docker-compose.yml

# Copyright (c) 2026 CoverIt Labs. All Rights Reserved.
# Proprietary and confidential. Unauthorized use is strictly prohibited.
# See LICENSE file in the project root for full license information.

name: coverit

services:
  api:
    image: ghcr.io/coveritlabs/coverit-api:${API_TAG:-dev}
    build:
      context: ${API_DIR:-.}
      secrets:
        - npm_token
    pull_policy: always
    container_name: coverit-api
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=${NODE_ENV:-development}
      - PORT=3000
      - DATABASE_URL=${DATABASE_URL:-postgresql://postgres:postgres@db:5432/coverit}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379/0}
      - CRAWL_ARQ_QUEUE_NAME=${CRAWL_ARQ_QUEUE_NAME:-arq:queue}
      - MANUAL_ARQ_QUEUE_NAME=${MANUAL_ARQ_QUEUE_NAME:-arq:manual-recordings}
      - CRAWL_ARQ_EXPIRES_MS=${CRAWL_ARQ_EXPIRES_MS:-86400000}
      - JWT_SECRET=${JWT_SECRET:-}
      - INTERNAL_SERVICE_TOKEN=${INTERNAL_SERVICE_TOKEN:-}
      - JWT_ACCESS_EXPIRY=${JWT_ACCESS_EXPIRY:-15m}
      - JWT_REFRESH_EXPIRY_SECONDS=${JWT_REFRESH_EXPIRY_SECONDS:-604800}
      - RESET_TOKEN_TTL_SECONDS=${RESET_TOKEN_TTL_SECONDS:-3600}
      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173}
      - CORS_CREDENTIALS=${CORS_CREDENTIALS:-true}
      - FRONTEND_URL=${FRONTEND_URL:-http://localhost:5173}
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
      - GOOGLE_CALLBACK_URL=${GOOGLE_CALLBACK_URL:-http://localhost:3000/api/v1/auth/oauth/google/callback}
      - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID:-}
      - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET:-}
      - GITHUB_CALLBACK_URL=${GITHUB_CALLBACK_URL:-http://localhost:3000/api/v1/auth/oauth/github/callback}
      - RESEND_API_KEY=${RESEND_API_KEY:-}
      - RESET_PASSWORD_EMAIL=${RESET_PASSWORD_EMAIL:-}
      - NOTIFICATION_EMAIL=${NOTIFICATION_EMAIL:-}
      - RESET_PASSWORD_TEMPLATE_ID=${RESET_PASSWORD_TEMPLATE_ID:-}
      - ISSUE_CREATED_TEMPLATE_ID=${ISSUE_CREATED_TEMPLATE_ID:-}
      - ISSUE_FAILED_TEMPLATE_ID=${ISSUE_FAILED_TEMPLATE_ID:-}
      - CODE_GENERATED_TEMPLATE_ID=${CODE_GENERATED_TEMPLATE_ID:-}
      - CODE_GENERATION_FAILED_TEMPLATE_ID=${CODE_GENERATION_FAILED_TEMPLATE_ID:-}
      - DAGSHUB_BASE_URL=${DAGSHUB_BASE_URL:-https://dagshub.com}
      - DAGSHUB_OWNER=${DAGSHUB_OWNER:-}
      - DAGSHUB_BUCKET_NAME=${DAGSHUB_BUCKET_NAME:-}
      - DAGSHUB_TOKEN=${DAGSHUB_TOKEN:-}
      - DAGSHUB_ARTIFACT_PREFIX=${DAGSHUB_ARTIFACT_PREFIX:-artifacts/}
      - REGRESSION_ARTIFACT_MAX_BYTES=${REGRESSION_ARTIFACT_MAX_BYTES:-104857600}
      - NODE_TLS_REJECT_UNAUTHORIZED=0
      - ATLASSIAN_CLIENT_ID=${ATLASSIAN_CLIENT_ID:-}
      - ATLASSIAN_CLIENT_SECRET=${ATLASSIAN_CLIENT_SECRET:-}
      - ATLASSIAN_CALLBACK_URL=${ATLASSIAN_CALLBACK_URL:-http://localhost:3000/api/v1/oauth/jira/callback}
      - OAUTH_TOKEN_ENCRYPTION_KEY=${OAUTH_TOKEN_ENCRYPTION_KEY:-}
      - OAUTH_STATE_TTL_SECONDS=${OAUTH_STATE_TTL_SECONDS:-600}
      - NEO4J_URI=${NEO4J_URI:-bolt://neo4j:7687}
      - NEO4J_USERNAME=${NEO4J_USERNAME:-${NEO4J_USER:-neo4j}}
      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy

  db:
    image: postgres:18
    container_name: coverit-postgres
    ports:
      - "${POSTGRES_HOST_PORT:-15432}:5432"
    environment:
      - POSTGRES_USER=${DB_USER:-postgres}
      - POSTGRES_PASSWORD=${DB_PASSWORD:-postgres}
      - POSTGRES_DB=${DB_NAME:-coverit}
    volumes:
      - postgres_data:/var/lib/postgresql
      - ./database:/docker-entrypoint-initdb.d
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-postgres}"]
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    container_name: coverit-redis
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  neo4j:
    image: neo4j:5-community
    container_name: coverit-neo4j
    ports:
      - "7474:7474"
      - "7687:7687"
    environment:
      - NEO4J_AUTH=neo4j/${NEO4J_PASSWORD:-password}
    volumes:
      - neo4j_data:/data
    healthcheck:
      test: ["CMD-SHELL", "cypher-shell -u neo4j -p ${NEO4J_PASSWORD:-password} 'RETURN 1'"]
      interval: 10s
      timeout: 10s
      retries: 12
    restart: unless-stopped

secrets:
  npm_token:
    environment: GITHUB_TOKEN

volumes:
  postgres_data:
  redis_data:
  neo4j_data: