# Sparrow -- local development environment.
# Builds the server from source (Dockerfile) instead of pulling the published image.
#
#   make docker-dev
#
# The server starts on:
#   - Web UI + REST API: http://localhost:8080 (API docs at /docs)

services:
  postgres:
    image: postgres:15-alpine
    platform: linux/${TARGETARCH:-arm64}
    restart: unless-stopped
    environment:
      POSTGRES_DB: sparrow
      POSTGRES_USER: sparrow
      POSTGRES_PASSWORD: sparrow
      POSTGRES_INITDB_ARGS: "--encoding=UTF-8"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U sparrow -d sparrow"]
      interval: 5s
      timeout: 3s
      retries: 10

  sparrow:
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    ports:
      - "8080:8080"
    environment:
      DATABASE_URL: postgres://sparrow:sparrow@postgres:5432/sparrow?sslmode=disable
      SPARROW_SERVE_UI: "true"
      # Required: keyring for envelope encryption (generate with: openssl rand -hex 32)
      SPARROW_ENCRYPTION_KEYS: "${SPARROW_ENCRYPTION_KEYS:-main=0000000000000000000000000000000000000000000000000000000000000000}"
      SPARROW_ENCRYPTION_PRIMARY_KEY_ID: "${SPARROW_ENCRYPTION_PRIMARY_KEY_ID:-main}"
      # Dev default: allow localhost/private-network webhook targets (SSRF
      # protection stays on in production images; this compose is local-only).
      SPARROW_ALLOW_PRIVATE_NETWORKS: "${SPARROW_ALLOW_PRIVATE_NETWORKS:-true}"
      # Optional: require an API key for all requests
      # SPARROW_API_KEY: "change-me-to-a-secure-random-string"
      # Optional: custom port (default HTTP=8080)
      # SPARROW_HTTP_PORT: "8080"
      # Optional: log level: debug | info (default) | warn | error
      # SPARROW_LOG_LEVEL: "info"
    depends_on:
      postgres:
        condition: service_healthy

volumes:
  postgres_data:
    driver: local