services:
  postgres:
    image: postgres:18-alpine
    environment:
      POSTGRES_DB: pcr
      POSTGRES_USER: pcr
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-pcr-local-password}"
    volumes:
      - postgres-data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U pcr -d pcr"]
      interval: 2s
      timeout: 5s
      retries: 15

  pcr-server:
    build: .
    ports:
      - "8080:8080"
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PCR_API_TOKENS: "${PCR_API_TOKENS:-changeme}"
      # Dev placeholder; >= 32 bytes so config.loadSessionSecret accepts it.
      # MUST be overridden in any non-local environment.
      PCR_SESSION_SECRET: "${PCR_SESSION_SECRET:-dev-default-please-override-in-production}"
      PCR_DATABASE_URL: "postgres://pcr:${POSTGRES_PASSWORD:-pcr-local-password}@postgres:5432/pcr?sslmode=disable"
      PCR_AUTO_MIGRATE: "true"
      PCR_REQUIRE_AUTH_READS: "true"
      PCR_COOKIE_SECURE: "false"
      PCR_HUMAN_AUTH_PROVIDER: "${PCR_HUMAN_AUTH_PROVIDER:-github}"
      PCR_PUBLIC_URL: "${PCR_PUBLIC_URL:-http://localhost:8080}"
      PCR_OAUTH_CLIENT_ID: "${PCR_OAUTH_CLIENT_ID:-replace-me}"
      PCR_OAUTH_CLIENT_SECRET: "${PCR_OAUTH_CLIENT_SECRET:-replace-me}"
      PCR_OIDC_ISSUER_URL: "${PCR_OIDC_ISSUER_URL:-}"
      PCR_ALLOWED_ORGS: "${PCR_ALLOWED_ORGS:-}"
      PCR_HUMAN_AUTH_ALLOW_ANY: "${PCR_HUMAN_AUTH_ALLOW_ANY:-true}"
      PCR_HUMAN_SESSION_DURATION: "${PCR_HUMAN_SESSION_DURATION:-12h}"
    restart: unless-stopped

volumes:
  postgres-data: