# Hazina Assist — full local demo stack
#   app (Next.js, port 3000) + categoriser (DS service, 8001)
#   + Prometheus (authenticated scrape) + Grafana
# Usage:  cd deploy && docker compose up -d
#
# DATABASE: this build is SQLite-ONLY (the Prisma schema/provider targets
# SQLite; see prisma/schema.prisma). The app DB file persists in the `appdata`
# volume. PostgreSQL support is roadmap work — do not point DATABASE_URL at
# Postgres: the generated client is not provider-compatible (deep-review P1-4).
#
# MODE: the stack boots in DEPLOYMENT_MODE=demo (synthetic data, demo identity
# picker, OTP code revealed). Operational mode fails closed at startup without
# real secrets/IdP/OTP provider — see src/lib/deployment.ts.
services:
  app:
    build:
      context: ..
      dockerfile: deploy/Dockerfile.app
    ports:
      - "3000:3000"
    environment:
      DATABASE_URL: ${DATABASE_URL:-file:/app/db/custom.db}
      DEPLOYMENT_MODE: demo
      # generate a real secret for any shared/persistent deployment:
      #   openssl rand -hex 32
      HAZINA_INTENT_SECRET: ${HAZINA_INTENT_SECRET:-dev-only-secret-rotate-me}
      # scrape token — MUST match deploy/prometheus.yml `authorization.credentials`
      HAZINA_METRICS_TOKEN: ${HAZINA_METRICS_TOKEN:-dev-scrape-token-change-me}
      CATEGORISER_URL: http://categoriser:8000
    volumes:
      - appdata:/app/db
    depends_on:
      - categoriser
    healthcheck:
      # readiness probe — DB is checked; liveness is the same endpoint with ?probe=live
      test: ["CMD", "curl", "-f", "http://localhost:3000/api/health?probe=ready"]
      interval: 15s
      timeout: 5s
      retries: 5

  categoriser:
    build:
      context: ../services/categoriser
    ports:
      - "8001:8000"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 15s
      timeout: 5s
      retries: 5

  prometheus:
    image: prom/prometheus:latest
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
    ports:
      - "9090:9090"

  grafana:
    image: grafana/grafana:latest
    environment:
      # change for anything beyond a localhost demo
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD:-admin}
    volumes:
      - ./grafana/provisioning:/etc/grafana/provisioning:ro
    ports:
      - "3300:3000"
    depends_on:
      - prometheus

volumes:
  appdata: