docker-compose.yml

services:
  mariadb:
    image: mariadb:11.7
    restart: unless-stopped
    environment:
      MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD:?MARIADB_ROOT_PASSWORD is required}
      MARIADB_DATABASE: ${MARIADB_DATABASE:-triangle}
      MARIADB_USER: ${MARIADB_USER:-triangle_user}
      MARIADB_PASSWORD: ${MARIADB_PASSWORD:?MARIADB_PASSWORD is required}
    volumes:
      - mariadb_data:/var/lib/mysql
      - ./server/internal/database/wordpress_etl/01-authors.sql:/docker-entrypoint-initdb.d/01-authors.sql:ro,z
      - ./server/internal/database/wordpress_etl/02-articles.sql:/docker-entrypoint-initdb.d/02-articles.sql:ro,z
      - ./server/internal/database/wordpress_etl/03-articles-authors.sql:/docker-entrypoint-initdb.d/03-articles-authors.sql:ro,z
      - ./server/internal/database/wordpress_etl/04-seo.sql:/docker-entrypoint-initdb.d/04-seo.sql:ro,z
      - ./server/internal/database/wordpress_etl/05-article-embeddings.sql:/docker-entrypoint-initdb.d/05-article-embeddings.sql:ro,z
      - ./server/internal/database/wordpress_etl/06-taxonomy.sql:/docker-entrypoint-initdb.d/06-taxonomy.sql:ro,z
      - ./server/internal/database/wordpress_etl/07-poll-counts.sql:/docker-entrypoint-initdb.d/07-poll-counts.sql:ro,z
      - ./server/internal/database/wordpress_etl/08-comments.sql:/docker-entrypoint-initdb.d/08-comments.sql:ro,z
    ports:
      - "127.0.0.1:${MARIADB_PORT_FORWARD:-3306}:3306"
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 20s
    networks:
      - triangle_net

  embeddings:
    build:
      context: ./embeddings
      dockerfile: Dockerfile
    restart: unless-stopped
    # Capped for the same reason as production (see deploy/compose.cms.yml):
    # uncapped, embedding a freshly seeded corpus saturates every core on the
    # machine. Both settings are needed and should match: cpus is the ceiling,
    # OMP_NUM_THREADS stops onnxruntime spawning a thread per core regardless.
    cpus: ${EMBED_CPUS:-4}
    environment:
      EMBED_MODEL: ${EMBED_MODEL:-BAAI/bge-small-en-v1.5}
      OMP_NUM_THREADS: ${EMBED_CPUS:-4}
    healthcheck:
      # /health 503s until the model finishes loading, so this gates the CMS's
      # first search rather than letting it fail against a cold container.
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health')\""]
      interval: 20s
      timeout: 5s
      retries: 5
      start_period: 60s
    # Stateless by design: no volume, nothing to back up. Not published to the
    # host either; only the CMS talks to it, over the internal network.
    networks:
      - triangle_net

  cms:
    build:
      context: ./server
      dockerfile: Dockerfile
    restart: unless-stopped
    environment:
      EMBEDDINGS_URL: ${EMBEDDINGS_URL:-http://embeddings:8000}
      DB_NAME: ${MARIADB_DATABASE:-triangle}
      DB_USER: ${MARIADB_USER:-triangle_user}
      DB_PASSWORD: ${MARIADB_PASSWORD:?MARIADB_PASSWORD is required}
      DB_HOST: mariadb
      DB_PORT: 3306
      TLS_CERT_FILE: /app/certs/localhost.crt
      TLS_KEY_FILE: /app/certs/localhost.key
      OIDC_ISSUER_URL: ${OIDC_ISSUER_URL:-}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
      SLACK_WEBHOOK_URL: ${SLACK_WEBHOOK_URL:-}
      SLACK_SIGNING_SECRET: ${SLACK_SIGNING_SECRET:-}
      SLACK_CLASSIFIEDS_QUEUE_URL: ${SLACK_CLASSIFIEDS_QUEUE_URL:-}
      CMS_REBUILD_TAXONOMY_COUNTS_ON_STARTUP: ${CMS_REBUILD_TAXONOMY_COUNTS_ON_STARTUP:-false}
    depends_on:
      mariadb:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget --no-check-certificate -q -O - https://127.0.0.1:8080/v1/health >/dev/null 2>&1 || exit 1"]
      interval: 20s
      timeout: 5s
      retries: 5
      start_period: 20s
    ports:
      - "8080:8080"
    volumes:
      # TLS certs are mounted at runtime (not baked into the image). Generate
      # local dev certs with scripts/generate_certs.sh. In production these are
      # provided by the host / replaced by Nginx TLS termination.
      - ./server/certs:/app/certs:ro
    networks:
      - triangle_net


volumes:
  mariadb_data:

networks:
  triangle_net:
    driver: bridge