name: jevbox
services:
  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_PASSWORD: local-development-only
    ports:
      - "127.0.0.1:55432:5432"
    volumes:
      - postgres:/var/lib/postgresql/data
      - ./infra/local/init-postgres.sql:/docker-entrypoint-initdb.d/init.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 3s
      timeout: 3s
      retries: 20
    restart: unless-stopped
  spicedb-migrate:
    image: authzed/spicedb:v1.48.0
    command: migrate head
    environment:
      SPICEDB_DATASTORE_ENGINE: postgres
      SPICEDB_DATASTORE_CONN_URI: postgres://spicedb:spicedb-local@postgres:5432/spicedb?sslmode=disable
    depends_on:
      postgres:
        condition: service_healthy
  spicedb:
    image: authzed/spicedb:v1.48.0
    command: [serve, --telemetry-endpoint=]
    environment:
      SPICEDB_DATASTORE_ENGINE: postgres
      SPICEDB_DATASTORE_CONN_URI: postgres://spicedb:spicedb-local@postgres:5432/spicedb?sslmode=disable
      SPICEDB_GRPC_PRESHARED_KEY: ${SPICEDB_PRESHARED_KEY:-jevbox-local-spicedb-key}
      SPICEDB_HTTP_ENABLED: "true"
      SPICEDB_HTTP_ADDR: ":8443"
    ports:
      - "127.0.0.1:58443:8443"
    depends_on:
      spicedb-migrate:
        condition: service_completed_successfully
    restart: unless-stopped
  mailpit:
    image: axllent/mailpit:v1.29.5
    ports:
      - "127.0.0.1:1025:1025"
      - "127.0.0.1:8025:8025"
    restart: unless-stopped
  app:
    image: jevbox:local
    build: .
    ports:
      - "127.0.0.1:4310:4310"
    environment: &app-environment
      APP_ORIGIN: http://localhost:4310
      ALLOW_SIGNUP: "true"
      AUTH_LOCAL_DEVELOPMENT: "true"
      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:-}
      SMTP_HOST: mailpit
      SMTP_PORT: "1025"
      AUTH_EMAIL_FROM: Jevbox <auth@localhost.test>
      DATABASE_URL: postgres://jevbox:jevbox-local@postgres:5432/jevbox
      SPICEDB_HTTP_URL: http://spicedb:8443
      SPICEDB_PRESHARED_KEY: ${SPICEDB_PRESHARED_KEY:-jevbox-local-spicedb-key}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:-}
      FILE_STORAGE: ${FILE_STORAGE:-}
      S3_BUCKET: ${S3_BUCKET:-}
      AWS_REGION: ${AWS_REGION:-}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
      AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN:-}
      S3_ENDPOINT: ${S3_ENDPOINT:-}
      S3_FORCE_PATH_STYLE: ${S3_FORCE_PATH_STYLE:-false}
      S3_PREFIX: ${S3_PREFIX:-jevbox}
    depends_on:
      postgres:
        condition: service_healthy
      spicedb:
        condition: service_started
      mailpit:
        condition: service_started
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    stop_grace_period: 45s
  worker:
    image: jevbox:local
    build: .
    command: [node, --import, tsx, server/worker.ts]
    environment: *app-environment
    depends_on:
      postgres:
        condition: service_healthy
      spicedb:
        condition: service_started
      mailpit:
        condition: service_started
    healthcheck:
      disable: true
    restart: unless-stopped
    stop_grace_period: 45s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
volumes:
  postgres: