homelab/nodes/heimdall/jobsquatch-alpha/compose.yaml

services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: jobsquatch
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}
    networks:
      - jobsquatch-internal
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 10

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    networks:
      - jobsquatch-internal
    volumes:
      - redis_data:/data
    command: redis-server --appendonly yes

  app:
    image: ghcr.io/teamcastaldi/jobsquatch-backend:${IMAGE_TAG:-latest}
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    networks:
      - jobsquatch-internal
    environment:
      APP_ENV: production
      DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}@db:5432/jobsquatch
      REDIS_URL: redis://redis:6379/0
      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY must be set}
      ACCESS_TOKEN_EXPIRE_DAYS: ${ACCESS_TOKEN_EXPIRE_DAYS:-7}
      APP_BASE_URL: ${APP_BASE_URL:?APP_BASE_URL must be set}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:?ANTHROPIC_API_KEY must be set}
      RESEND_API_KEY: ${RESEND_API_KEY:?RESEND_API_KEY must be set}
      EMAIL_FROM: ${EMAIL_FROM:?EMAIL_FROM must be set}
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:?STRIPE_SECRET_KEY must be set}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:?STRIPE_WEBHOOK_SECRET must be set}
      STRIPE_STARTER_PRICE_ID: ${STRIPE_STARTER_PRICE_ID:?STRIPE_STARTER_PRICE_ID must be set}
      STRIPE_PACK_PRICE_ID: ${STRIPE_PACK_PRICE_ID:?STRIPE_PACK_PRICE_ID must be set}
      STRIPE_BETA_PRICE_ID: ${STRIPE_BETA_PRICE_ID:?STRIPE_BETA_PRICE_ID must be set}
      CORS_ORIGINS: ${CORS_ORIGINS:-}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    command: >
      sh -c "alembic upgrade head && uvicorn src.web.app:app --host 0.0.0.0 --port 8000"
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health')\""]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  frontend:
    image: ghcr.io/teamcastaldi/jobsquatch-frontend:${IMAGE_TAG:-latest}
    restart: unless-stopped
    ports:
      - "6080:80"
    networks:
      - jobsquatch-internal
      - proxy-net
    depends_on:
      app:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.jobsquatch.rule=Host(`jobsquatch-alpha.castaldifamily.com`)"
      - "traefik.http.routers.jobsquatch.entrypoints=websecure"
      - "traefik.http.routers.jobsquatch.tls=true"
      - "traefik.http.routers.jobsquatch.tls.certresolver=cloudflare"
      - "traefik.http.routers.jobsquatch.middlewares=security-headers@file"
      - "traefik.http.services.jobsquatch.loadbalancer.server.port=80"

volumes:
  postgres_data:
  redis_data:

networks:
  jobsquatch-internal:
    internal: true
  proxy-net:
    external: true