docker-compose.yml

version: "3.9"

services:
  postgres:
    image: postgres:16-alpine
    # SECURITY: POSTGRES_PASSWORD has no default. `docker compose up` will fail
    # until you set it in .env. Generate with: openssl rand -base64 32
    environment:
      POSTGRES_USER: netleaf
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required — set it in .env, generate with `openssl rand -base64 32`}
      POSTGRES_DB: netleaf
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U netleaf"]
      interval: 5s
      timeout: 5s
      retries: 10
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    command: >
      sh -c "[ -n \"$$REDIS_PASSWORD\" ] && exec redis-server --requirepass \"$$REDIS_PASSWORD\" || exec redis-server"
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
    volumes:
      - redis_data:/data
    restart: unless-stopped

  migrate:
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    command: ["node", "dist/db/migrate.js"]
    environment:
      DATABASE_URL: postgresql://netleaf:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required — set it in .env, generate with `openssl rand -base64 32`}@postgres:5432/netleaf
    depends_on:
      postgres:
        condition: service_healthy
    restart: "no"

  api:
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    ports:
      - "3000:3000"
    environment:
      NODE_ENV: ${NODE_ENV:-production}
      PORT: 3000
      LOCAL_MODE: ${LOCAL_MODE:-false}
      REDIS_URL: ${REDIS_URL:-redis://redis:6379}
      DATABASE_URL: postgresql://netleaf:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required — set it in .env, generate with `openssl rand -base64 32`}@postgres:5432/netleaf
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      OLLAMA_URL: ${OLLAMA_URL:-http://host.docker.internal:11434}
      # Which Ollama model /v1/extract uses. Defaults to llama3.1 in code — set
      # this to a model you've actually pulled (e.g. qwen3.5:4b, gemma4:e4b).
      OLLAMA_MODEL: ${OLLAMA_MODEL:-}
      BRAVE_API_KEY: ${BRAVE_API_KEY:-}
      LEGACY_API_KEYS: ${LEGACY_API_KEYS:-}
      BROWSER_POOL_SIZE: ${BROWSER_POOL_SIZE:-3}
      CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost:3001}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
      migrate:
        condition: service_completed_successfully
    restart: unless-stopped

  web:
    build:
      context: ./apps/web
      dockerfile: Dockerfile
      args:
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3000}
    ports:
      - "3001:3000"
    environment:
      NODE_ENV: ${NODE_ENV:-production}
      PORT: 3000
      DATABASE_URL: postgresql://netleaf:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required — set it in .env, generate with `openssl rand -base64 32`}@postgres:5432/netleaf
      # Auth.js v5: AUTH_SECRET + trust the proxy host.
      # No default — startup fails if AUTH_SECRET is unset. Generate with:
      #   openssl rand -base64 32
      AUTH_SECRET: ${AUTH_SECRET:?AUTH_SECRET is required — generate with `openssl rand -base64 32`}
      AUTH_TRUST_HOST: "true"
      # Public origin of the web app. Without it NextAuth derives the container's
      # internal HOSTNAME (0.0.0.0:3000) for sign-in/callback URLs and redirects.
      # Set to your real origin in prod, e.g. https://netleaf.example.com.
      AUTH_URL: ${AUTH_URL:-http://localhost:3001}
      AUTH_GOOGLE_ID: ${AUTH_GOOGLE_ID:-}
      AUTH_GOOGLE_SECRET: ${AUTH_GOOGLE_SECRET:-}
      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3000}
    depends_on:
      postgres:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    restart: unless-stopped

volumes:
  postgres_data:
  redis_data: