version: '3.9'

# CE: Local developer stack.
# Use ./scripts/dev-start.sh instead of docker compose directly —
# it handles health checks and seeding.

services:
  supabase-db:
    image: supabase/postgres:15.8.1.060
    restart: unless-stopped
    ports:
      - "54322:5432"
    environment:
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: postgres
    volumes:
      - supabase-db-data:/var/lib/postgresql/data
      - ./supabase/migrations:/docker-entrypoint-initdb.d/migrations:ro

  supabase-api:
    image: postgrest/postgrest:v12.2.0
    restart: unless-stopped
    depends_on:
      - supabase-db
    ports:
      - "54321:3000"
    environment:
      PGRST_DB_URI: postgres://postgres:postgres@supabase-db:5432/postgres
      PGRST_DB_SCHEMA: public
      PGRST_DB_ANON_ROLE: anon
      # Generate a per-developer secret with `openssl rand -base64 48` and
      # export PGRST_JWT_SECRET in your shell or .env.local. The fallback is
      # intentionally non-functional so misconfigured stacks fail loudly.
      PGRST_JWT_SECRET: ${PGRST_JWT_SECRET:?set PGRST_JWT_SECRET in .env.local before running docker-compose.dev.yml}

  # platform-api worker runs via `pnpm nx serve platform-api` (see scripts/dev-start.sh).
  # It has no HTTP server and no Dockerfile; do not add it here.

volumes:
  supabase-db-data:
