docker-compose.yml

# Mongo root credentials (P4-02). Defaults keep `docker compose up` and the CI
# smoke test bootable without a local .env.docker; override both in any real
# deployment. Auth is enforced because MONGO_INITDB_ROOT_* is set — note that it
# only takes effect on a FRESH `mongo_data` volume (`docker compose down -v`).
#
# Shared resource limits + log rotation. Each service merges these with ONE key:
#   <<: [*resource-limits, *logging]
# (never two `<<:` keys, never a merge key inside a sequence).
x-resource-limits: &resource-limits
  deploy:
    resources:
      limits:
        cpus: "1.0"
        memory: 1G
      reservations:
        cpus: "0.25"
        memory: 256M

x-logging: &logging
  logging:
    driver: json-file
    options:
      max-size: "10m"
      max-file: "3"

# Shared runtime env for the API and the BullMQ workers (kept in a single
# anchor so worker services stay in lock-step with `app`).
x-worker-env: &worker-env
  MONGO_URI: mongodb://${MONGO_INITDB_ROOT_USERNAME:-navin}:${MONGO_INITDB_ROOT_PASSWORD:-navin-dev-password}@mongo:27017/navin_dev?authSource=admin
  REDIS_URL: redis://redis:6379
  JWT_SECRET: ${JWT_SECRET:-dev-secret-key-replace-in-prod-min-32-chars}

services:
  mongo:
    <<: [*resource-limits, *logging]
    image: mongo:6.0
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGO_INITDB_ROOT_USERNAME:-navin}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_INITDB_ROOT_PASSWORD:-navin-dev-password}
    ports:
      - "127.0.0.1:27017:27017"
    volumes:
      - mongo_data:/data/db
    restart: unless-stopped
    healthcheck:
      # Authenticated probe: fails if auth is misconfigured, not just if mongod is down.
      test: ["CMD-SHELL", "mongosh --quiet -u \"$$MONGO_INITDB_ROOT_USERNAME\" -p \"$$MONGO_INITDB_ROOT_PASSWORD\" --authenticationDatabase admin --eval \"db.adminCommand('ping').ok\" | grep -q 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  redis:
    <<: [*resource-limits, *logging]
    image: redis:7-alpine
    # Durability (H2.4): AOF persistence + named volume so BullMQ jobs
    # (transaction_queue anchors, alert_queue alerts) survive container restarts.
    command: ["redis-server", "--appendonly", "yes"]
    ports:
      - "127.0.0.1:6379:6379"
    volumes:
      - redis_data:/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s

  # One-shot schema migrations (see TODO H2.1, docs/DATABASE.md §3).
  # Runs `migrate:up` to completion before app/workers start; re-runs are a
  # no-op via the `changelog` collection. Deliberately UNTAGGED (no profiles):
  # profile-gating a hard startup dependency breaks plain `docker compose up`
  # on compose versions that don't auto-resolve profiled dependencies, and
  # `required: false` would silently skip migrations — the drift this prevents.
  migrate:
    <<: [*resource-limits, *logging]
    build: .
    image: navin-backend:local
    command: ["npm", "run", "migrate:up"]
    env_file:
      - path: .env.docker
        required: false
    environment:
      MONGO_URI: mongodb://${MONGO_INITDB_ROOT_USERNAME:-navin}:${MONGO_INITDB_ROOT_PASSWORD:-navin-dev-password}@mongo:27017/navin_dev?authSource=admin
    depends_on:
      mongo:
        condition: service_healthy
    # One-shot: no restart policy, no ports, no app healthcheck.
    # `MONGO_URI` must stay in lock-step with `app`/workers (P4-02 auth change).
    healthcheck:
      disable: true

  app:
    <<: [*resource-limits, *logging]
    build: .
    image: navin-backend:local
    ports:
      - "3000:3000"
    # Optional: copy .env.docker.example to .env.docker and override secrets locally.
    # Compose does not set NODE_ENV — the image defaults to production (#499).
    env_file:
      - path: .env.docker
        required: false
    environment:
      <<: *worker-env
      PORT: "3000"
    depends_on:
      mongo:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  # Dedicated Stellar anchor worker (see docs/adr-worker-topology.md).
  # No ports published — communicates with infra over the compose network only.
  stellar-worker:
    <<: [*resource-limits, *logging]
    build: .
    image: navin-backend-worker:local
    command: ["node", "dist/src/workers/stellar.worker.js"]
    env_file:
      - path: .env.docker
        required: false
    environment:
      <<: *worker-env
    depends_on:
      mongo:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    restart: unless-stopped
    # Worker containers do not listen on 3000 — disable the app image's
    # inherited healthcheck (only `app` should probe /api/health).
    healthcheck:
      disable: true

  # Dedicated Stellar confirmation indexer worker (see docs/adr-worker-topology.md).
  # No ports published — communicates with infra over the compose network only.
  stellar-indexer:
    <<: [*resource-limits, *logging]
    build: .
    image: navin-backend-indexer:local
    command: ["node", "dist/src/workers/stellar-indexer.worker.js"]
    env_file:
      - path: .env.docker
        required: false
    environment:
      <<: *worker-env
    depends_on:
      mongo:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    restart: unless-stopped
    # Worker containers do not listen on 3000 — disable the app image's
    # inherited healthcheck (only `app` should probe /api/health).
    healthcheck:
      disable: true

volumes:
  mongo_data:
  redis_data: