# Sparrow -- LOCAL EVALUATION with the published Docker image.
#
#   curl -O https://raw.githubusercontent.com/sarathsp06/sparrow/main/deploy/docker-compose.yml
#   docker compose up -d
#   open http://localhost:8080          # UI + REST API, API docs at /docs
#
# Port 8080 taken? SPARROW_PORT=8090 docker compose up -d, then open
# http://localhost:8090 (the container still listens on 8080).
#
# No clone, no secrets, no .env -- this file is for trying Sparrow on your own
# machine. It is deliberately NOT a production setup:
#
#   - the API is open (no SPARROW_API_KEY), so anyone who can reach the port
#     can use it -- which is why the port is published on 127.0.0.1 only;
#   - the encryption keyring is a well-known all-zeros key, so webhook secrets
#     stored here are not really protected;
#   - SSRF protection is relaxed so webhooks can target services on your
#     machine (use http://host.docker.internal:<port> to reach the host).
#
# For a real deployment (Kubernetes or any container platform) follow
# https://sarathsp06.github.io/sparrow/deployment/production/ -- it covers
# the required secrets, SPARROW_ENVIRONMENT=production, and network exposure.
#
# Want to try sign-in, access tokens and invites locally? Uncomment
# SPARROW_API_KEY below, then `docker compose up -d` again.
#
# Clean up: `docker compose down -v` (removes containers and data).

services:
  postgres:
    image: postgres:15-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: sparrow
      POSTGRES_USER: sparrow
      POSTGRES_PASSWORD: sparrow # local only: Postgres has no published port
      POSTGRES_INITDB_ARGS: "--encoding=UTF-8"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U sparrow -d sparrow"]
      interval: 5s
      timeout: 3s
      retries: 10

  sparrow:
    image: "ghcr.io/sarathsp06/sparrow:${SPARROW_VERSION:-latest}"
    restart: unless-stopped
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    ports:
      - "127.0.0.1:${SPARROW_PORT:-8080}:8080" # loopback only -- the API below is unauthenticated
    extra_hosts:
      - "host.docker.internal:host-gateway" # lets webhooks reach your machine on Linux too
    environment:
      DATABASE_URL: postgres://sparrow:sparrow@postgres:5432/sparrow?sslmode=disable
      SPARROW_SERVE_UI: "true"
      # LOCAL ONLY: well-known all-zeros key. Never reuse it -- a real
      # deployment needs `openssl rand -hex 32` stored in a secret manager.
      SPARROW_ENCRYPTION_KEYS: "main=0000000000000000000000000000000000000000000000000000000000000000"
      SPARROW_ENCRYPTION_PRIMARY_KEY_ID: main
      # LOCAL ONLY: allow webhooks to localhost/private addresses.
      SPARROW_ALLOW_PRIVATE_NETWORKS: "true"
      # Optional: require a key on /v1 and show the UI sign-in prompt.
      # SPARROW_API_KEY: "local-test-key"
    depends_on:
      postgres:
        condition: service_healthy

volumes:
  postgres_data:
    driver: local