docker-compose.yml

services:
  postgres:
    image: postgres:17.5-alpine
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=pagespace
      - POSTGRES_USER=user
      - POSTGRES_PASSWORD=password
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d pagespace"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - internal
    deploy:
      resources:
        limits:
          memory: 200M

  migrate:
    build:
      context: .
      dockerfile: apps/web/Dockerfile.migrate
    depends_on:
      postgres:
        condition: service_healthy
    env_file: .env
    environment:
      - DATABASE_URL=postgresql://user:password@postgres:5432/pagespace
      - PNPM_HOME=/usr/local/bin
    command: >
      sh -c "
        echo 'Starting database migrations...' &&
        pnpm run db:migrate &&
        echo 'Migrations complete, starting services...'
      "
    healthcheck:
      test: ["CMD", "echo", "Migration service healthy"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - internal

  web:
    build:
      context: .
      dockerfile: apps/web/Dockerfile
      args:
        # NEXT_PUBLIC_* vars must be passed at build time for Next.js to inline them
        # Note: Stripe keys are hardcoded in stripe-config.ts to simplify builds
        - NEXT_PUBLIC_REALTIME_URL=${NEXT_PUBLIC_REALTIME_URL}
        - NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL}
        - NEXT_PUBLIC_STORAGE_MAX_FILE_SIZE_MB=${NEXT_PUBLIC_STORAGE_MAX_FILE_SIZE_MB}
        - NEXT_PUBLIC_GOOGLE_OAUTH_CLIENT_ID=${NEXT_PUBLIC_GOOGLE_OAUTH_CLIENT_ID}
        - NEXT_PUBLIC_GOOGLE_OAUTH_IOS_CLIENT_ID=${NEXT_PUBLIC_GOOGLE_OAUTH_IOS_CLIENT_ID}
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - "3000:3000"
    depends_on:
      migrate:
        condition: service_completed_successfully
      processor:
        condition: service_healthy
    volumes:
      - file_storage:/app/storage
    env_file: .env
    environment:
      - DATABASE_URL=postgresql://user:password@postgres:5432/pagespace
      - NEXT_PUBLIC_REALTIME_URL=${NEXT_PUBLIC_REALTIME_URL}
      - FILE_STORAGE_PATH=/app/storage
      - PROCESSOR_URL=http://processor:3003
      - PORT=3000
      - HOSTNAME=0.0.0.0
      - NODE_OPTIONS=--max-old-space-size=640
    deploy:
      resources:
        limits:
          memory: 768M
    networks:
      - internal
      - frontend

  # Permission fixer - runs once to fix existing volume permissions
  processor-permissions:
    build:
      context: .
      dockerfile: apps/processor/Dockerfile
    user: root
    volumes:
      - file_storage:/data/files
      - cache_storage:/data/cache
    command: |
      sh -c '
        echo "Fixing volume permissions..."
        chown -R 1000:1000 /data/files /data/cache
        echo "Permissions fixed successfully"
      '
    restart: "no"
    networks:
      - internal

  processor:
    # @tensorflow/tfjs-node has no Linux-arm64 prebuild. CI + prod build on
    # ubuntu-latest (amd64); pin here so local builds on Apple Silicon
    # produce an amd64 image (runs via Rosetta 2). No-op on amd64 hosts.
    platform: linux/amd64
    build:
      context: .
      dockerfile: apps/processor/Dockerfile
      platforms:
        - linux/amd64
    ports:
      - "3003:3003"
    depends_on:
      migrate:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      processor-permissions:
        condition: service_completed_successfully
    volumes:
      - file_storage:/data/files
      - cache_storage:/data/cache
    env_file: .env
    environment:
      - DATABASE_URL=postgresql://user:password@postgres:5432/pagespace
      - FILE_STORAGE_PATH=/data/files
      - CACHE_PATH=/data/cache
      - PORT=3003
      - NODE_OPTIONS=--max-old-space-size=1024
      - ENABLE_OCR=${ENABLE_OCR:-false}
      - ENABLE_EXTERNAL_OCR=${ENABLE_EXTERNAL_OCR:-false}
      - PROCESSOR_AUTH_REQUIRED=${PROCESSOR_AUTH_REQUIRED:-true}
      - PROCESSOR_UPLOAD_RATE_LIMIT=${PROCESSOR_UPLOAD_RATE_LIMIT:-100}
      - PROCESSOR_UPLOAD_RATE_WINDOW=${PROCESSOR_UPLOAD_RATE_WINDOW:-3600}
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3003/health', (r) => {r.statusCode === 200 ? process.exit(0) : process.exit(1)})"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          memory: 1280M
    restart: unless-stopped
    networks:
      - internal
    user: "1000:1000"
    read_only: true
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
    security_opt:
      - no-new-privileges:true

