docker-compose.dev.yml

services:
  migrate:
    build:
      labels:
        com.linksense.development.owner: ${LINKSENSE_DEV_RESOURCE_OWNER:-unmanaged}
        com.linksense.development.role: migrate

  runner-worker-image:
    build:
      labels:
        com.linksense.development.owner: ${LINKSENSE_DEV_RESOURCE_OWNER:-unmanaged}
        com.linksense.development.role: worker

  postgres:
    healthcheck:
      start_interval: 100ms

  redis:
    healthcheck:
      start_interval: 100ms

  # Development keeps the production service topology and host-backed user
  # directory while running source-aware Linux images for hot reload.
  api:
    image: linksense-api-dev:${LINKSENSE_DEV_IMAGE_TAG:-local}
    build: !override
      context: .
      dockerfile: Dockerfile.dev
      target: development
      labels:
        com.linksense.development.owner: ${LINKSENSE_DEV_RESOURCE_OWNER:-unmanaged}
        com.linksense.development.role: dependencies
      args:
        PNPM_VERSION: ${PNPM_VERSION:-10.34.6}
        DEV_IMAGE_FINGERPRINT: ${LINKSENSE_DEV_IMAGE_FINGERPRINT:-unversioned}
        DEBIAN_MIRROR_URL: ${DEBIAN_MIRROR_URL:-http://deb.debian.org/debian}
        DEBIAN_SECURITY_MIRROR_URL: ${DEBIAN_SECURITY_MIRROR_URL:-http://security.debian.org/debian-security}
        LINKSENSE_NODE_PACKAGE_REGISTRY_URL: ${LINKSENSE_NODE_PACKAGE_REGISTRY_URL:-https://registry.npmjs.org/}
        PRISMA_ENGINES_MIRROR: ${PRISMA_ENGINES_MIRROR:-https://binaries.prisma.sh}
    # The server must be init's direct child: a surviving watch parent hides
    # OOM/SIGKILL from Docker's restart policy. Host watch owns sync + restart.
    working_dir: /workspace/apps/api
    command: ["node", "--import", "tsx", "src/index.ts"]
    user: "node"
    read_only: false
    restart: unless-stopped
    # scripts/dev.mjs prepares dependencies and checks application readiness.
    # Source watching uses scoped build/up --no-deps commands in dev-watch.mjs.
    depends_on: !reset {}
    healthcheck:
      interval: 5s
      timeout: 3s
      retries: 3
    environment:
      NODE_ENV: development
      NODE_OPTIONS: --conditions=development --max-old-space-size=768
      NODE_COMPILE_CACHE: /tmp/linksense-node-compile-cache
      # Docker Desktop may resolve public domains through its 198.18.0.0/15
      # DNS proxy. Only this explicit development setting trusts that mapping.
      LINKSENSE_SAFE_HTTP_ALLOW_BENCHMARK_PROXY: "true"
    ports:
      - "${LINKSENSE_DEV_API_BIND_ADDRESS:-127.0.0.1}:${LINKSENSE_DEV_API_PORT:-4000}:4000"
    develop:
      watch:
        - action: sync+restart
          path: ./apps/api/src
          target: /workspace/apps/api/src
          ignore: [generated/]
        - action: sync
          path: ./apps/docs/docs
          target: /workspace/apps/docs/docs
        - action: sync
          path: ./apps/docs/i18n/en-US/docusaurus-plugin-content-docs/current
          target: /workspace/apps/docs/i18n/en-US/docusaurus-plugin-content-docs/current
        - action: sync+restart
          path: ./packages/shared/src
          target: /workspace/packages/shared/src
        - action: sync+restart
          path: ./apps/api/tsconfig.json
          target: /workspace/apps/api/tsconfig.json
        - action: rebuild
          path: ./apps/api/package.json
        - action: rebuild
          path: ./packages/shared/package.json
        - action: rebuild
          path: ./package.json
        - action: rebuild
          path: ./pnpm-lock.yaml
        - action: rebuild
          path: ./patches

  runner:
    image: linksense-runner-controller-dev:${LINKSENSE_DEV_IMAGE_TAG:-local}
    # Storage and worker images are prepared by scripts/dev.mjs before startup.
    depends_on: !reset {}
    healthcheck:
      interval: 5s
      timeout: 3s
      retries: 3
    build: !override
      context: .
      dockerfile: Dockerfile.dev
      target: development
      labels:
        com.linksense.development.owner: ${LINKSENSE_DEV_RESOURCE_OWNER:-unmanaged}
        com.linksense.development.role: dependencies
      args:
        PNPM_VERSION: ${PNPM_VERSION:-10.34.6}
        DEV_IMAGE_FINGERPRINT: ${LINKSENSE_DEV_IMAGE_FINGERPRINT:-unversioned}
        DEBIAN_MIRROR_URL: ${DEBIAN_MIRROR_URL:-http://deb.debian.org/debian}
        DEBIAN_SECURITY_MIRROR_URL: ${DEBIAN_SECURITY_MIRROR_URL:-http://security.debian.org/debian-security}
        LINKSENSE_NODE_PACKAGE_REGISTRY_URL: ${LINKSENSE_NODE_PACKAGE_REGISTRY_URL:-https://registry.npmjs.org/}
        PRISMA_ENGINES_MIRROR: ${PRISMA_ENGINES_MIRROR:-https://binaries.prisma.sh}
    working_dir: /workspace/apps/runner
    command: ["node", "--import", "tsx", "src/index.ts"]
    user: "0:0"
    read_only: false
    restart: unless-stopped
    environment:
      NODE_ENV: development
      NODE_OPTIONS: --conditions=development --max-old-space-size=512
      NODE_COMPILE_CACHE: /tmp/linksense-node-compile-cache
      LINKSENSE_ENABLE_DEVELOPMENT_ENDPOINTS: "true"
      # Hot reload must not delete task workers. Explicit dev stop/rebuild calls
      # the authenticated cleanup endpoint before Compose changes networks.
      LINKSENSE_REMOVE_WORKERS_ON_SHUTDOWN: "false"
      LINKSENSE_WORKER_IMAGE_REVISION: ${LINKSENSE_WORKER_IMAGE_REVISION:-unversioned}
    ports:
      - "${LINKSENSE_DEV_RUNNER_BIND_ADDRESS:-127.0.0.1}:${LINKSENSE_DEV_RUNNER_PORT:-4010}:4010"
    develop:
      watch:
        - action: sync+restart
          path: ./apps/runner/src
          target: /workspace/apps/runner/src
        - action: sync+restart
          path: ./packages/shared/src
          target: /workspace/packages/shared/src
        - action: sync+restart
          path: ./apps/runner/tsconfig.json
          target: /workspace/apps/runner/tsconfig.json
        - action: rebuild
          path: ./apps/runner/package.json
        - action: rebuild
          path: ./packages/shared/package.json
        - action: rebuild
          path: ./package.json
        - action: rebuild
          path: ./pnpm-lock.yaml
        - action: rebuild
          path: ./patches

  web:
    image: linksense-web-dev:${LINKSENSE_DEV_IMAGE_TAG:-local}
    build: !override
      context: .
      dockerfile: Dockerfile.dev
      target: development
      labels:
        com.linksense.development.owner: ${LINKSENSE_DEV_RESOURCE_OWNER:-unmanaged}
        com.linksense.development.role: dependencies
      args:
        PNPM_VERSION: ${PNPM_VERSION:-10.34.6}
        DEV_IMAGE_FINGERPRINT: ${LINKSENSE_DEV_IMAGE_FINGERPRINT:-unversioned}
        DEBIAN_MIRROR_URL: ${DEBIAN_MIRROR_URL:-http://deb.debian.org/debian}
        DEBIAN_SECURITY_MIRROR_URL: ${DEBIAN_SECURITY_MIRROR_URL:-http://security.debian.org/debian-security}
        LINKSENSE_NODE_PACKAGE_REGISTRY_URL: ${LINKSENSE_NODE_PACKAGE_REGISTRY_URL:-https://registry.npmjs.org/}
        PRISMA_ENGINES_MIRROR: ${PRISMA_ENGINES_MIRROR:-https://binaries.prisma.sh}
    command: ["pnpm", "--filter", "@linksense/web", "dev"]
    user: "node"
    read_only: false
    restart: unless-stopped
    depends_on: !reset {}
    environment:
      NODE_ENV: development
      NODE_OPTIONS: --conditions=development --max-old-space-size=768
      # Preserve same-origin Cookie authentication through Vite's /api proxy.
      VITE_API_BASE_URL: ""
      LINKSENSE_DEV_API_PROXY_TARGET: http://api:4000
      LINKSENSE_DEV_DOCS_PROXY_TARGET: http://docs:80
    ports: !override
      - "${LINKSENSE_DEV_WEB_BIND_ADDRESS:-127.0.0.1}:${LINKSENSE_DEV_WEB_PORT:-18172}:18173"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fsS http://127.0.0.1:18173/ >/dev/null",
        ]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 10s
    develop:
      watch:
        - action: sync
          path: ./apps/web/src
          target: /workspace/apps/web/src
        - action: sync
          path: ./apps/web/public
          target: /workspace/apps/web/public
        # Shared contracts are imported through Vite's external workspace
        # module graph. Docker Compose file sync does not reliably emit the
        # filesystem event Vite needs to invalidate its transformed module
        # cache, so restart the dev server whenever a shared contract changes.
        - action: sync+restart
          path: ./packages/shared/src
          target: /workspace/packages/shared/src
        - action: sync+restart
          path: ./apps/web/index.html
          target: /workspace/apps/web/index.html
        - action: sync+restart
          path: ./apps/web/vite.config.ts
          target: /workspace/apps/web/vite.config.ts
        - action: sync+restart
          path: ./scripts/application-build.mjs
          target: /workspace/scripts/application-build.mjs
        - action: sync+restart
          path: ./scripts/source-fingerprint.mjs
          target: /workspace/scripts/source-fingerprint.mjs
        - action: sync+restart
          path: ./scripts/application-build.d.mts
          target: /workspace/scripts/application-build.d.mts
        - action: rebuild
          path: ./apps/web/package.json
        - action: rebuild
          path: ./packages/shared/package.json
        - action: rebuild
          path: ./package.json
        - action: rebuild
          path: ./pnpm-lock.yaml
        - action: rebuild
          path: ./patches

  # Keep Vite's HTTP listener and expose a second, trusted HTTP/2 entry.
  dev-gateway:
    image: nginx:1.28-alpine
    restart: unless-stopped
    labels:
      com.linksense.development.gateway-revision: ${LINKSENSE_DEV_GATEWAY_REVISION:-unversioned}
    ports:
      - "${LINKSENSE_DEV_WEB_BIND_ADDRESS:-127.0.0.1}:${LINKSENSE_DEV_WEB_HTTPS_PORT:-18173}:443"
    volumes:
      - type: bind
        source: ./deploy/development/nginx
        target: /etc/nginx/conf.d
        read_only: true
        bind:
          create_host_path: false
      # This directory contains only leaf files and the public CA. mkcert's
      # signing key stays in the host CA directory and is never mounted.
      - type: bind
        source: ${LINKSENSE_DEV_TLS_DIR:-./.data/dev/tls}
        target: /run/linksense-dev-tls
        read_only: true
        bind:
          create_host_path: false
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/health/live"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 5s
    develop:
      watch:
        - action: restart
          path: ./deploy/development/nginx

  docs:
    image: linksense-docs-dev:${LINKSENSE_DEV_IMAGE_TAG:-local}
    build:
      context: .
      dockerfile: Dockerfile.web
      target: docs-runtime
      labels:
        com.linksense.development.owner: ${LINKSENSE_DEV_RESOURCE_OWNER:-unmanaged}
        com.linksense.development.role: docs
      args:
        DOCS_IMAGE_FINGERPRINT: ${LINKSENSE_DOCS_IMAGE_FINGERPRINT:-unversioned}
        # Build on the same small Docker VM as the running development stack.
        DOCS_BUILD_NODE_OPTIONS: --max-old-space-size=1024
        DOCS_BUILD_TERSER_PARALLEL: "false"
        LINKSENSE_NODE_PACKAGE_REGISTRY_URL: ${LINKSENSE_NODE_PACKAGE_REGISTRY_URL:-https://registry.npmjs.org/}
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/help/ && wget -q -O /dev/null http://127.0.0.1/help/en-US/"]
      interval: 10s
      timeout: 3s
      retries: 10
      start_period: 5s
      start_interval: 500ms
    develop:
      watch:
        - action: rebuild
          path: ./apps/docs
          ignore: [node_modules/, build/, .docusaurus/]
        - action: rebuild
          path: ./Dockerfile.web
        - action: rebuild
          path: ./deploy/nginx/help-location.conf
        - action: rebuild
          path: ./deploy/nginx/development-docs.conf
        - action: rebuild
          path: ./pnpm-lock.yaml
        - action: rebuild
          path: ./package.json
        - action: rebuild
          path: ./patches