docker-compose.yml

services:
  db:
    image: postgres:16
    environment:
      POSTGRES_DB: crewcaptain
      POSTGRES_USER: ${DB_USER:-crewcaptain}
      POSTGRES_PASSWORD: ${DB_PASSWORD:-changeme}
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-crewcaptain}"]
      interval: 5s
      timeout: 3s
      retries: 5

  api:
    image: ghcr.io/hechi/crewcaptain/api:latest
    ports:
      - "8080:8080"
    environment:
      DB_URL: jdbc:postgresql://db:5432/crewcaptain
      DB_USER: ${DB_USER:-crewcaptain}
      DB_PASSWORD: ${DB_PASSWORD:-changeme}
      OIDC_ISSUER_URI: ${OIDC_ISSUER_URI:-http://localhost:9000/application/o/crewcaptain/}
      OIDC_JWKS_URI: ${OIDC_JWKS_URI:-http://localhost:9000/application/o/crewcaptain/jwks/}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:-}
      METRICS_TOKEN: ${METRICS_TOKEN:-}
      AI_DEFAULT_BASE_URL: ${AI_DEFAULT_BASE_URL:-}
      AI_DEFAULT_API_KEY: ${AI_DEFAULT_API_KEY:-}
      AI_DEFAULT_MODEL: ${AI_DEFAULT_MODEL:-}
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080/actuator/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5

  frontend:
    image: ghcr.io/hechi/crewcaptain/frontend:latest
    ports:
      - "3000:3000"
    environment:
      NEXTAUTH_URL: ${NEXTAUTH_URL:-http://localhost:3000}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:-change-me-in-production}
      # Auth.js v5 refuses to infer the host from request headers in production
      # unless the host is explicitly trusted. Required for self-hosted/Docker.
      AUTH_TRUST_HOST: "true"
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-crewcaptain}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-changeme}
      OIDC_ISSUER: ${OIDC_ISSUER:-http://localhost:9000/application/o/crewcaptain/}
      # In-network address of the api service. This proxy hop is always
      # container-to-container, so it must use the compose service name — never
      # the host's localhost (which would resolve to the frontend itself).
      # For running the frontend OUTSIDE docker, see API_BASE_URL in .env.example.
      API_BASE_URL: http://api:8080
    depends_on:
      api:
        condition: service_healthy

volumes:
  pgdata: