docker-compose.yml

# docker-compose.yml
# Full deployment: Postgres + Redis + the API + the web app.
#
# Usage:
#   cp .env.example .env                              # infra + web settings
#   cp apps/api/.env.example apps/api/.env            # API secrets
#   docker compose up -d --build                      # build + start everything
#   docker compose logs -f dropto-web                 # stream logs for a service
#   docker compose down                               # stop (data survives in the volumes)
#
# Migrations run automatically on every `up` (the one-shot `dropto-migrate` service); the API
# only starts once they have been applied.
#
# Infra + web settings: root .env (see .env.example)
# API secrets:          apps/api/.env (see apps/api/.env.example)

services:
  dropto-pg:
    image: postgres:${POSTGRES_VERSION:-18}-alpine
    container_name: dropto-pg
    restart: unless-stopped
    environment:
      POSTGRES_USER: '${DB_USER}'
      POSTGRES_PASSWORD: '${DB_PASS}'
      POSTGRES_DB: '${DB_NAME}'
      # Pinned on purpose: the postgres:18 image moved its default PGDATA to
      # /var/lib/postgresql/18/docker. Setting it keeps one layout across majors, so the volume
      # mount below stays correct on 17 and 18 alike.
      PGDATA: /var/lib/postgresql/data
    ports:
      # Loopback only — nothing outside this host needs to reach the database.
      - '127.0.0.1:${DB_PORT:-5432}:5432'
    volumes:
      - dropto_pg_data:/var/lib/postgresql/data
    networks:
      - dropto_net
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${DB_USER} -d ${DB_NAME}']
      interval: 10s
      timeout: 5s
      retries: 5

  dropto-redis:
    image: redis:7-alpine
    container_name: dropto-redis
    restart: unless-stopped
    command: ['redis-server', '--requirepass', '${REDIS_PASS}']
    ports:
      - '127.0.0.1:${REDIS_PORT:-6379}:6379'
    volumes:
      - dropto_redis_data:/data
    networks:
      - dropto_net
    healthcheck:
      test: ['CMD', 'redis-cli', '-a', '${REDIS_PASS}', 'ping']
      interval: 10s
      timeout: 5s
      retries: 5

  # One-shot: applies pending Prisma migrations, then exits. Shares the API image.
  dropto-migrate:
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    image: dropto-api
    container_name: dropto-migrate
    restart: 'no'
    command: ['node_modules/.bin/prisma', 'migrate', 'deploy']
    env_file:
      - apps/api/.env
    environment: &api_env
      NODE_ENV: 'production'
      # Inside the network the services talk over their container names and default ports; these
      # override apps/api/.env so the root .env stays the single source for infra credentials.
      DB_HOST: 'dropto-pg'
      DB_PORT: '5432'
      DB_NAME: '${DB_NAME}'
      DB_USER: '${DB_USER}'
      DB_PASS: '${DB_PASS}'
      REDIS_HOST: 'dropto-redis'
      REDIS_PORT: '6379'
      REDIS_USER: '${REDIS_USER:-default}'
      REDIS_PASS: '${REDIS_PASS}'
      REDIS_KEY_PREFIX: '${REDIS_KEY_PREFIX:-dropto:}'
    networks:
      - dropto_net
    depends_on:
      dropto-pg:
        condition: service_healthy

  dropto-api:
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    image: dropto-api
    container_name: dropto-api
    restart: unless-stopped
    env_file:
      - apps/api/.env
    environment: *api_env
    # The server only reads its own bundle; /tmp is writable for Prisma's query engine.
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    ports:
      # The browser hits this directly during the Google OAuth redirect, so it must be reachable
      # from wherever the operator's browser runs. Drop the 127.0.0.1 prefix to expose it on the LAN.
      - '127.0.0.1:${API_PORT:-4000}:4000'
    networks:
      - dropto_net
    depends_on:
      dropto-pg:
        condition: service_healthy
      dropto-redis:
        condition: service_healthy
      dropto-migrate:
        condition: service_completed_successfully

  dropto-web:
    build:
      context: .
      dockerfile: apps/web/Dockerfile
      args:
        # Inlined into the client bundle / prerendered metadata — build-time only.
        NEXT_PUBLIC_GOOGLE_API_KEY: '${NEXT_PUBLIC_GOOGLE_API_KEY:-}'
        NEXT_PUBLIC_GOOGLE_APP_ID: '${NEXT_PUBLIC_GOOGLE_APP_ID:-}'
        APP_URL: '${APP_URL:-http://localhost:3000}'
    image: dropto-web
    container_name: dropto-web
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    environment:
      NODE_ENV: 'production'
      PORT: '3000'
      # Runtime, so rebranding the instance needs no rebuild.
      APP_NAME: '${APP_NAME:-DropTo}'
      APP_PRIMARY_COLOR: '${APP_PRIMARY_COLOR:-}'
      APP_URL: '${APP_URL:-http://localhost:3000}'
      # Server-to-server, over the compose network — never leaves the host.
      API_URL: 'http://dropto-api:4000/api/v1'
      COOKIE_DOMAIN: '${COOKIE_DOMAIN:-localhost}'
    ports:
      # Bound to loopback for a same-host reverse proxy; drop the prefix to expose it directly.
      - '127.0.0.1:${WEB_PORT:-3000}:3000'
    networks:
      - dropto_net
    depends_on:
      dropto-api:
        condition: service_healthy

volumes:
  dropto_pg_data:
  dropto_redis_data:

networks:
  dropto_net:
    driver: bridge
    name: dropto_net