docker-compose.yml

services:
  postgres:
    image: postgres:17
    environment:
      POSTGRES_DB: centralconfig
      POSTGRES_USER: centralconfig
      POSTGRES_PASSWORD: localdev
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U centralconfig"]
      interval: 2s
      timeout: 5s
      retries: 10

  redis:
    image: redis:7
    command: redis-server --maxmemory 128mb --maxmemory-policy allkeys-lru
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 2s
      timeout: 5s
      retries: 10

  migrate:
    image: ${TOOLS_IMAGE:-decree-tools}
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - ./db/migrations:/migrations:ro
    command: ["goose", "-dir", "/migrations", "postgres", "postgres://centralconfig:localdev@postgres:5432/centralconfig?sslmode=disable", "up"]

  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.127.0
    command: ["--config=/etc/otelcol/config.yaml"]
    volumes:
      - ./deploy/otel-collector.yaml:/etc/otelcol/config.yaml:ro
    ports:
      - "4317:4317"   # OTLP gRPC
      - "4318:4318"   # OTLP HTTP
    depends_on:
      jaeger:
        condition: service_started

  jaeger:
    image: jaegertracing/all-in-one:1.76.0
    ports:
      - "16686:16686" # Jaeger UI
      - "14268:14268" # Jaeger collector

  service:
    image: ${SERVICE_IMAGE:-decree-server}
    build:
      context: .
      dockerfile: build/Dockerfile
    depends_on:
      migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    environment:
      GRPC_PORT: "9090"
      DB_WRITE_URL: "postgres://centralconfig:localdev@postgres:5432/centralconfig?sslmode=disable"
      DB_READ_URL: "postgres://centralconfig:localdev@postgres:5432/centralconfig?sslmode=disable"
      REDIS_URL: "redis://redis:6379"
      ENABLE_SERVICES: "schema,config,audit"
      HTTP_PORT: "8080"
      USAGE_FLUSH_INTERVAL: "1s"
      INSECURE_LISTEN: "1"
      ENABLE_REFLECTION: "1"
      # Tight ingest limits so the validation-limit and security e2e tests
      # can trip them with small payloads. Existing fixtures use at most a
      # few fields and small YAMLs (< 1 KiB), well under these caps.
      SCHEMA_MAX_FIELDS: "100"
      SCHEMA_MAX_DOC_BYTES: "4096"
      # 64 KiB recv cap so TestSecurity_OversizeRequestRejected can trip it
      # with a small payload. All legitimate test fixtures are well under 1 KiB.
      GRPC_MAX_RECV_MSG_BYTES: "65536"
      # e2e tests pass auth headers directly over HTTP; trusted-proxy mode lets
      # the gateway forward them instead of rejecting them with 401.
      DECREE_GATEWAY_TRUSTED_PROXY: "1"
    ports:
      - "9090:9090"
      - "8080:8080"

volumes:
  pgdata: