compose.dev.yml

services:
  backend:
    build:
      context: .
      dockerfile: backend/Dockerfile
    env_file: .env
    environment:
      - ENVIRONMENT=local
      - GIT_HASH=${GIT_HASH:-}
    networks:
      - pikenet-private
      - kindred-internal-crm
    dns:
      - 1.1.1.1
    volumes:
      - ./backend/app:/app/backend/app
      - ./backend/scripts:/app/backend/scripts
      - ./backend/tests:/app/backend/tests
      - ./backend/alembic.ini:/app/backend/alembic.ini:ro
    working_dir: /app/backend
    command: ["bash", "-c", "bash scripts/prestart.sh && fastapi run --reload app/main.py"]
    # Loopback-only port so the puppeteer e2e suite can hit the API without
    # going through Traefik. Traefik still fronts the canonical hostname.
    ports:
      - "127.0.0.1:8001:8000"
    labels:
      # Hard-coded kindred.dev.khanpikehome.com (tailnet-only via admin-ipallowlist)
      # so a misset DOMAIN can never claim the prod hostname.
      - "traefik.enable=true"
      - "traefik.http.routers.crm-api.rule=Host(`kindred.dev.khanpikehome.com`) && (PathPrefix(`/api`) || PathPrefix(`/docs`) || PathPrefix(`/redoc`) || PathPrefix(`/openapi.json`) || PathPrefix(`/dav`) || PathPrefix(`/.well-known`))"
      - "traefik.http.routers.crm-api.entrypoints=websecure"
      - "traefik.http.routers.crm-api.tls=true"
      - "traefik.http.routers.crm-api.tls.certresolver=letsencrypt"
      - "traefik.http.routers.crm-api.tls.domains[0].main=*.dev.khanpikehome.com"
      - "traefik.http.routers.crm-api.middlewares=admin-ipallowlist@file"
      - "traefik.http.services.crm-api.loadbalancer.server.port=8000"
      - "traefik.docker.network=pikenet-private"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/api/v1/utils/health-check/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy

  frontend:
    image: node:22-slim
    working_dir: /app/frontend
    env_file: .env
    environment:
      - VITE_API_URL=https://kindred.dev.khanpikehome.com
      - VITE_PUBLIC_HOST=kindred.dev.khanpikehome.com
      - VITE_AUTH_MODE=${AUTH_MODE:-local}
      - VITE_CF_LOGOUT_URL=${VITE_CF_LOGOUT_URL:-}
      - GIT_HASH=${GIT_HASH:-}
      # Playwright runs on the host (scripts/run-e2e-prepush.sh), not in this
      # container. Skip the ~400 MB Chromium/Firefox/WebKit/ffmpeg download.
      - PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
    volumes:
      - ./package.json:/app/package.json:ro
      - ./pnpm-lock.yaml:/app/pnpm-lock.yaml:ro
      - ./pnpm-workspace.yaml:/app/pnpm-workspace.yaml:ro
      - ./frontend:/app/frontend
      # pnpm's hoisted node_modules lives at the workspace root (/app), not
      # /app/frontend. Persist that and mask the host's frontend/node_modules.
      - crm-frontend-node-modules:/app/node_modules
      - /app/frontend/node_modules
    command:
      - sh
      - -c
      - |
        corepack enable &&
        pnpm install --frozen-lockfile &&
        pnpm dev -- --host 0.0.0.0 --port 5173
    networks:
      - pikenet-private
    dns:
      - 1.1.1.1
    # Loopback-only port for puppeteer e2e — same rationale as backend.
    ports:
      - "127.0.0.1:5173:5173"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.crm.rule=Host(`kindred.dev.khanpikehome.com`)"
      - "traefik.http.routers.crm.entrypoints=websecure"
      - "traefik.http.routers.crm.tls=true"
      - "traefik.http.routers.crm.tls.certresolver=letsencrypt"
      - "traefik.http.routers.crm.tls.domains[0].main=*.dev.khanpikehome.com"
      - "traefik.http.routers.crm.middlewares=admin-ipallowlist@file"
      - "traefik.http.services.crm.loadbalancer.server.port=5173"
      - "traefik.docker.network=pikenet-private"

  db:
    image: postgres:18-alpine
    container_name: crm-db
    restart: unless-stopped
    env_file: .env
    environment:
      - PGDATA=/var/lib/postgresql/data/pgdata
    volumes:
      - crm-db:/var/lib/postgresql/data
    networks:
      - kindred-internal-crm
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5

  worker:
    build:
      context: .
      dockerfile: backend/Dockerfile
    command: ["arq", "app.worker.WorkerSettings"]
    env_file: .env
    volumes:
      - ./backend/app:/app/backend/app
    working_dir: /app/backend
    networks:
      - kindred-internal-crm
    security_opt:
      - no-new-privileges:true
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    volumes:
      - crm-redis:/data
    networks:
      - kindred-internal-crm
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  meilisearch:
    image: getmeili/meilisearch:v1.49
    restart: unless-stopped
    env_file: .env
    environment:
      - MEILI_ENV=production
      - MEILI_NO_ANALYTICS=true
      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY}
    volumes:
      - crm-meili:/meili_data
    networks:
      - kindred-internal-crm
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:7700/health"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  # Project-local. Dev never shares storage with prod (apps/kindred uses
  # its own kindred-prod-* volumes). After Track A cutover the legacy
  # external crm-db/crm-redis/crm-meili volumes are gone anyway.
  crm-db:
  crm-redis:
  crm-meili:
  crm-frontend-node-modules:

networks:
  pikenet-private:
    external: true
  kindred-internal-crm:
    external: true