# ---------------------------------------------------------------------------
# Plugwerk server — minimal local/dev compose template.
#
# This file is bundled in the server distribution as a starting point. It is
# NOT production-ready as-is:
#
#   - The Postgres credentials (POSTGRES_PASSWORD, PLUGWERK_DB_PASSWORD) are
#     placeholder values. Replace them with strong secrets before any non-
#     local-dev use.
#   - PLUGWERK_AUTH_JWT_SECRET and PLUGWERK_AUTH_ENCRYPTION_KEY are passed through from
#     the host environment (`${VAR:?…}`) and fail fast if missing.
#   - The admin bootstrap password is auto-generated on first start and
#     printed to `docker compose logs plugwerk-server`; `passwordChangeRequired`
#     is set, so the operator is forced to change it on first login. To pin
#     a fixed admin password for CI/smoke-test environments, export
#     `PLUGWERK_AUTH_ADMIN_PASSWORD` in your own shell or `.env` before
#     running `docker compose up` — never commit that value.
#
# See the Docker Hub README for a guided setup (strong secret generation,
# login instructions, operational caveats).
# ---------------------------------------------------------------------------
services:
  postgres:
    image: postgres:18-alpine
    environment:
      POSTGRES_DB: plugwerk
      POSTGRES_USER: plugwerk
      POSTGRES_PASSWORD: plugwerk
    ports:
      - "127.0.0.1:5432:5432"
    volumes:
      # postgres:18+ requires the volume at /var/lib/postgresql (not /var/lib/postgresql/data)
      # so PGDATA can live in a major-version-specific subdirectory alongside config.
      # See https://github.com/docker-library/postgres/pull/1259.
      - postgres-data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U plugwerk"]
      interval: 5s
      timeout: 5s
      retries: 5

  plugwerk-server:
    image: plugwerk/plugwerk-server:${PLUGWERK_VERSION:-latest}
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PLUGWERK_DB_URL: jdbc:postgresql://postgres:5432/plugwerk
      PLUGWERK_DB_USERNAME: plugwerk
      PLUGWERK_DB_PASSWORD: plugwerk
      PLUGWERK_AUTH_JWT_SECRET: "${PLUGWERK_AUTH_JWT_SECRET:?Set PLUGWERK_AUTH_JWT_SECRET (min 32 chars)}"
      PLUGWERK_AUTH_ENCRYPTION_KEY: "${PLUGWERK_AUTH_ENCRYPTION_KEY:?Set PLUGWERK_AUTH_ENCRYPTION_KEY (min 16 chars, 32+ recommended)}"
      # PLUGWERK_AUTH_ADMIN_PASSWORD is intentionally NOT declared here.
      # If unset, the server generates a random admin password on first start
      # and forces a change on first login. Export it only for CI / smoke-test
      # environments where a deterministic password is required; the process
      # environment is picked up by Spring Boot without needing a compose entry.
    volumes:
      - plugwerk-artifacts:/var/plugwerk/artifacts
    ports:
      - "8080:8080"

volumes:
  postgres-data:
  plugwerk-artifacts:
