docker-compose.yml

services:
  # ── PIA VPN gateway (only active with: docker compose --profile vpn up) ──────
  # Feature flag: set VPN_ENABLED=true in backend/.env AND run with --profile vpn
  gluetun:
    profiles: [vpn]
    image: qmcgaw/gluetun:latest
    container_name: streambridge_gluetun
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - "8888:8888"   # HTTP proxy (used by backend when VPN_ENABLED=true)
      - "8000:8000"   # gluetun control API (used by VPN rotation job)
    environment:
      VPN_SERVICE_PROVIDER: private internet access
      VPN_TYPE: wireguard
      # Keep these optional so plain local `docker compose up` works without VPN creds.
      # When the `vpn` profile is enabled, provide real values via env or `.env`.
      PRIVATE_INTERNET_ACCESS_USER: ${PIA_USERNAME:-}
      PRIVATE_INTERNET_ACCESS_PASSWORD: ${PIA_PASSWORD:-}
      SERVER_REGIONS: ${PIA_SERVER_REGIONS:-US East}
      HTTPPROXY: on
      HTTPPROXY_LOG: off
      HTTPPROXY_LISTENING_ADDRESS: :8888
      HTTP_CONTROL_SERVER_ADDRESS: :8000
      HTTP_CONTROL_SERVER_LOG: off
      UPDATER_PERIOD: 24h
    healthcheck:
      test: ["CMD", "/gluetun-entrypoint", "healthcheck"]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 20s

  # ── Redis (required by Twenty CRM's BullMQ workers) ───────────────────────────
  redis:
    image: redis:7-alpine
    container_name: streambridge_redis
    restart: unless-stopped
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5

  # ── Twenty CRM Server ─────────────────────────────────────────────────────────
  twenty:
    image: twentycrm/twenty:latest
    container_name: streambridge_twenty
    restart: unless-stopped
    ports:
      - "3002:3000"
    environment:
      PORT: 3000
      PG_DATABASE_URL: postgresql://postgres:streambridge_dev@postgres:5432/twentycrm
      REDIS_URL: redis://redis:6379
      SERVER_URL: ${TWENTY_SERVER_URL:-http://localhost:3002}
      ACCESS_TOKEN_SECRET: ${TWENTY_ACCESS_TOKEN_SECRET:-changeme-access}
      LOGIN_TOKEN_SECRET: ${TWENTY_LOGIN_TOKEN_SECRET:-changeme-login}
      REFRESH_TOKEN_SECRET: ${TWENTY_REFRESH_TOKEN_SECRET:-changeme-refresh}
      FILE_TOKEN_SECRET: ${TWENTY_FILE_TOKEN_SECRET:-changeme-file}
      STORAGE_TYPE: local
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy

  # ── Twenty CRM Background Worker ──────────────────────────────────────────────
  twenty-worker:
    image: twentycrm/twenty:latest
    container_name: streambridge_twenty_worker
    restart: unless-stopped
    command: ["yarn", "worker:prod"]
    environment:
      PG_DATABASE_URL: postgresql://postgres:streambridge_dev@postgres:5432/twentycrm
      REDIS_URL: redis://redis:6379
      ACCESS_TOKEN_SECRET: ${TWENTY_ACCESS_TOKEN_SECRET:-changeme-access}
      LOGIN_TOKEN_SECRET: ${TWENTY_LOGIN_TOKEN_SECRET:-changeme-login}
      REFRESH_TOKEN_SECRET: ${TWENTY_REFRESH_TOKEN_SECRET:-changeme-refresh}
      FILE_TOKEN_SECRET: ${TWENTY_FILE_TOKEN_SECRET:-changeme-file}
      SERVER_URL: ${TWENTY_SERVER_URL:-http://localhost:3002}
    depends_on:
      - twenty
      - redis

  postgres:
    image: postgres:16-alpine
    container_name: streambridge_db
    restart: unless-stopped
    environment:
      POSTGRES_DB: streambridge
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: streambridge_dev
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d streambridge"]
      interval: 5s
      timeout: 5s
      retries: 10

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: streambridge_backend
    restart: unless-stopped
    ports:
      - "3001:3001"
    env_file:
      - ./backend/.env
    environment:
      DATABASE_URL: postgresql://postgres:streambridge_dev@postgres:5432/streambridge
      PORT: 3001
      NODE_ENV: production
      # Set BASE_URL to your public backend URL (e.g. https://api.yourdomain.com)
      BASE_URL: ${BASE_URL:-http://localhost:3001}
      # Set FRONTEND_URL to your public frontend URL (e.g. https://yourdomain.com)
      FRONTEND_URL: ${FRONTEND_URL:-http://localhost:3000}
      # ── VPN feature flag ────────────────────────────────────────────────────
      # Set to "true" AND run with --profile vpn to enable PIA VPN routing
      VPN_ENABLED: ${VPN_ENABLED:-false}
      # Proxy URL (only used when VPN_ENABLED=true; gluetun must be running)
      GLOBAL_AGENT_HTTP_PROXY: http://gluetun:8888
      GLOBAL_AGENT_NO_PROXY: localhost,127.0.0.1,postgres
      GLUETUN_CONTROL_URL: http://gluetun:8000
      VPN_ROTATION_HOURS: ${VPN_ROTATION_HOURS:-6}
    depends_on:
      postgres:
        condition: service_healthy

  frontend:
    build:
      context: ./frontend-next
      dockerfile: Dockerfile
      args:
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3001}
    container_name: streambridge_frontend
    restart: unless-stopped
    ports:
      - "3000:3000"
    depends_on:
      - backend

volumes:
  postgres_data: