compose.yaml

services:
  api:
    build: .
    ports:
      - "8000:8000"
    # Allocate sufficient shared memory for Playwright headless Chromium PDF rendering
    shm_size: '1gb'
    environment:
      # DATABASE_URL uses the Compose service name 'db'. Password will be URI-percent-encoded if containing reserved characters.
      DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD}@db:5432/tasks
      SUPABASE_URL: ${SUPABASE_URL}
      SUPABASE_KEY: ${SUPABASE_KEY}
      # LLM Triage configurations (Milestone W6)
      LLM_BASE_URL: ${LLM_BASE_URL:-https://openrouter.ai/api/v1}
      LLM_API_KEY: ${LLM_API_KEY:-}
      LLM_MODEL: ${LLM_MODEL:-openrouter/free}
      LLM_STUB: ${LLM_STUB:-0}
      LLM_ENABLED: ${LLM_ENABLED:-true}
    volumes:
      # Persist generated PDF report artifacts across container lifecycles (Milestone W7b)
      - reportdata:/app/reports
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
    restart: on-failure

  db:
    image: postgres:16-alpine
    restart: always
    environment:
      # Note: POSTGRES_PASSWORD sets superuser password during volume initialization.
      # Credential Rotation: If taskdata volume already exists, updating POSTGRES_PASSWORD in .env requires running:
      #   docker compose exec db psql -U postgres -c "ALTER USER postgres WITH PASSWORD 'new_password';"
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: tasks
    ports:
      - "5432:5432"
    volumes:
      - taskdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d tasks"]
      interval: 3s
      timeout: 5s
      retries: 10

volumes:
  taskdata:
  reportdata: