docker-compose.yml

services:
  db:
    image: postgres:17-alpine
    environment:
      POSTGRES_DB: ${DB_NAME}
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - db-data:/var/lib/postgresql/data
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U ${DB_USER} -d ${DB_NAME}" ]
      interval: 5s
      timeout: 5s
      retries: 5

  meilisearch:
    image: getmeili/meilisearch:v1.10
    environment:
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY}
      MEILI_ENV: ${MEILI_ENV:-production}
      MEILI_NO_ANALYTICS: "true"
    volumes:
      - meili-data:/meili_data
    healthcheck:
      # The v1.10 image is Alpine-based and ships curl; /health is public
      # (no master key needed) and returns {"status":"available"} when ready.
      test: [ "CMD", "curl", "-fsS", "http://localhost:7700/health" ]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s

  backend:
    build: ./backend
    environment:
      SPRING_DATASOURCE_URL: jdbc:postgresql://db:5432/${DB_NAME}
      SPRING_DATASOURCE_USERNAME: ${DB_USER}
      SPRING_DATASOURCE_PASSWORD: ${DB_PASSWORD}
      OIDC_JWK_SET_URI: ${OIDC_JWK_SET_URI}
      TRANSLATION_API_URL: ${TRANSLATION_API_URL:-}
      TRANSLATION_API_KEY: ${TRANSLATION_API_KEY:-}
      TRANSLATION_MODEL: ${TRANSLATION_MODEL:-}
      MEILI_HOST: http://meilisearch:7700
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY}
      MEILI_INDEX_PREFIX: ${MEILI_INDEX_PREFIX:-crm_}
      # MCP server (Onyx) — off by default; enabling grants every API key MCP read access.
      MCP_ENABLED: ${MCP_ENABLED:-false}
      MCP_AUTH_API_KEY_ENABLED: ${MCP_AUTH_API_KEY_ENABLED:-true}
      # Backup admin (spec 107) — DbBackupClient proxies the db-backup service.
      # Token is optional: a blank value lets the backend boot, and the admin
      # backup page reports "not configured" until it is set.
      DB_BACKUP_BASE_URL: http://db-backup:8080
      DB_BACKUP_API_TOKEN: ${DB_BACKUP_API_TOKEN:-}
    depends_on:
      db:
        condition: service_healthy
      meilisearch:
        condition: service_healthy
      db-backup:
        condition: service_healthy

  frontend:
    build: ./frontend
    environment:
      - BACKEND_URL=http://backend:8080
      - OIDC_ISSUER_URI=${OIDC_ISSUER_URI}
      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID}
      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
      - AUTH_SECRET=${AUTH_SECRET}
      - AUTH_URL=${AUTH_URL}
      - AUTH_TRUST_HOST=true
    depends_on:
      - backend

  db-backup:
    # OpenElementsLabs db-backup-service (spec 107): an HTTP API in front of
    # pg_dump + S3 upload that the backend's DbBackupClient talks to. It
    # replaces the previous cron-only ./scripts container. Pinned by tag +
    # digest for reproducible deployments.
    image: ghcr.io/openelementslabs/db-backup-service:0.1.1@sha256:1c331a1f33f6003e709e7166ad9d2908a370d514a13325972bfc167e10566548
    environment:
      DB_HOST: db
      DB_PORT: 5432
      DB_NAME: ${DB_NAME}
      DB_USER: ${DB_USER}
      DB_PASSWORD: ${DB_PASSWORD}
      STORAGE_BACKEND: s3
      # The image reads the fixed names S3_* / AWS_* internally, but we feed them
      # from DB_BACKUP_*-prefixed host variables so they don't collide with the
      # generic S3 credentials any other sidecar might use.
      S3_BUCKET: ${DB_BACKUP_S3_BUCKET}
      S3_ENDPOINT: ${DB_BACKUP_S3_ENDPOINT}
      S3_PREFIX: ${DB_BACKUP_S3_PREFIX:-backups}
      AWS_ACCESS_KEY_ID: ${DB_BACKUP_AWS_ACCESS_KEY_ID}
      AWS_SECRET_ACCESS_KEY: ${DB_BACKUP_AWS_SECRET_ACCESS_KEY}
      AWS_DEFAULT_REGION: ${DB_BACKUP_AWS_DEFAULT_REGION:-eu-central-1}
      # Bearer token shared with the backend (DB_BACKUP_API_TOKEN below).
      API_TOKEN: ${DB_BACKUP_API_TOKEN}
      BACKUP_INTERVAL: ${BACKUP_INTERVAL:-24h}
      RETENTION_DAYS: ${BACKUP_RETENTION_DAYS:-30}
    healthcheck:
      # Spring Boot Actuator /health is public (no token) and reports DOWN until
      # the database component is reachable, so the container only flips healthy
      # once it can actually reach the DB. start_period covers the JVM cold start.
      test: [ "CMD", "curl", "-fsS", "http://localhost:8080/health" ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    depends_on:
      db:
        condition: service_healthy


volumes:
  db-data:
  meili-data: