docker-compose.yaml

version: "3.9"

services:
  db:
    build: .
    container_name: pg_todo_db
    environment:
      POSTGRES_DB: todo
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      # Secrets used by init scripts (see db/init/*.sh)
      JWT_SECRET: ${JWT_SECRET}
      AUTHENTICATOR_PASSWORD: ${AUTHENTICATOR_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 5s
      retries: 20
    volumes:
      - db_data:/var/lib/postgresql/data
    networks:
      - internal

  postgrest:
    image: postgrest/postgrest:v12.2.12
    container_name: pg_todo_pgrst
    environment:
      # point PostgREST at the DB using the "authenticator" role
      PGRST_DB_URI: postgres://authenticator:${AUTHENTICATOR_PASSWORD}@db:5432/todo
      PGRST_DB_ANON_ROLE: web_anon
      # only expose the "api" schema as HTTP (no direct table exposure)
      PGRST_DB_SCHEMAS: api
      PGRST_JWT_SECRET: ${JWT_SECRET}
      PGRST_SERVER_PORT: "3000"
    depends_on:
      db:
        condition: service_healthy
    ports:
      - "3000:3000"
    networks:
      - internal

volumes:
  db_data:

networks:
  internal:
    driver: bridge