# SPP Command Deck — self-hosted stack.
#
# Requires Docker and Docker Compose. Images are pulled pre-built from our registry — no source
# checkout, no build toolchain needed.
#
#   docker compose up -d
#   open http://localhost:8078
#
# The Postgres password below is never exposed outside this compose network (no host port is
# published for postgres or api — only web, which is the app's actual entrypoint), so the default
# is safe to run as-is. Change it if you'd like; the app doesn't care what it's set to.
services:
  postgres:
    image: pgvector/pgvector:pg17
    restart: unless-stopped
    environment:
      POSTGRES_DB: monitoring
      POSTGRES_USER: monitoring
      POSTGRES_PASSWORD: spp-command-deck-local
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U monitoring -d monitoring"]
      interval: 5s
      timeout: 5s
      retries: 10

  api:
    image: preview.sqlperformancepartners.com:8443/spp-command-deck:api
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      ASPNETCORE_ENVIRONMENT: Production
      ConnectionStrings__Postgres: "Host=postgres;Database=monitoring;Username=monitoring;Password=spp-command-deck-local"
      Cors__SpaOrigins: "http://localhost:8078"
      Oidc__SpaRedirectUris: "http://localhost:8078/auth/callback,http://127.0.0.1:8078/auth/callback"
      Oidc__SpaPostLogoutRedirectUris: "http://localhost:8078/,http://127.0.0.1:8078/"
      # Encrypted server passwords (ServerPasswordProtector) are unreadable if this key ring is
      # lost — must be a real persisted volume, not the container's ephemeral filesystem.
      DataProtection__KeysPath: "/app/keys"
    volumes:
      - dataprotection-keys:/app/keys

  web:
    image: preview.sqlperformancepartners.com:8443/spp-command-deck:web
    restart: unless-stopped
    depends_on:
      - api
    ports:
      - "8078:8080"

volumes:
  postgres-data:
  dataprotection-keys:
