docker-compose.yml

services:
  postgres:
    image: postgres:14-alpine
    container_name: synapse-postgres
    environment:
      POSTGRES_USER: synapse
      POSTGRES_PASSWORD: synapse
      POSTGRES_DB: synapse
      POSTGRES_INITDB_ARGS: "-c wal_level=replica -c max_wal_senders=3 -c max_replication_slots=3"
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - postgres_wal:/var/lib/postgresql/wal_archive
      # Provisions the restricted synapse_app role (NOBYPASSRLS) the app
      # connects as below. Only runs on first init of an empty data volume —
      # `docker compose down -v` before `up` if the role needs (re)creating
      # on an existing volume.
      - ./scripts/db-init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U synapse"]
      interval: 5s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    container_name: synapse-redis
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 5

  vault:
    image: hashicorp/vault:latest
    container_name: synapse-vault
    ports:
      - "8200:8200"
    environment:
      VAULT_DEV_ROOT_TOKEN_ID: "root"
      VAULT_DEV_LISTEN_ADDRESS: "0.0.0.0:8200"
    cap_add:
      - IPC_LOCK
    command: server -dev

  app:
    build: .
    container_name: synapse-app
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      SERVER_PORT: 3000
      # Restricted, non-superuser role — see scripts/db-init/01-create-app-role.sql.
      # Do not point this at the bootstrap `synapse` superuser: that role has
      # BYPASSRLS and silently defeats every RLS policy in migrations/.
      DATABASE_URL: postgres://synapse_app:synapse_app@postgres:5432/synapse
      DATABASE_URL_TEMPLATE: postgres://synapse_app:{password}@postgres:5432/synapse
      # pg_dump refuses to dump FORCE ROW LEVEL SECURITY tables (transactions,
      # settlements) under synapse_app's NOBYPASSRLS role — BackupService
      # needs its own, separately-privileged connection. See
      # Config::backup_database_url and docs/postmortem-cross-tenant-leak.md.
      BACKUP_DATABASE_URL: postgres://synapse:synapse@postgres:5432/synapse
      STELLAR_HORIZON_URL: https://horizon-testnet.stellar.org
      VAULT_ADDR: http://vault:8200
      VAULT_ROLE_ID: ""
      VAULT_SECRET_ID: ""
      REDIS_URL: redis://redis:6379
    ports:
      - "3000:3000"
    volumes:
      - ./migrations:/app/migrations # optional: for live migration updates
    command: ["/app/synapse-core"]

volumes:
  postgres_data:
  postgres_wal:
  redis_data: