docker-compose.yml

services:
  db:
    image: pgvector/pgvector:pg16
    environment:
      POSTGRES_DB: ai_email
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    entrypoint:
      - sh
      - -c
      - |
        : "$${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env before running Docker Compose}"
        exec docker-entrypoint.sh postgres
    ports:
      - "127.0.0.1:15432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U \"$${POSTGRES_USER}\" -d \"$${POSTGRES_DB}\""]
      interval: 5s
      timeout: 5s
      retries: 10
    volumes:
      - postgres-data:/var/lib/postgresql/data

  ollama:
    build:
      context: .
      dockerfile: Dockerfile.ollama
    environment:
      OLLAMA_NO_CLOUD: "true"
    ports:
      - "11434:11434"

  backend:
    build:
      context: .
      dockerfile: Dockerfile
      target: backend-runtime
    environment:
      DATABASE_URL: postgresql+asyncpg://postgres:${POSTGRES_PASSWORD}@db:5432/ai_email
      READONLY_DATABASE_URL: ${READONLY_DATABASE_URL:-}
      DEBUG: "false"
      ALLOW_LOCAL_LLM_PROVIDERS: "true"
      ALLOWED_LLM_BASE_URL_HOSTS: ollama
      AUTH_SESSION_HMAC_SECRET: ${AUTH_SESSION_HMAC_SECRET}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY}
      OPENAI_API_KEY: ollama
      OPENAI_BASE_URL: http://ollama:11434/v1
      OPENAI_EMBEDDING_MODEL: embeddinggemma
      OPENAI_MODEL: gemma4:e2b-it-qat
    depends_on:
      db:
        condition: service_healthy
      ollama:
        condition: service_started
    ports:
      - "8000:8000"
    command:
      - sh
      - -c
      - |
        : "$${AUTH_SESSION_HMAC_SECRET:?Set AUTH_SESSION_HMAC_SECRET in .env before running Docker Compose}"
        : "$${ENCRYPTION_KEY:?Set ENCRYPTION_KEY in .env before running Docker Compose}"
        python scripts/migrate_db.py && python scripts/start_backend.py --host 0.0.0.0 --port 8000

  frontend:
    build:
      context: .
      dockerfile: frontend/Dockerfile
    environment:
      # The browser uses same-origin /api/*. The Next.js route handler resolves
      # the backend through this Docker-network URL at runtime.
      BACKEND_INTERNAL_URL: http://backend:8000
      ALLOW_DOCKER_BACKEND_INTERNAL_URL: "1"
    depends_on:
      - backend
    ports:
      - "3000:3000"

volumes:
  postgres-data: