docker-compose.yml

# Full stack: app + Postgres (persistent) + Redis (persistent).
# Secrets/config come from a sibling .env file (GITHUB_TOKEN, DEFAULT_TEAMS, OIDC_*).
services:
  app:
    build: .
    restart: unless-stopped
    ports:
      - '${APP_PORT:-3000}:3000'
    environment:
      # data sources (internal network — not the host dev ports)
      DATABASE_URL: postgres://teamhealth:${POSTGRES_PASSWORD:-teamhealth}@postgres:5432/teamhealth
      REDIS_URL: redis://redis:6379
      # GitHub
      GITHUB_TOKEN: ${GITHUB_TOKEN:?set GITHUB_TOKEN in .env}
      ALLOWED_ORGS: ${ALLOWED_ORGS:-linagora,cozy}
      DEFAULT_TEAMS: ${DEFAULT_TEAMS:-}
      GLOBAL_REPOS: ${GLOBAL_REPOS:-}
      # web
      ORIGIN: ${ORIGIN:-http://localhost:3000}
      # auth (leave AUTH_DISABLED unset / false in prod and set OIDC_*)
      AUTH_DISABLED: ${AUTH_DISABLED:-}
      OIDC_ISSUER: ${OIDC_ISSUER:-}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
      AUTH_SECRET: ${AUTH_SECRET:-}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started

  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: teamhealth
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-teamhealth}
      POSTGRES_DB: teamhealth
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U teamhealth']
      interval: 5s
      timeout: 3s
      retries: 12

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: ['redis-server', '--appendonly', 'yes']
    volumes:
      - redisdata:/data

volumes:
  pgdata:
  redisdata: