docker-compose.yml

version: '3.8'

services:
  # PostgreSQL Database
  postgres:
    image: postgres:16-alpine
    container_name: zeal-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-zeal}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-zeal_password}
      POSTGRES_DB: ${POSTGRES_DB:-zeal_db}
      POSTGRES_INITDB_ARGS: "-E UTF8"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-zeal} -d ${POSTGRES_DB:-zeal_db}"]
      interval: 30s
      timeout: 3s
      retries: 3
    networks:
      - zeal-network

  # Redis Cache
  redis:
    image: redis:7-alpine
    container_name: zeal-redis
    restart: unless-stopped
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:-redispass123}
    volumes:
      - redis_data:/data
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-redispass123}", "ping"]
      interval: 30s
      timeout: 3s
      retries: 3
    networks:
      - zeal-network

  # MinIO Object Storage
  minio:
    image: minio/minio:latest
    container_name: zeal-minio
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin123}
      MINIO_BROWSER_REDIRECT_URL: ${MINIO_BROWSER_REDIRECT_URL:-http://localhost:9001}
    volumes:
      - minio_data:/data
    ports:
      - "9000:9000"
      - "9001:9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 30s
      timeout: 20s
      retries: 3
    networks:
      - zeal-network

  # MinIO Bucket Setup (runs once to create bucket and set permissions)
  minio-setup:
    image: minio/mc:latest
    container_name: zeal-minio-setup
    depends_on:
      minio:
        condition: service_healthy
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin123}
      MINIO_BUCKET: ${MINIO_BUCKET:-zeal-uploads}
    entrypoint: >
      /bin/sh -c "
      mc alias set myminio http://minio:9000 $$MINIO_ROOT_USER $$MINIO_ROOT_PASSWORD;
      mc mb --ignore-existing myminio/$$MINIO_BUCKET;
      mc anonymous set download myminio/$$MINIO_BUCKET;
      echo 'MinIO bucket setup complete';
      "
    networks:
      - zeal-network

  # Rust CRDT Server
  crdt-server:
    build:
      context: ./crdt-server
      dockerfile: Dockerfile
    container_name: zeal-crdt-server
    restart: unless-stopped
    depends_on:
      redis:
        condition: service_healthy
    environment:
      RUST_LOG: ${RUST_LOG:-info}
      CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost:3000}
      MAX_CLIENTS_PER_ROOM: ${MAX_CLIENTS_PER_ROOM:-100}
      CLIENT_TIMEOUT_MINUTES: ${CLIENT_TIMEOUT_MINUTES:-30}
      REDIS_URL: redis://:${REDIS_PASSWORD:-redispass123}@redis:6379
      DISABLE_REDIS_PERSISTENCE: ${DISABLE_REDIS_PERSISTENCE:-false}
    ports:
      - "8080:8080"
    networks:
      - zeal-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 3s
      retries: 3

  # Next.js Application
  app:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: zeal-app
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      crdt-server:
        condition: service_healthy
      minio:
        condition: service_healthy
    environment:
      # Database
      DATABASE_URL: postgresql://${POSTGRES_USER:-zeal}:${POSTGRES_PASSWORD:-zeal_password}@postgres:5432/${POSTGRES_DB:-zeal_db}?schema=public
      
      # Redis
      REDIS_URL: redis://:${REDIS_PASSWORD:-redispass123}@redis:6379
      
      # CRDT Server
      NEXT_PUBLIC_CRDT_SERVER_URL: ${NEXT_PUBLIC_CRDT_SERVER_URL:-ws://localhost:8080}
      
      # MinIO
      MINIO_ENDPOINT: minio:9000
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin123}
      MINIO_BUCKET: ${MINIO_BUCKET:-zeal-uploads}
      MINIO_USE_SSL: ${MINIO_USE_SSL:-false}
      NEXT_PUBLIC_MINIO_URL: ${NEXT_PUBLIC_MINIO_URL:-http://localhost:9000}
      
      # NextAuth
      NEXTAUTH_URL: ${NEXTAUTH_URL:-http://localhost:3000}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
      
      # Auth Configuration
      ZEAL_AUTH_ENABLED: ${ZEAL_AUTH_ENABLED:-false}
      ZEAL_SECRET_KEY: ${ZEAL_SECRET_KEY}
      
      # App Config
      NODE_ENV: ${NODE_ENV:-production}
      NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
      NEXT_PUBLIC_ENABLE_COLLABORATION: ${NEXT_PUBLIC_ENABLE_COLLABORATION:-true}
      
