docker-compose.yml

services:
  postgres:
    image: postgres:17.5-alpine
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=pagespace
      - POSTGRES_USER=user
      - POSTGRES_PASSWORD=password
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d pagespace"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - internal
    deploy:
      resources:
        limits:
          memory: 200M

  # Trust plane: dedicated Admin Postgres for the tamper-evident security audit
  # chain, isolated from the app database in every deployment mode (#890).
  # CREDENTIAL MODEL (Phase 2): the owner/bootstrap role goes ONLY to this
  # container and the migrate one-shot (the owner would bypass the
  # drizzle-admin/0001 zero-trust grants). Runtime services connect as
  # per-service LOGIN users provisioned by db:provision:admin-users:
  #   web       → admin_app_user       (admin_app: SELECT+INSERT audit chain)
  #   processor → admin_processor_user (admin_chainer + admin_siem)
  #   admin     → admin_reader_user    (admin_reader: read-only)
  #   realtime  → none (no audit path)
  postgres-admin:
    image: postgres:17.5-alpine
    ports:
      - "5433:5432"
    volumes:
      - postgres_admin_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=pagespace_admin
      - POSTGRES_USER=user
      - POSTGRES_PASSWORD=password
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d pagespace_admin"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - internal
    deploy:
      resources:
        limits:
          memory: 200M

  # Analytics tier (#890 Phase 3): local ClickHouse so dev + integration tests
  # have a real CH to hit. DEV/CI ONLY — in production the analytics tier is
  # cloud-managed ClickHouse Cloud (AWS us-east-1), so the tenant/onprem
  # compose stacks deliberately do NOT carry this service. Ships dark: no app
  # service sets CLICKHOUSE_ENABLED; devs opt in via .env (see .env.example).
  clickhouse:
    image: clickhouse/clickhouse-server:25.3-alpine
    ports:
      - "8123:8123"
    volumes:
      - clickhouse_data:/var/lib/clickhouse
    environment:
      - CLICKHOUSE_DB=pagespace_analytics
      - CLICKHOUSE_USER=user
      - CLICKHOUSE_PASSWORD=password
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:8123/ping || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - internal
    deploy:
      resources:
        limits:
          memory: 1G

  migrate:
    build:
      context: .
      dockerfile: apps/web/Dockerfile.migrate
    depends_on:
      postgres:
        condition: service_healthy
      postgres-admin:
        condition: service_healthy
    env_file: .env
    environment:
      - DATABASE_URL=postgresql://user:password@postgres:5432/pagespace
      - ADMIN_DATABASE_URL=postgresql://user:password@postgres-admin:5432/pagespace_admin
      # Dev passwords for the per-service admin LOGIN users (provisioned below).
      - ADMIN_APP_PASSWORD=admin-app-password
      - ADMIN_PROCESSOR_PASSWORD=admin-processor-password
      - ADMIN_READER_PASSWORD=admin-reader-password
      - ADMIN_ERASER_PASSWORD=admin-eraser-password
    command: >
      sh -c "
        echo 'Starting database migrations...' &&
        bun run db:migrate &&
        echo 'Starting admin database migrations...' &&
        bun run db:migrate:admin &&
        echo 'Provisioning admin login users...' &&
        bun run db:provision:admin-users &&
        echo 'Migrations complete, starting services...'
      "
    healthcheck:
      test: ["CMD", "echo", "Migration service healthy"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - internal

  web:
    build:
      context: .
      dockerfile: apps/web/Dockerfile
      args:
        # NEXT_PUBLIC_* vars must be passed at build time for Next.js to inline them
        # Note: Stripe keys are hardcoded in stripe-config.ts to simplify builds
        - NEXT_PUBLIC_REALTIME_URL=${NEXT_PUBLIC_REALTIME_URL}
        - NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL}
        - NEXT_PUBLIC_STORAGE_MAX_FILE_SIZE_MB=${NEXT_PUBLIC_STORAGE_MAX_FILE_SIZE_MB}
        - NEXT_PUBLIC_GOOGLE_OAUTH_CLIENT_ID=${NEXT_PUBLIC_GOOGLE_OAUTH_CLIENT_ID}
        - NEXT_PUBLIC_GOOGLE_OAUTH_IOS_CLIENT_ID=${NEXT_PUBLIC_GOOGLE_OAUTH_IOS_CLIENT_ID}
        - NEXT_PUBLIC_ADMIN_APP_URL=${NEXT_PUBLIC_ADMIN_APP_URL:-http://localhost:3005}
        # Default to localhost so local compose bakes a Domain=localhost cookie for web,
        # matching the marketing service below. Without a default, web would bake a
        # host-only ps_consent while marketing bakes Domain=localhost — the duplicate
        # host-only/domain-scoped cookie state that persistConsentToCookie deletes around.
        - NEXT_PUBLIC_COOKIE_DOMAIN=${NEXT_PUBLIC_COOKIE_DOMAIN:-localhost}
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - "3000:3000"
    depends_on:
      migrate:
        condition: service_completed_successfully
      processor:
        condition: service_healthy
    env_file: .env
    environment:
      - DATABASE_URL=postgresql://user:password@postgres:5432/pagespace
      - ADMIN_DATABASE_URL=postgresql://admin_app_user:admin-app-password@postgres-admin:5432/pagespace_admin
      # GDPR pseudonymization route — the only consumer of the eraser identity.
      - ADMIN_ERASER_DATABASE_URL=postgresql://admin_gdpr_eraser_user:admin-eraser-password@postgres-admin:5432/pagespace_admin
      - NEXT_PUBLIC_REALTIME_URL=${NEXT_PUBLIC_REALTIME_URL}
      - PROCESSOR_URL=http://processor:3003
      - PORT=3000
      - HOSTNAME=0.0.0.0
      - NODE_OPTIONS=--max-old-space-size=640
    networks:
      - internal
      - frontend


  admin:
    build:
      context: .
      dockerfile: apps/admin/Dockerfile
      args:
        - NEXT_PUBLIC_WEB_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
    ports:
      - "3005:3005"
    depends_on:
      migrate:
        condition: service_completed_successfully
    env_file: .env
    environment:
      - DATABASE_URL=postgresql://user:password@postgres:5432/pagespace
      - ADMIN_DATABASE_URL=postgresql://admin_reader_user:admin-reader-password@postgres-admin:5432/pagespace_admin
      - ADMIN_URL=${ADMIN_URL:-http://localhost:3005}
      - NEXT_PUBLIC_WEB_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
      - WEB_APP_INTERNAL_URL=http://web:3000
      - PORT=3005
      - HOSTNAME=0.0.0.0
      - NODE_OPTIONS=--max-old-space-size=512
    deploy:
      resources:
        limits:
          memory: 512M
    networks:
      - internal
      - frontend


  processor:
    # @tensorflow/tfjs-node has no Linux-arm64 prebuild. CI + prod build on
    # ubuntu-latest (amd64); pin here so local builds on Apple Silicon
    # produce an amd64 image (runs via Rosetta 2). No-op on amd64 hosts.
    platform: linux/amd64
    build:
      context: .
      dockerfile: apps/processor/Dockerfile
      platforms:
        - linux/amd64
    ports:
      - "3003:3003"
    depends_on:
      migrate:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
    env_file: .env
    environment:
      - DATABASE_URL=postgresql://user:password@postgres:5432/pagespace
      - ADMIN_DATABASE_URL=postgresql://admin_processor_user:admin-processor-password@postgres-admin:5432/pagespace_admin
      # Era-fork guard (#890 Phase 2): the volumes are persistent, so an
      # upgraded stack can hold legacy security_audit_log rows — never default
      # to genesis chaining. Fresh installs opt in via .env (.env.example
      # ships it true); upgrades leave it unset until the backfill has run.
      - AUDIT_CHAINER_ALLOW_GENESIS=${AUDIT_CHAINER_ALLOW_GENESIS:-}
      - PORT=3003
      - NODE_OPTIONS=--max-old-space-size=1024
      - ENABLE_OCR=${ENABLE_OCR:-false}
      - ENABLE_EXTERNAL_OCR=${ENABLE_EXTERNAL_OCR:-false}
      - PROCESSOR_AUTH_REQUIRED=${PROCESSOR_AUTH_REQUIRED:-true}
      - PROCESSOR_UPLOAD_RATE_LIMIT=${PROCESSOR_UPLOAD_RATE_LIMIT:-100}
      - PROCESSOR_UPLOAD_RATE_WINDOW=${PROCESSOR_UPLOAD_RATE_WINDOW:-3600}
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
      - AWS_REGION=${AWS_REGION:-auto}
      - TIGRIS_BUCKET=${TIGRIS_BUCKET:-pagespace-files}
      - AWS_ENDPOINT_URL_S3=${AWS_ENDPOINT_URL_S3}
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3003/health', (r) => {r.statusCode === 200 ? process.exit(0) : process.exit(1)})"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    restart: unless-stopped
    networks:
      - internal
      - frontend
    user: "1000:1000"
    read_only: true
    tmpfs:
      # No size cap: business tier allows 1 GB files; semaphore permits up to
      # UPLOAD_MAX_PERMITS (default 20) concurrent uploads. A hard 100 m limit
      # would ENOSPC any file over 100 MB mid-upload. Let the kernel manage /tmp
      # size (defaults to 50% of RAM); noexec/nosuid security options preserved.
      - /tmp:noexec,nosuid
    security_opt:
      - no-new-privileges:true

  realtime:
    build:
      context: .
      dockerfile: apps/realtime/Dockerfile
    ports:
      - "3001:3001"
    depends_on:
      migrate:
        condition: service_completed_successfully
    env_file: .env
    environment:
      - DATABASE_URL=postgresql://user:password@postgres:5432/pagespace
      - PORT=${REALTIME_PORT}
      - CORS_ORIGIN=${CORS_ORIGIN:-http://localhost:3000}
    deploy:
      resources:
        limits:
          memory: 256M
    networks:
      - internal
      - frontend

  # Cron service for scheduled background jobs
  # Runs inside Docker network, authenticates with CRON_SECRET
  cron:
    build:
      context: ./docker/cron
      dockerfile: Dockerfile
    depends_on:
      web:
        condition: service_started
    environment:
      - CRON_SECRET=${CRON_SECRET}
    volumes:
      - cron_logs:/var/log/cron
    deploy:
      resources:
        limits:
          memory: 32M
    restart: unless-stopped
    networks:
      - internal

  marketing:
    build:
      context: .
      dockerfile: apps/marketing/Dockerfile
      args:
        - NEXT_PUBLIC_MARKETING_URL=http://localhost:3004
        - NEXT_PUBLIC_APP_URL=http://localhost:3000
        - NEXT_PUBLIC_COOKIE_DOMAIN=localhost
    ports:
      - "3004:3004"
    environment:
      - PORT=3004
      - NEXT_PUBLIC_MARKETING_URL=http://localhost:3004
      - NEXT_PUBLIC_APP_URL=http://localhost:3000
      - NEXT_PUBLIC_COOKIE_DOMAIN=localhost
      - RESEND_API_KEY=${RESEND_API_KEY}
      - FROM_EMAIL=${FROM_EMAIL:-noreply@pagespace.ai}
      - NODE_ENV=production
    deploy:
      resources:
        limits:
          memory: 256M
    networks:
      - frontend

  # Test service for running unit tests with database access
  test:
    build:
      context: .
      dockerfile: apps/web/Dockerfile.migrate
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      - DATABASE_URL=postgresql://user:password@postgres:5432/pagespace_test
      - CSRF_SECRET=test-csrf-secret-minimum-32-characters-long-for-testing-purposes
      - ENCRYPTION_KEY=test-encryption-key-32-chars-minimum-required-length
      - REALTIME_BROADCAST_SECRET=test-realtime-broadcast-secret-32-chars-minimum-length
    command: >
      sh -c "
        echo 'Setting up test database schema...' &&
        cd packages/db && bun x drizzle-kit push --force &&
        cd ../.. &&
        echo 'Running tests...' &&
        bun run test:unit
      "
    networks:
      - internal
    profiles:
      - test

  # nginx is no longer used for file serving — files are served directly from Tigris via presigned URLs

networks:
  internal:
    driver: bridge
    internal: true
  frontend:
    driver: bridge

volumes:
  postgres_data:
  postgres_admin_data:
  clickhouse_data:
  cron_logs: