docker-compose.yml

services:
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: flowable
      POSTGRES_USER: flowable
      POSTGRES_PASSWORD: flowable
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U flowable"]
      interval: 5s
      timeout: 5s
      retries: 10

  flowable:
    image: flowable/flowable-rest:7.2.0
    ports:
      - "8080:8080"
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      SPRING_DATASOURCE_URL: jdbc:postgresql://postgres:5432/flowable
      SPRING_DATASOURCE_USERNAME: flowable
      SPRING_DATASOURCE_PASSWORD: flowable
      FLOWABLE_REST_APP_ADMIN_USER_ID: rest-admin
      FLOWABLE_REST_APP_ADMIN_PASSWORD: test
      FLOWABLE_REST_APP_ADMIN_FIRST_NAME: REST
      FLOWABLE_REST_APP_ADMIN_LAST_NAME: Admin
      # Native CORS — verified live against flowable-rest:7.2.0 (Story 34.2, 2026-06-17).
      # Spring relaxed-binding: hyphens within a segment collapse (allowed-origins → ALLOWEDORIGINS).
      # Reproduces the nginx CORS contract: single explicit origin, Authorization header allowed,
      # credentials enabled. Note: no fail-fast on a malformed ALLOWED_ORIGIN — see docs/deployment-guide.md.
      FLOWABLE_REST_APP_CORS_ENABLED: "true"
      FLOWABLE_REST_APP_CORS_ALLOWEDORIGINS: ${ALLOWED_ORIGIN:-http://localhost:5173}
      FLOWABLE_REST_APP_CORS_ALLOWEDHEADERS: Authorization,Content-Type,Accept
      FLOWABLE_REST_APP_CORS_ALLOWEDMETHODS: GET,POST,PUT,DELETE,OPTIONS
      FLOWABLE_REST_APP_CORS_ALLOWCREDENTIALS: "true"
    healthcheck:
      # Probe the Swagger UI landing at /flowable-rest/docs/ — it is served
      # unauthenticated by Flowable 7.2.0 and returns 200 once Spring + Tomcat
      # finish bootstrapping, which is the readiness signal we need. The
      # /management/engine endpoint requires Basic auth, so embedding
      # credentials in the URL would leak the password to `docker inspect`
      # for anyone with daemon access.
      test: ["CMD-SHELL", "wget -q --spider http://localhost:8080/flowable-rest/docs/ || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 30s

  # Served only when the `flowatch` profile is activated:
  #   docker compose --profile flowatch up -d
  # The default stack (postgres + flowable) keeps starting as-is when
  # no profile is passed. Override the tag with FLOWATCH_TAG (defaults to
  # :latest; common alternates are :develop and :sha-<short>).
  flowatch:
    profiles: ["flowatch"]
    image: syalioune/flowatch:${FLOWATCH_TAG:-latest}
    ports:
      - "${FLOWATCH_PORT:-5173}:8080"
    depends_on:
      flowable:
        condition: service_healthy

volumes:
  postgres_data: