compose.yaml

# Vortex production compose configuration.
# Images for api, app, and worker are pulled from manifold.omni.dev (private).
# To build from source instead, use the dev override:
#   docker compose -f compose.yaml -f compose.dev.yaml up --build

services:
  db:
    image: postgres:18-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${DB_NAME:-vortex}
      POSTGRES_USER: ${DB_USER:-postgres}
      POSTGRES_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD is required}
    volumes:
      - db_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-postgres}"]
      interval: 5s
      timeout: 5s
      retries: 5
    ports:
      - "${DB_PORT:-5432}:5432"

  cache:
    image: docker.io/valkey/valkey:8-alpine
    restart: unless-stopped
    command: ["valkey-server", "--requirepass", "${CACHE_PASSWORD:?CACHE_PASSWORD is required}"]
    volumes:
      - cache_data:/data
    healthcheck:
      test: ["CMD-SHELL", "REDISCLI_AUTH=${CACHE_PASSWORD} valkey-cli ping"]
      interval: 5s
      timeout: 5s
      retries: 5
    ports:
      - "${CACHE_PORT:-6379}:6379"

  events:
    image: apache/iggy:0.7.0
    restart: unless-stopped
    cap_add:
      - SYS_NICE
    security_opt:
      - seccomp:unconfined
    ulimits:
      memlock:
        soft: -1
        hard: -1
    environment:
      IGGY_ROOT_USERNAME: ${IGGY_USERNAME:?IGGY_USERNAME is required}
      IGGY_ROOT_PASSWORD: ${IGGY_PASSWORD:?IGGY_PASSWORD is required}
      IGGY_TCP_ADDRESS: "0.0.0.0:8090"
      IGGY_HTTP_ADDRESS: "0.0.0.0:3000"
      IGGY_HTTP_ENABLED: "true"
    volumes:
      - events_data:/local_data
    healthcheck:
      test: ["CMD-SHELL", "sh -c 'echo -n > /dev/tcp/localhost/8090' 2>/dev/null || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 5s
    ports:
      - "${EVENTS_TCP_PORT:-8090}:8090"

  api:
    image: manifold.omni.dev/omnidotdev/vortex-api:latest
    restart: unless-stopped
    environment:
      DATABASE_URL: postgres://${DB_USER:-postgres}:${DB_PASSWORD}@db:5432/${DB_NAME:-vortex}
      CACHE_URL: redis://default:${CACHE_PASSWORD}@cache:6379
      EVENTS_URL: iggy://events:8090
      IGGY_USERNAME: ${IGGY_USERNAME:?IGGY_USERNAME is required}
      IGGY_PASSWORD: ${IGGY_PASSWORD:?IGGY_PASSWORD is required}
      # Server-side only: used for JWKS, userinfo, and API key verification
      # against Gatekeeper (identity provider). Must point to a reachable
      # Gatekeeper instance, not the vortex-app service.
      AUTH_BASE_URL: ${AUTH_BASE_URL:?AUTH_BASE_URL is required (Gatekeeper URL)}
      HATCHET_CLIENT_TOKEN: ${HATCHET_CLIENT_TOKEN:?HATCHET_CLIENT_TOKEN is required}
      HATCHET_CLIENT_TLS_STRATEGY: ${HATCHET_CLIENT_TLS_STRATEGY:-none}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:?ENCRYPTION_KEY is required}
      PORT: "4000"
      HOST: "0.0.0.0"
      NODE_ENV: production
      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost:3000}
      WORKER_URL: http://worker:8080
      INTERNAL_API_SECRET: ${INTERNAL_API_SECRET:?INTERNAL_API_SECRET is required}
      PLATFORM_ORG_ID: ${PLATFORM_ORG_ID:-}
    depends_on:
      db:
        condition: service_healthy
      cache:
        condition: service_healthy
      events:
        condition: service_healthy
    ports:
      - "${API_PORT:-4000}:4000"
    healthcheck:
      test: ["CMD", "bun", "-e", "fetch('http://localhost:4000/health').then(r=>{if(!r.ok)throw 1}).catch(()=>process.exit(1))"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 15s

  app:
    image: manifold.omni.dev/omnidotdev/vortex-app:latest
    restart: unless-stopped
    environment:
      NODE_ENV: production
      VITE_BASE_URL: http://localhost:${APP_PORT:-3000}
      VITE_API_BASE_URL: http://localhost:${API_PORT:-4000}
      API_INTERNAL_URL: http://api:4000
      AUTH_SECRET: ${AUTH_SECRET:?AUTH_SECRET is required}
      CACHE_URL: redis://default:${CACHE_PASSWORD}@cache:6379
      # OAuth providers (optional)
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
      OIDC_ISSUER: ${OIDC_ISSUER:-}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
    depends_on:
      api:
        condition: service_healthy
      cache:
        condition: service_healthy
    ports:
      - "${APP_PORT:-3000}:3000"
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:3000/api/_health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 15s

  worker:
    image: manifold.omni.dev/omnidotdev/vortex-worker:latest
    restart: unless-stopped
    environment:
      NODE_ENV: production
      DATABASE_URL: postgres://${DB_USER:-postgres}:${DB_PASSWORD}@db:5432/${DB_NAME:-vortex}
      CACHE_URL: redis://default:${CACHE_PASSWORD}@cache:6379
      EVENTS_URL: iggy://events:8090
      HATCHET_CLIENT_TOKEN: ${HATCHET_CLIENT_TOKEN:?HATCHET_CLIENT_TOKEN is required}
      HATCHET_CLIENT_TLS_STRATEGY: ${HATCHET_CLIENT_TLS_STRATEGY:-none}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:?ENCRYPTION_KEY is required}
      HEALTH_PORT: "8080"
      INTERNAL_API_SECRET: ${INTERNAL_API_SECRET:?INTERNAL_API_SECRET is required}
      VORTEX_API_URL: http://api:4000
      VORTEX_PUBLIC_URL: ${VORTEX_PUBLIC_URL:-http://localhost:4000}
      VORTEX_CALLBACK_BASE_URL: ${VORTEX_CALLBACK_BASE_URL:-http://localhost:3000}
      MANTLE_API_URL: ${MANTLE_API_URL:-}
      MANTLE_SERVICE_KEY: ${MANTLE_SERVICE_KEY:-}
      AUTH_API_URL: ${AUTH_API_URL:-}
      EMAIL_RENDER_SECRET: ${EMAIL_RENDER_SECRET:-}
      HERALD_API_URL: ${HERALD_API_URL:-}
      HERALD_API_KEY: ${HERALD_API_KEY:-}
      HERALD_SENDER_EMAIL_ADDRESS: ${HERALD_SENDER_EMAIL_ADDRESS:-}
      HERALD_SEND_ENABLED: ${HERALD_SEND_ENABLED:-}
      IGGY_USERNAME: ${IGGY_USERNAME:?IGGY_USERNAME is required}
      IGGY_PASSWORD: ${IGGY_PASSWORD:?IGGY_PASSWORD is required}
    depends_on:
      db:
        condition: service_healthy
      cache:
        condition: service_healthy
      events:
        condition: service_healthy
      api:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "bun", "-e", "fetch('http://localhost:8080/health').then(r=>{if(!r.ok)throw 1}).catch(()=>process.exit(1))"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s

volumes:
  db_data:
  cache_data:
  events_data: