# NABDH | نَبْض — local stack.
#
#   docker compose up --build
#
# Brings up PostgreSQL and the application, syncs the schema and seeds the demonstration
# grid. The console is then on http://localhost:3000.

services:
  postgres:
    image: postgres:17-alpine
    container_name: nabdh-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-nabdh}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-nabdh_local_password}
      POSTGRES_DB: ${POSTGRES_DB:-nabdh}
    volumes:
      - nabdh-postgres:/var/lib/postgresql/data
    # Not published by default: only the app needs it, and an exposed database port is
    # the most common way a demo stack ends up reachable from the network.
    expose:
      - '5432'
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER:-nabdh} -d ${POSTGRES_DB:-nabdh}']
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 10s

  web:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: nabdh-web
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      NODE_ENV: production
      DATABASE_PROVIDER: postgresql
      DATABASE_URL: postgresql://${POSTGRES_USER:-nabdh}:${POSTGRES_PASSWORD:-nabdh_local_password}@postgres:5432/${POSTGRES_DB:-nabdh}?schema=public
      # Override in a .env file beside this compose file. The default is a local
      # placeholder and must not be used anywhere reachable.
      AUTH_SECRET: ${AUTH_SECRET:-local-compose-secret-change-me-0123456789abcdef}
      AUTH_SESSION_TTL_HOURS: '8'
      DEMO_ACCOUNTS_ENABLED: ${DEMO_ACCOUNTS_ENABLED:-true}
      DEMO_ACCOUNT_PASSWORD: ${DEMO_ACCOUNT_PASSWORD:-NabdhDemo!2026}
      NEXT_PUBLIC_DEFAULT_LOCALE: ${NEXT_PUBLIC_DEFAULT_LOCALE:-ar}
      NEXT_PUBLIC_DEMO_DATA: 'true'
      TELEMETRY_TICK_MS: '3000'
      RATE_LIMIT_WINDOW_MS: '60000'
      RATE_LIMIT_MAX_REQUESTS: '240'
      RATE_LIMIT_LOGIN_MAX: '10'
      # Set to true once the demonstration data is in place to keep it across restarts.
      SKIP_SEED: ${SKIP_SEED:-false}
    ports:
      - '${WEB_PORT:-3000}:3000'
    healthcheck:
      test: ['CMD', 'curl', '-fsS', 'http://127.0.0.1:3000/api/health']
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s

volumes:
  nabdh-postgres:
