIE_SECRET must be set for EVERY profile, including `test`. DATABASE_URL, REDIS_URL and CORS_ORIGINS
# are passed through unchecked: the API's own boot validation rejects them when missing or invalid.

x-api-build: &api-build
  context: .
  dockerfile: docker/api.Dockerfile

x-api-secrets: &api-secrets
  JWT_ACCESS_SECRET: ${JWT_ACCESS_SECRET:?set JWT_ACCESS_SECRET in .env}
  COOKIE_SECRET: ${COOKIE_SECRET:?set COOKIE_SECRET in .env}

# Connection strings for the dev and test databases as seen from other containers.
x-dev-urls: &dev-urls
  DATABASE_URL: postgresql://rustandspark:${POSTGRES_PASSWORD:-rustandspark}@postgres:5432/rustandspark
  REDIS_URL: redis://redis:6379

# GET /v1/health (S1.5): only exits 0 on HTTP 200, i.e. the app is up AND its db/redis
# dependencies answer, not merely that the port accepts a TCP connection. Node's built-in
# http client is used instead of curl so the slim runtime image needs no extra package.
x-api-healthcheck: &api-healthcheck
  test:
    - CMD
    - node
    - -e
    - |
      const req = require('http').get('http://127.0.0.1:3000/v1/health', (res) => process.exit(res.statusCode === 200 ? 0 : 1));
      req.on('error', () => process.exit(1));
      req.setTimeout(2000, () => { req.destroy(); process.exit(1); });
  interval: 5s
  timeout: 3s
  retries: 12
  start_period: 10s

services:
  postgres:
    profiles: [dev]
    image: postgres:16
    environment:
      POSTGRES_USER: rustandspark
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-rustandspark}
      POSTGRES_DB: rustandspark
    ports:
      - 127.0.0.1:5432:5432
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: [CMD-SHELL, pg_isready -U rustandspark -d rustandspark]
      interval: 5s
      timeout: 3s
      retries: 10

  redis:
    profiles: [dev]
    image: redis:7
    command: [redis-server, --appendonly, 'yes']
    ports:
      - 127.0.0.1:6379:6379
    volumes:
      - redis-data:/data
    healthcheck:
      test: [CMD, redis-cli, ping]
      interval: 5s
      timeout: 3s
      retries: 10

  # One-shot: applies migrations and the insert-only seed, then exits. api and worker wait for it
  # to complete successfully, so `up` works from empty volumes (a bare API crashes on the first
  # query with Prisma P2021 when the schema does not exist).
  migrate:
    profiles: [dev]
    build:
      <<: *api-build
      target: migrate
    image: rustandspark-migrate:dev
    restart: 'no'
    environment: *dev-urls
    depends_on:
      postgres:
        condition: service_healthy

  api:
    profiles: [dev]
    build: *api-build
    image: rustandspark-api:dev
    environment:
      <<: [*api-secrets, *dev-urls]
      NODE_ENV: development
      PORT: '3000'
      CORS_ORIGINS: ${CORS_ORIGINS}
      # Password-reset email: Resend credentials + the browser-facing origin for the reset link.
      # Defaults keep compose interpolation quiet when the keys are absent (email simply disabled).
      RESEND_API_KEY: ${RESEND_API_KEY:-}
      RESEND_FROM_EMAIL: ${RESEND_FROM_EMAIL:-}
      RESEND_FROM_NAME: ${RESEND_FROM_NAME:-}
      WEB_URL: ${WEB_URL:-http://localhost:8080}
      # Admin-uploaded images (faction banners/logos/backgrounds) live on a named volume.
      ART_DIR: /data/art
    volumes:
      - art-data:/data/art
    ports:
      - 127.0.0.1:${API_PORT:-3000}:3000
    depends_on:
      migrate:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck: *api-healthcheck

  # Same image as api; dist/worker.js arrives in S1.8, so this service cannot run before then.
  worker:
    profiles: [dev]
    build: *api-build
    image: rustandspark-api:dev
    command: [node, dist/worker.js]
    environment:
      <<: [*api-secrets, *dev-urls]
      NODE_ENV: development
      PORT: '3000'
      CORS_ORIGINS: ${CORS_ORIGINS}
    depends_on:
      migrate:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy

  postgres-test:
    profiles: [test]
    image: postgres:16
    environment:
      POSTGRES_USER: rustandspark
      POSTGRES_PASSWORD: rustandspark
      POSTGRES_DB: rustandspark_test
    ports:
      - 127.0.0.1:5433:5432
    tmpfs:
      - /var/lib/postgresql/data
    healthcheck:
      test: [CMD-SHELL, pg_isready -U rustandspark -d rustandspark_test]
      interval: 2s
      timeout: 3s
      retries: 15

  redis-test:
    profiles: [test]
    image: redis:7
    command: [redis-server, --appendonly, 'yes']
    ports:
      - 127.0.0.1:6380:6379
    tmpfs:
      - /data
    healthcheck:
      test: [CMD, redis-cli, ping]
      interval: 2s
      timeout: 3s
      retries: 15

  # prod: no postgres/redis here; DATABASE_URL and REDIS_URL must point at external instances.
  migrate-prod:
    profiles: [prod]
    build:
      <<: *api-build
      target: migrate
    image: rustandspark-migrate:prod
    restart: 'no'
    environment:
      DATABASE_URL: ${DATABASE_URL}

  api-prod:
    profiles: [prod]
    build: *api-build
    image: rustandspark-api:prod
    restart: unless-stopped
    environment:
      <<: *api-secrets
      NODE_ENV: production
      PORT: '3000'
      DATABASE_URL: ${DATABASE_URL}
      REDIS_URL: ${REDIS_URL}
      CORS_ORIGINS: ${CORS_ORIGINS}
      ART_DIR: /data/art
    volumes:
      - art-data:/data/art
    ports:
      - 127.0.0.1:${API_PORT:-3000}:3000
    depends_on:
      migrate-prod:
        condition: service_completed_successfully
    healthcheck: *api-healthcheck

  worker-prod:
    profiles: [prod]
    build: *api-build
    image: rustandspark-api:prod
    restart: unless-stopped
    command: [node, dist/worker.js]
    environment:
      <<: *api-secrets
      NODE_ENV: production
      PORT: '3000'
      DATABASE_URL: ${DATABASE_URL}
      REDIS_URL: ${REDIS_URL}
      CORS_ORIGINS: ${CORS_ORIGINS}
    depends_on:
      migrate-prod:
        condition: service_completed_successfully

  web:
    profiles: [dev]
    build:
      context: .
      dockerfile: docker/web.Dockerfile
    image: rustandspark-web:dev
    environment:
      API_UPSTREAM: api:3000
    ports:
      - ${WEB_BIND:-127.0.0.1}:${WEB_PORT:-8080}:80
      - ${WEB_BIND:-127.0.0.1}:${WEB_TLS_PORT:-8443}:443
    volumes:
      - ./certs:/etc/nginx/certs:ro
    depends_on:
      api:
        condition: service_healthy

  web-prod:
    profiles: [prod]
    build:
      context: .
      dockerfile: docker/web.Dockerfile
    image: rustandspark-web:prod
    restart: unless-stopped
    environment:
      API_UPSTREAM: api-prod:3000
    ports:
      - ${WEB_BIND:-127.0.0.1}:${WEB_PORT:-8080}:80
      - ${WEB_BIND:-127.0.0.1}:${WEB_TLS_PORT:-8443}:443
    volumes:
      - ./certs:/etc/nginx/certs:ro
    depends_on:
      api-prod:
        condition: service_healthy

volumes:
  postgres-data:
  redis-data:
  art-data: