docker-compose.yml

x-gateway-env: &gateway_common_env
  LOG_LEVEL: ${LOG_LEVEL:-info}
  LOG_SQL_QUERIES: "true"
  APP_SECRET_KEY: dev-secret-key-change-in-production
  GOOGLE_CLIENT_ID: mock-client-id
  GOOGLE_CLIENT_SECRET: mock-client-secret
  GOOGLE_ALLOWED_DOMAIN: ${GOOGLE_ALLOWED_DOMAIN:-example.com}
  CONVOX_SECRET_ENV_VARS: DATABASE_URL,REDIS_URL,SECRET_KEY_BASE
  ADMIN_USERS: admin@example.com
  VIEWER_USERS: viewer@example.com
  DEPLOYER_USERS: deployer@example.com
  OPERATIONS_USERS: ops@example.com
  RACK: Dev
  RACK_HOST: http://mock-convox:${MOCK_CONVOX_PORT:-5443}
  RACK_TOKEN: mock-rack-token-12345
  RACK_USERNAME: convox
  DATABASE_URL: postgres://postgres:postgres@postgres:5432/gateway_dev?sslmode=disable

x-gateway-health: &gateway_healthcheck
  test:
    ["CMD-SHELL", "curl -fsS http://localhost:$$PORT/api/v1/health || exit 1"]
  interval: 2s
  timeout: 5s
  retries: 3

x-gateway-test-env: &gateway_test_env
  <<: *gateway_common_env
  RACK: Test
  RACK_HOST: http://mock-convox-test:${TEST_MOCK_CONVOX_PORT:-6443}
  DOMAIN: localhost
  GOOGLE_OAUTH_BASE_URL: http://mock-oauth-test:${TEST_MOCK_OAUTH_PORT:-9345}
  DEV_MODE: "true"
  E2E_TEST_MODE: "true"
  FORCE_CSP_IN_DEV: "true"
  RATE_LIMIT_RPS: ${RATE_LIMIT_RPS:-100}
  RATE_LIMIT_BURST: ${RATE_LIMIT_BURST:-200}
  LOG_LEVEL: debug
  DEBUG_TOPICS: "mfa,sql,http.request.info"
  # Increase DB connections for E2E tests to avoid starvation under load
  DB_MAX_OPEN_CONNS: "25"
  DB_MAX_IDLE_CONNS: "5"
  # Test settings via environment variables
  RGW_SETTING_MFA_TRUSTED_DEVICE_TTL_DAYS: "45"
  RGW_APP_API_SETTING_DEFAULT_BRANCH: "develop"

x-gateway-test-service: &gateway_test_service
  profiles: [test]
  build:
    context: .
    dockerfile: Dockerfile
    args:
      COMMIT_SHA: ${COMMIT_SHA:-dev}
  image: ${GATEWAY_TEST_IMAGE:-rack-gateway-api:test}
  volumes: []
  depends_on:
    postgres:
      condition: service_healthy
    mock-convox-test:
      condition: service_started
    mock-oauth-test:
      condition: service_healthy
  restart: unless-stopped
  healthcheck: *gateway_healthcheck
  networks:
    - gateway-net

services:
  mock-oauth:
    build:
      context: ./mock-oauth
    environment:
      PORT: 3346
      NODE_ENV: development
      OAUTH_ISSUER: http://mock-oauth:3346
      OAUTH_BROWSER_BASE: http://localhost:3346
    ports:
      - "3346:3346"
    networks:
      - gateway-net
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:3346/health || exit 1"]
      interval: 2s
      timeout: 5s
      retries: 30

  mock-convox:
    build:
      context: .
      dockerfile: Dockerfile.mock-convox
    environment:
      MOCK_CONVOX_PORT: 5444
      LOG_LEVEL: debug
    ports:
      - "5444:5444"
    networks:
      - gateway-net

  mock-oauth-test:
    profiles: [test]
    build:
      context: ./mock-oauth
    environment:
      PORT: ${TEST_MOCK_OAUTH_PORT:-9345}
      MOCK_OAUTH_PORT: ${TEST_MOCK_OAUTH_PORT:-9345}
      NODE_ENV: test
      OAUTH_ISSUER: http://mock-oauth-test:${TEST_MOCK_OAUTH_PORT:-9345}
      OAUTH_BROWSER_BASE: http://localhost:${TEST_MOCK_OAUTH_PORT:-9345}
    ports:
      - "${TEST_MOCK_OAUTH_PORT:-9345}:${TEST_MOCK_OAUTH_PORT:-9345}"
    networks:
      - gateway-net
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fsS http://localhost:${TEST_MOCK_OAUTH_PORT:-9345}/health || exit 1",
        ]
      interval: 2s
      timeout: 5s
      retries: 30

  mock-convox-test:
    profiles: [test]
    build:
      context: .
      dockerfile: Dockerfile.mock-convox
    environment:
      MOCK_CONVOX_PORT: ${TEST_MOCK_CONVOX_PORT:-6443}
      LOG_LEVEL: debug
    ports:
      - "${TEST_MOCK_CONVOX_PORT:-6443}:${TEST_MOCK_CONVOX_PORT:-6443}"
    networks:
      - gateway-net

  gateway-api-preview:
    profiles: [preview]
    build:
      context: .
      dockerfile: Dockerfile
      args:
        COMMIT_SHA: ${COMMIT_SHA:-dev}
    image: ${GATEWAY_IMAGE:-rack-gateway-api:local}
    environment:
      <<: *gateway_common_env
      DOMAIN: localhost
      PORT: ${GATEWAY_PORT:-8447}
      # Internal service URL for OIDC discovery/token endpoints
      GOOGLE_OAUTH_BASE_URL: http://mock-oauth:${MOCK_OAUTH_PORT:-3345}
      DEV_MODE: "true"
      FORCE_CSP_IN_DEV: "true"
      RATE_LIMIT_RPS: ${RATE_LIMIT_RPS:-100}
      RATE_LIMIT_BURST: ${RATE_LIMIT_BURST:-200}
    ports:
      - "${GATEWAY_PORT:-8447}:${GATEWAY_PORT:-8447}"
    volumes: []
    depends_on:
      postgres:
        condition: service_healthy
      mock-convox:
        condition: service_started
      mock-oauth:
        condition: service_healthy
    restart: unless-stopped
    healthcheck: *gateway_healthcheck
    networks:
      - gateway-net

  gateway-api-test:
    <<: *gateway_test_service
    environment:
      <<: *gateway_test_env
      PORT: ${TEST_GATEWAY_PORT:-9447}
      DATABASE_URL: postgres://postgres:postgres@postgres:5432/gateway_test?sslmode=disable
    ports:
      - "${TEST_GATEWAY_PORT:-9447}:${TEST_GATEWAY_PORT:-9447}"

  gateway-api-test-2:
    <<: *gateway_test_service
    environment:
      <<: *gateway_test_env
      PORT: ${TEST_GATEWAY_PORT_2:-9448}
      DATABASE_URL: postgres://postgres:postgres@postgres:5432/gateway_test_2?sslmode=disable
    ports:
      - "${TEST_GATEWAY_PORT_2:-9448}:${TEST_GATEWAY_PORT_2:-9448}"

  gateway-api-test-3:
    <<: *gateway_test_service
    environment:
      <<: *gateway_test_env
      PORT: ${TEST_GATEWAY_PORT_3:-9449}
      DATABASE_URL: postgres://postgres:postgres@postgres:5432/gateway_test_3?sslmode=disable
    ports:
      - "${TEST_GATEWAY_PORT_3:-9449}:${TEST_GATEWAY_PORT_3:-9449}"

  gateway-api-test-4:
    <<: *gateway_test_service
    environment:
      <<: *gateway_test_env
      PORT: ${TEST_GATEWAY_PORT_4:-9450}
      DATABASE_URL: postgres://postgres:postgres@postgres:5432/gateway_test_4?sslmode=disable
    ports:
      - "${TEST_GATEWAY_PORT_4:-9450}:${TEST_GATEWAY_PORT_4:-9450}"

  gateway-api-test-5:
    <<: *gateway_test_service
    environment:
      <<: *gateway_test_env
      PORT: ${TEST_GATEWAY_PORT_5:-9451}
      DATABASE_URL: postgres://postgres:postgres@postgres:5432/gateway_test_5?sslmode=disable
    ports:
      - "${TEST_GATEWAY_PORT_5:-9451}:${TEST_GATEWAY_PORT_5:-9451}"

  gateway-api-test-6:
    <<: *gateway_test_service
    environment:
      <<: *gateway_test_env
      PORT: ${TEST_GATEWAY_PORT_6:-9452}
      DATABASE_URL: postgres://postgres:postgres@postgres:5432/gateway_test_6?sslmode=disable
    ports:
      - "${TEST_GATEWAY_PORT_6:-9452}:${TEST_GATEWAY_PORT_6:-9452}"

  gateway-api-test-7:
    <<: *gateway_test_service
    environment:
      <<: *gateway_test_env
      PORT: ${TEST_GATEWAY_PORT_7:-9453}
      DATABASE_URL: postgres://postgres:postgres@postgres:5432/gateway_test_7?sslmode=disable
    ports:
      - "${TEST_GATEWAY_PORT_7:-9453}:${TEST_GATEWAY_PORT_7:-9453}"

  postgres:
    image: postgres:16-alpine
    command: postgres -c max_connections=500
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: postgres
    # Expose on a non-default host port to avoid conflicts with local Postgres
    ports:
      - "55432:5432"
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 2s
      timeout: 5s
      retries: 50
    networks:
      - gateway-net

  minio:
    image: minio/minio:latest
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    ports:
      - "9000:9000"   # S3 API
      - "9001:9001"   # MinIO Console
    volumes:
      - minio-data:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - gateway-net

  minio-setup:
    image: minio/mc:latest
    depends_on:
      minio:
        condition: service_healthy
    entrypoint: >
      /bin/sh -c "
      mc alias set myminio http://minio:9000 minioadmin minioadmin;
      if ! mc stat myminio/audit-anchors >/dev/null 2>&1; then
        mc mb --with-lock myminio/audit-anchors;
        mc retention set --default COMPLIANCE 400d myminio/audit-anchors;
      fi;
      echo 'MinIO bucket setup complete';
      "
    networks:
      - gateway-net

  web-dev:
    profiles: [dev]
    build:
      context: ./web
      dockerfile: Dockerfile.dev
      target: dev
    environment:
      # In dev profile, proxy API requests to gateway-api-dev (same Compose network)
      VITE_API_BASE_URL: http://gateway-api-dev:8448
      VITE_DEBUG_PROXY: ${VITE_DEBUG_PROXY:-false}
      VITE_DISABLE_HMR: "true"
      WEB_PORT: "5173"
      CI: true # allows bun install to reuse cache
    ports:
      - "5224:5173"
    volumes:
      - ./web:/app
      - /app/node_modules
    # Always ensure deps are installed inside the container to reflect lockfile changes
    command: sh -lc "bun install && bun run dev -- --host 0.0.0.0"
    networks:
      - gateway-net

  gateway-api-dev:
    profiles: [dev]
    build:
      context: .
      dockerfile: Dockerfile.gateway-dev
    environment:
      <<: *gateway_common_env
      DOMAIN: localhost
      PORT: 8448
      RACK_HOST: http://mock-convox:5444
      GOOGLE_OAUTH_BASE_URL: http://mock-oauth:3346
      DEV_MODE: "true"
      WEB_DEV_SERVER_URL: http://web-dev:5173
      WEB_PORT: 5224
      RATE_LIMIT_RPS: ${RATE_LIMIT_RPS:-100}
      RATE_LIMIT_BURST: ${RATE_LIMIT_BURST:-200}
      # MinIO S3 configuration for WORM audit anchors
      AWS_ENDPOINT_URL_S3: http://minio:9000
      AWS_ACCESS_KEY_ID: minioadmin
      AWS_SECRET_ACCESS_KEY: minioadmin
      AWS_REGION: us-east-1
      AUDIT_ANCHOR_BUCKET: audit-anchors
      AUDIT_ANCHOR_CHAIN_ID: dev
      AUDIT_ANCHOR_RETENTION_DAYS: "400"
      AUDIT_ANCHOR_INTERVAL_MINUTES: "1"  # Every minute for dev testing
    ports:
      - "8448:8448"
    depends_on:
      postgres:
        condition: service_healthy
      mock-convox:
        condition: service_started
      mock-oauth:
        condition: service_healthy
      minio:
        condition: service_healthy
    restart: unless-stopped
    healthcheck: *gateway_healthcheck
    networks:
      - gateway-net

networks:
  gateway-net:
    driver: bridge

volumes:
  postgres-data:
  minio-data: