docker-compose.yml

services:

  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: vaultkey
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme}
      POSTGRES_DB: vaultkey
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./db/migrations:/docker-entrypoint-initdb.d:ro
    networks:
      - internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U vaultkey"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 120s

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: >
      redis-server
      --requirepass ${REDIS_PASSWORD:-redischangeme}
      --appendonly yes
      --appendfsync everysec
    volumes:
      - redis_data:/data
    networks:
      - internal
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-redischangeme}", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 30s

  vault:
    image: hashicorp/vault:1.15
    restart: unless-stopped
    cap_add:
      - IPC_LOCK
    volumes:
      - vault_data:/vault/data
      - ./config/vault.hcl:/vault/config/vault.hcl:ro
      - ./scripts:/scripts:ro
    networks:
      - internal
    command: server
    environment:
      VAULT_ADDR: http://0.0.0.0:8200
      VAULT_API_ADDR: http://0.0.0.0:8200
    healthcheck:
      test: ["CMD", "wget", "--spider", "--tries=1", "http://127.0.0.1:8200/v1/sys/health?standbyok=true&sealedcode=200&uninitcode=200"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  vault-init:
    image: python:3-alpine
    restart: on-failure
    depends_on:
      vault:
        condition: service_healthy
    environment:
      VAULT_ADDR: http://vault:8200
      VAULT_MOUNT_PATH: transit
      VAULT_KEY_NAME: vaultkey-master
    volumes:
      - vault_data:/vault/data
      - ./scripts:/scripts:ro
    entrypoint: ["sh", "-c", "apk add --no-cache curl && sh /scripts/vault-init.sh"]
    networks:
      - internal
      - external  # Needs external to install curl via apk

  pgadmin:
    image: dpage/pgadmin4:latest
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL:-admin@local.dev}
      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD:-pgadminchangeme}
      PGADMIN_CONFIG_SERVER_MODE: "False"
      PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED: "False"
    volumes:
      - pgadmin_data:/var/lib/pgadmin
    ports:
      - "127.0.0.1:5050:80"   # localhost only — never exposed publicly
    networks:
      - internal
      - external

  api:
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      vault-init:
        condition: service_completed_successfully
    environment:
      PORT: 8080
      DATABASE_URL: postgres://vaultkey:${POSTGRES_PASSWORD:-changeme}@postgres:5432/vaultkey?sslmode=disable
      VAULT_ADDR: http://vault:8200
      VAULT_TOKEN_FILE: /vault/data/root_token
      VAULT_MOUNT_PATH: transit
      VAULT_KEY_NAME: vaultkey-master
      REDIS_ADDR: redis:6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:-redischangeme}

      # Worker config
      WORKER_CONCURRENCY: ${WORKER_CONCURRENCY:-10}
      WORKER_POLL_TIMEOUT_SEC: 5

      # EVM RPC endpoints
      EVM_RPC_11155111: ${EVM_RPC_11155111:-https://eth-sepolia.public.blastapi.io}
      EVM_RPC_80002: ${EVM_RPC_80002:-https://polygon-amoy-bor-rpc.publicnode.com}
      EVM_RPC_421614: ${EVM_RPC_421614:-https://sepolia-rollup.arbitrum.io/rpc}
      EVM_RPC_84532: ${EVM_RPC_84532:-https://sepolia.base.org}
      EVM_RPC_11155420: ${EVM_RPC_11155420:-https://sepolia.optimism.io}
      TATUM_API_KEY: ${TATUM_API_KEY}

      SOLANA_RPC_URL: ${SOLANA_RPC_URL:-https://api.devnet.solana.com}

      ADMIN_TOKEN: ${ADMIN_TOKEN}
      ENVIRONMENT: ${ENVIRONMENT:-testnet}
      PLARTFORM_SUPPORT_EMAIL: ${PLARTFORM_SUPPORT_EMAIL}
      ENABLE_CLOUD_FEATURES: ${ENABLE_CLOUD_FEATURES:-false}
      TESTNET_MAX_PROJECTS: ${TESTNET_MAX_PROJECTS:-2}
      TESTNET_MAX_MEMBERS: ${TESTNET_MAX_MEMBERS:-3}
      TESTNET_MAX_API_KEYS: ${TESTNET_MAX_API_KEYS:-3}

      # Clerk authentication (required if ENABLE_CLOUD_FEATURES=true)
      CLERK_SECRET_KEY: ${CLERK_SECRET_KEY}
      CLERK_PUBLISHABLE_KEY: ${CLERK_PUBLISHABLE_KEY}
      CLERK_WEBHOOK_SECRET: ${CLERK_WEBHOOK_SECRET}

      # Stripe keys (for billing features, required if ENABLE_CLOUD_FEATURES=true)
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY}
      STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET}

      ENABLE_TEST_UI: ${ENABLE_TEST_UI:-false}
      ALLOWED_ORIGINS: ${ALLOWED_ORIGINS:-http://localhost:3000}


      # Email config (required if ENABLE_CLOUD_FEATURES=true)
      EMAIL_PROVIDER: ${EMAIL_PROVIDER:-noop} # noop, smtp, or resend
      EMAIL_FROM_ADDRESS: ${EMAIL_FROM_ADDRESS}
      EMAIL_FROM_NAME: ${EMAIL_FROM_NAME}
      SMTP_HOST: ${SMTP_HOST}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USERNAME: ${SMTP_USERNAME}
      SMTP_PASSWORD: ${SMTP_PASSWORD}
      EMAIL_UNSUB_URL: ${EMAIL_UNSUB_URL:-https://example.com/unsubscribe}
      EMAIL_NOOP_VERBOSE: ${EMAIL_NOOP_VERBOSE:-false}
      APP_BASE_URL: ${APP_BASE_URL:-http://localhost:8080}

      RESEND_API_KEY: ${RESEND_API_KEY}

    ports:
      - "8080:8080"
    volumes:
      - vault_data:/vault/data:ro
    networks:
      - internal
      - external

networks:
  internal:
    internal: true   # Vault, Redis, Postgres unreachable from outside
  external:
    internal: false  # Only the API is exposed

volumes:
  postgres_data:
  redis_data:
  vault_data:
  pgadmin_data: