# Brain of Reese — service orchestration.
#
#   Development:   podman compose up -d            # starts Postgres 17 + pgvector
#   Full stack:    podman compose --profile prod up -d   # adds the app container
#
# The `db` image is built locally from `./db` (base: docker.io/postgres:17,
# extended with the pgvector extension) so no non-official base image is used.

name: brain-of-reese

services:
  db:
    build:
      context: ./db
    image: brain-of-reese/db:pg17-vector
    restart: unless-stopped
    environment:
      POSTGRES_USER: reese
      POSTGRES_PASSWORD: reese
      POSTGRES_DB: brain_of_reese
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U reese -d brain_of_reese"]
      interval: 5s
      timeout: 5s
      retries: 12

  app:
    build:
      context: .
    image: brain-of-reese/app:latest
    restart: unless-stopped
    profiles: ["prod"]
    depends_on:
      db:
        condition: service_healthy
    environment:
      BOR_ENVIRONMENT: production
      BOR_DATABASE_URL: postgresql+psycopg://reese:reese@db:5432/brain_of_reese
      BOR_LLM_BASE_URL: https://aipi.reeseapps.com/v1
      # BOR_LLM_API_KEY: provide via shell env or your own env file — never commit it
      # Single-admin auth (phase 16) is a fail-loud boot gate: set both via
      # your shell env or an env file for the prod profile (the app refuses
      # to boot without them). `:-` defaults keep `podman compose up -d db`
      # (the dev workflow) parseable without them. Values are secrets:
      # never commit them.
      BOR_ADMIN_PASSWORD: ${BOR_ADMIN_PASSWORD:-}
      BOR_SESSION_SECRET: ${BOR_SESSION_SECRET:-}
    ports:
      - "8000:8000"

volumes:
  pgdata: