docker-compose.yml

# One-command run: `docker compose up --build`
#   web  -> http://localhost:3000   (React SPA)
#   api  -> http://localhost:8080   (API; Scalar UI at /scalar/v1)
#   db   -> localhost:5432          (Postgres)
# No secret literals live here — POSTGRES_PASSWORD and Jwt__SigningKey must come from .env
# (see .env.example). Demo seed passwords default to the documented throwaway values.
services:
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-widgetworks}
      POSTGRES_DB: ${POSTGRES_DB:-widgetworks}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-widgetworks}"]
      interval: 5s
      timeout: 5s
      retries: 10

  # Local mail catcher: accepts SMTP on 1025 and shows the delivered messages
  # (text AND html) at http://localhost:8025. Nothing leaves the machine.
  mailpit:
    image: axllent/mailpit
    ports:
      - "8025:8025"
      - "1025:1025"

  api:
    build:
      context: .
      dockerfile: Dockerfile.api
    environment:
      ASPNETCORE_ENVIRONMENT: Development
      Postgres__Host: db
      Postgres__Port: "5432"
      Postgres__Database: ${POSTGRES_DB:-widgetworks}
      Postgres__Username: ${POSTGRES_USER:-widgetworks}
      Postgres__Password: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
      Jwt__SigningKey: ${Jwt__SigningKey:?set Jwt__SigningKey in .env}
      Cors__AllowedOrigins: ${Cors__AllowedOrigins:-http://localhost:3000,http://localhost:5173}
      App__BaseUrl: ${App__BaseUrl:-http://localhost:3000}
      Payments__Provider: ${Payments__Provider:-Mock}
      # Optional shared secret for the mock webhook; empty means no signature required.
      Payments__Mock__WebhookSecret: ${Payments__Mock__WebhookSecret:-}
      # Stripe TEST mode only. Values come from .env / the secret store — never literals here.
      Payments__Stripe__SecretKey: ${Payments__Stripe__SecretKey:-}
      Payments__Stripe__WebhookSecret: ${Payments__Stripe__WebhookSecret:-}
      Email__Provider: ${Email__Provider:-Dev}
      # Defaults match EmailOptions, so behaviour is unchanged unless .env sets them.
      # Note UseStartTls must be false for Mailpit — port 1025 is plain SMTP.
      Email__Host: ${Email__Host:-localhost}
      Email__Port: ${Email__Port:-587}
      Email__UseStartTls: ${Email__UseStartTls:-true}
      Email__Username: ${Email__Username:-}
      Email__Password: ${Email__Password:-}
      Email__FromAddress: ${Email__FromAddress:-no-reply@widgetworks.demo}
      Email__FromName: ${Email__FromName:-WidgetWorks}
      Google__ClientId: ${Google__ClientId:-}
      Seed__DemoAdminPassword: ${Seed__DemoAdminPassword:-DemoAdmin!Change01}
      Seed__DemoCustomerPassword: ${Seed__DemoCustomerPassword:-DemoUser!Change01}
      Seed__DemoManagerPassword: ${Seed__DemoManagerPassword:-DemoManager!Change01}
    ports:
      - "8080:8080"
    depends_on:
      db:
        condition: service_healthy
      mailpit:
        condition: service_started

  web:
    build:
      context: .
      dockerfile: Dockerfile.web
      args:
        # Public build-time config (client id is public; never a secret).
        VITE_API_BASE_URL: ${VITE_API_BASE_URL:-http://localhost:8080}
        VITE_GOOGLE_CLIENT_ID: ${VITE_GOOGLE_CLIENT_ID:-}
    ports:
      - "3000:80"
    depends_on:
      - api

volumes:
  pgdata: