docker-compose.fullapp.dev.yml

# Backwards-compatibility duplicate of starters/docker/compose.fullapp.dev.yml — the canonical file
# lives there; edit that one. scripts/__tests__/root-compose-backcompat.test.mjs
# enforces byte equality with the source.

# Full stack with app in dev mode: mounted source + yarn dev (watch).
# Usage: docker compose --project-directory . -f starters/docker/compose.fullapp.dev.yml up --build

services:
  opencode:
    build:
      context: ./docker/opencode
      args:
        # OpenCode is pre-installed in this published base image (see
        # docker/opencode/BASE_IMAGE.md); the local build only COPYs project
        # files, so it needs no proxy-hostile network — the FROM pull goes
        # through the container engine's trust (OS certificate store).
        # Override to pin a different pushed base tag.
        OPENCODE_BASE_IMAGE: ${OPENCODE_BASE_IMAGE:-docker.io/openmercatocom/open-mercato-opencode:1.18.3}
    image: opencode-mvp
    container_name: mercato-opencode-${DEPLOY_ENV:-local}
    restart: unless-stopped
    environment:
      # Unified AI provider/model selection. OM_AI_* wins; OPENCODE_* stays
      # as a BC fallback resolved by the opencode entrypoint script.
      OM_AI_PROVIDER: ${OM_AI_PROVIDER:-openai}
      OM_AI_MODEL: ${OM_AI_MODEL:-gpt-5-mini}
      OPENCODE_PROVIDER: ${OPENCODE_PROVIDER:-}
      OPENCODE_MODEL: ${OPENCODE_MODEL:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      GOOGLE_GENERATIVE_AI_API_KEY: ${GOOGLE_GENERATIVE_AI_API_KEY:-}
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
      OPENROUTER_BASE_URL: ${OPENROUTER_BASE_URL:-}
      # Additional OM AI providers (Windows setup / .env). Forwarded so a
      # provider chosen in the configurator actually reaches this container.
      AZURE_OPENAI_API_KEY: ${AZURE_OPENAI_API_KEY:-}
      AZURE_OPENAI_BASE_URL: ${AZURE_OPENAI_BASE_URL:-}
      DEEPINFRA_API_KEY: ${DEEPINFRA_API_KEY:-}
      DEEPINFRA_BASE_URL: ${DEEPINFRA_BASE_URL:-}
      GROQ_API_KEY: ${GROQ_API_KEY:-}
      GROQ_BASE_URL: ${GROQ_BASE_URL:-}
      TOGETHER_API_KEY: ${TOGETHER_API_KEY:-}
      TOGETHER_BASE_URL: ${TOGETHER_BASE_URL:-}
      FIREWORKS_API_KEY: ${FIREWORKS_API_KEY:-}
      FIREWORKS_BASE_URL: ${FIREWORKS_BASE_URL:-}
      LITELLM_API_KEY: ${LITELLM_API_KEY:-}
      LITELLM_BASE_URL: ${LITELLM_BASE_URL:-}
      OLLAMA_API_KEY: ${OLLAMA_API_KEY:-}
      OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-}
      LM_STUDIO_API_KEY: ${LM_STUDIO_API_KEY:-}
      LM_STUDIO_BASE_URL: ${LM_STUDIO_BASE_URL:-}
      # In-network MCP wiring. MCP_SERVER_API_KEY (env) wins when set; the
      # file fallback reads the key the mcp service provisioned into the
      # shared volume after waiting for the MCP /health endpoint.
      OPENCODE_MCP_URL: ${OPENCODE_MCP_URL:-http://mcp:3001/mcp}
      MCP_SERVER_API_KEY: ${MCP_SERVER_API_KEY:-}
      MCP_SERVER_API_KEY_FILE: /run/mcp-shared/mcp-api-key
    volumes:
      - mcp_shared:/run/mcp-shared:ro
      # File-defined agents (delivery model A — dev bind-mount). The generator
      # emits these from `agents/<id>/` dirs; OpenCode loads them on new sessions
      # (no guaranteed hot-reload — restart this service after `yarn generate`).
      - ./docker/opencode/agents:/home/opencode/.config/opencode/agents:ro
      # Native OpenCode skills (Phase 3). Generated from `agents/<id>/skills/`;
      # loaded on new sessions (restart this service after `yarn generate`).
      - ./docker/opencode/skills:/home/opencode/.config/opencode/skills:ro
      # Corporate CA bundle for pulled images (entrypoint exports
      # SSL_CERT_FILE/NODE_EXTRA_CA_CERTS when certs are present).
      - ./docker/opencode/certs:/run/om-certs:ro
    ports:
      - "${OPENCODE_PORT:-4096}:4096"
    depends_on:
      mcp:
        condition: service_started
    # Visibility only (compose ps / smoke tests): the entrypoint owns the
    # wait-for-MCP-and-key sequencing.
    healthcheck:
      test: ["CMD", "curl", "-fsS", "--max-time", "5", "http://127.0.0.1:4096/global/health"]
      interval: 30s
      timeout: 6s
      retries: 20
      start_period: 900s
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - mercato-network-fullapp

  mcp:
    # No build block on purpose: compose builds this exact tag via the app
    # service before creating containers, so declaring the build here would
    # only solve the multi-hundred-MB build context a second time.
    image: open-mercato/app:${DEPLOY_ENV:-local}-dev
    container_name: mercato-mcp-${DEPLOY_ENV:-local}
    restart: unless-stopped
    user: "0"
    command: ["/bin/sh", "/app/docker/scripts/mcp-entrypoint.sh"]
    volumes:
      - .:/app
      - app_node_modules:/app/node_modules
      - mcp_shared:/run/mcp-shared
      # Same dist volumes as the app service so the MCP process sees the
      # container-built package output instead of any host dist/ artifacts.
      # KEEP IN SYNC with the app service's pkg_*_dist list and the top-level
      # volumes block — a package missing here resolves stale host artifacts
      # only inside this container.
      - pkg_core_dist:/app/packages/core/dist
      - pkg_shared_dist:/app/packages/shared/dist
      - pkg_ui_dist:/app/packages/ui/dist
      - pkg_cli_dist:/app/packages/cli/dist
      - pkg_cache_dist:/app/packages/cache/dist
      - pkg_content_dist:/app/packages/content/dist
      - pkg_checkout_dist:/app/packages/checkout/dist
      - pkg_events_dist:/app/packages/events/dist
      - pkg_onboarding_dist:/app/packages/onboarding/dist
      - pkg_queue_dist:/app/packages/queue/dist
      - pkg_search_dist:/app/packages/search/dist
      - pkg_scheduler_dist:/app/packages/scheduler/dist
      - pkg_ai_assistant_dist:/app/packages/ai-assistant/dist
      - pkg_create_app_dist:/app/packages/create-app/dist
      - pkg_documents_dist:/app/packages/documents/dist
    ports:
      - "${MCP_PORT:-3001}:3001"
    environment:
      NODE_ENV: development
      NODE_OPTIONS: ${MCP_NODE_OPTIONS:---max-old-space-size=2048}
      DEPLOY_ENV: ${DEPLOY_ENV:-local}
      DATABASE_URL: postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@mercato-postgres-${DEPLOY_ENV:-local}:5432/${POSTGRES_DB:-open-mercato}
      REDIS_URL: redis://mercato-redis-${DEPLOY_ENV:-local}:6379
      QUEUE_REDIS_URL: redis://mercato-redis-${DEPLOY_ENV:-local}:6379
      CACHE_REDIS_URL: redis://mercato-redis-${DEPLOY_ENV:-local}:6379
      CACHE_STRATEGY: redis
      AUTO_SPAWN_WORKERS: "false"
      AUTO_SPAWN_SCHEDULER: "false"
      MEILISEARCH_HOST: http://mercato-meilisearch-${DEPLOY_ENV:-local}:7700
      MEILISEARCH_API_KEY: ${MEILISEARCH_MASTER_KEY:-meilisearch-dev-key}
      JWT_SECRET: ${JWT_SECRET:-JWT}
      # Code Mode api.request() must call back into the app over service DNS.
      # NEXT_PUBLIC_* are pinned because the CLI dotenv-loads the bind-mounted
      # apps/mercato/.env for vars missing from the container env — a host
      # .env pointing at localhost:3000 would otherwise hijack the base URL.
      APP_URL: http://app:3000
      NEXT_PUBLIC_APP_URL: http://app:3000
      NEXT_PUBLIC_API_BASE_URL: ""
      # Session-token (tier 2) decryption requires the app's encryption config.
      TENANT_DATA_ENCRYPTION: ${TENANT_DATA_ENCRYPTION:-true}
      TENANT_DATA_ENCRYPTION_DEBUG: ${TENANT_DATA_ENCRYPTION_DEBUG:-false}
      TENANT_DATA_ENCRYPTION_FALLBACK_KEY: ${TENANT_DATA_ENCRYPTION_FALLBACK_KEY:-dev-tenant-encryption-fallback-key-32chars}
      TENANT_DATA_ENCRYPTION_KEY: ${TENANT_DATA_ENCRYPTION_KEY:-}
      OM_INIT_SUPERADMIN_EMAIL: ${OM_INIT_SUPERADMIN_EMAIL:-}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      GOOGLE_GENERATIVE_AI_API_KEY: ${GOOGLE_GENERATIVE_AI_API_KEY:-}
      MCP_PORT: "3001"
      MCP_SERVER_API_KEY_FILE: /run/mcp-shared/mcp-api-key
      MCP_WAIT_FOR_APP_TIMEOUT: ${MCP_WAIT_FOR_APP_TIMEOUT:-1800}
      MCP_DEBUG: ${MCP_DEBUG:-false}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      meilisearch:
        condition: service_healthy
      app:
        condition: service_started
    # Visibility only (compose ps / smoke tests): startup ordering is owned by
    # the entrypoint wait loops, not by this healthcheck.
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3001/health"]
      interval: 30s
      timeout: 5s
      retries: 20
      start_period: 900s
    networks:
      - mercato-network-fullapp

  # Traefik (TLS termination, on-demand ACME, custom-domain ForwardAuth gate)
  # is now an opt-in overlay so this base file works behind an external reverse
  # proxy (Dokploy, Caddy, nginx, Cloudflare Tunnel, etc.) without conflict.
  # To run the bundled Traefik in dev, layer the prod-default overlay plus the
  # dev overlay (the dev overlay flips ACME to LE staging so iteration does
  # not burn LE production rate limits):
  #   docker compose --project-directory . -f starters/docker/compose.fullapp.dev.yml \
  #     -f starters/docker/compose.fullapp.traefik.yml \
  #     -f starters/docker/compose.fullapp.traefik.dev.yml up --build

  # One-shot: raise the shared WSL2/Linux kernel's inotify limits before the
  # app starts watching. Turbopack watches the whole repo via inotify and does
  # NOT honor the polling env vars above, so the defaults overflow with
  # "System limit for number of file watchers reached". All Docker Desktop /
  # WSL2 containers share one kernel, so this single privileged container
  # raises the limit for the app too. Each `|| true` keeps a read-only or
  # already-higher value from failing the run. If your Docker policy forbids
  # privileged containers, remove this service and the app's dependency on it,
  # then raise the limits on the host/WSL2 kernel yourself.
  file-watch-limits:
    image: busybox:1.37
    container_name: mercato-file-watch-limits-${DEPLOY_ENV:-local}
    privileged: true
    restart: "no"
    network_mode: none
    command:
      - sh
      - -c
      - |
        sysctl -w fs.inotify.max_user_watches=16777216 || true
        sysctl -w fs.inotify.max_user_instances=8192 || true
        sysctl -w fs.inotify.max_queued_events=1048576 || true
        echo "[file-watch-limits] inotify limits now:"
        sysctl fs.inotify.max_user_watches fs.inotify.max_user_instances fs.inotify.max_queued_events || true

  app:
    build:
      context: .
      target: dev
      args:
        # Optional internal Alpine mirror for proxy-blocked corporate networks
        # (empty = official CDN; see the Dockerfile builder stage comment).
        - ALPINE_MIRROR=${ALPINE_MIRROR:-}
    image: open-mercato/app:${DEPLOY_ENV:-local}-dev
    # Without a restart policy the app stays down after a daemon/host reboot
    # while mcp and opencode (restart: unless-stopped) wait on it forever.
    restart: unless-stopped
    user: "0"
    command: ["/bin/sh", "/app/docker/scripts/dev-entrypoint.sh"]
    # Traefik labels live in compose.fullapp.traefik.yml — opt-in only.
    volumes:
      - .:/app
      - app_node_modules:/app/node_modules
      - app_next:/app/apps/mercato/.next
      - init_marker:/tmp/init-marker
      - attachments_storage:/app/apps/mercato/storage
      # Exclude package dist dirs so container builds own output (avoids host dist overwriting .js imports).
      # KEEP IN SYNC with the mcp service's pkg_*_dist list and the top-level volumes block.
      - pkg_core_dist:/app/packages/core/dist
      - pkg_shared_dist:/app/packages/shared/dist
      - pkg_ui_dist:/app/packages/ui/dist
      - pkg_cli_dist:/app/packages/cli/dist
      - pkg_cache_dist:/app/packages/cache/dist
      - pkg_content_dist:/app/packages/content/dist
      - pkg_checkout_dist:/app/packages/checkout/dist
      - pkg_events_dist:/app/packages/events/dist
      - pkg_onboarding_dist:/app/packages/onboarding/dist
      - pkg_queue_dist:/app/packages/queue/dist
      - pkg_search_dist:/app/packages/search/dist
      - pkg_scheduler_dist:/app/packages/scheduler/dist
      - pkg_ai_assistant_dist:/app/packages/ai-assistant/dist
      - pkg_create_app_dist:/app/packages/create-app/dist
      # The documents-collab sidecar reads its server entry from this volume. The app service
      # owns the build that populates it, so it must be mounted here too — otherwise the volume
      # masks the bind-mounted host dist for the sidecar and nothing ever fills it.
      - pkg_documents_dist:/app/packages/documents/dist
      - mcp_shared:/run/mcp-shared:ro
    ports:
      - "${APP_PORT:-3000}:3000"
      - "${OM_DEV_SPLASH_PORT:-4000}:${OM_DEV_SPLASH_PORT:-4000}"
    environment:
      CHOKIDAR_USEPOLLING: ${CHOKIDAR_USEPOLLING:-true}
      WATCHPACK_POLLING: ${WATCHPACK_POLLING:-true}
      OM_DEV_SPLASH_PORT: ${OM_DEV_SPLASH_PORT:-4000}
      # Bind on all interfaces INSIDE the container: the dev server (next dev)
      # and the splash both default to loopback (127.0.0.1), which Docker's
      # published-port forwarding cannot reach, so the browser gets connection
      # refused even though the port is mapped.
      HOSTNAME: 0.0.0.0
      OM_DEV_SPLASH_BIND: ${OM_DEV_SPLASH_BIND:-0.0.0.0}
      REDIS_URL: redis://mercato-redis-${DEPLOY_ENV:-local}:6379
      QUEUE_REDIS_URL: redis://mercato-redis-${DEPLOY_ENV:-local}:6379
      TENANT_DATA_ENCRYPTION: ${TENANT_DATA_ENCRYPTION:-true}
      TENANT_DATA_ENCRYPTION_DEBUG: ${TENANT_DATA_ENCRYPTION_DEBUG:-false}
      TENANT_DATA_ENCRYPTION_FALLBACK_KEY: ${TENANT_DATA_ENCRYPTION_FALLBACK_KEY:-dev-tenant-encryption-fallback-key-32chars}
      NODE_ENV: development
      NODE_OPTIONS: ${NODE_OPTIONS:---max-old-space-size=3072}
      DEPLOY_ENV: ${DEPLOY_ENV:-local}
      PORT: 3000
      DATABASE_URL: postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@mercato-postgres-${DEPLOY_ENV:-local}:5432/${POSTGRES_DB:-open-mercato}
      JWT_SECRET: ${JWT_SECRET:-JWT}
      APP_URL: ${APP_URL:-http://localhost:3000}
      NEXT_PUBLIC_DOCUMENTS_COLLAB_URL: ${NEXT_PUBLIC_DOCUMENTS_COLLAB_URL:-}
      DOCUMENTS_COLLAB_JWT_SECRET_V2: ${DOCUMENTS_COLLAB_JWT_SECRET_V2:-dev-only-documents-collab-v2-secret}
      # Additional trusted app/dev origins for the Open Mercato origin allowlist (resolveAllowedDevOrigins)
      APP_ALLOWED_ORIGINS: ${APP_ALLOWED_ORIGINS:-}
      CACHE_REDIS_URL: redis://mercato-redis-${DEPLOY_ENV:-local}:6379
      CACHE_STRATEGY: redis
      ENABLE_CRUD_API_CACHE: ${ENABLE_CRUD_API_CACHE:-true}
      OM_AI_PROVIDER: ${OM_AI_PROVIDER:-openai}
      OM_AI_MODEL: ${OM_AI_MODEL:-gpt-5-mini}
      OPENCODE_PROVIDER: ${OPENCODE_PROVIDER:-}
      OPENCODE_MODEL: ${OPENCODE_MODEL:-}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      GOOGLE_GENERATIVE_AI_API_KEY: ${GOOGLE_GENERATIVE_AI_API_KEY:-}
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
      OPENROUTER_BASE_URL: ${OPENROUTER_BASE_URL:-}
      # Additional OM AI providers (Windows setup / .env), for the unified
      # in-process AI framework (playground / <AiChat>).
      AZURE_OPENAI_API_KEY: ${AZURE_OPENAI_API_KEY:-}
      AZURE_OPENAI_BASE_URL: ${AZURE_OPENAI_BASE_URL:-}
      DEEPINFRA_API_KEY: ${DEEPINFRA_API_KEY:-}
      DEEPINFRA_BASE_URL: ${DEEPINFRA_BASE_URL:-}
      GROQ_API_KEY: ${GROQ_API_KEY:-}
      GROQ_BASE_URL: ${GROQ_BASE_URL:-}
      TOGETHER_API_KEY: ${TOGETHER_API_KEY:-}
      TOGETHER_BASE_URL: ${TOGETHER_BASE_URL:-}
      FIREWORKS_API_KEY: ${FIREWORKS_API_KEY:-}
      FIREWORKS_BASE_URL: ${FIREWORKS_BASE_URL:-}
      LITELLM_API_KEY: ${LITELLM_API_KEY:-}
      LITELLM_BASE_URL: ${LITELLM_BASE_URL:-}
      OLLAMA_API_KEY: ${OLLAMA_API_KEY:-}
      OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-}
      LM_STUDIO_API_KEY: ${LM_STUDIO_API_KEY:-}
      LM_STUDIO_BASE_URL: ${LM_STUDIO_BASE_URL:-}
      MEILISEARCH_HOST: http://mercato-meilisearch-${DEPLOY_ENV:-local}:7700
      MEILISEARCH_API_KEY: ${MEILISEARCH_MASTER_KEY:-meilisearch-dev-key}
      NEXT_PUBLIC_UPGRADE_ACTIONS_ENABLED: ${NEXT_PUBLIC_UPGRADE_ACTIONS_ENABLED:-true}
      UPGRADE_ACTIONS_ENABLED: ${UPGRADE_ACTIONS_ENABLED:-true}
      SELF_SERVICE_ONBOARDING_ENABLED: ${SELF_SERVICE_ONBOARDING_ENABLED:-true}
      DEMO_MODE: ${DEMO_MODE:-true}
      RESEND_API_KEY: ${RESEND_API_KEY:-}
      EMAIL_FROM: ${EMAIL_FROM:-}
      NEW_RELIC_APP_NAME: ${NEW_RELIC_APP_NAME:-}
      NEW_RELIC_LICENSE_KEY: ${NEW_RELIC_LICENSE_KEY:-}
      TENANT_DATA_ENCRYPTION_KEY: ${TENANT_DATA_ENCRYPTION_KEY:-}
      ADMIN_EMAIL: ${ADMIN_EMAIL:-admin@example.com}
      OM_INIT_SUPERADMIN_EMAIL: ${OM_INIT_SUPERADMIN_EMAIL:-}
      OM_INIT_SUPERADMIN_PASSWORD: ${OM_INIT_SUPERADMIN_PASSWORD:-password}
      SSO_DEV_SEED: ${SSO_DEV_SEED:-true}
      # Service DNS, not the container_name: survives DEPLOY_ENV != local.
      SSO_DEV_ISSUER: ${SSO_DEV_ISSUER:-http://keycloak:8080/realms/open-mercato}
      SSO_DEV_CLIENT_ID: ${SSO_DEV_CLIENT_ID:-open-mercato-app}
      SSO_DEV_CLIENT_SECRET: ${SSO_DEV_CLIENT_SECRET:-}
      SSO_DEV_ALLOWED_DOMAINS: ${SSO_DEV_ALLOWED_DOMAINS:-example.com}
      # Custom-domain routing (Phase 1–3 of portal-custom-domain spec).
      DOMAIN_CHECK_SECRET: ${DOMAIN_CHECK_SECRET:-}
      DOMAIN_RESOLVE_SECRET: ${DOMAIN_RESOLVE_SECRET:-}
      INTERNAL_APP_ORIGIN: ${INTERNAL_APP_ORIGIN:-http://app:3000}
      PLATFORM_DOMAINS: ${PLATFORM_DOMAINS:-localhost,openmercato.com}
      PLATFORM_PORTAL_BASE_URL: ${PLATFORM_PORTAL_BASE_URL:-https://openmercato.com}
      CUSTOMER_DOMAIN_ORIGIN_HEADER: ${CUSTOMER_DOMAIN_ORIGIN_HEADER:-X-Open-Mercato-Origin}
      # AI assistant wiring (service DNS; NEXT_PUBLIC_APP_URL stays a
      # browser-resolvable URL and must NOT point at service DNS).
      OPENCODE_URL: ${OPENCODE_URL:-http://opencode:4096}
      MCP_URL: ${MCP_URL:-http://mcp:3001}
      MCP_SERVER_API_KEY_FILE: /run/mcp-shared/mcp-api-key
    depends_on:
      file-watch-limits:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      meilisearch:
        condition: service_healthy
    # Visibility only (compose ps / smoke tests); dependents use their own
    # entrypoint waits, so tuning this does not change startup ordering.
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3000"]
      interval: 30s
      timeout: 10s
      retries: 40
      start_period: 900s
    networks:
      - mercato-network-fullapp

  documents-collab:
    profiles:
      - documents-collab
    # Reuse the dev image built by app instead of rebuilding the same tag.
    image: open-mercato/app:${DEPLOY_ENV:-local}-dev
    command: ["yarn", "documents:collab"]
    working_dir: /app
    # Restart so a first boot that loses the race for the shared
    # pkg_documents_dist volume (still being built by the app image) comes back
    # up once dist is present, instead of exiting and staying dead.
    restart: unless-stopped
    volumes:
      - .:/app
      - app_node_modules:/app/node_modules
      - pkg_documents_dist:/app/packages/documents/dist
    ports:
      - "${DOCUMENTS_COLLAB_PORT:-4101}:${DOCUMENTS_COLLAB_PORT:-4101}"
    environment:
      NODE_ENV: development
      DATABASE_URL: postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@mercato-postgres-${DEPLOY_ENV:-local}:5432/${POSTGRES_DB:-open-mercato}
      JWT_SECRET: ${JWT_SECRET:-JWT}
      APP_URL: ${APP_URL:-http://localhost:3000}
      NEXT_PUBLIC_APP_URL: ${APP_URL:-http://localhost:3000}
      DOCUMENTS_COLLAB_PORT: ${DOCUMENTS_COLLAB_PORT:-4101}
      DOCUMENTS_COLLAB_REDIS_URL: redis://mercato-redis-${DEPLOY_ENV:-local}:6379
      DOCUMENTS_COLLAB_REDIS_PREFIX: ${DOCUMENTS_COLLAB_REDIS_PREFIX:-open-mercato:documents:collab:${DEPLOY_ENV:-local}}
      # Same Redis as the app so multi-instance collaboration sync works out of the box
      # (DOCUMENTS_COLLAB_REDIS_URL wins when both are set).
      REDIS_URL: redis://mercato-redis-${DEPLOY_ENV:-local}:6379
      DOCUMENTS_COLLAB_ALLOWED_ORIGINS: ${DOCUMENTS_COLLAB_ALLOWED_ORIGINS:-http://localhost:3000}
      DOCUMENTS_COLLAB_JWT_SECRET_V2: ${DOCUMENTS_COLLAB_JWT_SECRET_V2:-dev-only-documents-collab-v2-secret}
      DOCUMENTS_COLLAB_JWT_SECRET: ${DOCUMENTS_COLLAB_JWT_SECRET:-}
      DOCUMENTS_COLLAB_APP_ROOT: /app/apps/mercato
      # Mirror the app service's tenant-encryption configuration so the sidecar
      # can decrypt the same data as the app.
      TENANT_DATA_ENCRYPTION: ${TENANT_DATA_ENCRYPTION:-true}
      TENANT_DATA_ENCRYPTION_DEBUG: ${TENANT_DATA_ENCRYPTION_DEBUG:-false}
      TENANT_DATA_ENCRYPTION_FALLBACK_KEY: ${TENANT_DATA_ENCRYPTION_FALLBACK_KEY:-dev-tenant-encryption-fallback-key-32chars}
      TENANT_DATA_ENCRYPTION_KEY: ${TENANT_DATA_ENCRYPTION_KEY:-}
      CACHE_REDIS_URL: redis://mercato-redis-${DEPLOY_ENV:-local}:6379
      CACHE_STRATEGY: redis
    depends_on:
      app:
        condition: service_started
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - mercato-network-fullapp

  postgres:
    image: pgvector/pgvector:pg17-trixie
    container_name: mercato-postgres-${DEPLOY_ENV:-local}
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      POSTGRES_DB: ${POSTGRES_DB:-open-mercato}
    # ports not exposed - only accessible within docker network
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - mercato-network-fullapp

  redis:
    image: redis:7-alpine
    container_name: mercato-redis-${DEPLOY_ENV:-local}
    restart: unless-stopped
    # ports not exposed - only accessible within docker network
    volumes:
      - ./docker/redis/redis.conf:/usr/local/etc/redis/redis.conf
      - redis_data:/data
    command: redis-server /usr/local/etc/redis/redis.conf --maxmemory ${REDIS_MAXMEMORY:-512mb}
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - mercato-network-fullapp

  keycloak:
    image: quay.io/keycloak/keycloak:26.1
    container_name: mercato-keycloak-${DEPLOY_ENV:-local}
    restart: unless-stopped
    command: start-dev
    environment:
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-admin}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
    ports:
      - "${KEYCLOAK_PORT:-8080}:8080"
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/8080; echo -e 'GET /health/ready HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3; cat <&3 | grep -q '200'"]
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 30s
    networks:
      - mercato-network-fullapp

  meilisearch:
    image: getmeili/meilisearch:v1.11
    container_name: mercato-meilisearch-${DEPLOY_ENV:-local}
    restart: unless-stopped
    environment:
      MEILI_ENV: development
      MEILI_MASTER_KEY: ${MEILISEARCH_MASTER_KEY:-meilisearch-dev-key}
      MEILI_NO_ANALYTICS: "true"
    # ports not exposed - only accessible within docker network
    volumes:
      - meilisearch_data:/meili_data
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:7700/health"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - mercato-network-fullapp

  localstack:
    image: localstack/localstack:latest
    container_name: mercato-localstack-${DEPLOY_ENV:-local}
    restart: unless-stopped
    profiles:
      - storage-s3
    ports:
      - "${LOCALSTACK_PORT:-4566}:4566"
    environment:
      SERVICES: s3
      AWS_DEFAULT_REGION: us-east-1
      LOCALSTACK_HOST: localhost
    volumes:
      - localstack_data:/var/lib/localstack
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:4566/_localstack/health"]
      interval: 10s
      timeout: 5s
      retries: 10
    networks:
      - mercato-network-fullapp

volumes:
  postgres_data:
    name: mercato-postgres-data-${DEPLOY_ENV:-local}
  redis_data:
    name: mercato-redis-data-${DEPLOY_ENV:-local}
  meilisearch_data:
    name: mercato-meilisearch-data-${DEPLOY_ENV:-local}
  localstack_data:
    name: mercato-localstack-data-${DEPLOY_ENV:-local}
  init_marker:
    name: mercato-init-marker-${DEPLOY_ENV:-local}
  mcp_shared:
    name: mercato-mcp-shared-${DEPLOY_ENV:-local}
  attachments_storage:
    name: mercato-attachments-storage-${DEPLOY_ENV:-local}
  app_node_modules:
    name: mercato-app-node-modules-${DEPLOY_ENV:-local}
  app_next:
    name: mercato-app-next-${DEPLOY_ENV:-local}
  pkg_core_dist:
    name: mercato-pkg-core-dist-${DEPLOY_ENV:-local}
  pkg_shared_dist:
    name: mercato-pkg-shared-dist-${DEPLOY_ENV:-local}
  pkg_ui_dist:
    name: mercato-pkg-ui-dist-${DEPLOY_ENV:-local}
  pkg_cli_dist:
    name: mercato-pkg-cli-dist-${DEPLOY_ENV:-local}
  pkg_cache_dist:
    name: mercato-pkg-cache-dist-${DEPLOY_ENV:-local}
  pkg_content_dist:
    name: mercato-pkg-content-dist-${DEPLOY_ENV:-local}
  pkg_checkout_dist:
    name: mercato-pkg-checkout-dist-${DEPLOY_ENV:-local}
  pkg_events_dist:
    name: mercato-pkg-events-dist-${DEPLOY_ENV:-local}
  pkg_onboarding_dist:
    name: mercato-pkg-onboarding-dist-${DEPLOY_ENV:-local}
  pkg_queue_dist:
    name: mercato-pkg-queue-dist-${DEPLOY_ENV:-local}
  pkg_search_dist:
    name: mercato-pkg-search-dist-${DEPLOY_ENV:-local}
  pkg_scheduler_dist:
    name: mercato-pkg-scheduler-dist-${DEPLOY_ENV:-local}
  pkg_ai_assistant_dist:
    name: mercato-pkg-ai-assistant-dist-${DEPLOY_ENV:-local}
  pkg_create_app_dist:
    name: mercato-pkg-create-app-dist-${DEPLOY_ENV:-local}
  pkg_documents_dist:
    name: mercato-pkg-documents-dist-${DEPLOY_ENV:-local}

networks:
  mercato-network-fullapp:
    name: mercato-network-${DEPLOY_ENV:-local}-v2
    driver: bridge