docker-compose.yml

version: '3.8'

services:
  postgres:
    build:
      context: ./postgres
      dockerfile: Dockerfile
    environment:
      # SECURITY: Use environment variables for credentials
      POSTGRES_DB: ${POSTGRES_DB:-oniva}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
    ports:
      - "127.0.0.1:5432:5432"  # Bind to localhost only
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    # SECURITY: Require password authentication
    command: redis-server --requirepass ${REDIS_PASSWORD:?REDIS_PASSWORD is required}
    ports:
      - "127.0.0.1:6379:6379"  # Bind to localhost only
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    command: uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload
    ports:
      - "8000:8000"
    environment:
      # SECURITY: All secrets from environment variables
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      REDIS_URL: ${REDIS_URL:?REDIS_URL is required}
      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required}
      ENCRYPTION_SALT: ${ENCRYPTION_SALT:-}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      DEBUG: ${DEBUG:-false}
      ENVIRONMENT: ${ENVIRONMENT:-development}
      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:3000,http://localhost:3001}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    volumes:
      - ./backend:/app

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    command: npm run dev
    ports:
      - "3000:3000"
    environment:
      NEXT_PUBLIC_API_URL: http://localhost:8000
    volumes:
      - ./frontend:/app
      - /app/node_modules
      - /app/.next
    depends_on:
      - backend

  # --- Synthetic Bank (E2E QA test fixture) ---
  bank-postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: synthetic_bank
      POSTGRES_USER: ${BANK_POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${BANK_POSTGRES_PASSWORD:-postgres}
    ports:
      - "127.0.0.1:5433:5432"
    volumes:
      - bank_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${BANK_POSTGRES_USER:-postgres}"]
      interval: 10s
      timeout: 5s
      retries: 5

  bank-api:
    build:
      context: ./synthetic-bank
      dockerfile: Dockerfile
    command: uvicorn app.main:app --host 0.0.0.0 --port 8001 --reload
    ports:
      - "8001:8001"
    environment:
      BANK_DATABASE_URL: postgresql+asyncpg://${BANK_POSTGRES_USER:-postgres}:${BANK_POSTGRES_PASSWORD:-postgres}@bank-postgres:5432/synthetic_bank
    depends_on:
      bank-postgres:
        condition: service_healthy
    volumes:
      - ./synthetic-bank:/app
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8001/health')\""]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 10s

volumes:
  postgres_data:
  redis_data:
  bank_postgres_data: