compose.yaml

services:
  redis:
    image: redis:7-alpine
    command: ["redis-server", "--save", "60", "1", "--loglevel", "warning"]
    restart: unless-stopped
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5

  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-workflows}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
    restart: unless-stopped
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-workflows}",
        ]
      interval: 10s
      timeout: 3s
      retries: 5

  minio:
    image: cgr.dev/chainguard/minio
    command: ["server", "/data", "--console-address", ":9001"]
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-internal}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-change-me}
      MC_HOST_local: "http://${MINIO_ROOT_USER:-internal}:${MINIO_ROOT_PASSWORD:-change-me}@127.0.0.1:9000"
    restart: unless-stopped
    volumes:
      - minio-data:/data
    healthcheck:
      test: ["CMD-SHELL", "mc ready local || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 5

  minio-init:
    image: cgr.dev/chainguard/minio-client
    environment:
      MC_HOST_local: "http://${MINIO_ROOT_USER:-internal}:${MINIO_ROOT_PASSWORD:-change-me}@minio:9000"
    command:
      - mb
      - --ignore-existing
      - local/${MINIO_INTERNAL_BUCKET:-internal-transfers}
    depends_on:
      minio:
        condition: service_healthy
    restart: "no"

  clamav:
    image: clamav/clamav:1.4
    platform: ${CLAMAV_PLATFORM:-linux/amd64}
    restart: unless-stopped
    volumes:
      - clamav-data:/var/lib/clamav
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "tmp=$$(mktemp) && printf clean >$$tmp && clamdscan --stream --no-summary $$tmp >/dev/null 2>&1; code=$$?; rm -f $$tmp; exit $$code",
        ]
      interval: 30s
      timeout: 10s
      retries: 20
      start_period: 60s

  discord_bot:
    build:
      context: .
      dockerfile: apps/discord_bot/Dockerfile
    env_file:
      - .env
    environment:
      REDIS_URL: redis://redis:6379/0
      REDIS_QUEUE_NAME: ${REDIS_QUEUE_NAME:-jobs.default}
      POSTGRES_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-workflows}
      BACKEND_API_BASE_URL: http://web:8090
      AUDIT_API_BASE_URL: ""
    restart: unless-stopped
    networks:
      - default
      - infra
    depends_on:
      redis:
        condition: service_healthy
      postgres:
        condition: service_healthy

  web:
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    command: ["uv", "run", "--package", "api", "backend-api"]
    env_file:
      - .env
    environment:
      REDIS_URL: redis://redis:6379/0
      REDIS_QUEUE_NAME: ${REDIS_QUEUE_NAME:-jobs.default}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      POSTGRES_DB: ${POSTGRES_DB:-workflows}
      POSTGRES_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-workflows}
      JOB_MAX_ATTEMPTS: ${JOB_MAX_ATTEMPTS:-8}
      JOB_RETRY_BASE_SECONDS: ${JOB_RETRY_BASE_SECONDS:-5}
      JOB_RETRY_MAX_SECONDS: ${JOB_RETRY_MAX_SECONDS:-300}
      MINIO_ENDPOINT: http://minio:9000
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-internal}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-change-me}
      MINIO_INTERNAL_BUCKET: ${MINIO_INTERNAL_BUCKET:-internal-transfers}
      # Use '-' intentionally: an explicitly blank value means "scanner not configured",
      # allowing startup while /health reports degraded in non-local runtimes.
      INTAKE_RESUME_VIRUS_SCAN_COMMAND: ${INTAKE_RESUME_VIRUS_SCAN_COMMAND-clamdscan --stream --no-summary --config-file=/etc/clamav/clamdscan.conf}
      DISCORD_BOT_INTERNAL_BASE_URL: http://discord_bot:3000
      # Keep the container's internal listen port fixed; vary only the published
      # host port for tunnels/local multi-worktree runs.
      WEB_HOST: 0.0.0.0
      WEB_PORT: 8090
    ports:
      - "${WEB_HOST_BIND:-${WEBHOOK_INGEST_HOST_BIND:-127.0.0.1}}:${WEB_HOST_PORT:-${WEBHOOK_INGEST_HOST_PORT:-8090}}:8090"
    restart: unless-stopped
    networks:
      - default
      - infra
    depends_on:
      redis:
        condition: service_healthy
      postgres:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully

  worker:
    build:
      context: .
      dockerfile: apps/worker/Dockerfile
    command: >-
      uv run --package worker
      dramatiq five08.worker.actors
      --processes ${WORKER_PROCESSES:-1}
      --threads ${WORKER_THREADS:-8}
      -Q ${WORKER_QUEUE_NAMES:-jobs.default}
    env_file:
      - .env
    environment:
      REDIS_URL: redis://redis:6379/0
      REDIS_QUEUE_NAME: ${REDIS_QUEUE_NAME:-jobs.default}
      WORKER_API_BASE_URL: http://web:8090
      WORKER_QUEUE_NAMES: ${WORKER_QUEUE_NAMES:-jobs.default}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      POSTGRES_DB: ${POSTGRES_DB:-workflows}
      POSTGRES_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-workflows}
      JOB_MAX_ATTEMPTS: ${JOB_MAX_ATTEMPTS:-8}
      JOB_RETRY_BASE_SECONDS: ${JOB_RETRY_BASE_SECONDS:-5}
      JOB_RETRY_MAX_SECONDS: ${JOB_RETRY_MAX_SECONDS:-300}
      MINIO_ENDPOINT: http://minio:9000
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-internal}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-change-me}
      MINIO_INTERNAL_BUCKET: ${MINIO_INTERNAL_BUCKET:-internal-transfers}
      # Use '-' intentionally: an explicitly blank value means "scanner not configured",
      # allowing startup while /health reports degraded in non-local runtimes.
      INTAKE_RESUME_VIRUS_SCAN_COMMAND: ${INTAKE_RESUME_VIRUS_SCAN_COMMAND-clamdscan --stream --no-summary --config-file=/etc/clamav/clamdscan.conf}
      DISCORD_BOT_INTERNAL_BASE_URL: http://discord_bot:3000
    restart: unless-stopped
    networks:
      - default
      - infra
    depends_on:
      web:
        condition: service_started
      redis:
        condition: service_healthy
      postgres:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully

volumes:
  redis-data:
  postgres-data:
  minio-data:
  clamav-data:

networks:
  infra:
    name: ${INFRA_DOCKER_NETWORK:-508-infra}
    external: true