docker-compose.yml

name: ${COMPOSE_PROJECT_NAME:?set COMPOSE_PROJECT_NAME in the checkout-local .env}

x-backend-runtime: &backend-runtime
  profiles: ["backend"]
  build:
    context: .
    dockerfile: docker/backend/Dockerfile.dev
    args:
      LOCAL_UID: ${LOCAL_UID:-1000}
      LOCAL_GID: ${LOCAL_GID:-1000}
  image: ${COMPOSE_PROJECT_NAME}-backend:local
  init: true
  user: "${LOCAL_UID:-1000}:${LOCAL_GID:-1000}"
  environment: &backend-environment
    OPENAI_API_KEY: ${OPENAI_API_KEY:-}
    WORKSTREAM_API_RATE_LIMIT_KEY_SECRET: ${WORKSTREAM_API_RATE_LIMIT_KEY_SECRET:?set WORKSTREAM_API_RATE_LIMIT_KEY_SECRET in .env}
    WORKSTREAM_ARTIFACT_ADMISSION_DEPLOYMENT_MAXIMUM_BYTES: "4294967296"
    WORKSTREAM_ARTIFACT_ADMISSION_PRODUCER_MAXIMUM_BYTES: "268435456"
    WORKSTREAM_ARTIFACT_ADMISSION_PROJECT_MAXIMUM_BYTES: "1073741824"
    WORKSTREAM_ARTIFACT_ADMISSION_TASK_MAXIMUM_BYTES: "67108864"
    WORKSTREAM_ARTIFACT_S3_ACCESS_KEY_ID: ${WORKSTREAM_MINIO_ROOT_USER:?set WORKSTREAM_MINIO_ROOT_USER in .env}
    WORKSTREAM_ARTIFACT_S3_ADDRESSING_STYLE: path
    WORKSTREAM_ARTIFACT_S3_BUCKET: ${WORKSTREAM_ARTIFACT_S3_BUCKET:-workstream-local}
    WORKSTREAM_ARTIFACT_S3_CREDENTIAL_MODE: local_static
    WORKSTREAM_ARTIFACT_S3_ENDPOINT_URL: http://minio:9000
    WORKSTREAM_ARTIFACT_S3_PRIVATE_PREFIX: artifacts
    WORKSTREAM_ARTIFACT_S3_PROVIDER_PROFILE: minio
    WORKSTREAM_ARTIFACT_S3_REGION: us-east-1
    WORKSTREAM_ARTIFACT_S3_SECRET_ACCESS_KEY: ${WORKSTREAM_MINIO_ROOT_PASSWORD:?set WORKSTREAM_MINIO_ROOT_PASSWORD in .env}
    WORKSTREAM_ARTIFACT_SCRATCH_ROOT: /workspace/scratch/artifacts
    WORKSTREAM_ARTIFACT_STORE_BACKEND: s3_compatible
    WORKSTREAM_AUTH_PROVIDER: flow
    WORKSTREAM_CELERY_BROKER_URL: redis://redis:6379/0
    WORKSTREAM_DATABASE_URL: ${WORKSTREAM_DATABASE_URL:?set WORKSTREAM_DATABASE_URL in .env}
    WORKSTREAM_DEBUG: "true"
    WORKSTREAM_ENVIRONMENT: local
    WORKSTREAM_FLOW_AUTH_AUDIENCE: ${WORKSTREAM_FLOW_AUTH_AUDIENCE:-workstream-local-pilot}
    WORKSTREAM_FLOW_AUTH_ISSUER: ${WORKSTREAM_FLOW_AUTH_ISSUER:-https://flow.local/pilot}
    WORKSTREAM_FLOW_AUTH_LOCAL_HMAC_SECRET: ${WORKSTREAM_FLOW_AUTH_LOCAL_HMAC_SECRET:?set WORKSTREAM_FLOW_AUTH_LOCAL_HMAC_SECRET in .env}
    WORKSTREAM_PAGINATION_CURSOR_HMAC_SECRET: ${WORKSTREAM_PAGINATION_CURSOR_HMAC_SECRET:?set WORKSTREAM_PAGINATION_CURSOR_HMAC_SECRET in .env}
    WORKSTREAM_PROJECT_AGENT_MODEL: ${WORKSTREAM_PROJECT_AGENT_MODEL:-gpt-5.6-terra}
  volumes:
    - ./backend:/workspace/backend
    - workstream_scratch_data:/workspace/scratch

services:
  backend:
    <<: *backend-runtime
    command:
      - /bin/sh
      - -c
      - |
        set -eu
        python scripts/ensure_local_minio_bucket.py
        python -m alembic upgrade head
        exec python -m uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload
    ports:
      - "127.0.0.1:${WORKSTREAM_API_HOST_PORT:-8000}:8000"
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - >-
          import urllib.request;
          urllib.request.urlopen('http://127.0.0.1:8000/api/v1/health', timeout=2)
      interval: 5s
      timeout: 3s
      retries: 20
      start_period: 15s

  worker:
    <<: *backend-runtime
    command:
      - python
      - -m
      - celery
      - -A
      - app.workers.celery_app
      - worker
      - --pool=prefork
      - --concurrency=${WORKSTREAM_CELERY_WORKER_CONCURRENCY:-2}
      - --hostname=worker@%h
      - --pidfile=/tmp/celery-worker.pid
      - --loglevel=INFO
    depends_on:
      backend:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
    healthcheck:
      test:
        - CMD-SHELL
        - test -s /tmp/celery-worker.pid && kill -0 "$$(cat /tmp/celery-worker.pid)"
      interval: 10s
      timeout: 8s
      retries: 12
      start_period: 20s

  beat:
    <<: *backend-runtime
    command:
      - python
      - -m
      - celery
      - -A
      - app.workers.celery_app
      - beat
      - --schedule=/workspace/scratch/celerybeat-schedule
      - --pidfile=/tmp/celerybeat.pid
      - --loglevel=INFO
    depends_on:
      backend:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
    healthcheck:
      test:
        - CMD-SHELL
        - test -s /tmp/celerybeat.pid && kill -0 "$$(cat /tmp/celerybeat.pid)"
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 15s

  postgres:
    image: public.ecr.aws/docker/library/postgres:16@sha256:33f923b05f64ca54ac4401c01126a6b92afe839a0aa0a52bc5aeb5cc958e5f20
    environment:
      POSTGRES_DB: workstream
      POSTGRES_USER: workstream
      POSTGRES_PASSWORD: ${WORKSTREAM_POSTGRES_PASSWORD:?set WORKSTREAM_POSTGRES_PASSWORD in .env}
    ports:
      - "127.0.0.1:${WORKSTREAM_POSTGRES_HOST_PORT:-5433}:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U workstream -d workstream"]
      interval: 5s
      timeout: 5s
      retries: 10
    volumes:
      - workstream_postgres_uuid7_data:/var/lib/postgresql/data
      - ./docker/postgres/init:/docker-entrypoint-initdb.d:ro

  redis:
    image: redis:7@sha256:b2b95679e3b46fb51864949ed25ea976fc3a6bcc00a40a1bc00d568cb2822e50
    ports:
      - "127.0.0.1:${WORKSTREAM_REDIS_HOST_PORT:-6379}:6379"
    volumes:
      - workstream_redis_uuid7_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 10

  minio:
    image: ${COMPOSE_PROJECT_NAME}-minio:source
    pull_policy: build
    build:
      context: docker/minio
      dockerfile: Dockerfile
    command: server /data --address :9000 --console-address :9001
    environment:
      MINIO_ROOT_USER: ${WORKSTREAM_MINIO_ROOT_USER:?set WORKSTREAM_MINIO_ROOT_USER in .env}
      MINIO_ROOT_PASSWORD: ${WORKSTREAM_MINIO_ROOT_PASSWORD:?set WORKSTREAM_MINIO_ROOT_PASSWORD in .env}
    ports:
      - "127.0.0.1:${WORKSTREAM_MINIO_API_HOST_PORT:-9000}:9000"
      - "127.0.0.1:${WORKSTREAM_MINIO_CONSOLE_HOST_PORT:-9001}:9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/ready"]
      interval: 5s
      timeout: 5s
      retries: 20
    volumes:
      - workstream_minio_data:/data

volumes:
  workstream_postgres_uuid7_data:
  workstream_redis_uuid7_data:
  workstream_minio_data:
  workstream_scratch_data: