docker-compose.yml

# CCE — Local development stack (infrastructure services only)
# Docker Compose v2 syntax. No top-level `version:` key (obsolete in v2).
# Backend/frontend app services are added in later phases.
#
# Usage:
#   docker compose up -d            # start infra services
#   docker compose ps               # list running services + health
#   docker compose logs <service>   # tail logs
#   docker compose down             # stop services (keeps volumes)
#   docker compose down -v          # stop + remove volumes (DESTROYS data)

name: cce

networks:
  # Single internal network all services share. Services resolve each other by service name.
  cce-net:
    driver: bridge

volumes:
  # Named volumes for persistent state. Survive `docker compose down` but not `down -v`.
  sqlserver-data:
  redis-data:
  keycloak-data:
  clamav-data:
  meilisearch-data:

services:

  sqlserver:
    # Azure SQL Edge — native arm64, SQL Server 2022-compatible for our scope.
    # Prod swaps this for mcr.microsoft.com/mssql/server:2022-latest (amd64).
    image: mcr.microsoft.com/azure-sql-edge:1.0.7
    container_name: cce-sqlserver
    platform: linux/arm64/v8
    environment:
      ACCEPT_EULA: "Y"
      # SA_PASSWORD must be ≥8 chars with 3 of 4: upper/lower/digit/symbol.
      # Read from .env via host env — never baked into the image.
      MSSQL_SA_PASSWORD: "${SQL_PASSWORD:?SQL_PASSWORD not set — run: cp .env.example .env && grep -E '^(SQL_PASSWORD|REDIS_PASSWORD|KEYCLOAK_CLIENT_SECRET_|SENTRY_DSN)' .env.local.example >> .env}"
      MSSQL_PID: "Developer"
      MSSQL_COLLATION: "SQL_Latin1_General_CP1_CI_AS"
    ports:
      - "1433:1433"
    volumes:
      - sqlserver-data:/var/opt/mssql
    networks:
      - cce-net
    healthcheck:
      # Non-blocking TCP probe. Azure SQL Edge 1.0.7 does NOT bundle sqlcmd, so we can't use a real SQL query.
      # `exec 3<>/dev/tcp/localhost/1433` opens+closes the socket without blocking on EOF (which is what
      # `cat </dev/tcp/...` would do). The port being accepting-connections means the SQL server process is up.
      # Phase 06 adds a migration-level test that actually runs a query.
      test: ["CMD-SHELL", "timeout 3 bash -c 'exec 3<>/dev/tcp/localhost/1433' 2>/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    container_name: cce-redis
    ports:
      - "6379:6379"
    command:
      - "redis-server"
      - "--save"
      - "60"
      - "1000"
      - "--loglevel"
      - "notice"
    volumes:
      - redis-data:/data
    networks:
      - cce-net
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 5s
    restart: unless-stopped

  keycloak:
    image: quay.io/keycloak/keycloak:25.0.6
    container_name: cce-keycloak
    command: ["start-dev", "--import-realm"]
    environment:
      # Use the legacy KEYCLOAK_ADMIN/_PASSWORD vars — in KC 25.0.6 the newer
      # KC_BOOTSTRAP_ADMIN_* vars don't reliably provision a master-realm admin
      # under `start-dev`. The legacy vars are deprecated but still create a
      # permanent admin on empty DB, which is what we need for Phase 02 Task 2.4
      # and general admin-console access. Real prod uses federated ADFS — sub-project 8.
      KEYCLOAK_ADMIN: "admin"
      KEYCLOAK_ADMIN_PASSWORD: "admin"
      KC_HTTP_ENABLED: "true"
      KC_HOSTNAME_STRICT: "false"
      KC_HEALTH_ENABLED: "true"
      KC_HTTP_PORT: "8080"
      KC_MANAGEMENT_PORT: "9000"
    ports:
      - "8080:8080"
      - "9000:9000"
    volumes:
      - keycloak-data:/opt/keycloak/data
      - ./keycloak:/opt/keycloak/data/import:ro
    networks:
      - cce-net
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && cat <&3 | grep -q 'status.*UP'"]
      interval: 10s
      timeout: 5s
      retries: 15
      start_period: 30s
    restart: unless-stopped

  maildev:
    image: maildev/maildev:2.1.0
    container_name: cce-maildev
    environment:
      MAILDEV_INCOMING_USER: ""
      MAILDEV_INCOMING_PASS: ""
      MAILDEV_WEB_PORT: "1080"
      MAILDEV_SMTP_PORT: "1025"
    ports:
      - "1025:1025"   # SMTP
      - "1080:1080"   # Web UI
    networks:
      - cce-net
    healthcheck:
      # Use 127.0.0.1 not `localhost` — in the container `localhost` resolves to IPv6 `::1` first,
      # but MailDev 2.1.0 binds IPv4 only, so wget on `localhost` hits `Connection refused`.
      test: ["CMD-SHELL", "wget -q -O - http://127.0.0.1:1080/healthz >/dev/null 2>&1 || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 5s
    restart: unless-stopped

  clamav:
    # Multi-arch (amd64 + arm64) Debian-based variant of the official ClamAV image.
    # See Phase 01 Divergence 3 — `clamav/clamav:stable` is amd64-only.
    # No `environment:` block — the image's entrypoint treats every CLAMD_CONF_* var as
    # a line appended to /etc/clamav/clamd.conf. Setting CLAMD_CONF_FOREGROUND=yes breaks
    # parsing because FOREGROUND is not a valid clamd.conf option. The baked defaults
    # already run clamd in the foreground and bind 0.0.0.0:3310, which is what we need.
    image: clamav/clamav-debian:stable
    container_name: cce-clamav
    ports:
      - "3310:3310"
    volumes:
      - clamav-data:/var/lib/clamav
    networks:
      - cce-net
    healthcheck:
      # PING/PONG clamd protocol over TCP:3310. Use 127.0.0.1 not `localhost` to avoid
      # IPv6-first resolver behavior (ClamAV binds IPv4 only in the default config).
      test: ["CMD-SHELL", "echo 'PING' | nc -w 1 127.0.0.1 3310 | grep -q 'PONG'"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 120s
    restart: unless-stopped

  meilisearch:
    image: getmeili/meilisearch:v1.10
    container_name: cce-meilisearch
    ports:
      - "7700:7700"
    environment:
      MEILI_ENV: development
      MEILI_NO_ANALYTICS: "true"
      MEILI_MASTER_KEY: dev-meili-master-key-change-me
    volumes:
      - meilisearch-data:/meili_data
    networks:
      - cce-net

  k6:
    image: grafana/k6:0.55.0
    profiles: ["loadtest"]
    container_name: cce-k6
    networks:
      - cce-net
    volumes:
      - ./loadtest/scenarios:/scenarios:ro
    environment:
      API_BASE_URL: "http://host.docker.internal:5001"
      KEYCLOAK_URL: "http://host.docker.internal:8080"
      OIDC_CLIENT_ID: "cce-admin-cms"
      OIDC_CLIENT_SECRET: "${KEYCLOAK_CLIENT_SECRET_INTERNAL:-dev-internal-secret-change-me}"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    # No `command` — passed at run time via `docker compose --profile loadtest run k6 run /scenarios/...`