docker-compose.yml

# =============================================================================
# SRS — Docker Compose (production-grade)
# =============================================================================
# ALL secrets are injected via environment variables — never hardcoded here.
#
# Quick start
# -----------
# 1. Copy .env.example → .env and fill in every required variable.
# 2. Run:  docker compose --env-file .env up -d
#
# Required env vars (must be set before running):
#   POSTGRES_PASSWORD   — strong random password for the DB superuser
#   SECRET_KEY          — 32+ char random string for JWT signing
#   OPENAI_API_KEY      — your OpenAI key
#   RESEND_API_KEY      — your Resend key (for OTP emails)
#
# Optional env vars (sensible defaults shown):
#   POSTGRES_USER                    default: srs_user
#   POSTGRES_DB                      default: srs_db
#   ENV                              default: production
#   DEBUG                            default: false
#   LOG_LEVEL                        default: INFO
#   ACCESS_TOKEN_EXPIRE_MINUTES      default: 60
#   AI_PROVIDER                      default: openai
#   OPENAI_MODEL                     default: gpt-4o-mini
#   CONFIDENCE_THRESHOLD_AUTO_RESOLVE default: 0.75
#   AUTH_RATE_LIMIT_LOGIN            default: 10/minute
#   AUTH_RATE_LIMIT_FORGOT_PASSWORD  default: 5/minute
#   SENTRY_DSN                       default: (disabled)
# =============================================================================

services:

  # ---------------------------------------------------------------------------
  # PostgreSQL
  # ---------------------------------------------------------------------------
  db:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB:       ${POSTGRES_DB:-srs_db}
      POSTGRES_USER:     ${POSTGRES_USER:-srs_user}
      # No default — compose fails loudly if this is missing.
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set. Generate with: python -c "import secrets; print(secrets.token_urlsafe(24))"}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      # - ./init.sql:/docker-entrypoint-initdb.d/init.sql
    # Bind to localhost only — DB must not be reachable from outside the
    # compose network.  Remove this ports block entirely in production.
    ports:
      - "127.0.0.1:5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-srs_user} -d ${POSTGRES_DB:-srs_db}"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # Redis (optional caching layer)
  # ---------------------------------------------------------------------------
  redis:
    image: redis:7-alpine
    command: ["redis-server", "--save", "60", "1", "--loglevel", "warning"]
    volumes:
      - redis_data:/data
    ports:
      - "127.0.0.1:6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  # ---------------------------------------------------------------------------
  # FastAPI application
  # ---------------------------------------------------------------------------
  api:
    build: .
    ports:
      - "127.0.0.1:8000:8000"
    environment:
      # ---- Database ---------------------------------------------------------
      DATABASE_URL: "postgresql://${POSTGRES_USER:-srs_user}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}@db:5432/${POSTGRES_DB:-srs_db}"

      # ---- Cache ------------------------------------------------------------
      REDIS_URL: "redis://redis:6379"

      # ---- Security ---------------------------------------------------------
      # Must be a cryptographically random string of at least 32 characters.
      # Generate with: python -c "import secrets; print(secrets.token_hex(32))"
      SECRET_KEY: "${SECRET_KEY:?SECRET_KEY must be set — generate with: python -c \"import secrets; print(secrets.token_hex(32))\"}"

      # ---- AI / Email -------------------------------------------------------
      OPENAI_API_KEY: "${OPENAI_API_KEY:?OPENAI_API_KEY must be set}"
      RESEND_API_KEY: "${RESEND_API_KEY:?RESEND_API_KEY must be set — get yours at https://resend.com}"

      # ---- Runtime ----------------------------------------------------------
      # ENV is the canonical setting name used by the app (Settings.ENV).
      # ENVIRONMENT was previously used in compose but is not read by the app.
      ENV:       "${ENV:-production}"
      DEBUG:     "${DEBUG:-false}"
      LOG_LEVEL: "${LOG_LEVEL:-INFO}"

      # ---- Auth -------------------------------------------------------------
      ACCESS_TOKEN_EXPIRE_MINUTES: "${ACCESS_TOKEN_EXPIRE_MINUTES:-60}"

      # ---- AI model config --------------------------------------------------
      AI_PROVIDER:    "${AI_PROVIDER:-openai}"
      OPENAI_MODEL:   "${OPENAI_MODEL:-gpt-4o-mini}"
      CONFIDENCE_THRESHOLD_AUTO_RESOLVE: "${CONFIDENCE_THRESHOLD_AUTO_RESOLVE:-0.75}"

      # ---- Rate limiting ----------------------------------------------------
      AUTH_RATE_LIMIT_LOGIN:           "${AUTH_RATE_LIMIT_LOGIN:-10/minute}"
      AUTH_RATE_LIMIT_FORGOT_PASSWORD: "${AUTH_RATE_LIMIT_FORGOT_PASSWORD:-5/minute}"

      # ---- Error tracking (optional) ----------------------------------------
      SENTRY_DSN: "${SENTRY_DSN:-}"

    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ---------------------------------------------------------------------------
  # Nginx reverse proxy + TLS termination
  # See docs/deployment/NGINX.md for cert setup (self-signed for local dev
  # via ./scripts/generate-dev-cert.sh, or Let's Encrypt/Certbot for prod).
  # ---------------------------------------------------------------------------
  nginx:
    image: nginx:1.27-alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./ssl:/etc/nginx/ssl:ro
    depends_on:
      api:
        condition: service_healthy
    restart: unless-stopped

volumes:
  postgres_data:
  redis_data: