docker-compose.yml

name: ai-native-pr-platform

services:
  postgres:
    image: postgres:16.6-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-platform}
      POSTGRES_USER: ${POSTGRES_USER:-platform}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-platform-dev-only}
    volumes:
      - platform_postgres_data:/var/lib/postgresql/data
    networks:
      - platform
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s
    security_opt:
      - no-new-privileges:true
    cap_drop: [ALL]
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID

  gitea:
    image: gitea/gitea:1.22.6-rootless
    restart: unless-stopped
    environment:
      USER_UID: 1000
      USER_GID: 1000
      GITEA__database__DB_TYPE: postgres
      GITEA__database__HOST: postgres:5432
      GITEA__database__NAME: ${POSTGRES_DB:-platform}
      GITEA__database__USER: ${POSTGRES_USER:-platform}
      GITEA__database__PASSWD: ${POSTGRES_PASSWORD:-platform-dev-only}
      GITEA__security__INSTALL_LOCK: "true"
      GITEA__server__DOMAIN: ${GITEA_DOMAIN:-localhost}
      GITEA__server__ROOT_URL: ${GITEA_ROOT_URL:-http://localhost:3001/}
      GITEA__server__HTTP_PORT: 3000
      GITEA__server__SSH_PORT: 2222
      GITEA__server__SSH_LISTEN_PORT: 2222
      GITEA__webhook__ALLOWED_HOST_LIST: private
    ports:
      - "${GITEA_PORT:-3001}:3000"
      - "${GITEA_SSH_PORT:-2222}:2222"
    volumes:
      - platform_gitea_data:/var/lib/gitea
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - platform
    healthcheck:
      test: ["CMD-SHELL", "wget --quiet --spider http://127.0.0.1:3000/ || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s
    security_opt:
      - no-new-privileges:true
    cap_drop: [ALL]

  registry:
    image: registry:2.8.3
    restart: unless-stopped
    environment:
      REGISTRY_STORAGE_DELETE_ENABLED: "true"
      REGISTRY_HTTP_ADDR: 0.0.0.0:5000
    ports:
      - "${REGISTRY_DEBUG_PORT:-5001}:5000"
    volumes:
      - platform_registry_data:/var/lib/registry
      - ./infra/registry/config.yml:/etc/docker/registry/config.yml:ro
    command: ["/bin/registry", "serve", "/etc/docker/registry/config.yml"]
    networks:
      - platform
    healthcheck:
      test: ["CMD-SHELL", "wget --quiet --spider http://127.0.0.1:5000/v2/ || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 5s
    security_opt:
      - no-new-privileges:true
    cap_drop: [ALL]

  # Run exactly one migration command before starting API and Worker. The
  # application-owned migration entrypoint is intentionally configurable.
  migrate:
    build:
      context: .
      dockerfile: Dockerfile
      target: api-runtime
    image: ${PLATFORM_MIGRATOR_IMAGE:-platform-api:dev}
    restart: "no"
    environment:
      DATABASE_URL: postgres://${POSTGRES_USER:-platform}:${POSTGRES_PASSWORD:-platform-dev-only}@postgres:5432/${POSTGRES_DB:-platform}
    command: ["node", "packages/db/dist/migrate.js"]
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - platform
    security_opt:
      - no-new-privileges:true

  api:
    build:
      context: .
      dockerfile: Dockerfile
      target: api-runtime
    image: ${PLATFORM_API_IMAGE:-platform-api:dev}
    restart: unless-stopped
    environment:
      NODE_ENV: ${NODE_ENV:-development}
      PORT: 3000
      K8S_MODE: local
      KUBECONFIG: /nonexistent
      DATABASE_URL: postgres://${POSTGRES_USER:-platform}:${POSTGRES_PASSWORD:-platform-dev-only}@postgres:5432/${POSTGRES_DB:-platform}
      GITEA_BASE_URL: ${GITEA_BASE_URL:-http://gitea:3000}
      GITEA_PUBLIC_URL: ${GITEA_PUBLIC_URL:-http://localhost:3001}
      GITEA_WEBHOOK_SECRET: ${GITEA_WEBHOOK_SECRET:-replace-with-a-32-byte-secret}
      SESSION_ENCRYPTION_KEY: ${SESSION_ENCRYPTION_KEY:-replace-with-a-32-byte-session-key}
      GITEA_OAUTH_CLIENT_ID: ${GITEA_OAUTH_CLIENT_ID:-}
      GITEA_OAUTH_CLIENT_SECRET: ${GITEA_OAUTH_CLIENT_SECRET:-}
      PLATFORM_PUBLIC_URL: ${PLATFORM_PUBLIC_URL:-http://localhost:3000}
      AGENT_PROVIDER: ${AGENT_PROVIDER:-mock}
      PREVIEW_MODE: local
      REGISTRY_PUSH_HOST: ${COMPOSE_REGISTRY_HOST:-registry:5000}
      REGISTRY_PULL_HOST: ${COMPOSE_REGISTRY_HOST:-registry:5000}
    ports:
      - "${API_PORT:-3000}:3000"
    volumes:
      - platform_logs:/var/log/platform
    depends_on:
      postgres:
        condition: service_healthy
      gitea:
        condition: service_healthy
      registry:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    networks:
      - platform
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/healthz').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 15s

  worker:
    build:
      context: .
      dockerfile: Dockerfile
      target: worker-runtime
    image: ${PLATFORM_WORKER_IMAGE:-platform-worker:dev}
    restart: unless-stopped
    environment:
      NODE_ENV: ${NODE_ENV:-development}
      K8S_MODE: local
      DATABASE_URL: postgres://${POSTGRES_USER:-platform}:${POSTGRES_PASSWORD:-platform-dev-only}@postgres:5432/${POSTGRES_DB:-platform}
      GITEA_BASE_URL: ${GITEA_BASE_URL:-http://gitea:3000}
      GITEA_RUNNER_BASE_URL: ${GITEA_RUNNER_BASE_URL:-http://host.k3d.internal:3001}
      GITEA_PUBLIC_URL: ${GITEA_PUBLIC_URL:-http://localhost:3001}
      GITEA_WEBHOOK_SECRET: ${GITEA_WEBHOOK_SECRET:-replace-with-a-32-byte-secret}
      SESSION_ENCRYPTION_KEY: ${SESSION_ENCRYPTION_KEY:-replace-with-a-32-byte-session-key}
      AGENT_PROVIDER: ${AGENT_PROVIDER:-mock}
      WORKFLOW_EXECUTOR: ${WORKFLOW_EXECUTOR:-fixture}
      K8S_STORAGE_CLASS: ${K8S_STORAGE_CLASS:-local-path}
      K8S_JOB_TIMEOUT_MS: ${K8S_JOB_TIMEOUT_MS:-900000}
      K8S_RUNNER_IMAGE: ${K8S_RUNNER_IMAGE:-registry.example.test/platform/runner@sha256:replace}
      K8S_PREVIEW_IMAGE: ${K8S_PREVIEW_IMAGE:-registry.example.test/platform/preview@sha256:replace}
      GITEA_RUNNER_TOKEN: ${GITEA_RUNNER_TOKEN:-}
      GITEA_PLATFORM_TOKEN: ${GITEA_PLATFORM_TOKEN:-}
      AGENT_REVIEW_URL: ${AGENT_REVIEW_URL:-http://agent-review:3002}
      PREVIEW_MODE: local
      REGISTRY_PUSH_HOST: ${COMPOSE_REGISTRY_HOST:-registry:5000}
      REGISTRY_PULL_HOST: ${COMPOSE_REGISTRY_HOST:-registry:5000}
      REGISTRY_API_URL: ${REGISTRY_API_URL:-http://registry:5000}
      KUBECONFIG: /var/run/platform/kubeconfig
      PORT: 3001
      WORKER_HEALTH_PORT: 3001
    command: ["node", "apps/worker/dist/main.js"]
    volumes:
      - platform_logs:/var/log/platform
      - ${KUBECONFIG_WORKER:-./infra/k3d/kubeconfig.worker}:/var/run/platform/kubeconfig:ro
    extra_hosts:
      - host.docker.internal:host-gateway
    depends_on:
      postgres:
        condition: service_healthy
      gitea:
        condition: service_healthy
      registry:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    networks:
      - platform
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3001/healthz').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 15s

  # The web package is owned by a later target. Keep the deployment contract
  # available without coupling this target to an implementation in apps/web.
  web:
    build:
      context: .
      dockerfile: Dockerfile
      target: web-runtime
    image: ${PLATFORM_WEB_IMAGE:-platform-web:dev}
    restart: unless-stopped
    ports:
      - "${WEB_PORT:-8080}:80"
    depends_on:
      api:
        condition: service_healthy
    networks:
      - platform
    healthcheck:
      test: ["CMD-SHELL", "wget --quiet --spider http://127.0.0.1/ || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 6
    security_opt:
      - no-new-privileges:true

  agent-review:
    build:
      context: .
      dockerfile: Dockerfile
      target: agent-review-runtime
    image: ${PLATFORM_AGENT_IMAGE:-platform-agent:dev}
    restart: unless-stopped
    environment:
      NODE_ENV: ${NODE_ENV:-development}
      AGENT_PROVIDER: ${AGENT_PROVIDER:-mock}
      AGENT_MODEL_API_KEY: ${AGENT_MODEL_API_KEY:-}
    command: ["node", "apps/agent-review/dist/main.js"]
    ports:
      - "${AGENT_REVIEW_PORT:-3002}:3002"
    networks:
      - platform
    read_only: true
    tmpfs:
      - /tmp:size=32m,mode=1777
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3002/healthz').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 15s

networks:
  platform:
    name: ${COMPOSE_NETWORK_NAME:-ai-platform-compose}

volumes:
  platform_postgres_data:
    name: ${COMPOSE_POSTGRES_VOLUME:-ai-platform-compose-postgres}
  platform_gitea_data:
    name: ${COMPOSE_GITEA_VOLUME:-ai-platform-compose-gitea}
  platform_registry_data:
    name: ${COMPOSE_REGISTRY_VOLUME:-ai-platform-compose-registry}
  platform_logs:
    name: ${COMPOSE_LOG_VOLUME:-ai-platform-compose-logs}