docker-compose.yml

services:
  server:
    build:
      context: .
      dockerfile: packages/server/Dockerfile
      args:
        # Build-time CA certificate — base64-encoded PEM bundle (see env.example).
        # Pass via: docker compose --env-file .docker-certs.env build
        EXTRA_CA_CERTS_B64: ${EXTRA_CA_CERTS_B64:-}
    # Not exposed publicly — nginx is the only ingress point.
    # Uncomment the line below to expose the server port for local debugging:
    # ports:
    #   - "8080:8080"
    environment:
      PORT: 8080
      NODE_ENV: production
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET}
      SESSION_SECRET: ${SESSION_SECRET}
      # Must match the public URL users reach the app at (nginx origin).
      # Used for CORS and post-login redirect.
      FRONTEND_URL: ${FRONTEND_URL:-http://localhost:5174}
      CACHE_MAX_SIZE_MB: ${CACHE_MAX_SIZE_MB:-128}
      # Limit which repositories are visible (optional)
      GITHUB_ORG: ${GITHUB_ORG:-}
      GITHUB_REPOS: ${GITHUB_REPOS:-}
      GITHUB_SCOPE: ${GITHUB_SCOPE:-}
      # Trust X-Forwarded-For from nginx for accurate rate-limit key resolution
      TRUST_PROXY: "true"
      # Set to "true" only when serving over HTTPS (controls Secure cookie flag)
      COOKIE_SECURE: ${COOKIE_SECURE:-false}
      # Corporate HTTP proxy (optional — picked up automatically by EnvHttpProxyAgent)
      HTTPS_PROXY: ${HTTPS_PROXY:-}
      HTTP_PROXY: ${HTTP_PROXY:-}
      NO_PROXY: ${NO_PROXY:-}
      LOG_LEVEL: ${LOG_LEVEL:-info}
    healthcheck:
      # Uses Node's built-in fetch — no curl dependency in the minimal runtime image.
      test: ["CMD", "node", "-e", "fetch('http://localhost:8080/system/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    # Docker applies exponential backoff between restarts (up to ~100s),
    # so rapid crash loops are throttled automatically.
    restart: unless-stopped

  web:
    build:
      context: .
      dockerfile: packages/web/Dockerfile
      args:
        EXTRA_CA_CERTS_B64: ${EXTRA_CA_CERTS_B64:-}
    ports:
      - "${WEB_PORT:-5174}:80"
    depends_on:
      server:
        condition: service_healthy
    restart: unless-stopped