runtm

version: "3.8"

services:
  api:
    build:
      context: ..
      dockerfile: infra/Dockerfile.api
    # Note: USER directive in Dockerfile handles non-root for production
    # For local dev, we don't override user to avoid volume permission issues
    ports:
      - "8000:8000"
    env_file:
      - ../.env  # Load from project root .env file
    environment:
      - DATABASE_URL=postgresql://runtm:runtm@postgres:5432/runtm
      - REDIS_URL=redis://redis:6379
      - API_SECRET=${RUNTM_API_SECRET:?Set RUNTM_API_SECRET environment variable}
      - ARTIFACT_STORAGE_PATH=/artifacts
      - ARTIFACT_STORAGE_BACKEND=local
      - AUTH_MODE=single_tenant
      - DEBUG=true
      # FLY_API_TOKEN and FLY_ORG are loaded from .env via env_file above
    volumes:
      - artifacts:/artifacts
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 10s
      timeout: 5s
      retries: 5

  worker:
    build:
      context: ..
      dockerfile: infra/Dockerfile.worker
    # Note: USER directive in Dockerfile handles non-root for production
    # For local dev, we don't override user to avoid volume permission issues
    env_file:
      - ../.env  # Load from project root .env file
    environment:
      - DATABASE_URL=postgresql://runtm:runtm@postgres:5432/runtm
      - REDIS_URL=redis://redis:6379
      - API_SECRET=${RUNTM_API_SECRET:?Set RUNTM_API_SECRET environment variable}
      - FLY_ORG=${FLY_ORG:-personal}
      - ARTIFACT_STORAGE_PATH=/artifacts
      - ARTIFACT_STORAGE_BACKEND=local
      - USE_REMOTE_BUILDER=true
      - DEBUG=true
      # ALLOW_LOCAL_BUILDS is intentionally NOT set - forbidden in production
      # FLY_API_TOKEN is loaded from .env via env_file above
    volumes:
      - artifacts:/artifacts
      # SECURITY: Docker socket mount removed - use remote builder instead
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
      api:
        condition: service_healthy

  postgres:
    image: postgres:15-alpine
    environment:
      - POSTGRES_USER=runtm
      - POSTGRES_PASSWORD=runtm
      - POSTGRES_DB=runtm
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U runtm"]
      interval: 5s
      timeout: 5s
      retries: 5
    ports:
      # SECURITY: Bind to localhost only - prevent external access
      - "127.0.0.1:5432:5432"

  redis:
    image: redis:7-alpine
    ports:
      # SECURITY: Bind to localhost only - prevent external access
      - "127.0.0.1:6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 5

volumes:
  artifacts:
    driver: local
  pgdata:
    driver: local