craftvia/docker-compose.yml

# Craftvia — lokales Dev-Compose. Härtung:
#   - F-11: alle Images auf konkrete Tags gepinnt (kein :latest / rollender Tag)
#   - F-18: Host-Ports NUR auf 127.0.0.1 gebunden; Redis mit Passwort (requirepass);
#           security_opt no-new-privileges auf allen Services.
# Für Prod/Testserver gilt docker-compose.coolify.yml (Netzsegmentierung, Limits etc.).
#
# Build-Targets (Dockerfile ist multi-stage; die LETZTE Stage ist das Garage-Image —
# ohne explizites target würde `build: .` dieses Image bauen, das weder node noch npx hat):
#   runner  → Next-Standalone-App
#   migrate → Node + tsx + src (Worker, Provisioning-/Seed-Jobs)
services:
  app:
    build:
      context: .
      target: runner
    ports:
      - "127.0.0.1:3000:3000"
    env_file: .env
    security_opt:
      - "no-new-privileges:true"
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
      garage:
        condition: service_healthy
      garage-provision:
        condition: service_completed_successfully
    restart: unless-stopped

  # Mail-Worker (BullMQ): Zustellung + täglicher Erinnerungslauf.
  worker:
    profiles: ["worker"]
    build:
      context: .
      target: migrate
    command: ["npm", "run", "worker:mail"]
    env_file: .env
    security_opt:
      - "no-new-privileges:true"
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    restart: unless-stopped

  postgres:
    image: pgvector/pgvector:0.8.0-pg16
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-craftvia}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-craftvia}
      POSTGRES_DB: ${POSTGRES_DB:-craftvia}
    volumes:
      - pgdata:/var/lib/postgresql/data
    ports:
      - "127.0.0.1:5432:5432"
    security_opt:
      - "no-new-privileges:true"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-craftvia}"]
      interval: 5s
      timeout: 5s
      retries: 10

  redis:
    image: redis:7.4.2-alpine
    # F-18: Redis mit Passwort. REDIS_URL in .env muss das Passwort tragen, z. B.
    # redis://:${REDIS_PASSWORD}@localhost:6379
    command: ["redis-server", "--requirepass", "${REDIS_PASSWORD:-craftvia-redis}"]
    volumes:
      - redisdata:/data
    ports:
      - "127.0.0.1:6379:6379"
    security_opt:
      - "no-new-privileges:true"

  # Objektspeicher: Garage (S3-kompatibel). S3-API auf 3900, Admin-API auf 3903 (nur lokal
  # gebunden). Dev-Secrets kommen aus .env (siehe .env.example).
  garage:
    image: dxflrs/garage:v1.2.0
    environment:
      GARAGE_RPC_SECRET: ${GARAGE_RPC_SECRET:-0000000000000000000000000000000000000000000000000000000000000002}
      GARAGE_ADMIN_TOKEN: ${GARAGE_ADMIN_TOKEN:-0000000000000000000000000000000000000000000000000000000000000003}
    volumes:
      - ./deploy/garage.toml:/etc/garage.toml:ro
      - garage_meta:/var/lib/garage/meta
      - garage_data:/var/lib/garage/data
    ports:
      - "127.0.0.1:3900:3900"
      - "127.0.0.1:3903:3903"
    security_opt:
      - "no-new-privileges:true"
    healthcheck:
      test: ["CMD", "/garage", "status"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 5s

  # Idempotenter Provisioning-Job (Layout + Bucket + Key + Rechte via Admin-API).
  # Läuft im migrate-Target (Node + tsx vorhanden); einmalig vor der app.
  # Alternative ohne Image-Build (Host-Node):
  #   GARAGE_ADMIN_URL=http://localhost:3903 npx tsx scripts/garage-provision.ts
  garage-provision:
    build:
      context: .
      target: migrate
    command: ["npx", "tsx", "scripts/garage-provision.ts"]
    environment:
      GARAGE_ADMIN_URL: http://garage:3903
      GARAGE_ADMIN_TOKEN: ${GARAGE_ADMIN_TOKEN:-0000000000000000000000000000000000000000000000000000000000000003}
      S3_ACCESS_KEY: ${S3_ACCESS_KEY:-GKdead0000beef0000cafe0000}
      S3_SECRET_KEY: ${S3_SECRET_KEY:-0000000000000000000000000000000000000000000000000000000000000001}
      S3_BUCKET: ${S3_BUCKET:-craftvia-documents}
      GARAGE_CAPACITY_BYTES: ${GARAGE_CAPACITY_BYTES:-10000000000}
    security_opt:
      - "no-new-privileges:true"
    depends_on:
      garage:
        condition: service_healthy
    restart: "no"

  mailhog:
    image: mailhog/mailhog:v1.0.1
    profiles: ["dev"]
    ports:
      - "127.0.0.1:1025:1025"
      - "127.0.0.1:8025:8025"
    security_opt:
      - "no-new-privileges:true"

volumes:
  pgdata:
  redisdata:
  garage_meta:
  garage_data: