compose.dev.yaml

# compose.dev.yaml (DEVELOPMENT - explicit dev overlay)
# Run with: COMPOSE_DISABLE_ENV_FILE=1 docker compose -p r9lab_dev -f compose.yaml -f compose.dev.yaml up

x-backend-runtime-secrets: &backend-runtime-secrets
  - database_app_password
  - database_migration_password
  - database_backup_password
  - redis_password
  - auth_token_secret
  - oauth_state_secret
  - cache_signing_secret
  - data_encryption_key
  - google_oauth_client_secret
  - github_oauth_client_secret
  - smtp_password
  - microsoft_graph_client_secret
  - bootstrap_superuser_password

# www and docs are not part of compose.yaml, which covers what the deploy hosts run:
# they deploy to Cloudflare Workers. Here they run the Astro dev server, with the same
# hardening compose.yaml gives the app.
x-dev-site-hardening: &dev-site-hardening
  cap_drop:
    - ALL
  pids_limit: 512
  security_opt:
    - no-new-privileges:true

services:
  api:
    build:
      dockerfile: Dockerfile
      target: dev
    restart: "no"
    ports:
      - "127.0.0.1:8010:8000"
    environment:
      ENVIRONMENT: ${ENVIRONMENT:-dev}
      API_PUBLIC_URL: ${API_PUBLIC_URL:-http://127.0.0.1:8010}
      APP_PUBLIC_URL: ${APP_PUBLIC_URL:-http://127.0.0.1:8011}
      SITE_PUBLIC_URL: ${SITE_PUBLIC_URL:-http://127.0.0.1:8013}
      DOCS_PUBLIC_URL: ${DOCS_PUBLIC_URL:-http://127.0.0.1:8012}
    env_file:
      - path: ./backend/.env.dev
        required: false
    secrets: *backend-runtime-secrets
    develop:
      watch:
        - action: sync
          path: ./backend
          target: /opt/r9lab/backend
          ignore:
            - .venv/
            - __pycache__/
            - "*.pyc"
            - logs/
            - data/
        - action: rebuild
          path: ./backend/uv.lock
        - action: rebuild
          path: ./backend/pyproject.toml

  redis:
    ports:
      - "127.0.0.1:6379:6379"
    networks:
      # Accessible to edge to allow for local development interactions
      - edge
      - data
    secrets:
      - redis_password
    healthcheck:
      test: [ "CMD-SHELL", "REDISCLI_AUTH=\"$$(cat /run/secrets/redis_password)\" redis-cli ping | grep -q PONG" ]
    command:
      - sh
      - -c
      - |
        redis_password="$$(cat /run/secrets/redis_password)"
        exec redis-server --appendonly yes --save 60 1 --requirepass "$$redis_password"

  postgres:
    ports:
      - "127.0.0.1:5432:5432"
    networks:
      # Accessible to edge to allow for local development interactions
      - edge
      - data
    environment:
      POSTGRES_USER: postgres
      POSTGRES_DB: r9lab_db
      DATABASE_APP_USER: r9lab_app
      DATABASE_MIGRATION_USER: r9lab_migrator
      DATABASE_BACKUP_USER: r9lab_backup
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      DATABASE_APP_PASSWORD_FILE: /run/secrets/database_app_password
      DATABASE_MIGRATION_PASSWORD_FILE: /run/secrets/database_migration_password
      DATABASE_BACKUP_PASSWORD_FILE: /run/secrets/database_backup_password
    secrets:
      - postgres_password
      - database_app_password
      - database_migration_password
      - database_backup_password

  migrator:
    environment:
      ENVIRONMENT: ${ENVIRONMENT:-dev}
    secrets: *backend-runtime-secrets

  docs:
    !!merge <<: *dev-site-hardening
    build:
      context: .
      dockerfile: Dockerfile.sites
      target: dev
      args:
        SITE: docs
        PORT: "8000"
    restart: "no"
    ports:
      - "127.0.0.1:8012:8000"
    environment:
      PUBLIC_BACKEND_API_URL: ${API_PUBLIC_URL:-http://127.0.0.1:8010}
      PUBLIC_DOCS_URL: ${DOCS_PUBLIC_URL:-http://127.0.0.1:8012}
    develop:
      watch:
        # Keep watch scope explicit for Node-based subrepos: sync only source and
        # runtime config, and rebuild on dependency manifest changes.
        - action: sync
          path: ./docs/src
          target: /opt/r9lab/docs/src
        - action: sync
          path: ./docs/public
          target: /opt/r9lab/docs/public
        - action: sync
          path: ./docs/site
          target: /opt/r9lab/docs/site
        - action: sync
          path: ./docs/scripts
          target: /opt/r9lab/docs/scripts
        - action: sync
          path: ./docs/astro.config.mjs
          target: /opt/r9lab/docs/astro.config.mjs
        - action: sync
          path: ./docs/tsconfig.json
          target: /opt/r9lab/docs/tsconfig.json
        - action: sync
          path: ./docs/README.md
          target: /opt/r9lab/docs/README.md
        - action: sync
          path: ./docs/biome.jsonc
          target: /opt/r9lab/docs/biome.jsonc
        - action: sync
          path: ./docs/playwright.config.ts
          target: /opt/r9lab/docs/playwright.config.ts
        - action: rebuild
          path: ./pnpm-lock.yaml
        - action: rebuild
          path: ./pnpm-workspace.yaml
        - action: rebuild
          path: ./docs/package.json

  app:
    build:
      dockerfile: app/Dockerfile
      target: dev
    restart: "no"
    ports:
      - "127.0.0.1:8011:8081"
    environment:
      EXPO_PUBLIC_API_URL: ${API_PUBLIC_URL:-http://127.0.0.1:8010}
      EXPO_PUBLIC_WEBSITE_URL: ${SITE_PUBLIC_URL:-http://127.0.0.1:8013}
      EXPO_PUBLIC_DOCS_URL: ${DOCS_PUBLIC_URL:-http://127.0.0.1:8012}
    develop:
      watch:
        # Avoid watching the whole app tree. Recursive watches can walk
        # into large dependency/cache directories on the host and exhaust inotify.
        - action: sync
          path: ./app/src
          target: /opt/r9lab/app/src
        - action: sync
          path: ./app/config
          target: /opt/r9lab/app/config
        - action: sync
          path: ./app/scripts
          target: /opt/r9lab/app/scripts
        - action: sync
          path: ./app/app.json
          target: /opt/r9lab/app/app.json
        - action: sync
          path: ./app/babel.config.js
          target: /opt/r9lab/app/babel.config.js
        - action: sync
          path: ./app/biome.jsonc
          target: /opt/r9lab/app/biome.jsonc
        - action: sync
          path: ./app/eslint.config.mjs
          target: /opt/r9lab/app/eslint.config.mjs
        - action: sync
          path: ./app/expo-env.d.ts
          target: /opt/r9lab/app/expo-env.d.ts
        - action: sync
          path: ./app/jest.config.cjs
          target: /opt/r9lab/app/jest.config.cjs
        - action: sync
          path: ./app/playwright.config.ts
          target: /opt/r9lab/app/playwright.config.ts
        - action: sync
          path: ./app/README.md
          target: /opt/r9lab/app/README.md
        - action: sync
          path: ./app/tsconfig.json
          target: /opt/r9lab/app/tsconfig.json
        - action: rebuild
          path: ./pnpm-lock.yaml
        - action: rebuild
          path: ./pnpm-workspace.yaml
        - action: rebuild
          path: ./app/package.json

  www:
    !!merge <<: *dev-site-hardening
    build:
      context: .
      dockerfile: Dockerfile.sites
      target: dev
      args:
        SITE: www
        PORT: "8081"
    restart: "no"
    ports:
      - "127.0.0.1:8013:8081"
    environment:
      PUBLIC_DOCS_URL: ${DOCS_PUBLIC_URL:-http://127.0.0.1:8012}
      PUBLIC_APP_URL: ${APP_PUBLIC_URL:-http://127.0.0.1:8011}
      PUBLIC_SITE_URL: ${SITE_PUBLIC_URL:-http://127.0.0.1:8013}
      PUBLIC_API_URL: ${API_PUBLIC_URL:-http://127.0.0.1:8010}
    develop:
      watch:
        # Same rule here: explicit source/config syncs only, rebuild for deps.
        - action: sync
          path: ./www/src
          target: /opt/r9lab/www/src
        - action: sync
          path: ./www/public
          target: /opt/r9lab/www/public
        - action: sync
          path: ./www/astro.config.ts
          target: /opt/r9lab/www/astro.config.ts
        - action: sync
          path: ./www/biome.jsonc
          target: /opt/r9lab/www/biome.jsonc
        - action: sync
          path: ./www/playwright.config.ts
          target: /opt/r9lab/www/playwright.config.ts
        - action: sync
          path: ./www/README.md
          target: /opt/r9lab/www/README.md
        - action: sync
          path: ./www/tsconfig.json
          target: /opt/r9lab/www/tsconfig.json
        - action: rebuild
          path: ./pnpm-lock.yaml
        - action: rebuild
          path: ./pnpm-workspace.yaml
        - action: rebuild
          path: ./www/package.json

networks:
  data:
    internal: true

secrets:
  postgres_password:
    file: ./secrets/dev/postgres_password
  database_app_password:
    file: ./secrets/dev/database_app_password
  database_migration_password:
    file: ./secrets/dev/database_migration_password
  database_backup_password:
    file: ./secrets/dev/database_backup_password
  redis_password:
    file: ./secrets/dev/redis_password
  auth_token_secret:
    file: ./secrets/dev/auth_token_secret
  oauth_state_secret:
    file: ./secrets/dev/oauth_state_secret
  cache_signing_secret:
    file: ./secrets/dev/cache_signing_secret
  data_encryption_key:
    file: ./secrets/dev/data_encryption_key
  google_oauth_client_secret:
    file: ./secrets/dev/google_oauth_client_secret
  github_oauth_client_secret:
    file: ./secrets/dev/github_oauth_client_secret
  smtp_password:
    file: ./secrets/dev/smtp_password
  microsoft_graph_client_secret:
    file: ./secrets/dev/microsoft_graph_client_secret
  bootstrap_superuser_password:
    file: ./secrets/dev/bootstrap_superuser_password