      # Node Template Repository Configuration
      USE_TEMPLATE_REPOSITORY: ${USE_TEMPLATE_REPOSITORY:-true}
      AUTO_INGEST_TEMPLATES: ${AUTO_INGEST_TEMPLATES:-true}
      
      # AI Embedding Configuration (for semantic search)
      # Use mock embeddings for development (no API key required)
      EMBEDDING_VENDOR: ${EMBEDDING_VENDOR:-mock}
      EMBEDDING_DIMENSIONS: ${EMBEDDING_DIMENSIONS:-1536}
      EMBEDDING_BATCH_SIZE: ${EMBEDDING_BATCH_SIZE:-100}
      
      # Production AI embedding configuration (uncomment as needed):
      # EMBEDDING_VENDOR: ${EMBEDDING_VENDOR:-openai}
      # EMBEDDING_MODEL: ${EMBEDDING_MODEL:-text-embedding-3-small}
      # EMBEDDING_API_KEY: ${EMBEDDING_API_KEY}
      
      # Embed API Configuration (for workflow embedding)
      NEXT_PUBLIC_EMBED_ENABLED: ${NEXT_PUBLIC_EMBED_ENABLED:-true}
      EMBED_MAX_API_KEYS_PER_WORKFLOW: ${EMBED_MAX_API_KEYS_PER_WORKFLOW:-10}
      EMBED_DEFAULT_RATE_LIMIT: ${EMBED_DEFAULT_RATE_LIMIT:-1000}
      
      # Development URLs
      NEXT_PUBLIC_BASE_URL: ${NEXT_PUBLIC_BASE_URL:-http://localhost:3000}
      NEXT_PUBLIC_EMBED_URL: ${NEXT_PUBLIC_EMBED_URL:-http://localhost:3000/embed}
      
      # Authorization Configuration
      ZEAL_AUTH_ENABLED: ${ZEAL_AUTH_ENABLED:-false}
      ZEAL_AUTH_MODE: ${ZEAL_AUTH_MODE:-development}
      
      # JWT Configuration (for production auth)
      AUTH_JWT_ISSUER: ${AUTH_JWT_ISSUER}
      AUTH_JWT_AUDIENCE: ${AUTH_JWT_AUDIENCE}
      AUTH_JWT_JWKS_URI: ${AUTH_JWT_JWKS_URI}
      
      # Development auth settings
      ZEAL_DEV_USER_ID: ${ZEAL_DEV_USER_ID:-dev-user}
      ZEAL_DEV_ROLES: ${ZEAL_DEV_ROLES:-user,developer}
      ZEAL_DEV_ALLOW_ALL: ${ZEAL_DEV_ALLOW_ALL:-true}
      
      # Auth claim mappings
      AUTH_CLAIM_SUBJECT_ID: ${AUTH_CLAIM_SUBJECT_ID:-sub}
      AUTH_CLAIM_TENANT: ${AUTH_CLAIM_TENANT:-tenant_id}
      AUTH_CLAIM_ORGANIZATION: ${AUTH_CLAIM_ORGANIZATION:-org_id}
      AUTH_CLAIM_ROLES: ${AUTH_CLAIM_ROLES:-roles}
      AUTH_CLAIM_PERMISSIONS: ${AUTH_CLAIM_PERMISSIONS:-permissions}
      
      # Auth policies path (mounted as volume)
      ZEAL_AUTH_POLICIES_PATH: ${ZEAL_AUTH_POLICIES_PATH:-/app/auth-policies.yaml}
    ports:
      - "3000:3000"
    networks:
      - zeal-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 3s
      retries: 3
    volumes:
      # For development, you can mount the source code
      # - ./:/app
      # - /app/node_modules
      # - /app/.next
      - uploads:/app/uploads
      # Mount auth policies if they exist
      - ./auth-policies.yaml:/app/auth-policies.yaml:ro

  # Nginx Reverse Proxy (optional, for production)
  nginx:
    image: nginx:alpine
    container_name: zeal-nginx
    restart: unless-stopped
    depends_on:
      - app
      - crdt-server
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
      - nginx_cache:/var/cache/nginx
    networks:
      - zeal-network
    profiles:
      - production

networks:
  zeal-network:
    driver: bridge

volumes:
  postgres_data:
    driver: local
  redis_data:
    driver: local
  minio_data:
    driver: local
  uploads:
    driver: local
  nginx_cache:
    driver: local