docker-compose.yml

services:
  db:
    image: postgres:16-alpine
    container_name: bilingers-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-bilingers}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-bilingers}
      POSTGRES_DB: ${POSTGRES_DB:-bilingers}
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    volumes:
      - postgres-data:/var/lib/postgresql/data
      # Runs only on an empty data volume (first start).
      - ./db/init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-bilingers} -d ${POSTGRES_DB:-bilingers}"]
      interval: 5s
      timeout: 5s
      retries: 10

  backend:
    build:
      context: ./backend
    container_name: bilingers-backend
    restart: unless-stopped
    environment:
      DATABASE_URL: ${DATABASE_URL:-postgresql+psycopg://bilingers:bilingers@db:5432/bilingers}
      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:3000}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      PANEL_SESSION_TTL_MINUTES: ${PANEL_SESSION_TTL_MINUTES:-720}
      PANEL_LOGIN_MAX_ATTEMPTS: ${PANEL_LOGIN_MAX_ATTEMPTS:-5}
      PANEL_LOGIN_LOCKOUT_MINUTES: ${PANEL_LOGIN_LOCKOUT_MINUTES:-15}
      PANEL_PASSWORD_RESET_TTL_HOURS: ${PANEL_PASSWORD_RESET_TTL_HOURS:-24}
      # Passed through explicitly like every other setting: there is no
      # `env_file` here and pydantic-settings looks for `.env` next to the
      # code in the container, where the repository root's copy never lands,
      # so a variable missing from this block is a variable nobody can set.
      PANEL_LOGIN_IP_MAX_ATTEMPTS: ${PANEL_LOGIN_IP_MAX_ATTEMPTS:-20}
      PANEL_LOGIN_IP_WINDOW_MINUTES: ${PANEL_LOGIN_IP_WINDOW_MINUTES:-5}
      PRICING_FILE: ${PRICING_FILE:-/app/pricing.json}
      # No default, deliberately, matching `app.config`: a key shipped here
      # would be a shared key, which is the same as no encryption. Empty means
      # enrolling in 2FA is refused rather than storing a secret in the clear,
      # so this is the one variable a deployment has to fill in by hand.
      PANEL_TOTP_ENCRYPTION_KEY: ${PANEL_TOTP_ENCRYPTION_KEY:-}
      PANEL_TOTP_ISSUER: ${PANEL_TOTP_ISSUER:-Bilingers}
      PANEL_BACKUP_CODE_COUNT: ${PANEL_BACKUP_CODE_COUNT:-10}
      DOCX_IMPORT_MAX_BYTES: ${DOCX_IMPORT_MAX_BYTES:-5242880}
    ports:
      - "${BACKEND_PORT:-8000}:8000"
    volumes:
      - ./backend:/app
    depends_on:
      db:
        condition: service_healthy
    # Migrations run before the app, so a clean volume needs no manual step.
    # `exec` hands PID 1 to uvicorn: sh does not forward SIGTERM, so without it
    # every stop waits out the full grace period and then gets killed.
    command: sh -c "alembic upgrade head && exec uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload"

  frontend:
    build:
      context: ./frontend
    container_name: bilingers-frontend
    restart: unless-stopped
    environment:
      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:8000}
      WATCHPACK_POLLING: "true"
    ports:
      - "${FRONTEND_PORT:-3000}:3000"
    volumes:
      - ./frontend:/app
      # Keep the image's node_modules; do not let the host mount shadow it.
      - /app/node_modules
      - /app/.next
    depends_on:
      - backend
    command: npm run dev

volumes:
  postgres-data: