harlenalvarez/huddle-stack:2026.10.07-1

name: huddle

services:
  postgres:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-postgres:${HUDDLE_IMAGE_TAG:-dev}
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_ALLOWED_HOSTS: postgres
    volumes:
      - postgres_data:/var/lib/postgresql
    networks:
      - backend
    healthcheck:
      # Check the private listener without assuming a role from DATABASE_URL;
      # the custom entrypoint may initialize any configured username.
      test:
        [
          'CMD',
          'python3',
          '-c',
          "import socket; connection = socket.create_connection(('127.0.0.1', 5432), 3); connection.close()",
        ]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 15s
    restart: unless-stopped

  zitadel-db-init:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-postgres:${HUDDLE_IMAGE_TAG:-dev}
    entrypoint: ['python3', '/usr/local/lib/huddle/zitadel_db_init.py']
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_ALLOWED_HOSTS: postgres
      ZITADEL_DB_NAME: ${ZITADEL_DB_NAME:-zitadel}
      ZITADEL_DB_USER: ${ZITADEL_DB_USER:-zitadel}
      ZITADEL_DB_PASSWORD: ${ZITADEL_DB_PASSWORD:?ZITADEL_DB_PASSWORD is required}
      ZITADEL_MASTERKEY: ${ZITADEL_MASTERKEY:?ZITADEL_MASTERKEY is required}
      ZITADEL_SESSION_COOKIE_SECRET: ${ZITADEL_SESSION_COOKIE_SECRET:?ZITADEL_SESSION_COOKIE_SECRET is required}
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - zitadel_bootstrap:/zitadel/bootstrap
    networks:
      - backend
    restart: 'no'

  zitadel-api:
    image: ghcr.io/zitadel/zitadel:${ZITADEL_VERSION:-v4.19.3}
    user: '0'
    command:
      ['start-from-init', '--masterkey', '${ZITADEL_MASTERKEY:?ZITADEL_MASTERKEY is required}']
    environment:
      ZITADEL_PORT: '8080'
      ZITADEL_TLS_ENABLED: 'false'
      ZITADEL_EXTERNALDOMAIN: ${ZITADEL_DOMAIN:-localhost}
      ZITADEL_EXTERNALPORT: ${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}}
      ZITADEL_EXTERNALSECURE: ${ZITADEL_EXTERNALSECURE:-false}
      ZITADEL_DATABASE_POSTGRES_DSN: postgresql://${ZITADEL_DB_USER:-zitadel}:${ZITADEL_DB_PASSWORD:?ZITADEL_DB_PASSWORD is required}@postgres:5432/${ZITADEL_DB_NAME:-zitadel}?sslmode=disable
      ZITADEL_FIRSTINSTANCE_ORG_NAME: ${ZITADEL_ADMIN_ORG:-Huddle Admin}
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME: ${ZITADEL_ADMIN_EMAIL:?ZITADEL_ADMIN_EMAIL is required}
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS: ${ZITADEL_ADMIN_EMAIL:?ZITADEL_ADMIN_EMAIL is required}
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_VERIFIED: 'true'
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_FIRSTNAME: Huddle
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_LASTNAME: Admin
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD: ${ZITADEL_ADMIN_PASSWORD:?ZITADEL_ADMIN_PASSWORD is required}
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED: 'false'
      ZITADEL_FIRSTINSTANCE_PATPATH: /zitadel/bootstrap/admin.pat
      ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_USERNAME: huddle-bootstrap
      ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_NAME: Huddle bootstrap administrator
      ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_EXPIRATIONDATE: ${ZITADEL_ADMIN_PAT_EXPIRATION:-2027-10-01T00:00:00Z}
      ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH: /zitadel/bootstrap/login-client.pat
      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_USERNAME: login-client
      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_NAME: Huddle Login v2
      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_PAT_EXPIRATIONDATE: ${ZITADEL_LOGIN_PAT_EXPIRATION:-2027-10-01T00:00:00Z}
      ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED: 'true'
      ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_BASEURI: ${ZITADEL_PUBLIC_SCHEME:-http}://${ZITADEL_DOMAIN:-localhost}:${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}}/ui/v2/login/
      ZITADEL_OIDC_DEFAULTLOGINURLV2: ${ZITADEL_PUBLIC_SCHEME:-http}://${ZITADEL_DOMAIN:-localhost}:${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}}/ui/v2/login/login?authRequest=
      ZITADEL_OIDC_DEFAULTLOGOUTURLV2: ${ZITADEL_PUBLIC_SCHEME:-http}://${ZITADEL_DOMAIN:-localhost}:${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}}/ui/v2/login/logout?post_logout_redirect=
      ZITADEL_SAML_DEFAULTLOGINURLV2: ${ZITADEL_PUBLIC_SCHEME:-http}://${ZITADEL_DOMAIN:-localhost}:${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}}/ui/v2/login/login?samlRequest=
      # Invite-only from first start, before the operator runs bootstrap.
      ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_ALLOWREGISTER: 'false'
      ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_ALLOWUSERNAMEPASSWORD: 'true'
      ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_FORCEMFA: 'false'
      ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_HIDEPASSWORDRESET: 'true'
      ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_ALLOWEXTERNALIDP: 'false'
      ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_ALLOWDOMAINDISCOVERY: 'false'
      ZITADEL_DEFAULTINSTANCE_LOGINPOLICY_PASSWORDLESSTYPE: '0'
    depends_on:
      zitadel-db-init:
        condition: service_completed_successfully
    volumes:
      - zitadel_bootstrap:/zitadel/bootstrap
    networks:
      - backend
    healthcheck:
      test: ['CMD', '/app/zitadel', 'ready']
      interval: 10s
      timeout: 30s
      retries: 12
      start_period: 30s
    restart: unless-stopped

  zitadel-login:
    image: ghcr.io/zitadel/zitadel-login:${ZITADEL_VERSION:-v4.19.3}
    user: '0'
    environment:
      ZITADEL_API_URL: http://zitadel-api:8080
      NEXT_PUBLIC_BASE_PATH: /ui/v2/login
      ZITADEL_SERVICE_USER_TOKEN_FILE: /zitadel/bootstrap/login-client.pat
      ZITADEL_SESSION_COOKIE_SECRET: ${ZITADEL_SESSION_COOKIE_SECRET:?ZITADEL_SESSION_COOKIE_SECRET is required}
      CUSTOM_REQUEST_HEADERS: Host:${ZITADEL_DOMAIN:-localhost}:${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}},X-Forwarded-Proto:${ZITADEL_PUBLIC_SCHEME:-http}
    depends_on:
      zitadel-api:
        condition: service_healthy
    volumes:
      - zitadel_bootstrap:/zitadel/bootstrap:ro
    networks:
      - backend
    healthcheck:
      test: ['CMD', 'node', '/app/healthcheck.mjs', 'http://localhost:3000/ui/v2/login/healthy']
      interval: 10s
      timeout: 30s
      retries: 12
      start_period: 30s
    restart: unless-stopped

  zitadel:
    image: caddy:2-alpine
    environment:
      ZITADEL_SITE_ADDRESS: ${ZITADEL_SITE_ADDRESS:-http://:8080}
    configs:
      - source: zitadel_caddyfile
        target: /etc/caddy/Caddyfile
    depends_on:
      zitadel-login:
        condition: service_healthy
      zitadel-api:
        condition: service_healthy
    networks:
      - frontend
      - backend
    healthcheck:
      test:
        ['CMD', 'wget', '--quiet', '--output-document=/dev/null', 'http://127.0.0.1:2019/config/']
      interval: 10s
      timeout: 5s
      retries: 12
    restart: unless-stopped

  redis:
    image: redis:8-alpine
    command: ['redis-server', '--appendonly', 'yes']
    volumes:
      - redis_data:/data
    networks:
      - backend
    healthcheck:
      test: ['CMD', 'redis-cli', 'ping']
      interval: 5s
      timeout: 3s
      retries: 20
    restart: unless-stopped

  nats:
    image: nats:2-alpine
    command: ['-js', '-sd', '/data', '-m', '8222']
    volumes:
      - nats_data:/data
    networks:
      - backend
    healthcheck:
      test: ['CMD', 'wget', '--quiet', '--spider', 'http://127.0.0.1:8222/healthz']
      interval: 5s
      timeout: 3s
      retries: 20
    restart: unless-stopped

  nats-tools:
    image: natsio/nats-box:latest
    profiles: ['tools']
    entrypoint: ['sleep', 'infinity']
    depends_on:
      nats:
        condition: service_healthy
    networks:
      - backend

  artifact-storage-init:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    user: '0:0'
    entrypoint: ['sh', '-c']
    command:
      - mkdir -p /var/lib/huddle/artifacts && chown -R 10001:10001 /var/lib/huddle/artifacts
    volumes:
      - artifact_data:/var/lib/huddle/artifacts
    restart: 'no'

  api:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_STARTUP_TIMEOUT: ${DATABASE_STARTUP_TIMEOUT:-120}
      # Allow Zitadel bootstrap to render the stack before the org exists.
      # The ownership migration rejects a missing ID before changing the schema.
      ZITADEL_BOOTSTRAP_OWNER_ID: ${ZITADEL_BOOTSTRAP_OWNER_ID:-}
      FERNET_KEY: ${FERNET_KEY:?FERNET_KEY is required}
      ARTIFACT_BLOB_ROOT: /var/lib/huddle/artifacts
      HTTP_TIMEOUT: ${HTTP_TIMEOUT:-300}
      HTTPX_MAX_CONNECTIONS: ${HTTPX_MAX_CONNECTIONS:-100}
      HTTP_MAX_KEEPALIVE: ${HTTP_MAX_KEEPALIVE:-20}
      ASR_WS_URL: ${ASR_WS_URL:-ws://spark-427e.local:8005/v1/audio/transcriptions/realtime}
      VLLM_API_KEY: ${VLLM_API_KEY:-EMPTY}
      CHAT_HEIC_MODE: ${CHAT_HEIC_MODE:-passthrough}
      EXA_API_KEY: ${EXA_API_KEY:-}
      REDIS_HOST: redis:6379
      REDIS_KEY_PREFIX: ${REDIS_KEY_PREFIX:-huddle:}
      REDIS_MAX_CONNECTIONS: ${REDIS_MAX_CONNECTIONS:-10}
      REDIS_SOCKET_CONNECT_TIMEOUT: ${REDIS_SOCKET_CONNECT_TIMEOUT:-10.0}
      REDIS_SOCKET_TIMEOUT: ${REDIS_SOCKET_TIMEOUT:-30.0}
      REDIS_SOCKET_KEEPALIVE: ${REDIS_SOCKET_KEEPALIVE:-true}
      REDIS_SSL_ENABLED: 'false'
      REDIS_IS_CLUSTER: 'false'
      NATS_URL: nats://nats:4222
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      WEB_PUSH_ENABLED: ${WEB_PUSH_ENABLED:-false}
      WEB_PUSH_VAPID_PUBLIC_KEY: ${WEB_PUSH_VAPID_PUBLIC_KEY:-}
      OAUTH_CLIENT_ID: ${OAUTH_CLIENT_ID:-}
      OAUTH_ISSUER: ${OAUTH_ISSUER:-${ZITADEL_PUBLIC_SCHEME:-http}://${ZITADEL_DOMAIN:-localhost}:${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}}}
      OAUTH_AUDIENCE: ${OAUTH_AUDIENCE:-}
      OAUTH_JWKS_URL: ${OAUTH_JWKS_URL:-http://zitadel:8080/oauth/v2/keys}
      OAUTH_JWKS_HOST_HEADER: ${OAUTH_JWKS_HOST_HEADER:-${ZITADEL_DOMAIN:-localhost}:${ZITADEL_EXTERNALPORT:-${ZITADEL_HTTP_PORT:-8080}}}
      OAUTH_OWNER_CLAIM: ${OAUTH_OWNER_CLAIM:-urn:zitadel:iam:user:resourceowner:id}
      OAUTH_END_SESSION_ENDPOINT: ${OAUTH_END_SESSION_ENDPOINT:-}
      OAUTH_SCOPES: ${OAUTH_SCOPES:-}
      HUDDLE_PUBLIC_ORIGIN: ${HUDDLE_PUBLIC_ORIGIN:-https://localhost}
      HUDDLE_LANDING_ORIGIN: ${HUDDLE_LANDING_ORIGIN:-}
      INTEREST_TOKEN_SECRET: ${INTEREST_TOKEN_SECRET:-}
      INTEREST_HOURLY_SIGNUP_LIMIT: ${INTEREST_HOURLY_SIGNUP_LIMIT:-60}
      INTEREST_DAILY_EMAIL_LIMIT: ${INTEREST_DAILY_EMAIL_LIMIT:-100}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USERNAME: ${SMTP_USERNAME:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM: ${SMTP_FROM:-}
      SMTP_STARTTLS: ${SMTP_STARTTLS:-true}
      EBAY_ENVIRONMENT: ${EBAY_ENVIRONMENT:-sandbox}
      EBAY_CLIENT_ID: ${EBAY_CLIENT_ID:-}
      EBAY_CLIENT_SECRET: ${EBAY_CLIENT_SECRET:-}
      EBAY_REDIRECT_URI: ${EBAY_REDIRECT_URI:-}
      EBAY_ALLOW_PRODUCTION: ${EBAY_ALLOW_PRODUCTION:-false}
      EBAY_ACCOUNT_DELETION_VERIFICATION_TOKEN: ${EBAY_ACCOUNT_DELETION_VERIFICATION_TOKEN:-}
      EBAY_ACCOUNT_DELETION_PUBLIC_ORIGIN: ${EBAY_ACCOUNT_DELETION_PUBLIC_ORIGIN:-}
      EBAY_SANDBOX_API_URL: ${EBAY_SANDBOX_API_URL:-https://api.sandbox.ebay.com}
      EBAY_PRODUCTION_API_URL: ${EBAY_PRODUCTION_API_URL:-https://api.ebay.com}
      EBAY_SANDBOX_INVENTORY_API_URL: ${EBAY_SANDBOX_INVENTORY_API_URL:-https://api.sandbox.ebay.com/sell/inventory/v1}
      EBAY_PRODUCTION_INVENTORY_API_URL: ${EBAY_PRODUCTION_INVENTORY_API_URL:-https://api.ebay.com/sell/inventory/v1}
    depends_on:
      artifact-storage-init:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      nats:
        condition: service_healthy
    volumes:
      - artifact_data:/var/lib/huddle/artifacts
    networks:
      - backend
      - frontend
      - webhook_backend
    healthcheck:
      test:
        [
          'CMD',
          'python',
          '-c',
          "import urllib.request; urllib.request.urlopen('http://127.0.0.1:9000/api/health', timeout=3)",
        ]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 30s
    restart: unless-stopped

  schedule-publisher:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    entrypoint: ['python', '-m', 'huddle_api.scheduled_worker', 'scheduler']
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_HOST_OVERRIDE: postgres
      DATABASE_PORT_OVERRIDE: '5432'
      FERNET_KEY: ${FERNET_KEY:?FERNET_KEY is required}
      NATS_URL: nats://nats:4222
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      HUDDLE_PUBLIC_ORIGIN: ${HUDDLE_PUBLIC_ORIGIN:-https://localhost}
      REDIS_HOST: redis:6379
      REDIS_KEY_PREFIX: ${REDIS_KEY_PREFIX:-huddle:}
      VLLM_API_KEY: ${VLLM_API_KEY:-EMPTY}
      EXA_API_KEY: ${EXA_API_KEY:-}
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_healthy
      api:
        condition: service_healthy
    networks:
      - backend
    restart: unless-stopped

  notification-live-worker:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    entrypoint: ['python', '-m', 'huddle_api.live_outbox_worker', 'notifications']
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_HOST_OVERRIDE: postgres
      DATABASE_PORT_OVERRIDE: '5432'
      FERNET_KEY: ${FERNET_KEY:?FERNET_KEY is required}
      NATS_URL: nats://nats:4222
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      WEB_PUSH_VAPID_PUBLIC_KEY: ${WEB_PUSH_VAPID_PUBLIC_KEY:-}
      WEB_PUSH_VAPID_PRIVATE_KEY: ${WEB_PUSH_VAPID_PRIVATE_KEY:-}
      WEB_PUSH_VAPID_SUBJECT: ${WEB_PUSH_VAPID_SUBJECT:-}
      WEB_PUSH_ENABLED: ${WEB_PUSH_ENABLED:-false}
      HUDDLE_PUBLIC_ORIGIN: ${HUDDLE_PUBLIC_ORIGIN:-https://localhost}
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_healthy
      api:
        condition: service_healthy
    networks:
      - backend
      # Web Push must reach external browser push providers.
      - frontend
    restart: unless-stopped

  schedule-live-worker:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    entrypoint: ['python', '-m', 'huddle_api.live_outbox_worker', 'schedules']
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_HOST_OVERRIDE: postgres
      DATABASE_PORT_OVERRIDE: '5432'
      FERNET_KEY: ${FERNET_KEY:?FERNET_KEY is required}
      NATS_URL: nats://nats:4222
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_healthy
      api:
        condition: service_healthy
    networks:
      - backend
    restart: unless-stopped

  chat-thread-live-worker:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    entrypoint: ['python', '-m', 'huddle_api.live_outbox_worker', 'chat.threads']
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_HOST_OVERRIDE: postgres
      DATABASE_PORT_OVERRIDE: '5432'
      FERNET_KEY: ${FERNET_KEY:?FERNET_KEY is required}
      NATS_URL: nats://nats:4222
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_healthy
      api:
        condition: service_healthy
    networks:
      - backend
    restart: unless-stopped

  scheduled-task-worker:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-api:${HUDDLE_IMAGE_TAG:-dev}
    entrypoint: ['python', '-m', 'huddle_api.scheduled_worker', 'worker']
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      DATABASE_HOST_OVERRIDE: postgres
      DATABASE_PORT_OVERRIDE: '5432'
      FERNET_KEY: ${FERNET_KEY:?FERNET_KEY is required}
      ARTIFACT_BLOB_ROOT: /var/lib/huddle/artifacts
      NATS_URL: nats://nats:4222
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      HUDDLE_PUBLIC_ORIGIN: ${HUDDLE_PUBLIC_ORIGIN:-https://localhost}
      REDIS_HOST: redis:6379
      REDIS_KEY_PREFIX: ${REDIS_KEY_PREFIX:-huddle:}
      VLLM_API_KEY: ${VLLM_API_KEY:-EMPTY}
      HTTP_TIMEOUT: ${HTTP_TIMEOUT:-300}
      HTTPX_MAX_CONNECTIONS: ${HTTPX_MAX_CONNECTIONS:-100}
      HTTP_MAX_KEEPALIVE: ${HTTP_MAX_KEEPALIVE:-20}
      CHAT_HEIC_MODE: ${CHAT_HEIC_MODE:-passthrough}
      EXA_API_KEY: ${EXA_API_KEY:-}
      EBAY_ENVIRONMENT: ${EBAY_ENVIRONMENT:-sandbox}
      EBAY_CLIENT_ID: ${EBAY_CLIENT_ID:-}
      EBAY_CLIENT_SECRET: ${EBAY_CLIENT_SECRET:-}
      EBAY_REDIRECT_URI: ${EBAY_REDIRECT_URI:-}
      EBAY_ALLOW_PRODUCTION: ${EBAY_ALLOW_PRODUCTION:-false}
      EBAY_SANDBOX_API_URL: ${EBAY_SANDBOX_API_URL:-https://api.sandbox.ebay.com}
      EBAY_PRODUCTION_API_URL: ${EBAY_PRODUCTION_API_URL:-https://api.ebay.com}
      EBAY_SANDBOX_INVENTORY_API_URL: ${EBAY_SANDBOX_INVENTORY_API_URL:-https://api.sandbox.ebay.com/sell/inventory/v1}
      EBAY_PRODUCTION_INVENTORY_API_URL: ${EBAY_PRODUCTION_INVENTORY_API_URL:-https://api.ebay.com/sell/inventory/v1}
    depends_on:
      postgres:
        condition: service_healthy
      nats:
        condition: service_healthy
      api:
        condition: service_healthy
    volumes:
      - artifact_data:/var/lib/huddle/artifacts
    networks:
      - backend
      - frontend
      - webhook_backend
    restart: unless-stopped

  web:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-web:${HUDDLE_IMAGE_TAG:-dev}
    networks:
      - frontend
    healthcheck:
      test: ['CMD', 'wget', '--quiet', '--output-document=/dev/null', 'http://127.0.0.1/healthz']
      interval: 10s
      timeout: 5s
      retries: 12
    restart: unless-stopped

  landing:
    image: docker.io/${DOCKER_HUB_NAMESPACE:-local}/huddle-landing-web:${HUDDLE_IMAGE_TAG:-dev}
    environment:
      HUDDLE_APP_ORIGIN: ${HUDDLE_PUBLIC_ORIGIN:-https://localhost}
    networks:
      - frontend
    healthcheck:
      test: ['CMD', 'wget', '--quiet', '--output-document=/dev/null', 'http://127.0.0.1/healthz']
      interval: 10s
      timeout: 5s
      retries: 12
    restart: unless-stopped

  caddy:
    image: caddy:2-alpine
    environment:
      HUDDLE_HOSTNAME: ${HUDDLE_HOSTNAME:-localhost}
      HUDDLE_LANDING_HOSTNAME: ${HUDDLE_LANDING_HOSTNAME:-landing.localhost}
      HUDDLE_AUTH_HOSTNAME: ${HUDDLE_AUTH_HOSTNAME:-auth.localhost}
      HUDDLE_TLS_ISSUER: ${HUDDLE_TLS_ISSUER:-internal}
    configs:
      - source: caddyfile
        target: /etc/caddy/Caddyfile
    ports:
      - name: http
        target: 80
        published: ${HUDDLE_HTTP_PORT:-80}
        protocol: tcp
      - name: https
        target: 443
        published: ${HUDDLE_HTTPS_PORT:-443}
        protocol: tcp
      - name: http3
        target: 443
        published: ${HUDDLE_HTTPS_PORT:-443}
        protocol: udp
    volumes:
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      api:
        condition: service_healthy
      web:
        condition: service_healthy
      landing:
        condition: service_healthy
    networks:
      - frontend
    healthcheck:
      test:
        ['CMD', 'wget', '--quiet', '--output-document=/dev/null', 'http://127.0.0.1:2019/config/']
      interval: 10s
      timeout: 5s
      retries: 12
    restart: unless-stopped

  # The eBay webhook tunnel is for environments without a public domain (local
  # and LAN staging). Start it with `--profile tunnel`; production does not need it.
  ebay-webhook-gateway:
    image: caddy:2-alpine
    profiles: ['tunnel']
    configs:
      - source: ebay_webhook_caddyfile
        target: /etc/caddy/Caddyfile
    depends_on:
      api:
        condition: service_healthy
    networks:
      - webhook_edge
      - webhook_backend
    healthcheck:
      test:
        ['CMD', 'wget', '--quiet', '--output-document=/dev/null', 'http://127.0.0.1:2019/config/']
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 5s
    restart: unless-stopped

  cloudflared:
    image: cloudflare/cloudflared:latest
    profiles: ['tunnel']
    command: ['tunnel', '--no-autoupdate', '--url', 'http://ebay-webhook-gateway:8080']
    depends_on:
      ebay-webhook-gateway:
        condition: service_healthy
    networks:
      - webhook_edge
    restart: unless-stopped

configs:
  zitadel_caddyfile:
    file: ./zitadel.Caddyfile
  caddyfile:
    file: ./Caddyfile
  ebay_webhook_caddyfile:
    file: ./ebay-webhook.Caddyfile

networks:
  frontend:
  webhook_edge:
  webhook_backend:
    internal: true
  backend:
    internal: true

volumes:
  zitadel_bootstrap:
  postgres_data:
  redis_data:
  nats_data:
  caddy_data:
  caddy_config:
  artifact_data:
services:
  api:
    image: docker.io/harlenalvarez/huddle-api:2026.10.07-1@sha256:b2129a287d3271804d4d953242a6b140efa37ab151e9286a39a1f55d0e18502b
  artifact-storage-init:
    image: docker.io/harlenalvarez/huddle-api:2026.10.07-1@sha256:b2129a287d3271804d4d953242a6b140efa37ab151e9286a39a1f55d0e18502b
  caddy:
    image: docker.io/library/caddy:2-alpine@sha256:d8542f48d34a9cf4e4c11a478865229840e87e4c96ea3f439101f31a5d35f75f
  chat-thread-live-worker:
    image: docker.io/harlenalvarez/huddle-api:2026.10.07-1@sha256:b2129a287d3271804d4d953242a6b140efa37ab151e9286a39a1f55d0e18502b
  cloudflared:
    image: docker.io/cloudflare/cloudflared:latest@sha256:9b49eed8f62806d5d45ddf59ecefb5710429598ea6d3fcccd2af938f621b2b07
  ebay-webhook-gateway:
    image: docker.io/library/caddy:2-alpine@sha256:d8542f48d34a9cf4e4c11a478865229840e87e4c96ea3f439101f31a5d35f75f
  landing:
    image: docker.io/harlenalvarez/huddle-landing-web:2026.10.07-1@sha256:3b1735db83ab7e668f98d84dc7a4c011f7f9e5b20072c185bca3a1270d02b17e
  nats:
    image: docker.io/library/nats:2-alpine@sha256:ac8f88a6494bffc2c2a5289a0ca61cb28a9145c11ba5677cf24265d07f46d8d4
  nats-tools:
    image: docker.io/natsio/nats-box:latest@sha256:d2f04223f40e016f77922a8115d34b0cd5fad2ec10b19b39316ae92d07f3d295
  notification-live-worker:
    image: docker.io/harlenalvarez/huddle-api:2026.10.07-1@sha256:b2129a287d3271804d4d953242a6b140efa37ab151e9286a39a1f55d0e18502b
  postgres:
    image: docker.io/harlenalvarez/huddle-postgres:2026.10.07-1@sha256:dafe4936f5fad69f42147175d55d77e31d5315da24e53311fc13929898acb9d6
  redis:
    image: docker.io/library/redis:8-alpine@sha256:3811787313eba226a2ef38658c6ccb91cd5e110edc89c37767de373120a0e5a0
  schedule-live-worker:
    image: docker.io/harlenalvarez/huddle-api:2026.10.07-1@sha256:b2129a287d3271804d4d953242a6b140efa37ab151e9286a39a1f55d0e18502b
  schedule-publisher:
    image: docker.io/harlenalvarez/huddle-api:2026.10.07-1@sha256:b2129a287d3271804d4d953242a6b140efa37ab151e9286a39a1f55d0e18502b
  scheduled-task-worker:
    image: docker.io/harlenalvarez/huddle-api:2026.10.07-1@sha256:b2129a287d3271804d4d953242a6b140efa37ab151e9286a39a1f55d0e18502b
  web:
    image: docker.io/harlenalvarez/huddle-web:2026.10.07-1@sha256:e89b5020f2db035863022005a41418b2c66f8933224cfe69f172d8e41b918c18
  zitadel:
    image: docker.io/library/caddy:2-alpine@sha256:d8542f48d34a9cf4e4c11a478865229840e87e4c96ea3f439101f31a5d35f75f
  zitadel-api:
    image: ghcr.io/zitadel/zitadel:v4.19.3@sha256:d8430210beea5319bce553a0e6ff77167e30633535c3e072938c6b675f3c115e
  zitadel-db-init:
    image: docker.io/harlenalvarez/huddle-postgres:2026.10.07-1@sha256:dafe4936f5fad69f42147175d55d77e31d5315da24e53311fc13929898acb9d6
  zitadel-login:
    image: ghcr.io/zitadel/zitadel-login:v4.19.3@sha256:f4fb0eb8acb474e8abba0698dfb69b8b67e0856f5cda9e787c2c67b8205976f3