docker-compose.yml

# =============================================================================
# BusinessOS — Full Stack Compose
# Boots: postgres → redis → backend → frontend in dependency order.
# Usage:
#   First time:  make setup
#   Daily:       docker compose up -d
#   Logs:        docker compose logs -f
#   Teardown:    docker compose down -v
# =============================================================================

services:

  # ---------------------------------------------------------------------------
  # PostgreSQL 16 + pgvector
  # ---------------------------------------------------------------------------
  postgres:
    image: pgvector/pgvector:pg16
    restart: unless-stopped
    ports:
      - "${POSTGRES_PORT:-15432}:5432"
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-dev_password_change_in_prod}
      POSTGRES_DB: ${POSTGRES_DB:-business_os}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      # Current schema on first boot. Application data is not seeded.
      - ./desktop/backend-go/internal/database/schema.sql:/docker-entrypoint-initdb.d/01-schema.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-business_os}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    networks:
      - businessos-network

  # ---------------------------------------------------------------------------
  # Redis 7 (auth sessions, pub/sub, caching)
  # ---------------------------------------------------------------------------
  redis:
    image: redis:7-alpine
    restart: unless-stopped
    ports:
      - "${REDIS_PORT:-16379}:6379"
    command: >
      sh -c 'redis-server
        --requirepass "$${REDIS_PASSWORD:-dev_redis_change_in_prod}"
        --appendonly yes
        --maxmemory 512mb
        --maxmemory-policy allkeys-lru'
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-dev_redis_change_in_prod}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s
    networks:
      - businessos-network

  # ---------------------------------------------------------------------------
  # OptimalEngine (Elixir/OTP knowledge substrate)
  # ---------------------------------------------------------------------------
  optimal-engine:
    build:
      context: ./optimal-engine
      dockerfile: deploy/Dockerfile.engine
    image: businessos-optimal-engine:local
    restart: unless-stopped
    ports:
      - "${OPTIMAL_ENGINE_PORT:-4200}:4200"
    # Linux: host.docker.internal does not resolve without this mapping
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      OPTIMAL_ENGINE_ROOT: /data
      OPTIMAL_ENGINE_DB: /data/.optimal/index.db
      OPTIMAL_ENGINE_CACHE: /data/.optimal/cache
      OPTIMAL_API_ENABLED: "true"
      OPTIMAL_API_PORT: "4200"
      OPTIMAL_API_INTERFACE: "0.0.0.0"
      OPTIMAL_AUTH_REQUIRED: ${OPTIMAL_AUTH_REQUIRED:-false}
      OPTIMAL_BCRYPT_COST: ${OPTIMAL_BCRYPT_COST:-12}
      OLLAMA_HOST: ${OPTIMAL_OLLAMA_URL:-http://host.docker.internal:11434}
      MIX_ENV: prod
    volumes:
      - optimal_engine_data:/data
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:4200/api/health"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s
    networks:
      - businessos-network

  # ---------------------------------------------------------------------------
  # BusinessOS Backend (Go)
  # Dockerfile: desktop/backend-go/Dockerfile (multi-stage, alpine final image)
  # Health probes: GET /healthz (liveness), GET /readyz (readiness)
  # ---------------------------------------------------------------------------
  backend:
    build:
      context: ./desktop/backend-go
      dockerfile: Dockerfile
    image: businessos-backend:local
    restart: unless-stopped
    ports:
      - "${BACKEND_PORT:-8001}:8001"
    # Linux: host.docker.internal does not resolve without this mapping
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      # ── Server ────────────────────────────────────────────────────────────
      ENVIRONMENT: ${ENVIRONMENT:-development}
      GIN_MODE: ${GIN_MODE:-release}
      SERVER_PORT: "8001"
      ALLOWED_ORIGINS: >-
        http://localhost:5173,http://localhost:3000,http://localhost:3300,http://frontend:3000

      # ── Database ──────────────────────────────────────────────────────────
      DATABASE_URL: >-
        postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-dev_password_change_in_prod}@postgres:5432/${POSTGRES_DB:-business_os}?sslmode=disable

      # ── Redis ─────────────────────────────────────────────────────────────
      REDIS_URL: redis://redis:6379/0
      REDIS_PASSWORD: ${REDIS_PASSWORD:-dev_redis_change_in_prod}
      REDIS_TLS_ENABLED: "false"

      # ── Security (REQUIRED — set real values in .env for dev, secrets mgr for prod) ──
      SECRET_KEY: ${SECRET_KEY:-EWXwhwjE+DT+j+NqvOse0Rikz8Qb3ROhRgjhLSwIawYXlDCJUYT5q/Ef1VF1+b6a}
      TOKEN_ENCRYPTION_KEY: ${TOKEN_ENCRYPTION_KEY:-yvJ1Vnnisg9rB1zQ/ttO++Y1e3kM1Gxv3S23fuSXRgI=}
      REDIS_KEY_HMAC_SECRET: ${REDIS_KEY_HMAC_SECRET:-U85dnbezAi4+BloKef8acZ+O/eGpUVdfQRpcXnFybg4=}

      # ── AI Provider (defaults to local Ollama — no API key needed) ────────
      AI_PROVIDER: ${AI_PROVIDER:-ollama_local}
      OLLAMA_LOCAL_URL: ${OLLAMA_LOCAL_URL:-http://host.docker.internal:11434}
      DEFAULT_MODEL: ${DEFAULT_MODEL:-llama3.2:3b}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      ANTHROPIC_MODEL: ${ANTHROPIC_MODEL:-claude-sonnet-4-20250514}

      # ── OptimalEngine (knowledge substrate) ────────────────────────────────
      OPTIMAL_ENGINE_URL: ${OPTIMAL_ENGINE_URL:-http://optimal-engine:4200}
      OPTIMAL_ENGINE_API_KEY: ${OPTIMAL_ENGINE_API_KEY:-}

      # ── OSA Integration (optional — disabled by default) ──────────────────
      OSA_ENABLED: ${OSA_ENABLED:-false}
      OSA_BASE_URL: ${OSA_BASE_URL:-}
      OSA_SHARED_SECRET: ${OSA_SHARED_SECRET:-}
      OSA_MODE: ${OSA_MODE:-local}
      MIOSA_API_KEY: ${MIOSA_API_KEY:-}

      # ── OAuth (optional — leave blank to skip) ────────────────────────────
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      GOOGLE_REDIRECT_URI: ${GOOGLE_REDIRECT_URI:-http://localhost:8001/api/auth/google/callback}
      MICROSOFT_CLIENT_ID: ${MICROSOFT_CLIENT_ID:-}
      MICROSOFT_CLIENT_SECRET: ${MICROSOFT_CLIENT_SECRET:-}
      MICROSOFT_REDIRECT_URI: ${MICROSOFT_REDIRECT_URI:-http://localhost:8001/api/auth/microsoft/callback}
      SLACK_CLIENT_ID: ${SLACK_CLIENT_ID:-}
      SLACK_CLIENT_SECRET: ${SLACK_CLIENT_SECRET:-}
      SLACK_REDIRECT_URI: ${SLACK_REDIRECT_URI:-http://localhost:8001/api/auth/slack/callback}
      SLACK_SIGNING_SECRET: ${SLACK_SIGNING_SECRET:-}
      NOTION_CLIENT_ID: ${NOTION_CLIENT_ID:-}
      NOTION_CLIENT_SECRET: ${NOTION_CLIENT_SECRET:-}
      NOTION_REDIRECT_URI: ${NOTION_REDIRECT_URI:-http://localhost:8001/api/auth/notion/callback}
      HUBSPOT_CLIENT_ID: ${HUBSPOT_CLIENT_ID:-}
      HUBSPOT_CLIENT_SECRET: ${HUBSPOT_CLIENT_SECRET:-}
      HUBSPOT_REDIRECT_URI: ${HUBSPOT_REDIRECT_URI:-http://localhost:8001/api/auth/hubspot/callback}
      LINEAR_CLIENT_ID: ${LINEAR_CLIENT_ID:-}
      LINEAR_CLIENT_SECRET: ${LINEAR_CLIENT_SECRET:-}
      LINEAR_REDIRECT_URI: ${LINEAR_REDIRECT_URI:-http://localhost:8001/api/auth/linear/callback}
      CLICKUP_CLIENT_ID: ${CLICKUP_CLIENT_ID:-}
      CLICKUP_CLIENT_SECRET: ${CLICKUP_CLIENT_SECRET:-}
      CLICKUP_REDIRECT_URI: ${CLICKUP_REDIRECT_URI:-http://localhost:8001/api/auth/clickup/callback}
      AIRTABLE_CLIENT_ID: ${AIRTABLE_CLIENT_ID:-}
      AIRTABLE_CLIENT_SECRET: ${AIRTABLE_CLIENT_SECRET:-}
      AIRTABLE_REDIRECT_URI: ${AIRTABLE_REDIRECT_URI:-http://localhost:8001/api/auth/airtable/callback}

      # ── Web Push (optional) ───────────────────────────────────────────────
      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:-}
      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY:-}

      # ── Feature flags ─────────────────────────────────────────────────────
      ENABLE_LOCAL_MODELS: ${ENABLE_LOCAL_MODELS:-true}
      CONTAINER_MANAGER_ENABLED: ${CONTAINER_MANAGER_ENABLED:-false}
      SANDBOX_ENABLED: ${SANDBOX_ENABLED:-false}
      NATS_ENABLED: "false"
      CARRIER_ENABLED: "false"

    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      optimal-engine:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8001/healthz"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 20s
    networks:
      - businessos-network

  # ---------------------------------------------------------------------------
  # BusinessOS Frontend (SvelteKit adapter-node, port 3000)
  # Dockerfile: frontend/Dockerfile (multi-stage, node:20-alpine final image)
  # PUBLIC_API_URL is baked at build time via ARG; override via env at runtime.
  # ---------------------------------------------------------------------------
  frontend:
    build:
      context: .
      dockerfile: frontend/Dockerfile
      args:
        # Baked into the Vite bundle at build time — must point to the host's
        # externally-reachable backend (not the docker-internal hostname).
        PUBLIC_API_URL: ${PUBLIC_API_URL:-http://localhost:8001}
        PUBLIC_ENVIRONMENT: ${ENVIRONMENT:-development}
    image: businessos-frontend:local
    restart: unless-stopped
    ports:
      - "${FRONTEND_PORT:-3300}:3000"
    environment:
      NODE_ENV: production
      PORT: "3000"
      # SvelteKit CSRF: must match the URL users actually browse to.
      ORIGIN: ${ORIGIN:-http://localhost:3300}
      # Runtime env vars (non-PUBLIC_ vars are server-side only in SvelteKit)
      VITE_API_URL: ${VITE_API_URL:-http://localhost:8001/api}
      VITE_BACKEND_URL: ${VITE_BACKEND_URL:-http://localhost:8001}
      # Server-side /api/* proxy target (hooks.server.ts) — the browser talks
      # same-origin; the node server forwards to the backend container.
      BACKEND_INTERNAL_URL: http://backend:8001
    depends_on:
      backend:
        condition: service_healthy
    networks:
      - businessos-network

# =============================================================================
# Volumes
# =============================================================================
volumes:
  postgres_data:
    driver: local
  redis_data:
    driver: local
  optimal_engine_data:
    driver: local

# =============================================================================
# Networks
# =============================================================================
networks:
  businessos-network:
    driver: bridge