docker-compose.yml

services:
  postgres:
    image: postgres:16-alpine
    container_name: sastlink-compose-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${DB_USER:-sastlink}
      POSTGRES_PASSWORD: ${DB_PASSWORD:-change_me}
      POSTGRES_DB: ${DB_NAME:-sastlink}
    ports:
      - "127.0.0.1:${COMPOSE_DB_PORT:-15432}:5432"
    volumes:
      - postgres-data:/var/lib/postgresql/data
    # Tuned for the 1c1g deployment shape: max_connections tracks the API pool
    # (30) plus headroom, shared_buffers takes the memory the argon2id KDF leaves.
    # synchronous_commit stays on — these writes are the durability-critical path.
    command:
      - "-c"
      - "max_connections=50"
      - "-c"
      - "shared_buffers=256MB"
      - "-c"
      - "effective_cache_size=512MB"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-sastlink} -d ${DB_NAME:-sastlink}"]
      interval: 5s
      timeout: 5s
      retries: 10

  redis:
    image: redis:8-alpine
    container_name: sastlink-compose-redis
    restart: unless-stopped
    command: ["redis-server", "--requirepass", "${REDIS_PASSWORD:-change_me}"]
    ports:
      - "127.0.0.1:${COMPOSE_REDIS_PORT:-16379}:6379"
    healthcheck:
      test: ["CMD-SHELL", "redis-cli -a ${REDIS_PASSWORD:-change_me} ping | grep PONG"]
      interval: 5s
      timeout: 5s
      retries: 10

  migrate:
    build: .
    image: sastlink-api:current
    restart: "no"
    command: ["/usr/local/bin/migrate", "up"]
    environment:
      APP_ENV: development
      DB_HOST: postgres
      DB_PORT: "5432"
      DB_USER: ${DB_USER:-sastlink}
      DB_PASSWORD: ${DB_PASSWORD:-change_me}
      DB_NAME: ${DB_NAME:-sastlink}
      DB_SSLMODE: disable
      # migrate runs config.Load() which validates JWT_SECRET_KEY even though the
      # CLI never signs tokens; pass it through so validation passes.
      JWT_SECRET_KEY: ${JWT_SECRET_KEY}
      JWT_SECRET_KEY_PREV: ${JWT_SECRET_KEY_PREV}
      JWT_ACTIVE_KID: ${JWT_ACTIVE_KID:-link-v2-active}
      JWT_PREVIOUS_KID: ${JWT_PREVIOUS_KID}
      JWT_ISSUER: ${JWT_ISSUER:-http://localhost:8080}
      JWT_AUDIENCE: ${JWT_AUDIENCE:-sast-link-v2}
      REFRESH_TOKEN_HMAC_SECRET: ${REFRESH_TOKEN_HMAC_SECRET}
      OAUTH_CONSENT_URL: ${OAUTH_CONSENT_URL}
      SMTP_HOST: ${SMTP_HOST}
      SMTP_PORT: ${SMTP_PORT:-465}
      SMTP_USERNAME: ${SMTP_USERNAME}
      SMTP_PASSWORD: ${SMTP_PASSWORD}
      SMTP_FROM: ${SMTP_FROM}
      SMTP_USE_TLS: ${SMTP_USE_TLS:-true}
      SMTP_MAX_CONCURRENT: ${SMTP_MAX_CONCURRENT:-32}
      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost:3000}
    depends_on:
      postgres:
        condition: service_healthy

  api:
    image: sastlink-api:current
    restart: unless-stopped
    ports:
      - "127.0.0.1:${APP_PORT:-8080}:8080"
    environment:
      APP_ENV: ${APP_ENV:-development}
      APP_PORT: "8080"
      LOG_LEVEL: ${LOG_LEVEL:-warn}
      GOMEMLIMIT: ${GOMEMLIMIT:-900MiB}
      DB_HOST: postgres
      DB_PORT: "5432"
      DB_USER: ${DB_USER:-sastlink}
      DB_PASSWORD: ${DB_PASSWORD:-change_me}
      DB_NAME: ${DB_NAME:-sastlink}
      DB_SSLMODE: disable
      REDIS_HOST: redis
      REDIS_PORT: "6379"
      REDIS_PASSWORD: ${REDIS_PASSWORD:-change_me}
      REDIS_DB: ${REDIS_DB:-0}
      REDIS_KEY_PREFIX: ${REDIS_KEY_PREFIX:-sastlink}
      JWT_SECRET_KEY: ${JWT_SECRET_KEY}
      JWT_SECRET_KEY_PREV: ${JWT_SECRET_KEY_PREV}
      JWT_ACTIVE_KID: ${JWT_ACTIVE_KID:-link-v2-active}
      JWT_PREVIOUS_KID: ${JWT_PREVIOUS_KID}
      JWT_ISSUER: ${JWT_ISSUER:-http://localhost:8080}
      JWT_AUDIENCE: ${JWT_AUDIENCE:-sast-link-v2}
      JWT_ACCESS_TOKEN_EXPIRY: ${JWT_ACCESS_TOKEN_EXPIRY:-1h}
      JWT_REFRESH_TOKEN_EXPIRY: ${JWT_REFRESH_TOKEN_EXPIRY:-720h}
      REFRESH_TOKEN_HMAC_SECRET: ${REFRESH_TOKEN_HMAC_SECRET}
      INTERNAL_OAUTH_CLIENT_ID: ${INTERNAL_OAUTH_CLIENT_ID:-sast-link-web}
      OAUTH_CONSENT_URL: ${OAUTH_CONSENT_URL}
      OAUTH_CODE_TTL: ${OAUTH_CODE_TTL:-5m}
      OAUTH_AUTHORIZE_REQUEST_TTL: ${OAUTH_AUTHORIZE_REQUEST_TTL:-10m}
      # Third-party login: SAST Link acting as an OAuth *client*, the opposite
      # direction from the provider settings above. Both providers default to
      # off; a disabled one needs no credentials. Enabling either makes
      # OAUTH_LOGIN_REDIRECTS required, and enabling Feishu additionally
      # requires OAUTH_FEISHU_TENANT_KEY — an empty tenant key would accept
      # logins from every Lark tenant instead of the SAST enterprise.
      OAUTH_GITHUB_ENABLED: ${OAUTH_GITHUB_ENABLED:-false}
      OAUTH_GITHUB_CLIENT_ID: ${OAUTH_GITHUB_CLIENT_ID}
      OAUTH_GITHUB_CLIENT_SECRET: ${OAUTH_GITHUB_CLIENT_SECRET}
      OAUTH_GITHUB_REDIRECT_URI: ${OAUTH_GITHUB_REDIRECT_URI}
      OAUTH_FEISHU_ENABLED: ${OAUTH_FEISHU_ENABLED:-false}
      OAUTH_FEISHU_CLIENT_ID: ${OAUTH_FEISHU_CLIENT_ID}
      OAUTH_FEISHU_CLIENT_SECRET: ${OAUTH_FEISHU_CLIENT_SECRET}
      OAUTH_FEISHU_REDIRECT_URI: ${OAUTH_FEISHU_REDIRECT_URI}
      OAUTH_FEISHU_TENANT_KEY: ${OAUTH_FEISHU_TENANT_KEY}
      # Exact-match allow-list of frontend URLs a callback may return to. The
      # callback hands a login_code to whatever it redirects to, so a prefix
      # rule would let link.sast.fun.evil.test collect one.
      OAUTH_LOGIN_REDIRECTS: ${OAUTH_LOGIN_REDIRECTS}
      OAUTH_LOGIN_ERROR_REDIRECT: ${OAUTH_LOGIN_ERROR_REDIRECT}
      OAUTH_LOGIN_STATE_TTL: ${OAUTH_LOGIN_STATE_TTL:-10m}
      OAUTH_LOGIN_REGISTRATION_STATE_TTL: ${OAUTH_LOGIN_REGISTRATION_STATE_TTL:-15m}
      OAUTH_LOGIN_CODE_TTL: ${OAUTH_LOGIN_CODE_TTL:-60s}
      # Rate-limit defaults mirror .env.example so the local stack behaves like
      # the production configuration. Raise them in your .env when running
      # loadmix; leaving them wide open here makes bench results unrepresentative.
      RATE_LIMIT_LOGIN_RPM: ${RATE_LIMIT_LOGIN_RPM:-300}
      RATE_LIMIT_LOGIN_WINDOW: ${RATE_LIMIT_LOGIN_WINDOW:-15m}
      RATE_LIMIT_SEND_EMAIL_RPM: ${RATE_LIMIT_SEND_EMAIL_RPM:-3}
      RATE_LIMIT_SEND_EMAIL_IP_RPM: ${RATE_LIMIT_SEND_EMAIL_IP_RPM:-30}
      RATE_LIMIT_SEND_EMAIL_WINDOW: ${RATE_LIMIT_SEND_EMAIL_WINDOW:-60s}
      RATE_LIMIT_UNBIND_RPM: ${RATE_LIMIT_UNBIND_RPM:-3}
      RATE_LIMIT_UNBIND_WINDOW: ${RATE_LIMIT_UNBIND_WINDOW:-60s}
      RATE_LIMIT_AUTHORIZE_RPM: ${RATE_LIMIT_AUTHORIZE_RPM:-100}
      RATE_LIMIT_AUTHORIZE_WINDOW: ${RATE_LIMIT_AUTHORIZE_WINDOW:-60s}
      RATE_LIMIT_TOKEN_RPM: ${RATE_LIMIT_TOKEN_RPM:-100}
      RATE_LIMIT_TOKEN_WINDOW: ${RATE_LIMIT_TOKEN_WINDOW:-60s}
      RATE_LIMIT_REFRESH_RPM: ${RATE_LIMIT_REFRESH_RPM:-100}
      RATE_LIMIT_REFRESH_WINDOW: ${RATE_LIMIT_REFRESH_WINDOW:-60s}
      RATE_LIMIT_OAUTH_LOGIN_RPM: ${RATE_LIMIT_OAUTH_LOGIN_RPM:-100}
      RATE_LIMIT_OAUTH_LOGIN_WINDOW: ${RATE_LIMIT_OAUTH_LOGIN_WINDOW:-60s}
      RATE_LIMIT_EXCHANGE_CODE_RPM: ${RATE_LIMIT_EXCHANGE_CODE_RPM:-100}
      RATE_LIMIT_EXCHANGE_CODE_WINDOW: ${RATE_LIMIT_EXCHANGE_CODE_WINDOW:-60s}
      # Keyed by Register-Ticket, so the window must not outlive the ticket's
      # 5-minute TTL; the service refuses to start if it does.
      RATE_LIMIT_REGISTER_ATTEMPTS: ${RATE_LIMIT_REGISTER_ATTEMPTS:-5}
      RATE_LIMIT_REGISTER_WINDOW: ${RATE_LIMIT_REGISTER_WINDOW:-5m}
      RATE_LIMIT_CARD_RPM: ${RATE_LIMIT_CARD_RPM:-300}
      RATE_LIMIT_CARD_WINDOW: ${RATE_LIMIT_CARD_WINDOW:-60s}
      LOGIN_FAILURE_LIMIT: ${LOGIN_FAILURE_LIMIT:-10}
      LOGIN_FAILURE_WINDOW: ${LOGIN_FAILURE_WINDOW:-15m}
      ARGON2_CONCURRENCY: ${ARGON2_CONCURRENCY}
      ARGON2_TIME: ${ARGON2_TIME:-2}
      ARGON2_MEMORY: ${ARGON2_MEMORY:-19456}
      ARGON2_THREADS: ${ARGON2_THREADS:-1}
      # Retention sweeps run inside this process, not pg_cron. Listed here because
      # this block is a whitelist: an omitted variable cannot be overridden from .env.
      RETENTION_INTERVAL: ${RETENTION_INTERVAL:-1h}
      RETENTION_BATCH_SIZE: ${RETENTION_BATCH_SIZE:-1000}
      RETENTION_AUTHORIZATION_AGE: ${RETENTION_AUTHORIZATION_AGE:-1h}
      RETENTION_ACCESS_TOKEN_AGE: ${RETENTION_ACCESS_TOKEN_AGE:-24h}
      RETENTION_REFRESH_TOKEN_AGE: ${RETENTION_REFRESH_TOKEN_AGE:-24h}
      RETENTION_AUDIT_LOG_AGE: ${RETENTION_AUDIT_LOG_AGE:-2160h}
      SMTP_HOST: ${SMTP_HOST}
      SMTP_PORT: ${SMTP_PORT:-465}
      SMTP_USERNAME: ${SMTP_USERNAME}
      SMTP_PASSWORD: ${SMTP_PASSWORD}
      SMTP_FROM: ${SMTP_FROM}
      SMTP_USE_TLS: ${SMTP_USE_TLS:-true}
      SMTP_MAX_CONCURRENT: ${SMTP_MAX_CONCURRENT:-32}
      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost:3000}
      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1}
      HSTS_MAX_AGE: ${HSTS_MAX_AGE:-31536000}
      # Avatar upload object storage. Optional but all-or-nothing: an omitted
      # STORAGE_* set keeps PUT /user/avatar answering 50002. The audit default
      # is on and fail-closed (the bucket must have data-cos image review).
      STORAGE_ENDPOINT: ${STORAGE_ENDPOINT}
      STORAGE_REGION: ${STORAGE_REGION}
      STORAGE_BUCKET: ${STORAGE_BUCKET}
      STORAGE_ACCESS_KEY: ${STORAGE_ACCESS_KEY}
      STORAGE_SECRET_KEY: ${STORAGE_SECRET_KEY}
      STORAGE_BASE_URL: ${STORAGE_BASE_URL}
      STORAGE_AUDIT_ENABLED: ${STORAGE_AUDIT_ENABLED:-true}
      RATE_LIMIT_UPLOAD_AVATAR_RPM: ${RATE_LIMIT_UPLOAD_AVATAR_RPM:-10}
      RATE_LIMIT_UPLOAD_AVATAR_WINDOW: ${RATE_LIMIT_UPLOAD_AVATAR_WINDOW:-60s}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health | grep -q '\"status\":\"ok\"' || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  postgres-data: