Pipeline/compose.yml

name: pipeline

services:
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-pipeline}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    ports:
      - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 3s
      retries: 20

  redis:
    image: redis:7-alpine
    ports:
      - "127.0.0.1:${REDIS_PORT:-6379}:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5

  backend:
    build:
      # Build from repo root so the backend image can include repo-level assets
      # like `backend/templates/`.
      context: .
      dockerfile: backend/Dockerfile
    # Run as the host user so the container can read credential files mounted
    # from the host (e.g. ~/.claude/.credentials.json which has mode 600).
    # Set DOCKER_UID / DOCKER_GID in .env if your host uid:gid differs from 1000:1000.
    user: "${DOCKER_UID:-1000}:${DOCKER_GID:-1000}"
    env_file:
      - ./backend/.env
    environment:
      # Override localhost defaults for container networking
      DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-pipeline}
      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:3030}
      DB_AUTO_MIGRATE: ${DB_AUTO_MIGRATE:-true}
      AUTH_MODE: ${AUTH_MODE}
      LOCAL_AUTH_TOKEN: ${LOCAL_AUTH_TOKEN}
      BASE_URL: ${BASE_URL:-http://localhost:8000}
      RQ_REDIS_URL: redis://redis:6379/0
      # Claude Code credentials — read-only mount for subscription usage auto-detection.
      CLAUDE_CREDENTIALS_PATH: /run/secrets/claude_credentials
      # Codex CLI credentials — read-only mount for ChatGPT subscription usage auto-detection.
      CODEX_CREDENTIALS_PATH: /run/secrets/codex_credentials
      # Claude Code session JSONL files — read-only mount so the session viewer works.
      CLAUDE_PROJECTS_PATH: /run/claude/projects
      # AI provider API keys — seeded into provider_credentials on boot (optional).
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      ANTHROPIC_BASE_URL: ${ANTHROPIC_BASE_URL:-}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      OPENAI_BASE_URL: ${OPENAI_BASE_URL:-}
    volumes:
      - ${CLAUDE_CREDENTIALS_FILE:-/home/kaspa/.claude/.credentials.json}:/run/secrets/claude_credentials:ro
      - ${CODEX_CREDENTIALS_FILE:-/home/kaspa/.codex/auth.json}:/run/secrets/codex_credentials:ro
      - ${CLAUDE_PROJECTS_DIR:-/home/kaspa/.claude/projects}:/run/claude/projects:ro
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    ports:
      - "${BACKEND_PORT:-8001}:8000"

  frontend:
    build:
      context: ./frontend
      args:
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:8001}
        NEXT_PUBLIC_AUTH_MODE: ${AUTH_MODE}
        NEXT_PUBLIC_LOCAL_AUTH_TOKEN: ${LOCAL_AUTH_TOKEN}
    # Optional, user-managed env file.
    # IMPORTANT: do NOT load `.env.example` here because it contains non-empty
    # placeholder Clerk keys, which can accidentally flip Clerk "on".
    env_file:
      - ./frontend/.env
    environment:
      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:8001}
      NEXT_PUBLIC_AUTH_MODE: ${AUTH_MODE}
      NEXT_PUBLIC_LOCAL_AUTH_TOKEN: ${LOCAL_AUTH_TOKEN}
    depends_on:
      - backend
    ports:
      - "${FRONTEND_PORT:-3030}:3000"

  webhook-worker:
    build:
      context: .
      dockerfile: backend/Dockerfile
    command: ["python", "scripts/rq-docker", "worker"]
    env_file:
      - ./backend/.env
    depends_on:
      redis:
        condition: service_healthy
      db:
        condition: service_healthy
    environment:
      DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-pipeline}
      AUTH_MODE: ${AUTH_MODE}
      LOCAL_AUTH_TOKEN: ${LOCAL_AUTH_TOKEN}
      BASE_URL: ${BASE_URL:-http://localhost:8000}
      RQ_REDIS_URL: redis://redis:6379/0
      RQ_QUEUE_NAME: ${RQ_QUEUE_NAME:-default}
      RQ_DISPATCH_THROTTLE_SECONDS: ${RQ_DISPATCH_THROTTLE_SECONDS:-2.0}
      RQ_DISPATCH_MAX_RETRIES: ${RQ_DISPATCH_MAX_RETRIES:-3}
      FORGEJO_SYNC_ENABLED: ${FORGEJO_SYNC_ENABLED:-true}
      FORGEJO_SYNC_INTERVAL_SECONDS: ${FORGEJO_SYNC_INTERVAL_SECONDS:-3600}
      FORGEJO_SYNC_STARTUP_DELAY_SECONDS: ${FORGEJO_SYNC_STARTUP_DELAY_SECONDS:-60}
    restart: unless-stopped