docker-compose.yml

services:
  api:
    build:
      context: ./apps/backend
      dockerfile: Dockerfile
    ports:
      - "8000:8000"
    environment:
      APP_ENV: ${APP_ENV:-development}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      LOG_FORMAT: ${LOG_FORMAT:-text}
      DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-partha}:${POSTGRES_PASSWORD:-partha}@postgres:5432/${POSTGRES_DB:-partha}
      REDIS_URL: redis://redis:6379/0
      STORAGE_PATH: /data/partha
      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:5173,http://127.0.0.1:5173}
      AUTO_CREATE_TABLES: ${AUTO_CREATE_TABLES:-false}
      # Redis-backed so budgets are shared across API workers; the app default
      # ("memory") stays per-process for tests and bare-metal development.
      RATE_LIMIT_BACKEND: ${RATE_LIMIT_BACKEND:-redis}
      RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-true}
      RATE_LIMIT_DEFAULT_PER_MINUTE: ${RATE_LIMIT_DEFAULT_PER_MINUTE:-120}
      RATE_LIMIT_AUTH_PER_MINUTE: ${RATE_LIMIT_AUTH_PER_MINUTE:-10}
      RATE_LIMIT_AI_PER_MINUTE: ${RATE_LIMIT_AI_PER_MINUTE:-20}
      RATE_LIMIT_HEAVY_PER_MINUTE: ${RATE_LIMIT_HEAVY_PER_MINUTE:-30}
      # Hosted is the fail-safe default. Exact custom endpoint and CIDR
      # approval belongs to the deployment administrator, never a tenant.
      AI_EGRESS_MODE: ${AI_EGRESS_MODE:-hosted}
      AI_EGRESS_ALLOWED_BASE_URLS: ${AI_EGRESS_ALLOWED_BASE_URLS:-}
      AI_EGRESS_ALLOWED_CIDRS: ${AI_EGRESS_ALLOWED_CIDRS:-}
    volumes:
      - partha_storage:/data/partha
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    healthcheck:
      test:
        [
          "CMD",
          "python",
          "-c",
          "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/ready', timeout=5).read()",
        ]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 10s
    networks:
      - data
      - egress

  frontend:
    build:
      context: ./apps/frontend
      dockerfile: Dockerfile
    ports:
      - "5173:5173"
    environment:
      VITE_API_URL: http://localhost:8000
    volumes:
      - ./apps/frontend:/app
      - frontend_node_modules:/app/node_modules
    depends_on:
      api:
        condition: service_healthy
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "fetch('http://127.0.0.1:5173').then((response) => { if (!response.ok) process.exit(1); }).catch(() => process.exit(1));",
        ]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s
    networks:
      - data
      - egress

  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-partha}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-partha}
      POSTGRES_DB: ${POSTGRES_DB:-partha}
    # Intentionally no host port binding: the database is only reachable on the
    # internal `data` network. Self-hosted deployments should not expose Postgres
    # to the host/Internet (issue #186).
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 10
    networks:
      - data

  redis:
    image: redis:7-alpine
    # Intentionally no host port binding: Redis is only reachable on the internal
    # `data` network (issue #186).
    networks:
      - data

volumes:
  frontend_node_modules:
  postgres_data:
  partha_storage:

networks:
  # Database and cache are isolated from outbound networks. The API joins this
  # network solely to reach its data dependencies.
  data:
    internal: true
  # Compose cannot express an exact provider destination allowlist. Production
  # deployments must apply their own firewall, egress proxy, or mesh policy.
  egress: