docker-compose.override.yml

# Docker Compose Override File for Security Hardening
# This file injects secrets and authenticated connection strings
# Docker Compose automatically merges this with docker-compose.prod.yml
#
# Usage:
#   docker compose -f docker-compose.prod.yml -f docker-compose.override.yml up -d

services:
  # Inject secrets into local MongoDB container (and enable auth)
  mongodb:
    env_file:
      - ./.env.secrets
    environment:
      # Mongo container expects unencoded values
      - MONGO_INITDB_ROOT_USERNAME=${MONGO_INITDB_ROOT_USERNAME}
      - MONGO_INITDB_ROOT_PASSWORD=${MONGO_INITDB_ROOT_PASSWORD}

  redis:
    env_file:
      - ./.env.secrets
    environment:
      # Override with password from .env.secrets
      - REDIS_PASSWORD=${REDIS_PASSWORD}

  # Redis Stack for local RAG vector cache (only starts with --profile local-rag)
  redis_stack:
    env_file:
      - ./.env.secrets
    environment:
      # Use same password as regular Redis for consistency
      - REDIS_PASSWORD=${REDIS_PASSWORD}

  backend:
    env_file:
      - ./.env.secrets
    environment:
      # Force backend to use local MongoDB service (credentials are URL-encoded in run-prod.sh)
      - MONGO_DETAILS=mongodb://${MONGO_INITDB_ROOT_USERNAME_ENCODED:-admin}:${MONGO_INITDB_ROOT_PASSWORD_ENCODED}@mongodb:27017/litecoin_rag_db?authSource=admin
      - MONGO_URI=mongodb://${MONGO_INITDB_ROOT_USERNAME_ENCODED:-admin}:${MONGO_INITDB_ROOT_PASSWORD_ENCODED}@mongodb:27017/litecoin_rag_db?authSource=admin
      # Redis connection with password (if set, otherwise without password)
      - REDIS_URL=redis://${REDIS_PASSWORD_ENCODED:+:${REDIS_PASSWORD_ENCODED}@}redis:6379/0
      # Redis Stack URL for local RAG vector cache (uses same password as regular Redis)
      # Internal port is 6379, external host port is 6380
      - REDIS_STACK_URL=redis://${REDIS_PASSWORD_ENCODED:+:${REDIS_PASSWORD_ENCODED}@}redis_stack:6379

  payload_cms:
    env_file:
      - ./.env.secrets
    environment:
      # Force Payload to use local MongoDB service
      - DATABASE_URI=mongodb://${MONGO_INITDB_ROOT_USERNAME_ENCODED:-admin}:${MONGO_INITDB_ROOT_PASSWORD_ENCODED}@mongodb:27017/payload_cms?authSource=admin