compose.yaml

services:
  spoolstore:
    image: spoolstore
    build:
      context: apps/store
      dockerfile: ./Dockerfile
    environment:
      NODE_ENV: production
      STORE_DB_HOST: postgres
      STORE_DB_PORT: "5432"
      STORE_DB_USER: spool
      STORE_DB_PASSWORD: spool_dev
      STORE_DB_NAME: spool
      # Meridian IDEA-85: local-filesystem artifact blob storage on a Docker-named-volume,
      # accessed exclusively through the ArtifactBlobStore port (G08).
      ARTIFACT_BLOB_STORE_PATH: /usr/src/app/artifact-data
      # Real GitHub OAuth App credentials (see repo-root .env, gitignored) — used for the full
      # authorization-code flow (authorize redirect + token exchange + user lookup) against real
      # github.com/api.github.com, since GITHUB_OAUTH_TOKEN_URL/GITHUB_USER_API_URL are unset below.
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET}
      # GITHUB_OAUTH_TOKEN_URL/GITHUB_USER_API_URL intentionally left unset here so
      # auth-config.ts's defaults (real github.com/api.github.com) are used, allowing a genuine
      # end-to-end OAuth login test against a real GitHub OAuth App.
      # auth-config.ts's default redirect_uri assumes the store's own listen port (3000), but
      # this service is only reachable from the host via the published port below (3002:3000).
      # Without this override, the redirect_uri sent to GitHub (and echoed back in the token
      # exchange) points at the wrong port and login/token-exchange fails.
      GITHUB_OAUTH_REDIRECT_URI: http://localhost:3002/auth/github/callback
      # Bootstrap stakeholder (role='system') identity, sourced from the host's git config by
      # tools/docker/seed-admin-env.sh into repo-root .env before `docker compose up`. Falls
      # back to migrator.ts's built-in placeholder defaults when unset. Seeded only once — an
      # already-existing bootstrap stakeholder is never overwritten (see migrator.ts).
      ADMIN_STAKEHOLDER_NAME: ${ADMIN_STAKEHOLDER_NAME:-}
      ADMIN_STAKEHOLDER_EMAIL: ${ADMIN_STAKEHOLDER_EMAIL:-}
      # webhook-receiver-stub (and NODE_EXTRA_CA_CERTS to trust it) is not run by this compose
      # file; use compose.debug.yaml to exercise DeliveryWorkerService's outbound TLS handshake
      # against it.
    ports:
      - 3002:3000
    volumes:
      - spoolstore-artifact-data:/usr/src/app/artifact-data
    depends_on:
      postgres:
        condition: service_healthy

  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: spool
      POSTGRES_PASSWORD: spool_dev
      POSTGRES_DB: spool
    ports:
      # Host-side integration tests connect via localhost:5433; the store
      # container connects over the compose network at postgres:5432.
      - 5433:5432
    volumes:
      - spoolstore-postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U spool -d spool"]
      interval: 5s
      timeout: 5s
      retries: 10

volumes:
  spoolstore-postgres-data:
  spoolstore-artifact-data: