compose.yaml

services:
  web:
    build: .
    # No nested agent sandbox runs here, so Docker's default capabilities and profiles stay in place.
    # NET_ADMIN is for .devcontainer/init-firewall.sh.
    cap_add:
      - NET_ADMIN
    ports:
      - '5173:5173'
      - '5555:5555'
    tty: true
    volumes:
      - .:/usr/src/app
      - ./node_modules:/usr/src/app/node_modules
      # Hide the host .env from the container; compose still reads it on the host for substitution.
      - ./.devcontainer/empty.env:/usr/src/app/.env:ro
    environment:
      - NODE_ENV=development
      - DATABASE_URL=postgresql://db_user:db_password@db:5432/test_db?pgbouncer=true&connection_limit=10&connect_timeout=60&statement_timeout=60000 # Note: Local server cannot start if port is set to db:6543.
      - DIRECT_URL=postgresql://db_user:db_password@db:5432/test_db
      - CONFIRM_API_URL=${CONFIRM_API_URL:-} # Unset by default; set only for a real verification session without agents
    command: sleep infinity
    depends_on:
      - db

  db:
    image: postgres:15.1
    restart: unless-stopped
    volumes:
      - postgres-data:/var/lib/postgresql/data:cached
    environment:
      POSTGRES_USER: db_user
      POSTGRES_PASSWORD: db_password
      POSTGRES_DB: test_db
      POSTGRES_INITDB_ARGS: '--encoding=UTF8'
    ports:
      - '6543:5432'

volumes:
  postgres-data:
    driver: local