docker-compose.dev.yml

# Orvexa dev dependencies for docker-capable environments.
#
# This is the CONTAINER path of the devstack (issue #23 [O-14]). On machines
# without docker/sudo use scripts/devstack.sh instead — it provisions the same
# PostgreSQL 16 and must produce the SAME env contract:
#
#   ORVEXA_DATABASE_URL=postgres://postgres:postgres@127.0.0.1:55432/orvexa?sslmode=disable
#   ORVEXA_NATS_URL=nats://localhost:4222
#   ORVEXA_OPENSEARCH_URL=http://localhost:9200   (issue #36 — optional; unset = search off)
#   ORVEXA_CLICKHOUSE_URL=clickhouse://default@127.0.0.1:19000/default
#     (issue #35 — optional; unset = analytics facts stay on PostgreSQL)
#
# Usage:   docker compose -f docker-compose.dev.yml up -d
# Stop:    docker compose -f docker-compose.dev.yml down
# Wipe:    docker compose -f docker-compose.dev.yml down -v   (drops data volume)
#
# The integration suite consumes it identically:
#   ORVEXA_TEST_DATABASE_URL=postgres://postgres:postgres@127.0.0.1:55432/orvexa?sslmode=disable \
#     make integration

services:
  postgres:
    image: postgres:16
    container_name: orvexa-dev-postgres
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: orvexa
    ports:
      # Same host port as scripts/devstack.sh (overridable via
      # ORVEXA_DEVSTACK_PORT on the script path) so tooling is path-agnostic.
      - "55432:5432"
    volumes:
      - orvexa-dev-pgdata:/var/lib/postgresql/data
      # Migrations are applied by `make migrations` / scripts/devstack.sh, not
      # by an entrypoint blob: lexical order + ON_ERROR_STOP stays authoritative.
      - ./migrations:/migrations:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d orvexa"]
      interval: 5s
      timeout: 3s
      retries: 20
    # Loopback-only exposure on the host.
    security_opt:
      - no-new-privileges:true

  redis:
    image: redis:7
    container_name: orvexa-dev-redis
    ports:
      - "6379:6379"
    command: ["redis-server", "--save", "", "--appendonly", "no"]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 20
    security_opt:
      - no-new-privileges:true

  nats:
    image: nats:2.10-jetstream
    container_name: orvexa-dev-nats
    ports:
      # Matches ORVEXA_NATS_URL default (nats://localhost:4222).
      - "4222:4222"
      - "8222:8222" # monitoring
    command: ["-js", "-m", "8222"]
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8222/healthz || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 20
    security_opt:
      - no-new-privileges:true

  # Conversation search backend (issue #36). OPTIONAL dependency: the platform
  # boots and serves every non-search route with ORVEXA_OPENSEARCH_URL unset —
  # search degrades to the typed 503 search.not_configured instead.
  opensearch:
    image: opensearchproject/opensearch:2
    container_name: orvexa-dev-opensearch
    environment:
      discovery.type: single-node
      bootstrap.memory_lock: "true"
      # Dev-sized heap; single node, no replicas (index template in
      # internal/search matches).
      OPENSEARCH_JAVA_OPTS: -Xms512m -Xmx512m
      # Dev only: HTTP (no TLS) and no auth plugin. Production deployments
      # terminate TLS/auth in front of the cluster — never run this profile
      # outside loopback.
      plugins.security.disabled: "true"
      compatibility.override_main_response_version: "true"
    ports:
      # Matches ORVEXA_OPENSEARCH_URL default (http://localhost:9200).
      - "9200:9200"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - orvexa-dev-osdata:/usr/share/opensearch/data
    healthcheck:
      test: ["CMD-SHELL", "curl -fs http://localhost:9200/_cluster/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 30s
    security_opt:
      - no-new-privileges:true

  # Temporal (optional profile: docker compose --profile temporal up)
  # Adopted only by deployments building with -tags=temporal (ADR-0009).
  # (Relocated under services: during the #36 merge — main's append had
  # nested these definitions under the volumes: key, which is not a valid
  # compose service placement.)
  temporal:
    image: temporalio/auto-setup:1.25.2
    profiles: ["temporal"]
    ports: ["7233:7233"]
    environment:
      - DB=postgresql
      - POSTGRES_SEEDS=postgres
      - POSTGRES_USER=postgres
      - POSTGRES_PWD=postgres
    depends_on: [postgres]
  temporal-ui:
    image: temporalio/ui:2.26.2
    profiles: ["temporal"]
    ports: ["8081:8080"]
    environment:
      - TEMPORAL_ADDRESS=temporal:7233
    depends_on: [temporal]

  # OLAP facts backend (issue #35). OPTIONAL dependency: with
  # ORVEXA_CLICKHOUSE_URL unset the analytics worker keeps appending facts to
  # PostgreSQL (internal/analytics) — zero drift. Set → the batched store in
  # internal/analytics/clickhouse appends there instead (never both).
  clickhouse:
    image: clickhouse/clickhouse-server:24
    container_name: orvexa-dev-clickhouse
    ports:
      # Native (clickhouse-go default) + HTTP interfaces. Non-standard host
      # ports like PostgreSQL's 55432 above: a local ClickHouse install keeps
      # its usual 9000/8123.
      - "19000:9000"
      - "18123:8123"
    volumes:
      # Engine-specific DDL (NOT applied by the PG runners — see the file's
      # header): the official image executes /docker-entrypoint-initdb.d/* on
      # FIRST init of the data volume only. Existing volume → apply manually:
      #   docker compose -f docker-compose.dev.yml exec clickhouse \
      #     clickhouse-client --multiquery < migrations/0011_clickhouse_facts.sql
      - ./migrations/0011_clickhouse_facts.sql:/docker-entrypoint-initdb.d/0011_clickhouse_facts.sql:ro
      - orvexa-dev-clickhouse:/var/lib/clickhouse
    # Recommended descriptor limit for the server process.
    ulimits:
      nofile:
        soft: 262144
        hard: 262144
    healthcheck:
      test: ["CMD", "clickhouse-client", "--query", "SELECT 1"]
      interval: 5s
      timeout: 3s
      retries: 20
    security_opt:
      - no-new-privileges:true

volumes:
  orvexa-dev-pgdata:
  orvexa-dev-osdata:
  # Wiped by `docker compose -f docker-compose.dev.yml down -v`; facts DDL is
  # re-applied on the next first-init. Retention notes: docs/devstack.md.
  orvexa-dev-clickhouse: