docker-compose.yml

version: '3.8'

# Required environment variables — set these in a .env file or via your CI/CD
# secrets manager before running docker-compose up.
#
#   DB_PASS=<strong-password>          (required)
#   JWT_SECRET=<min-32-char-secret>    (required)
#   NIOFLOW_CORS_ORIGIN=https://yourdomain.com  (required)

services:
  app:
    build: .
    ports:
      - "8080:8080"
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    environment:
      - JDBC_URL=jdbc:postgresql://db:5432/nioflow
      - DB_USER=postgres
      # :? means Docker Compose will fail immediately if this variable is unset or empty
      - DB_PASS=${DB_PASS:?DB_PASS is required. Set it in .env or as an env var.}
      - NIOFLOW_ENABLE_DB=true
      - NIOFLOW_CORS_ORIGIN=${NIOFLOW_CORS_ORIGIN:?NIOFLOW_CORS_ORIGIN is required (e.g. https://yourdomain.com).}
      - JWT_SECRET=${JWT_SECRET:?JWT_SECRET is required and must be at least 32 characters.}
      - NIOFLOW_TRACING_ENABLED=true
      - OTEL_EXPORTER_OTLP_ENDPOINT=http://jaeger:4317
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/_ready >/dev/null || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 20s
    depends_on:
      db:
        condition: service_healthy
    networks:
      - nioflow-net

  db:
    image: postgres:15-alpine
    environment:
      - POSTGRES_DB=nioflow
      - POSTGRES_PASSWORD=${DB_PASS:?DB_PASS is required.}
    # Port 5432 is intentionally NOT exposed to the host.
    # The app container reaches the DB over the internal nioflow-net network.
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./init-db.sql:/docker-entrypoint-initdb.d/init-db.sql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - nioflow-net

  jaeger:
    image: jaegertracing/all-in-one:latest
    ports:
      - "16686:16686" # UI
      - "4317:4317"   # OTLP gRPC
      - "4318:4318"   # OTLP HTTP
    networks:
      - nioflow-net

networks:
  nioflow-net:
    driver: bridge

volumes:
  postgres_data: