docker-compose.yml

name: polycode

# Python and Ruff run in the browser. The backend only provides user ids,
# a network proxy for the in-browser Python, and live-share sessions.
services:
  frontend:
    build: ./frontend
    ports:
      - "${PORT:-8080}:8080"
    read_only: true
    tmpfs:
      - /tmp
    environment:
      # Into the CSP's connect-src: the browser talks to S3 directly.
      S3_PUBLIC_ORIGIN: ${S3_PUBLIC_ORIGIN:-http://localhost:9100}
      NGINX_ENVSUBST_OUTPUT_DIR: /tmp
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    depends_on:
      backend:
        condition: service_started
    restart: unless-stopped

  backend:
    build: ./backend
    environment:
      DATABASE_URL: postgres://polycode:${POSTGRES_PASSWORD:-polycode}@db:5432/polycode?sslmode=disable
      LISTEN_ADDR: ":8090"
      # Only for VPNs with "fake IP" DNS on a dev machine, e.g. 198.18.0.0/15.
      PROXY_ALLOW_CIDRS: ${PROXY_ALLOW_CIDRS:-}
      S3_ENDPOINT: s3:8333
      # What presigned URLs are signed for: the address the browser reaches.
      S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-localhost:9100}
      S3_BUCKET: polycode
      S3_ACCESS_KEY: polycode
      S3_SECRET_KEY: polycode-dev-secret
      S3_REGION: us-east-1
      S3_USE_SSL: "false"
      # Dev only: create the bucket with CORS for this origin on start.
      S3_DEV_BUCKET_ORIGIN: ${APP_ORIGIN:-http://localhost:8081}
    read_only: true
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    depends_on:
      db:
        condition: service_healthy
      s3:
        condition: service_healthy
    restart: unless-stopped

  # A local S3, for development and tests only: production names its own.
  s3:
    image: chrislusf/seaweedfs:4.05
    command: server -dir=/data -s3 -s3.port=8333 -s3.config=/etc/s3.json -volume.max=100 -master.volumeSizeLimitMB=128
    configs:
      - source: s3-identities
        target: /etc/s3.json
    ports:
      - "${S3_PORT:-9100}:8333"
    volumes:
      - s3-data:/data
    healthcheck:
      # Any HTTP answer: without a signature the gateway says 403.
      test: ["CMD-SHELL", "wget -q -S -O /dev/null http://127.0.0.1:8333/ 2>&1 | grep -q 'HTTP/'"]
      interval: 3s
      timeout: 3s
      retries: 30
    restart: unless-stopped

  db:
    image: postgres:17-alpine
    environment:
      POSTGRES_USER: polycode
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-polycode}
      POSTGRES_DB: polycode
    volumes:
      - db-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U polycode -d polycode"]
      interval: 5s
      timeout: 3s
      retries: 10
    restart: unless-stopped

configs:
  s3-identities:
    content: |
      {"identities":[{"name":"polycode","credentials":[{"accessKey":"polycode","secretKey":"polycode-dev-secret"}],"actions":["Admin","Read","List","Tagging","Write"]}]}

volumes:
  db-data:
  s3-data: