docker-compose.yml

services:
  db:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: archipulse
      POSTGRES_USER: archipulse
      POSTGRES_PASSWORD: archipulse
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U archipulse -d archipulse"]
      interval: 5s
      timeout: 5s
      retries: 10

  # Optional OIDC provider for local development.
  # Enable with: docker compose --profile oidc up
  dex:
    profiles: [oidc]
    image: ghcr.io/dexidp/dex:v2.45.1
    restart: unless-stopped
    volumes:
      - ./deploy/local/dex.yaml:/etc/dex/config.yaml:ro
    ports:
      - "5556:5556"
    command: dex serve /etc/dex/config.yaml

  app:
    build: .
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    env_file:
      - path: .env
        required: false   # optional — values below are used when .env is absent
    environment:
      DATABASE_URL: postgres://archipulse:archipulse@db:5432/archipulse?sslmode=disable
      PORT: 8080
      # Auth — override in .env or set directly here for local dev.
      # JWT_SECRET is required; the app will refuse to start without it.
      JWT_SECRET: ${JWT_SECRET:-change-me-in-production}
      ARCHIPULSE_BOOTSTRAP_EMAIL: ${ARCHIPULSE_BOOTSTRAP_EMAIL:-}
      ARCHIPULSE_BOOTSTRAP_PASSWORD: ${ARCHIPULSE_BOOTSTRAP_PASSWORD:-}
      # Optional OIDC (leave empty to disable)
      OIDC_ISSUER_URL: ${OIDC_ISSUER_URL:-}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
      OIDC_REDIRECT_URL: ${OIDC_REDIRECT_URL:-}
    ports:
      - "8080:8080"

volumes:
  pgdata: