docker-compose.yml

services:
  db:
    image: postgres:14
    environment:
      POSTGRES_USER: flowscan
      POSTGRES_PASSWORD: flowscan-local
      POSTGRES_DB: flowscan
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./backend/schema_v2.sql:/docker-entrypoint-initdb.d/schema.sql
    ports:
      - "5432:5432"
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U flowscan" ]
      interval: 5s
      timeout: 5s
      retries: 5

  backend:
    build:
      context: .
      dockerfile: backend/Dockerfile
    restart: always
    environment:
      - DB_URL=postgres://flowscan:flowscan-local@db:5432/flowscan?sslmode=disable
      - FLOW_ACCESS_NODE=access-001.mainnet28.nodes.onflow.org:9000
      - FLOW_ACCESS_NODES=access-001.mainnet28.nodes.onflow.org:9000,access.mainnet.nodes.onflow.org:9000
      - PORT=8080
      - START_BLOCK=140900000
      - LATEST_WORKER_COUNT=1
      - LATEST_BATCH_SIZE=1
      - HISTORY_WORKER_COUNT=2
      - HISTORY_BATCH_SIZE=5
      - ENABLE_HISTORY_INGESTER=false
      - ENABLE_DERIVED_WRITES=false
      - ENABLE_TOKEN_WORKER=false
      - ENABLE_META_WORKER=false
      - ENABLE_DAILY_STATS=false
      - ENABLE_LOOKUP_REPAIR=false
      - FLOW_RPC_RPS=5
      - FLOW_RPC_BURST=5
      - MAX_REORG_DEPTH=1000
      - SUPABASE_DB_URL=postgres://postgres:${SUPABASE_DB_PASSWORD}@supabase-db:5432/supabase
      - SUPABASE_JWT_SECRET=${SUPABASE_JWT_SECRET}
      - SVIX_AUTH_TOKEN=${SVIX_AUTH_TOKEN:-}
      - SVIX_SERVER_URL=${SVIX_SERVER_URL:-http://svix:8071}
    ports:
      - "8080:8080"
    depends_on:
      db:
        condition: service_healthy
      supabase-db:
        condition: service_healthy

  frontend:
    build:
      context: .
      dockerfile: frontend/Dockerfile
      args:
        VITE_GOTRUE_URL: ${API_EXTERNAL_URL:-http://localhost:9999}
        VITE_SUPABASE_URL: ${VITE_SUPABASE_URL:-http://localhost:54321}
        VITE_SUPABASE_ANON: ${SUPABASE_ANON_KEY}
        VITE_PASSKEY_RP_ID: ${VITE_PASSKEY_RP_ID:-localhost}
        VITE_PASSKEY_RP_NAME: ${VITE_PASSKEY_RP_NAME:-FlowIndex Developer Portal}
    environment:
      - BACKEND_API=http://backend:8080
      - BACKEND_WS=http://backend:8080
      - DOCS_URL=http://localhost:3001
      - VITE_GOTRUE_URL=${API_EXTERNAL_URL:-http://localhost:9999}
      - GOTRUE_URL=http://supabase-auth:9999
    ports:
      - "5173:8080" # Nginx listens on 8080 inside the container
    depends_on:
      - backend
      - supabase-gateway

  wallet:
    build:
      context: .
      dockerfile: wallet/Dockerfile
      args:
        VITE_API_URL: ${VITE_API_URL:-https://flowindex.io}
        VITE_SUPABASE_URL: ${VITE_SUPABASE_URL:-http://localhost:54321}
        VITE_RP_ID: ${VITE_RP_ID:-localhost}
    ports:
      - "5174:5174"
    restart: unless-stopped
    depends_on:
      - backend
      - supabase-gateway

  # --- Supabase Auth Stack ---
  supabase-db:
    image: supabase/postgres:15.8.1.060
    environment:
      POSTGRES_PASSWORD: ${SUPABASE_DB_PASSWORD}
      POSTGRES_DB: supabase
    volumes:
      - supabase_db_data:/var/lib/postgresql/data
      - ./supabase/migrations:/docker-entrypoint-initdb.d/migrations:ro
    ports:
      - "5433:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 5

  supabase-auth:
    image: supabase/gotrue:v2.170.0
    depends_on:
      supabase-db:
        condition: service_healthy
    environment:
      GOTRUE_API_HOST: 0.0.0.0
      GOTRUE_API_PORT: 9999
      API_EXTERNAL_URL: ${API_EXTERNAL_URL:-http://localhost:9999}
      GOTRUE_DB_DRIVER: postgres
      GOTRUE_DB_DATABASE_URL: postgres://postgres:${SUPABASE_DB_PASSWORD}@supabase-db:5432/supabase?search_path=auth
      GOTRUE_SITE_URL: ${SITE_URL:-http://localhost:5173}
      GOTRUE_URI_ALLOW_LIST: ${URI_ALLOW_LIST:-http://localhost:*,https://*.flowindex.io}
      GOTRUE_JWT_SECRET: ${SUPABASE_JWT_SECRET}
      GOTRUE_JWT_EXP: 3600
      GOTRUE_DISABLE_SIGNUP: "false"
      GOTRUE_EXTERNAL_EMAIL_ENABLED: "true"
      GOTRUE_MAILER_AUTOCONFIRM: ${GOTRUE_MAILER_AUTOCONFIRM:-true}
      GOTRUE_SMTP_HOST: ${GOTRUE_SMTP_HOST:-}
      GOTRUE_SMTP_PORT: ${GOTRUE_SMTP_PORT:-465}
      GOTRUE_SMTP_USER: ${GOTRUE_SMTP_USER:-}
      GOTRUE_SMTP_PASS: ${GOTRUE_SMTP_PASS:-}
      GOTRUE_SMTP_SENDER_NAME: ${GOTRUE_SMTP_SENDER_NAME:-FlowIndex}
      GOTRUE_SMTP_ADMIN_EMAIL: ${GOTRUE_SMTP_ADMIN_EMAIL:-noreply@flowindex.io}
      GOTRUE_MAILER_URLPATHS_CONFIRMATION: /developer/callback
      # OAuth providers (set in .env.local)
      GOTRUE_EXTERNAL_GITHUB_ENABLED: ${GOTRUE_EXTERNAL_GITHUB_ENABLED:-false}
      GOTRUE_EXTERNAL_GITHUB_CLIENT_ID: ${GOTRUE_EXTERNAL_GITHUB_CLIENT_ID:-}
      GOTRUE_EXTERNAL_GITHUB_SECRET: ${GOTRUE_EXTERNAL_GITHUB_SECRET:-}
      GOTRUE_EXTERNAL_GITHUB_REDIRECT_URI: ${GOTRUE_EXTERNAL_GITHUB_REDIRECT_URI:-http://localhost:9999/callback}
      GOTRUE_EXTERNAL_GOOGLE_ENABLED: ${GOTRUE_EXTERNAL_GOOGLE_ENABLED:-false}
      GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID: ${GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID:-}
      GOTRUE_EXTERNAL_GOOGLE_SECRET: ${GOTRUE_EXTERNAL_GOOGLE_SECRET:-}
      GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI: ${GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI:-http://localhost:9999/callback}
    ports:
      - "9999:9999"

  supabase-rest:
    image: postgrest/postgrest:v12.2.8
    depends_on:
      supabase-db:
        condition: service_healthy
    environment:
      PGRST_DB_URI: postgres://postgres:${SUPABASE_DB_PASSWORD}@supabase-db:5432/supabase
      PGRST_DB_SCHEMAS: public
      PGRST_DB_ANON_ROLE: anon
      PGRST_JWT_SECRET: ${SUPABASE_JWT_SECRET}
    ports:
      - "${SUPABASE_REST_PORT:-3000}:3000"

  passkey-auth:
    image: denoland/deno:2.2.10
    depends_on:
      supabase-auth:
        condition: service_started
      supabase-rest:
        condition: service_started
    command: ["run", "--allow-net", "--allow-env", "--no-check", "/app/index.ts"]
    environment:
      SUPABASE_URL: http://supabase-gateway:8000
      SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY}
      SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_KEY}
      EVM_WALLET_FACTORY_ADDRESS: ${EVM_WALLET_FACTORY_ADDRESS:-}
      EVM_RPC_URL: ${EVM_RPC_URL:-https://mainnet.evm.nodes.onflow.org}
      DENO_NO_UPDATE_CHECK: "1"
    volumes:
      - ./supabase/functions/passkey-auth/index.ts:/app/index.ts:ro

  flow-keys:
    image: denoland/deno:2.2.10
    depends_on:
      supabase-auth:
        condition: service_started
      supabase-rest:
        condition: service_started
    command: ["run", "--allow-net", "--allow-env", "--no-check", "/app/index.ts"]
    environment:
      SUPABASE_URL: http://supabase-gateway:8000
      SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY}
      SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_KEY}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY}
      LILICO_API_KEY: ${LILICO_API_KEY:-lilico:sF60s3wughJBmNh2}
      DENO_NO_UPDATE_CHECK: "1"
    volumes:
      - ./supabase/functions/flow-keys/index.ts:/app/index.ts:ro

  runner-projects:
    image: denoland/deno:2.2.10
    depends_on:
      supabase-auth:
        condition: service_started
      supabase-rest:
        condition: service_started
    command: ["run", "--allow-net", "--allow-env", "--no-check", "/app/index.ts"]
    environment:
      SUPABASE_URL: http://supabase-gateway:8000
      SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY}
      SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_KEY}
      DENO_NO_UPDATE_CHECK: "1"
    volumes:
      - ./supabase/functions/runner-projects/index.ts:/app/index.ts:ro

  runner:
    build:
      context: .
      dockerfile: runner/Dockerfile
      args:
        VITE_AI_CHAT_URL: ${VITE_AI_CHAT_URL:-http://localhost:3004}
        VITE_SUPABASE_URL: ${VITE_SUPABASE_URL:-http://localhost:54321}
        VITE_SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY:-}
        VITE_GOTRUE_URL: ${API_EXTERNAL_URL:-http://localhost:9999}
    environment:
      PORT: 8081
      GOTRUE_URL: http://supabase-auth:9999
      SUPABASE_GATEWAY_URL: http://supabase-gateway:8000
      GITHUB_APP_ID: ${GITHUB_APP_ID:-}
      GITHUB_APP_PRIVATE_KEY: ${GITHUB_APP_PRIVATE_KEY:-}
      GITHUB_APP_CLIENT_ID: ${GITHUB_APP_CLIENT_ID:-}
      GITHUB_APP_CLIENT_SECRET: ${GITHUB_APP_CLIENT_SECRET:-}
      GITHUB_APP_SLUG: ${GITHUB_APP_SLUG:-cadence-runner}
      GITHUB_APP_WEBHOOK_SECRET: ${GITHUB_APP_WEBHOOK_SECRET:-}
      FRONTEND_URL: ${FRONTEND_URL:-http://localhost:5173}
      HTTP_PORT: ${HTTP_PORT:-3003}
    ports:
      - "8081:80"
      - "3002:3002"
      - "3003:3003"
    depends_on:
      - supabase-gateway
      - simulate

  supabase-gateway:
    image: nginx:alpine
    depends_on:
      supabase-auth:
        condition: service_started
      supabase-rest:
        condition: service_started
      passkey-auth:
        condition: service_started
      flow-keys:
        condition: service_started
      runner-projects:
        condition: service_started
    volumes:
      - ./supabase/gateway/nginx.conf:/etc/nginx/conf.d/default.conf:ro
    ports:
      - "54321:8000"

  supabase-meta:
    image: supabase/postgres-meta:v0.84.2
    depends_on:
      supabase-db:
        condition: service_healthy
    environment:
      PG_META_PORT: 8080
      PG_META_DB_HOST: supabase-db
      PG_META_DB_PORT: 5432
      PG_META_DB_NAME: supabase
      PG_META_DB_USER: postgres
      PG_META_DB_PASSWORD: ${SUPABASE_DB_PASSWORD}

  supabase-studio:
    image: supabase/studio:latest
    depends_on:
      - supabase-meta
      - supabase-rest
    environment:
      STUDIO_PG_META_URL: http://supabase-meta:8080
      SUPABASE_URL: http://supabase-rest:3000
      SUPABASE_REST_URL: http://supabase-rest:3000
      SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY}
      SUPABASE_SERVICE_KEY: ${SUPABASE_SERVICE_KEY}
      NEXT_PUBLIC_ENABLE_LOGS: "true"
      NEXT_ANALYTICS_BACKEND_PROVIDER: ""
    # No public port — accessed through studio-auth proxy

  studio-auth:
    image: nginx:alpine
    depends_on:
      - supabase-studio
    volumes:
      - ./studio/nginx.conf:/etc/nginx/conf.d/default.conf:ro
    environment:
      - STUDIO_USER=${STUDIO_USER:-admin}
      - STUDIO_PASSWORD=${STUDIO_PASSWORD:-changeme}
    entrypoint: ["/bin/sh", "-c", "htpasswd -bc /etc/nginx/.htpasswd $$STUDIO_USER $$STUDIO_PASSWORD && nginx -g 'daemon off;'"]
    ports:
      - "8000:80"

  simulator:
    build:
      context: ./simulate/emulator
      dockerfile: Dockerfile
    ports:
      - "8888:8888"
      - "3569:3569"
      - "18080:8080"
    restart: unless-stopped

  simulator-api:
    build:
      context: ./simulate/api
      dockerfile: Dockerfile
    ports:
      - "9090:9090"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - EMULATOR_URL=http://simulator:8888
      - EMULATOR_ADMIN_URL=http://simulator:8080
      - EMULATOR_GRPC_URL=simulator:3569
      - PORT=9090
      - EMULATOR_CONTAINER=simulator
      - STUCK_TIMEOUT=60
      - CORS_ORIGINS=*
    depends_on:
      - simulator
    restart: unless-stopped

  simulate:
    build:
      context: ./simulate/frontend
      dockerfile: Dockerfile
    ports:
      - "5175:3000"
    environment:
      - SIMULATOR_BACKEND_URL=http://simulator-api:9090
    depends_on:
      - simulator-api
    restart: unless-stopped

  docs:
    build:
      context: .
      dockerfile: devportal/Dockerfile
    environment:
      - PORT=8080
      - BACKEND_API_URL=http://backend:8080
    ports:
      - "3001:8080"
    depends_on:
      - backend

  alto-bundler:
    image: ghcr.io/pimlicolabs/alto:latest
    restart: unless-stopped
    ports:
      - "4337:4337"
    env_file:
      - wallet/bundler/.env
    entrypoint: ["/bin/sh", "-c"]
    command:
      - >
        node src/esm/cli/alto.js run
        --rpc-url $$ALTO_RPC_URL
        --executor-private-keys $$ALTO_EXECUTOR_PRIVATE_KEY
        --utility-private-key $$ALTO_UTILITY_PRIVATE_KEY
        --entrypoints $$ALTO_ENTRYPOINTS
        --safe-mode false
        --chain-type default
        --deploy-simulations-contract true
        --log-level debug
        --port 4337
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:4337/health"]
      interval: 30s
      timeout: 10s
      retries: 3

volumes:
  postgres_data:
  supabase_db_data: