docker-compose.e2e.yaml

services:
  postgres-e2e:
    image: postgres:18-alpine
    container_name: ninerlog-e2e-db
    environment:
      POSTGRES_USER: testuser
      POSTGRES_PASSWORD: testpass
      POSTGRES_DB: ninerlog_e2e
    ports:
      - "5434:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U testuser -d ninerlog_e2e"]
      interval: 2s
      timeout: 5s
      retries: 10
    tmpfs:
      - /var/lib/postgresql

  mailpit:
    image: axllent/mailpit:latest
    container_name: ninerlog-e2e-mailpit
    ports:
      - "8025:8025"   # Web UI / REST API
      - "1025:1025"   # SMTP

  # SeaweedFS provides an S3-compatible API for cloud-backup e2e tests.
  # Replaces MinIO (community edition increasingly restricted / repos archived).
  # Exposes the S3 API on :8333 and a single static admin identity.
  seaweedfs:
    image: chrislusf/seaweedfs:latest
    container_name: ninerlog-e2e-seaweedfs
    entrypoint:
      - /bin/sh
      - -c
      - |
        mkdir -p /etc/seaweedfs
        cat > /etc/seaweedfs/s3.json <<'EOF'
        {
          "identities": [
            {
              "name": "admin",
              "credentials": [
                { "accessKey": "ninerlogadmin", "secretKey": "ninerlogsecret" }
              ],
              "actions": ["Admin", "Read", "Write", "List", "Tagging"]
            }
          ]
        }
        EOF
        exec weed server -s3 -s3.port=8333 -s3.config=/etc/seaweedfs/s3.json -dir=/data -ip=seaweedfs
    ports:
      - "8333:8333"
    healthcheck:
      # Master serves /cluster/status (HTTP 200) once the cluster is up; the S3
      # gateway returns HTTP 403 to an unauthenticated GET / as soon as it is
      # listening. Either response proves the daemon is ready.
      test:
        - CMD-SHELL
        - |
          curl -sf http://localhost:9333/cluster/status > /dev/null \
          && curl -s -o /dev/null -w '%{http_code}' http://localhost:8333/ | grep -qE '200|403'
      interval: 3s
      timeout: 5s
      retries: 30
      start_period: 5s

  seaweedfs-init:
    image: chrislusf/seaweedfs:latest
    container_name: ninerlog-e2e-seaweedfs-init
    depends_on:
      seaweedfs:
        condition: service_healthy
    entrypoint:
      - /bin/sh
      - -c
      - |
        for i in $$(seq 1 30); do
          echo "s3.bucket.create -name ninerlog-backups" | weed shell -master seaweedfs:9333 && exit 0
          sleep 1
        done
        echo "failed to create bucket" >&2
        exit 1

  sftp:
    # atmoz/sftp is a tiny OpenSSH-based SFTP-only image. The command-line
    # argument follows the format "user:pass:::folder", which creates the
    # /home/ninerlog/upload writable directory used by the e2e tests.
    image: atmoz/sftp:alpine
    container_name: ninerlog-e2e-sftp
    command: "ninerlog:ninerlogtest:::upload"
    ports:
      - "2222:22"
    healthcheck:
      # sshd is up as soon as port 22 accepts TCP. Use a portable nc fallback.
      test: ["CMD-SHELL", "(echo > /dev/tcp/localhost/22) >/dev/null 2>&1 || nc -z localhost 22 || exit 1"]
      interval: 3s
      timeout: 5s
      retries: 20
      start_period: 5s

  webdav:
    # Lightweight Apache + mod_dav image. Provides RFC 4918 WebDAV with HTTP
    # Basic auth, which is enough to exercise the WebDAV provider end-to-end.
    image: bytemark/webdav:latest
    container_name: ninerlog-e2e-webdav
    environment:
      AUTH_TYPE: Basic
      USERNAME: ninerlog
      PASSWORD: ninerlogtest
    ports:
      - "8088:80"
    healthcheck:
      # mod_dav returns 401 (auth required) on /, which proves the server is up
      # without needing credentials in the healthcheck.
      test: ["CMD-SHELL", "wget -qO- --tries=1 http://localhost/ 2>&1 | grep -q 'Authorization Required' || wget --server-response -qO- http://localhost/ 2>&1 | grep -q '401' || exit 1"]
      interval: 3s
      timeout: 5s
      retries: 20
      start_period: 5s

  api:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: ninerlog-e2e-api
    depends_on:
      postgres-e2e:
        condition: service_healthy
      mailpit:
        condition: service_started
      seaweedfs-init:
        condition: service_completed_successfully
      sftp:
        condition: service_started
      webdav:
        condition: service_started
    environment:
      DATABASE_URL: "postgresql://testuser:testpass@postgres-e2e:5432/ninerlog_e2e?sslmode=disable"
      PORT: "3000"
      JWT_SECRET: "e2e-test-jwt-secret-key-minimum-32-chars"
      REFRESH_SECRET: "e2e-test-refresh-secret-key-minimum-32"
      CORS_ORIGIN: "*"
      ADMIN_EMAIL: "admin@ninerlog-test.com"
      DISABLE_RATE_LIMIT: "true"
      MIGRATIONS_PATH: "db/migrations"
      # Sessions — a short grace keeps the replay test fast; keep in step with
      # refreshReuseGrace in test/e2e/auth_e2e_test.go.
      REFRESH_REUSE_GRACE: "1s"
      MAX_SESSIONS_PER_USER: "5"
      # SMTP — points to MailPit test server (no auth needed)
      SMTP_HOST: "mailpit"
      SMTP_PORT: "1025"
      SMTP_FROM: "noreply@ninerlog-test.com"
      FRONTEND_URL: "http://localhost:5173"
      # WebAuthn / passkeys (e2e uses localhost as RP)
      WEBAUTHN_RP_ID: "localhost"
      WEBAUTHN_RP_NAME: "NinerLog E2E"
      WEBAUTHN_RP_ORIGINS: "http://localhost:5173,http://localhost:3333"
      # Run notification checker less frequently in E2E (manual trigger used)
      NOTIFICATION_CHECK_INTERVAL: "24h"
      # No periodic airport refetch in test containers
      AIRPORT_REFRESH_INTERVAL: "off"
      # No GitHub release lookups from test containers
      UPDATE_CHECK_ENABLED: "false"
      # Cloud backups: 32-byte base64 key (deterministic for e2e only)
      BACKUP_CREDENTIALS_KEY: "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY="
      # The e2e backup targets (seaweedfs-test, sftp, webdav) are Docker
      # containers on a private network. The SSRF guard blocks private ranges
      # by default, so opt in here to let the e2e suite reach them.
      BACKUP_ALLOW_PRIVATE_NETWORKS: "true"
    ports:
      - "3333:3000"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:3000/health || exit 1"]
      interval: 3s
      timeout: 5s
      retries: 20
      start_period: 10s