docker-compose.yml

# ScreenCraft Development Environment
# Usage: docker-compose up -d
#
# C-04: Security - Use environment variables for credentials
# For development: Copy .env.example to .env and customize
# Credentials are read from environment variables with dev defaults
version: '3.9'

services:
  # PostgreSQL Database
  postgres:
    image: postgres:16-alpine
    container_name: screencraft-postgres
    environment:
      POSTGRES_DB: screencraft
      POSTGRES_USER: screencraft
      # C-04: Use env var with dev fallback (production should set POSTGRES_PASSWORD)
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-screencraft_dev_password}
      POSTGRES_INITDB_ARGS: "-E UTF8"
    ports:
      # C-04: Bind to localhost only for security
      - "127.0.0.1:5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - screencraft
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U screencraft"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Redis Cache & Queue
  redis:
    image: redis:7-alpine
    container_name: screencraft-redis
    # C-04: Add Redis authentication in production (M-13)
    command: redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy allkeys-lru ${REDIS_PASSWORD:+--requirepass $REDIS_PASSWORD}
    ports:
      # C-04: Bind to localhost only for security
      - "127.0.0.1:6379:6379"
    volumes:
      - redis_data:/data
    networks:
      - screencraft
    restart: unless-stopped
    healthcheck:
      # M-13: Use auth for healthcheck when REDIS_PASSWORD is set
      test: ["CMD-SHELL", "redis-cli ${REDIS_PASSWORD:+-a $REDIS_PASSWORD} ping | grep PONG"]
      interval: 10s
      timeout: 3s
      retries: 5

  # MinIO Object Storage
  minio:
    # C-07: Pin to specific version (not :latest)
    image: minio/minio:RELEASE.2024-01-16T16-07-38Z
    container_name: screencraft-minio
    command: server /data --console-address ":9001"
    environment:
      # C-04: Use env vars with dev defaults
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin123}
    ports:
      # C-04: Bind to localhost only for security
      - "127.0.0.1:9000:9000"
      - "127.0.0.1:9001:9001"
    volumes:
      - minio_data:/data
    networks:
      - screencraft
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 30s
      timeout: 20s
      retries: 3

  # MinIO Bucket Initialization
  minio-init:
    # C-07: Pin to specific version
    image: minio/mc:RELEASE.2024-01-16T02-45-38Z
    container_name: screencraft-minio-init
    depends_on:
      minio:
        condition: service_healthy
    environment:
      # C-04: Pass credentials via environment
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin123}
    entrypoint: >
      /bin/sh -c "
      mc alias set myminio http://minio:9000 $$MINIO_ROOT_USER $$MINIO_ROOT_PASSWORD;
      mc mb myminio/screenshots --ignore-existing;
      mc anonymous set download myminio/screenshots;
      exit 0;
      "
    networks:
      - screencraft

  # API Backend
  api:
    build:
      context: ./api
      dockerfile: Dockerfile
      target: development
    container_name: screencraft-api
    env_file:
      - ./api/.env
    environment:
      NODE_ENV: development
      PORT: 3000
      HOST: 0.0.0.0
      # C-04: Use env vars with dev defaults
      DATABASE_URL: postgresql://screencraft:${POSTGRES_PASSWORD:-screencraft_dev_password}@postgres:5432/screencraft
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
      MINIO_ENDPOINT: minio
      MINIO_PORT: 9000
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin123}
      MINIO_BUCKET: screenshots
      MINIO_USE_SSL: false
      LOG_LEVEL: debug
      LOG_PRETTY: true
      CORS_ORIGIN: http://localhost:4321,http://localhost:3001
    ports:
      - "3000:3000"
    volumes:
      - ./api/src:/app/src
      - ./api/prisma:/app/prisma
      - /app/node_modules
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
    networks:
      - screencraft
    restart: unless-stopped
    command: npm run dev
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=PathPrefix(`/v1`) || PathPrefix(`/api`) || PathPrefix(`/auth`) || PathPrefix(`/admin-api`)"
      - "traefik.http.routers.api.entrypoints=web"
      - "traefik.http.routers.api.priority=10"
      - "traefik.http.services.api.loadbalancer.server.port=3000"

  # BullMQ Worker
  worker:
    build:
      context: ./api
      dockerfile: Dockerfile
      target: development
    container_name: screencraft-worker
    env_file:
      - ./api/.env
    environment:
      NODE_ENV: development
      # C-04: Use env vars with dev defaults
      DATABASE_URL: postgresql://screencraft:${POSTGRES_PASSWORD:-screencraft_dev_password}@postgres:5432/screencraft
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
      MINIO_ENDPOINT: minio
      MINIO_PORT: 9000
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin123}
      MINIO_BUCKET: screenshots
      MINIO_USE_SSL: false
      LOG_LEVEL: debug
      LOG_PRETTY: true
      PLAYWRIGHT_TIMEOUT: 30000
      PLAYWRIGHT_NAVIGATION_TIMEOUT: 30000
      MAX_CONCURRENT_BROWSERS: 3
    volumes:
      - ./api/src:/app/src
      - ./api/prisma:/app/prisma
      - /app/node_modules
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
    networks:
      - screencraft
    restart: unless-stopped
    command: npm run worker:dev

  # Frontend (Astro)
  web:
    build:
      context: ./web
      dockerfile: Dockerfile
      target: development
    container_name: screencraft-web
    environment:
      NODE_ENV: development
      # Empty = same-origin, Traefik handles /api/ routing
      PUBLIC_API_URL: ""
    ports:
      - "4321:4321"
    volumes:
      - ./web/src:/app/src
      - ./web/public:/app/public
      - /app/node_modules
    networks:
      - screencraft
    restart: unless-stopped
    command: npm run dev -- --host 0.0.0.0
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.web.rule=PathPrefix(`/`)"
      - "traefik.http.routers.web.entrypoints=web"
      - "traefik.http.routers.web.priority=1"
      - "traefik.http.services.web.loadbalancer.server.port=4321"

  # C-06: Docker Socket Proxy for Traefik (security layer)
  docker-socket-proxy:
    image: tecnativa/docker-socket-proxy:0.1.1
    container_name: screencraft-socket-proxy
    environment:
      # Only allow container listing (minimal permissions)
      CONTAINERS: 1
      SERVICES: 0
      TASKS: 0
      NETWORKS: 0
      NODES: 0
      VOLUMES: 0
      SECRETS: 0
      CONFIGS: 0
      SWARM: 0
      BUILD: 0
      COMMIT: 0
      EXEC: 0
      IMAGES: 0
      INFO: 0
      POST: 0
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - screencraft
    restart: unless-stopped
    # C-08: Container security options
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true

  # Traefik Reverse Proxy
  traefik:
    image: traefik:v3.2
    container_name: screencraft-traefik
    command:
      - "--api.dashboard=false"
      - "--api.insecure=false"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
    ports:
      - "80:80"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - screencraft
    restart: unless-stopped

networks:
  screencraft:
    driver: bridge

volumes:
  postgres_data:
  redis_data:
  minio_data: