docker-compose.yml

services:
  db:
    image: postgres:16
    container_name: spaceworks-db
    environment:
      POSTGRES_USER: makerspace
      POSTGRES_PASSWORD: makerspace
      POSTGRES_DB: makerspace_manager
    ports:
      - "5432:5432"
    volumes:
      - makerspace_manager_pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U makerspace -d makerspace_manager"]
      interval: 5s
      timeout: 5s
      retries: 5

  minio:
    image: minio/minio:latest
    container_name: spaceworks-minio
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    ports:
      - "9000:9000"
      - "9001:9001"
    volumes:
      - minio_data:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 5s
      timeout: 5s
      retries: 5

  createbuckets:
    image: minio/mc:latest
    container_name: spaceworks-minio-createbuckets
    depends_on:
      minio:
        condition: service_healthy
    # MinIO already echoes the requesting Origin in its default CORS response (verified:
    # OPTIONS preflight returns Access-Control-Allow-Origin for http://localhost), so no
    # explicit `mc cors set` is needed for local dev. It was also failing on this mc release
    # (`cors set` expects S3 XML, not the JSON we wrote -> "decoding xml: EOF", exit 1).
    entrypoint: |
      /bin/sh -c '
      until mc alias set local http://minio:9000 minioadmin minioadmin; do sleep 1; done;
      mc mb --ignore-existing local/evidence;
      mc anonymous set none local/evidence;
      mc mb --ignore-existing local/public-images;
      mc anonymous set download local/public-images;
      '

  redis:
    image: redis:7-alpine
    container_name: spaceworks-redis
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 5

  # Backend is wired to MinIO for dev: it SIGNS presigned upload/view URLs with the
  # public endpoint (browser-reachable localhost:9000) and talks to MinIO server-side
  # over the internal endpoint (minio:9000). Empty creds would make every presigned
  # POST 403 at MinIO, so the root creds are supplied here.
  backend:
    build:
      context: ./backend
    container_name: spaceworks-backend
    environment: &backend-env
      SECRET_KEY: ${SECRET_KEY:-dev-insecure-change-me}
      DEBUG: ${DEBUG:-False}
      ALLOWED_HOSTS: ${ALLOWED_HOSTS:-localhost,127.0.0.1,backend}
      DATABASE_URL: ${DATABASE_URL:-postgres://makerspace:makerspace@db:5432/makerspace_manager}
      MANAGED_POSTGRES: ${MANAGED_POSTGRES:-False}
      CONN_MAX_AGE: ${CONN_MAX_AGE:-0}
      DISABLE_SERVER_SIDE_CURSORS: ${DISABLE_SERVER_SIDE_CURSORS:-False}
      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost,http://localhost:5173}
      API_CLIENT_ENC_KEY: ${API_CLIENT_ENC_KEY:-}
      # Dev serves the frontend same-origin behind nginx over plain http://localhost, where a
      # SameSite=None/Secure=True cookie (the prod default) is silently dropped by browsers,
      # so the 7-day refresh session never persists. Lax + non-secure makes it stick in dev.
      # Production (HTTPS, separate origins) keeps the secure defaults via its own env.
      AUTH_COOKIE_SECURE: ${AUTH_COOKIE_SECURE:-False}
      AUTH_COOKIE_SAMESITE: ${AUTH_COOKIE_SAMESITE:-Lax}
      # S3/MinIO: internal endpoint for server-side calls, public endpoint for the
      # presigned URLs the browser uses. Creds must match the minio service root user.
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-minioadmin}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-minioadmin}
      AWS_STORAGE_BUCKET_NAME: ${AWS_STORAGE_BUCKET_NAME:-evidence}
      PUBLIC_IMAGE_BUCKET: ${PUBLIC_IMAGE_BUCKET:-public-images}
      PUBLIC_IMAGE_BASE_URL: ${PUBLIC_IMAGE_BASE_URL:-http://localhost:9000/public-images}
      AWS_S3_ENDPOINT_URL: ${AWS_S3_ENDPOINT_URL:-http://minio:9000}
      AWS_S3_PUBLIC_ENDPOINT_URL: ${AWS_S3_PUBLIC_ENDPOINT_URL:-http://localhost:9000}
      STORAGE_PRESIGN_METHOD: ${STORAGE_PRESIGN_METHOD:-post}
      HMAC_CLIENT_ID: ${HMAC_CLIENT_ID:-}
      HMAC_SECRET: ${HMAC_SECRET:-}
      HMAC_MAX_CLOCK_SKEW_SECONDS: ${HMAC_MAX_CLOCK_SKEW_SECONDS:-300}
      HMAC_PROTECTED_PATH_PREFIXES: ${HMAC_PROTECTED_PATH_PREFIXES:-/api/public/,/api/v1/public/}
      CRON_SECRET: ${CRON_SECRET:-}
      EMAIL_BACKEND: ${EMAIL_BACKEND:-django.core.mail.backends.console.EmailBackend}
      EMAIL_HOST: ${EMAIL_HOST:-}
      EMAIL_PORT: ${EMAIL_PORT:-587}
      EMAIL_HOST_USER: ${EMAIL_HOST_USER:-}
      EMAIL_HOST_PASSWORD: ${EMAIL_HOST_PASSWORD:-}
      EMAIL_USE_TLS: ${EMAIL_USE_TLS:-True}
      DEFAULT_FROM_EMAIL: ${DEFAULT_FROM_EMAIL:-Makerspace <noreply@makerspace.local>}
      # Base URL used to build password-reset links in emails (forgot-password flow).
      PUBLIC_APP_BASE_URL: ${PUBLIC_APP_BASE_URL:-}
      STRIPE_CONNECT_REDIRECT_URI: ${STRIPE_CONNECT_REDIRECT_URI:-}
      CELERY_BROKER_URL: ${CELERY_BROKER_URL:-redis://redis:6379/0}
    command: >
      sh -c "python manage.py collectstatic --noinput &&
             gunicorn config.wsgi:application --bind 0.0.0.0:8000"
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/api/v1/health/', timeout=3).read()\""]
      interval: 10s
      timeout: 5s
      retries: 6
    ports:
      - "8001:8000"
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully

  migrate:
    build:
      context: ./backend
    container_name: spaceworks-migrate
    environment: *backend-env
    command: python manage.py migrate
    depends_on:
      db:
        condition: service_healthy
  worker:
    build:
      context: ./backend
    container_name: spaceworks-worker
    restart: unless-stopped
    environment: *backend-env
    command: celery -A config worker -l info
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully

  beat:
    build:
      context: ./backend
    container_name: spaceworks-beat
    restart: unless-stopped
    environment: *backend-env
    command: celery -A config beat -l info
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully

  frontend:
    build:
      context: ./frontend
      args:
        VITE_API_URL: ${VITE_API_URL:-/api}
        VITE_TENANT_TOKEN: ${VITE_TENANT_TOKEN:-}
        VITE_PUBLIC_API_KEY: ${VITE_PUBLIC_API_KEY:-}
        VITE_PUBLIC_CLIENT_ID: ${VITE_PUBLIC_CLIENT_ID:-}
    environment:
      TENANT_API_URL: ${TENANT_API_URL:-/api}
      TENANT_TOKEN: ${TENANT_TOKEN:-}
    container_name: spaceworks-frontend
    ports:
      - "80:80"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1/ >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 6
    depends_on:
      backend:
        condition: service_healthy

volumes:
  makerspace_manager_pgdata:
  minio_data: