docker-compose.yml

x-api-build: &api-build
  context: .
  dockerfile: docker/Dockerfile.backend

x-api-environment: &api-environment
  DATABASE_URL: postgresql+asyncpg://db2api:db2api@db:5432/db2api
  APP_ENV: development
  DEBUG: "false"
  LOG_LEVEL: INFO
  CORS_ORIGINS: "http://localhost:5173,http://localhost:80"
  JWT_SECRET_KEY: ${JWT_SECRET_KEY?JWT_SECRET_KEY is required}
  JWT_ALGORITHM: HS256
  JWT_ACCESS_TOKEN_EXPIRE_MINUTES: "60"
  QUERY_TIMEOUT_SECONDS: "30"
  ENCRYPTION_KEY: ${ENCRYPTION_KEY?ENCRYPTION_KEY is required}
  ADMIN_USERNAME: ${ADMIN_USERNAME?ADMIN_USERNAME is required}
  ADMIN_PASSWORD_HASH: ${ADMIN_PASSWORD_HASH?ADMIN_PASSWORD_HASH is required}
  # Leave blank for thin mode. For thick mode, the bundled Linux client lives
  # at /opt/oracle/instantclient_19_32.
  ORACLE_CLIENT_LIB_DIR: ${ORACLE_CLIENT_LIB_DIR:-}

services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: db2api
      POSTGRES_USER: db2api
      POSTGRES_PASSWORD: db2api
    ports:
      # Loopback only: the API reaches Postgres over the internal `backend`
      # network. This host mapping exists solely for local dev tools
      # (psql/GUI clients) and must never be published on external
      # interfaces — the data tier holds encrypted credentials, signing
      # secrets, and access logs.
      - "127.0.0.1:5432:5432"
    volumes:
      - db_data:/var/lib/postgresql/data
    # Data tier only — the API reaches Postgres here; nginx never does.
    networks:
      - backend
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U db2api -d db2api"]
      interval: 10s
      timeout: 5s
      retries: 5

  migrate:
    build: *api-build
    restart: "no"
    command: ["alembic", "upgrade", "head"]
    environment: *api-environment
    networks:
      - backend
    depends_on:
      db:
        condition: service_healthy

  api:
    build: *api-build
    restart: unless-stopped
    environment:
      <<: *api-environment
      # Trust forwarded headers ONLY from the dedicated nginx<->api "edge"
      # subnet. nginx is the sole member of that subnet besides this service,
      # so db/oracle (on the separate "backend" network) cannot reach :8000
      # to forge X-Forwarded-For even if compromised. Must match the edge
      # network's subnet below.
      FORWARDED_ALLOW_IPS: "10.31.0.0/24"
    # The backend is intentionally NOT published to the host: it is reached
    # only through the nginx reverse proxy (`web`). It sits on two segmented
    # networks — `edge` (shared only with nginx, the trusted proxy hop) and
    # `backend` (shared only with the data tier). Use `http://localhost/api/...`
    # (via `web`) in dev, or `docker compose exec api ...` for direct debugging.
    expose:
      - "8000"
    networks:
      - edge
      - backend
    depends_on:
      db:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8000/api/v1/admin/health/live || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s

  web:
    build:
      context: .
      dockerfile: docker/Dockerfile.frontend
    restart: unless-stopped
    ports:
      - "80:80"
    # Edge tier only — nginx is the trusted proxy hop and the single member of
    # the edge subnet that talks to the API. It has no route to the data tier.
    networks:
      - edge
    depends_on:
      api:
        condition: service_healthy

  # Optional Oracle XE service — activate with: docker compose --profile oracle up
  oracle:
    image: gvenzl/oracle-xe:21-slim
    profiles:
      - oracle
    restart: unless-stopped
    environment:
      ORACLE_PASSWORD: ${ORACLE_PASSWORD:-oracle}
    ports:
      # Loopback only — see the db service rationale. The API connects over
      # the internal `backend` network; this is for local dev access only.
      - "127.0.0.1:1521:1521"
    volumes:
      - oracle_data:/opt/oracle/oradata
    # Data tier only — reachable by the API, never by nginx.
    networks:
      - backend
    healthcheck:
      test: ["CMD-SHELL", "healthcheck.sh"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 120s

networks:
  # nginx <-> api only. Fixed subnet so the backend can scope
  # FORWARDED_ALLOW_IPS to exactly this hop (see the `api` service).
  edge:
    driver: bridge
    ipam:
      config:
        - subnet: 10.31.0.0/24
  # api <-> data tier (Postgres, Oracle). nginx is NOT attached, so a
  # compromised data container cannot reach the API to spoof forwarded headers.
  backend:
    driver: bridge

volumes:
  db_data:
  oracle_data: