docker-compose.yaml

services:
  # =========================================================================
  # DATABASES
  # =========================================================================

  # Production/Development Database
  db:
    image: postgres:15-alpine
    container_name: openrisk_db
    environment:
      POSTGRES_USER: ${DB_USER:-openrisk}
      POSTGRES_PASSWORD: ${DB_PASSWORD:?set DB_PASSWORD in .env, see .env.example}
      POSTGRES_DB: ${DB_NAME:-openrisk}
    ports:
      - "5434:5432"
    volumes:
      - openrisk_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-openrisk}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - openrisk_network
    restart: unless-stopped

  # Test Database (for integration tests)
  test_db:
    image: postgres:15-alpine
    container_name: openrisk_test_db
    environment:
      POSTGRES_USER: test
      POSTGRES_PASSWORD: test
      POSTGRES_DB: openrisk_test
    ports:
      - "5435:5432"
    volumes:
      - openrisk_test_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U test"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - openrisk_network
    restart: unless-stopped

  # =========================================================================
  # CACHING & MESSAGING
  # =========================================================================

  # Redis for caching and session management
  redis:
    image: redis:7-alpine
    container_name: openrisk_redis
    ports:
      - "6380:6379"
    command: redis-server --appendonly yes --requirepass ""
    volumes:
      - openrisk_redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - openrisk_network
    restart: unless-stopped

  # =========================================================================
  # BACKEND SERVICE (Development Mode)
  # =========================================================================

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: openrisk_backend
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      # Database
      DB_HOST: db
      DB_PORT: 5432
      DB_USER: ${DB_USER:-openrisk}
      DB_PASSWORD: ${DB_PASSWORD:?set DB_PASSWORD in .env, see .env.example}
      DB_NAME: ${DB_NAME:-openrisk}
      # Server
      PORT: ${PORT:-8080}
      # CORS
      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:5173,http://localhost:3000}
      # Redis. BOTH spellings, because the product reads both: REDIS_URL feeds
      # the events client, the JWT blacklist and the rate limiter, while
      # pkg/cache and the cache bootstrap read REDIS_HOST/REDIS_PORT. With only
      # one of them set, the other half silently falls back to localhost inside
      # the container — an in-memory cache that nothing shares (#728).
      REDIS_URL: redis://redis:6379/0
      REDIS_HOST: redis
      REDIS_PORT: 6379
      # Environment
      APP_ENV: ${APP_ENV:-development}
    ports:
      - "8080:8080"
    volumes:
      - openrisk_secrets:/app/secrets
    networks:
      - openrisk_network
    restart: unless-stopped
    # For development, you can override the CMD with:
    # command: go run ./cmd/server
    healthcheck:
      # wget, not curl: the backend image is alpine + ca-certificates and ships
      # no curl, so this probe could only fail with "executable file not found"
      # and the container sat permanently unhealthy while answering 200 (#647).
      #
      # 127.0.0.1, not localhost: inside the container `localhost` resolves to
      # ::1 first and the server listens on IPv4 only, so busybox wget got
      # "Connection refused" from a process that was serving fine.
      test: ["CMD", "wget", "--quiet", "--tries=1", "--output-document=/dev/null", "http://127.0.0.1:8080/api/v1/health"]
      interval: 10s
      timeout: 5s
      retries: 5

  # =========================================================================
  # FRONTEND SERVICE (Development Mode)
  # =========================================================================

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    container_name: openrisk_frontend
    depends_on:
      - backend
    environment:
      NODE_ENV: ${NODE_ENV:-development}
      # NOTE: VITE_API_URL is deliberately NOT set here. Vite inlines VITE_*
      # at BUILD time, so a runtime variable on this service never reached the
      # bundle — it only looked like it configured something (#647). The bundle
      # calls a relative /api/v1 and nginx proxies it to the backend, which is
      # what keeps the session cookies first-party. Splitting the origins needs
      # a build arg AND an HTTPS story; see frontend/nginx.conf.
    ports:
      - "5173:5173"
    networks:
      - openrisk_network
    restart: unless-stopped
    # For hot-reload during development:
    # command: npm run dev -- --host 0.0.0.0
    healthcheck:
      # wget, not curl, and 127.0.0.1, not localhost — see the backend probe
      # above for both reasons (#647).
      test: ["CMD", "wget", "--quiet", "--tries=1", "--output-document=/dev/null", "http://127.0.0.1:5173/"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  openrisk_data:
  openrisk_test_data:
  openrisk_redis_data:
  openrisk_secrets:

networks:
  openrisk_network:
    driver: bridge