  realtime:
    build:
      context: .
      dockerfile: apps/realtime/Dockerfile
    ports:
      - "3001:3001"
    depends_on:
      migrate:
        condition: service_completed_successfully
    env_file: .env
    environment:
      - DATABASE_URL=postgresql://user:password@postgres:5432/pagespace
      - PORT=${REALTIME_PORT}
      - CORS_ORIGIN=http://localhost:3000
    deploy:
      resources:
        limits:
          memory: 256M
    networks:
      - internal
      - frontend

  # Cron service for scheduled background jobs
  # Runs inside Docker network, authenticates with CRON_SECRET
  cron:
    build:
      context: ./docker/cron
      dockerfile: Dockerfile
    depends_on:
      web:
        condition: service_started
    environment:
      - CRON_SECRET=${CRON_SECRET}
    volumes:
      - cron_logs:/var/log/cron
    deploy:
      resources:
        limits:
          memory: 32M
    restart: unless-stopped
    networks:
      - internal

  marketing:
    build:
      context: .
      dockerfile: apps/marketing/Dockerfile
      args:
        - NEXT_PUBLIC_MARKETING_URL=http://localhost:3004
        - NEXT_PUBLIC_APP_URL=http://localhost:3000
        - NEXT_PUBLIC_COOKIE_DOMAIN=localhost
    ports:
      - "3004:3004"
    environment:
      - PORT=3004
      - NEXT_PUBLIC_MARKETING_URL=http://localhost:3004
      - NEXT_PUBLIC_APP_URL=http://localhost:3000
      - NEXT_PUBLIC_COOKIE_DOMAIN=localhost
      - RESEND_API_KEY=${RESEND_API_KEY}
      - FROM_EMAIL=${FROM_EMAIL:-noreply@pagespace.ai}
      - NODE_ENV=production
    deploy:
      resources:
        limits:
          memory: 256M
    networks:
      - frontend

  # Test service for running unit tests with database access
  test:
    build:
      context: .
      dockerfile: apps/web/Dockerfile.migrate
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      - DATABASE_URL=postgresql://user:password@postgres:5432/pagespace_test
      - CSRF_SECRET=test-csrf-secret-minimum-32-characters-long-for-testing-purposes
      - ENCRYPTION_KEY=test-encryption-key-32-chars-minimum-required-length
      - REALTIME_BROADCAST_SECRET=test-realtime-broadcast-secret-32-chars-minimum-length
    command: >
      sh -c "
        echo 'Setting up test database schema...' &&
        cd packages/db && pnpm drizzle-kit push --force &&
        cd ../.. &&
        echo 'Running tests...' &&
        pnpm test:unit
      "
    networks:
      - internal
    profiles:
      - test

  # Optional nginx service for efficient static file serving
  nginx:
    image: nginx:alpine
    ports:
      - "3004:80"
    volumes:
      - cache_storage:/usr/share/nginx/html/cache:ro
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      processor:
        condition: service_healthy
    deploy:
      resources:
        limits:
          memory: 128M
    profiles:
      - production
    networks:
      - frontend

networks:
  internal:
    driver: bridge
    internal: true
  frontend:
    driver: bridge

volumes:
  postgres_data:
  file_storage:
  cache_storage:
  cron_logs: