docker-compose.yml

# Local development stack for PropFlow API.
#
#   docker compose up -d db        # database only -- run the app from your IDE
#   docker compose up --build      # full stack, app included
#
# Credentials here are throwaway values for a local container and are not
# secrets. Real deployments supply DB_* via the environment or a secret manager.

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: propflow-app
    ports:
      - "8080:8080"
    environment:
      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-dev}
      PORT: 8080
      # "db" is the Compose service name, resolved on the shared network.
      # The previous configuration pointed at localhost, which inside the
      # container refers to the container itself -- the app could never connect.
      DB_URL: jdbc:postgresql://db:5432/${POSTGRES_DB:-propflow}
      DB_USERNAME: ${POSTGRES_USER:-propflow}
      DB_PASSWORD: ${POSTGRES_PASSWORD:-propflow}
      # No default. The application refuses to start without a signing key, and
      # Compose will fail the same way rather than silently booting with one
      # baked into this file -- a committed key is a key everyone has.
      # Set JWT_SECRET in .env; generate with: openssl rand -base64 48
      JWT_SECRET: "${JWT_SECRET:?set JWT_SECRET in .env - generate with openssl rand -base64 48}"
      JWT_EXPIRATION: ${JWT_EXPIRATION:-1h}
      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost:4200}
    depends_on:
      db:
        # Wait for PostgreSQL to accept connections, not merely for the
        # container to exist. Without this the app races the database on
        # startup and fails its first connection attempt.
        condition: service_healthy
    networks:
      - propflow
    restart: unless-stopped
    healthcheck:
      # Probes the readiness group, not plain /actuator/health: readiness
      # includes the database check, so the container is only reported healthy
      # once it can actually serve requests.
      #
      # curl is installed explicitly in the runtime image. The previous
      # healthcheck assumed it was present in a base image that did not have
      # it -- one of three reasons it could never have passed.
      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/actuator/health/readiness || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
      # Generous, because Flyway migrations run during startup on a cold
      # database. Failures before this elapses do not count against `retries`.
      start_period: 60s

  db:
    image: postgres:15-alpine
    container_name: propflow-db
    ports:
      # Host port is configurable because 5432 is frequently already taken by
      # another local PostgreSQL. Set DB_HOST_PORT in .env if it clashes, and
      # update DB_URL to match. The app container is unaffected -- it reaches
      # the database at db:5432 on the internal network.
      - "${DB_HOST_PORT:-5432}:5432"
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-propflow}
      POSTGRES_USER: ${POSTGRES_USER:-propflow}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-propflow}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - propflow
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-propflow} -d ${POSTGRES_DB:-propflow}"]
      interval: 5s
      timeout: 5s
      retries: 10
    restart: unless-stopped

  # Lightweight database browser at http://localhost:8082
  adminer:
    image: adminer
    container_name: propflow-adminer
    ports:
      # Adminer listens on 8080 inside the container. The previous mapping was
      # 8082:8082, so the service was unreachable. The host side is
      # configurable for the same reason as the database port: 8082 is a
      # popular choice and may already be taken.
      - "${ADMINER_HOST_PORT:-8082}:8080"
    depends_on:
      - db
    networks:
      - propflow
    restart: unless-stopped

volumes:
  postgres-data:

networks:
  propflow:
    driver: bridge