docker-compose.yml

version: '3.8'

# ─────────────────────────────────────────────────────────────────────────────
# Amana Docker Compose – environment-specific profiles
#
# Profiles:
#   dev      – local development (postgres + redis, persistent volume)
#   staging  – staging parity (postgres + redis, seeded synthetic data)
#   test     – CI / unit-test isolation (ephemeral in-memory postgres)
#
# Usage:
#   docker compose --profile dev     up -d
#   docker compose --profile staging up -d
#   docker compose --profile test    up -d
#
# Or use the helper scripts in scripts/:
#   ./scripts/dev-up.sh
#   ./scripts/staging-up.sh
#   ./scripts/test-up.sh
# ─────────────────────────────────────────────────────────────────────────────

x-postgres-healthcheck: &postgres-healthcheck
  test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]
  interval: 10s
  timeout: 5s
  retries: 5
  start_period: 10s

x-redis-healthcheck: &redis-healthcheck
  test: ["CMD", "redis-cli", "ping"]
  interval: 10s
  timeout: 5s
  retries: 5
  start_period: 5s

services:

  # ── Development ─────────────────────────────────────────────────────────────
  # Note: Default fallback credentials (e.g. 'password') and passwordless Redis are
  # for local isolated development only. Override passwords in non-dev environments.
  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-password} # Dev default only
      POSTGRES_DB: ${POSTGRES_DB:-amana}
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck: *postgres-healthcheck
    deploy:
      resources:
        limits:
          memory: 512M
    profiles: [dev]

  redis:
    image: redis:7-alpine
    # Note: Unsecured Redis is dev-only. Staging/prod environments mandate authentication.
    ports:
      - "${REDIS_PORT:-6379}:6379"
    healthcheck: *redis-healthcheck
    deploy:
      resources:
        limits:
          memory: 512M
    profiles: [dev]

  # ── Staging ─────────────────────────────────────────────────────────────────
  # Mirrors production topology: same images, separate named volume, locked
  # credentials sourced from .env.staging (never committed).
  postgres-staging:
    image: postgres:17-alpine
    environment:
      POSTGRES_USER: ${STAGING_POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${STAGING_POSTGRES_PASSWORD:-staging-password}
      POSTGRES_DB: ${STAGING_POSTGRES_DB:-amana_staging}
    ports:
      - "${STAGING_POSTGRES_PORT:-5434}:5432"
    volumes:
      - postgres_staging_data:/var/lib/postgresql/data
    healthcheck: *postgres-healthcheck
    deploy:
      resources:
        limits:
          memory: 512M
    profiles: [staging]

  pgbouncer-staging:
    image: pgbouncer:1.21-alpine
    command:
      - /bin/sh
      - -c
      - |
        cat > /etc/pgbouncer/pgbouncer.ini <<EOF
        [databases]
        amana_staging = host=postgres-staging port=5432 dbname=amana_staging

        [pgbouncer]
        listen_addr = 0.0.0.0
        listen_port = 6432
        auth_type = md5
        auth_file = /etc/pgbouncer/userlist.txt
        pool_mode = transaction
        max_client_conn = 100
        default_pool_size = 15
        reserve_pool_size = 5
        reserve_pool_timeout = 10
        server_idle_timeout = 600
        server_lifetime = 3600
        log_connections = 1
        log_disconnections = 1
        log_pooler_errors = 1
        stats_period = 60
        EOF
        echo "${STAGING_PGBOUNCER_USER:-postgres}:${STAGING_PGBOUNCER_PASSWORD:-staging-password}" > /etc/pgbouncer/userlist.txt
        exec pgbouncer -u pgbouncer -d /etc/pgbouncer/pgbouncer.ini
    environment:
      STAGING_PGBOUNCER_USER: ${STAGING_PGBOUNCER_USER:-postgres}
      STAGING_PGBOUNCER_PASSWORD: ${STAGING_PGBOUNCER_PASSWORD:-staging-password}
    ports:
      - "${STAGING_PGBOUNCER_PORT:-6432}:6432"
    depends_on:
      postgres-staging:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "pgbouncer", "-show", "stats"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 256M
    profiles: [staging]

  redis-staging:
    image: redis:7-alpine
    command: redis-server --requirepass ${STAGING_REDIS_PASSWORD:-staging-redis-pass}
    ports:
      - "${STAGING_REDIS_PORT:-6380}:6379"
    healthcheck: *redis-healthcheck
    deploy:
      resources:
        limits:
          memory: 512M
    profiles: [staging]

  # ── Test (CI / ephemeral) ───────────────────────────────────────────────────
  # Uses tmpfs so data never persists between test runs.
  postgres-test:
    image: postgres:17-alpine
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: password
      POSTGRES_DB: amana_test
    ports:
      - "${TEST_POSTGRES_PORT:-5433}:5432"
    tmpfs:
      - /var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 5s
    deploy:
      resources:
        limits:
          memory: 512M
    profiles: [test]

  redis-test:
    image: redis:7-alpine
    ports:
      - "${TEST_REDIS_PORT:-6381}:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 3s
    deploy:
      resources:
        limits:
          memory: 512M
    profiles: [test]

volumes:
  postgres_data:
    driver: local
  postgres_staging_data:
    driver: local