docker-compose.yml

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    image: tasky-server:dev
    container_name: tasky-app
    environment:
      PORT: 8080
      # Dev compose should run with local profile so dev-auth bypass is allowed.
      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-local}
      POSTGRES_HOST: pgbouncer
      POSTGRES_PORT: 5432
      PGBOUNCER_PORT: 5432
      FLYWAY_HOST: postgres
      POSTGRES_DB: ${POSTGRES_DB:-tasky}
      MINIO_ENDPOINT: http://minio:9000
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
      MINIO_BUCKET: ${MINIO_BUCKET:-tasky-local}
      TASKY_PUSH_PROVIDER: logging
      # Flyway migration owner (DDL rights); Flyway bypasses PgBouncer via direct Postgres port
      POSTGRES_USER: ${POSTGRES_USER:-tasky}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-tasky}
      # Least-privilege runtime user; app connects via PgBouncer with this account
      APP_DB_USER: ${APP_DB_USER:-tasky_app}
      APP_DB_PASSWORD: ${APP_DB_PASSWORD:-tasky_app}
      TASKY_JWT_SECRET: ${TASKY_JWT_SECRET}
      TASKY_ENCRYPTION_KEY: ${TASKY_ENCRYPTION_KEY}
      TASKY_BLIND_INDEX_KEY: ${TASKY_BLIND_INDEX_KEY}
      TASKY_QPAY_WEBHOOK_SECRET: ${TASKY_QPAY_WEBHOOK_SECRET}
      TASKY_CORS_ALLOWED_ORIGINS: ${TASKY_CORS_ALLOWED_ORIGINS:-http://localhost:5173}
      TASKY_WEBSOCKET_ALLOWED_ORIGINS: ${TASKY_WEBSOCKET_ALLOWED_ORIGINS:-http://localhost:5173}
      TASKY_DEV_AUTH_ENABLED: ${TASKY_DEV_AUTH_ENABLED:-true}
      TASKY_OTP_TEST_CODE: ''
    ports:
      - '${APP_PORT:-8080}:8080'
    depends_on:
      pgbouncer:
        condition: service_healthy
      minio:
        condition: service_healthy
      minio-bootstrap:
        condition: service_completed_successfully
    restart: unless-stopped
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://localhost:8080/actuator/health/liveness']
      interval: 10s
      timeout: 5s
      retries: 6

  postgres:
    image: postgis/postgis:16-3.4
    container_name: tasky-postgres
    restart: unless-stopped
    command:
      - 'postgres'
      - '-c'
      - 'shared_buffers=256MB'
      - '-c'
      - 'work_mem=4MB'
      - '-c'
      - 'maintenance_work_mem=64MB'
      - '-c'
      - 'max_connections=100'
      - '-c'
      - 'log_min_duration_statement=200'
      - '-c'
      - 'autovacuum_naptime=30s'
      - '-c'
      - 'autovacuum_vacuum_scale_factor=0.05'
      - '-c'
      - 'autovacuum_analyze_scale_factor=0.02'
      - '-c'
      - 'password_encryption=scram-sha-256'
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-tasky}
      POSTGRES_USER: ${POSTGRES_USER:-tasky}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-tasky}
      POSTGRES_HOST_AUTH_METHOD: scram-sha-256
    ports:
      - '${POSTGRES_PORT:-5432}:5432'
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./docker/init-db.sh:/docker-entrypoint-initdb.d/10-init-db.sh:ro
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER:-tasky} -d ${POSTGRES_DB:-tasky}']
      interval: 10s
      timeout: 5s
      retries: 6

  pgbouncer:
    image: edoburu/pgbouncer:v1.25.1-p0
    container_name: tasky-pgbouncer
    restart: unless-stopped
    environment:
      DB_HOST: postgres
      DB_PORT: 5432
      # Use least-privilege runtime user for pooled connections.
      DB_USER: ${APP_DB_USER:-tasky_app}
      DB_PASSWORD: ${APP_DB_PASSWORD:-tasky_app}
      DB_NAME: ${POSTGRES_DB:-tasky}
      AUTH_TYPE: scram-sha-256
      PGBOUNCER_POOL_MODE: transaction
      PGBOUNCER_DEFAULT_POOL_SIZE: 20
      PGBOUNCER_MAX_CLIENT_CONN: 100
      PGBOUNCER_MIN_POOL_SIZE: 5
    ports:
      - '${PGBOUNCER_PORT:-6432}:5432'
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'pg_isready -h 127.0.0.1 -p 5432 -U ${APP_DB_USER:-tasky_app} -d ${POSTGRES_DB:-tasky}',
        ]
      interval: 10s
      timeout: 5s
      retries: 6

  postgres-exporter:
    platform: linux/amd64
    image: prometheuscommunity/postgres-exporter:v0.16.0
    container_name: tasky-postgres-exporter
    restart: unless-stopped
    environment:
      DATA_SOURCE_NAME: 'postgresql://${POSTGRES_USER:-tasky}:${POSTGRES_PASSWORD:-tasky}@postgres:5432/${POSTGRES_DB:-tasky}?sslmode=disable'
    ports:
      - '${POSTGRES_EXPORTER_PORT:-9187}:9187'
    depends_on:
      postgres:
        condition: service_healthy
    profiles: ['ops']

  minio:
    image: minio/minio:latest
    container_name: tasky-minio
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
    ports:
      - '${MINIO_PORT:-9000}:9000'
      - '${MINIO_CONSOLE_PORT:-9001}:9001'
    volumes:
      - minio_data:/data
    healthcheck:
      test: ['CMD-SHELL', 'ls /data >/dev/null 2>&1']
      interval: 10s
      timeout: 5s
      retries: 6

  minio-bootstrap:
    image: minio/mc:latest
    container_name: tasky-minio-bootstrap
    depends_on:
      minio:
        condition: service_healthy
    entrypoint: >
      /bin/sh -c "
      mc alias set tasky http://minio:9000 ${MINIO_ROOT_USER:-minioadmin} ${MINIO_ROOT_PASSWORD:-minioadmin};
      mc mb --ignore-existing tasky/${MINIO_BUCKET:-tasky-local};
      mc anonymous set none tasky/${MINIO_BUCKET:-tasky-local};
      "

volumes:
  postgres_data:
  minio_data: