docker-compose.yml

# ─────────────────────────────────────────────────────────────────────────────
# Noteleaf — Docker Compose
#
# Services:
#   postgres  → PostgreSQL 16. Persistent volume for data.
#   migrate   → One-shot Prisma migration runner. Exits after running migrations.
#               Prevents api from starting until migrations are complete.
#   api       → Fastify API server. Starts after migrate completes successfully.
#   web       → Next.js frontend. Starts after api is healthy.
#
# Startup order:
#   postgres healthy → migrate completes → api healthy → web starts
#
# Quick start:
#   1. Create root .env (local). Production: .env.production → Render/Vercel dashboards
#   2. docker compose up --build
#
# Access:
#   Frontend: http://localhost:3003
#   Backend:  http://localhost:3002
#   Health:   http://localhost:3002/api/health
# ─────────────────────────────────────────────────────────────────────────────

services:

  # ── PostgreSQL ──────────────────────────────────────────────────────────────

  postgres:
    image: postgres:16-alpine
    container_name: noteleaf-postgres
    restart: unless-stopped

    environment:
      POSTGRES_USER:        ${POSTGRES_USER:-noteleaf}
      POSTGRES_PASSWORD:    ${POSTGRES_PASSWORD:-noteleaf_dev_password}
      POSTGRES_DB:          ${POSTGRES_DB:-noteleaf}
      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=en_US.utf8"

    ports:
      # Expose to host for local tools (Prisma Studio, psql, TablePlus).
      - "5433:5432"

    volumes:
      - postgres_data:/var/lib/postgresql/data

    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-noteleaf} -d ${POSTGRES_DB:-noteleaf}"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s

    networks:
      - noteleaf-internal

  # ── Database migrations (one-shot) ──────────────────────────────────────────

  migrate:
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    container_name: noteleaf-migrate
    command: ["sh", "scripts/migrate.sh"]

    environment:
      DATABASE_URL: postgresql://${POSTGRES_USER:-noteleaf}:${POSTGRES_PASSWORD:-noteleaf_dev_password}@postgres:5432/${POSTGRES_DB:-noteleaf}
      DIRECT_DATABASE_URL: postgresql://${POSTGRES_USER:-noteleaf}:${POSTGRES_PASSWORD:-noteleaf_dev_password}@postgres:5432/${POSTGRES_DB:-noteleaf}

    volumes:
      - ./apps/api/scripts:/app/apps/api/scripts:ro

    depends_on:
      postgres:
        condition: service_healthy

    restart: "no"
    networks:
      - noteleaf-internal

  # ── Fastify API ─────────────────────────────────────────────────────────────

  api:
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    container_name: noteleaf-api
    restart: unless-stopped

    environment:
      NODE_ENV: ${NODE_ENV:-production}
      PORT:     3001

      DATABASE_URL: postgresql://${POSTGRES_USER:-noteleaf}:${POSTGRES_PASSWORD:-noteleaf_dev_password}@postgres:5432/${POSTGRES_DB:-noteleaf}
      DIRECT_DATABASE_URL: postgresql://${POSTGRES_USER:-noteleaf}:${POSTGRES_PASSWORD:-noteleaf_dev_password}@postgres:5432/${POSTGRES_DB:-noteleaf}

      NVIDIA_STT_MODE:      ${NVIDIA_STT_MODE:-cloud}
      NVIDIA_API_KEY:       ${NVIDIA_API_KEY:?NVIDIA_API_KEY must be set}
      NVIDIA_FUNCTION_ID:   ${NVIDIA_FUNCTION_ID:-bb0837de-8c7b-481f-9ec8-ef5663e9c1fa}
      NVIDIA_NIM_HOST:      ${NVIDIA_NIM_HOST:-localhost}
      NVIDIA_NIM_GRPC_PORT: ${NVIDIA_NIM_GRPC_PORT:-50051}

      RESEND_API_KEY: ${RESEND_API_KEY:-}
      FROM_EMAIL:     ${FROM_EMAIL:-Noteleaf <onboarding@resend.dev>}

      # Allow requests from the web container and the host browser.
      ALLOWED_ORIGINS: ${ALLOWED_ORIGINS:-http://localhost:3003,http://web:3000}

      RATE_LIMIT_MAX:    ${RATE_LIMIT_MAX:-100}
      RATE_LIMIT_WINDOW_MS: ${RATE_LIMIT_WINDOW_MS:-60000}

      # Auth
      JWT_SECRET:           ${JWT_SECRET:?JWT_SECRET must be set}
      GOOGLE_CLIENT_ID:     ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      APP_URL:              ${APP_URL:-http://localhost:3003}
      API_URL:              ${API_URL:-http://localhost:3002}

    ports:
      # WebSocket connections (STT stream) go directly from the browser to this
      # port — Next.js rewrites do not proxy WebSockets.
      - "3002:3001"

    depends_on:
      postgres:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully

    healthcheck:
      test: ["CMD-SHELL", "node -e \"fetch('http://localhost:3001/api/health').then(r=>r.ok?process.exit(0):process.exit(1)).catch(()=>process.exit(1))\""]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 20s

    networks:
      - noteleaf-internal

  # ── Next.js Web ─────────────────────────────────────────────────────────────

  web:
    build:
      context: .
      dockerfile: apps/web/Dockerfile
      args:
        # NEXT_PUBLIC_* are baked into the client JS bundle at build time.
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3002}
        NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-http://localhost:3003}
        # Server-side rewrite target — Docker internal DNS, not localhost.
        API_INTERNAL_URL: http://api:3001
    container_name: noteleaf-web
    restart: unless-stopped

    environment:
      NODE_ENV:            ${NODE_ENV:-production}
      PORT:                3000
      API_INTERNAL_URL:    http://api:3001
      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3002}

    ports:
      - "3003:3000"

    depends_on:
      api:
        condition: service_healthy

    networks:
      - noteleaf-internal

# ── Volumes ────────────────────────────────────────────────────────────────────

volumes:
  postgres_data:
    name: noteleaf_postgres_data

# ── Networks ───────────────────────────────────────────────────────────────────

networks:
  noteleaf-internal:
    name: noteleaf-internal
    driver: bridge