compose.yml

# =============================================================================
# Docker Compose - Nexus Backend (Isolated Stack)
# =============================================================================
# This is the SOURCE OF TRUTH for running the backend locally.
#
# ISOLATION: This stack uses its own network and volumes, completely
# independent from any other Docker projects on this machine.
#
# Quick start:
#   export JWT_SECRET="YourSecure32CharacterSecretHere!"  # or set in .env
#   docker compose up -d
#   docker compose logs -f api
#
# IMPORTANT: JWT_SECRET must be set via environment variable or .env file
# =============================================================================

name: nexus-backend

services:
  # ---------------------------------------------------------------------------
  # API Service (ASP.NET Core 8)
  # ---------------------------------------------------------------------------
  api:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: nexus-backend-api
    ports:
      - "5080:8080"  # Host:Container - Access at http://localhost:5080
    environment:
      - ASPNETCORE_ENVIRONMENT=Development
      - ConnectionStrings__DefaultConnection=Host=db;Port=5432;Database=nexus_dev;Username=postgres;Password=postgres
      # JWT_SECRET MUST be provided via environment variable or .env file
      # DO NOT hardcode secrets here - the app will fail to start without this
      - Jwt__Secret=${JWT_SECRET:?JWT_SECRET environment variable is required}
      - Jwt__Issuer=
      - Jwt__Audience=
      - Cors__AllowedOrigins__0=http://localhost:5080
      - Cors__AllowedOrigins__1=http://localhost:5170
      - Cors__AllowedOrigins__2=http://localhost:5180
      - Cors__AllowedOrigins__3=http://localhost:5190
      - Cors__AllowedOrigins__4=http://localhost:5200
      # Rate limiting (relaxed for development)
      - RateLimiting__Auth__PermitLimit=10
      - RateLimiting__Auth__WindowSeconds=60
      - RateLimiting__General__PermitLimit=200
      - RateLimiting__General__WindowSeconds=60
      # RabbitMQ configuration
      - RabbitMq__Host=rabbitmq
      - RabbitMq__Port=5672
      - RabbitMq__Username=guest
      - RabbitMq__Password=guest
      - RabbitMq__VirtualHost=/
      - RabbitMq__ExchangeName=nexus.events
      - RabbitMq__Enabled=true
      # WebAuthn/Passkey (FIDO2) configuration
      - Fido2__ServerDomain=localhost
      - Fido2__ServerName=Project NEXUS
      - Fido2__Origins__0=http://localhost:5080
      - Fido2__Origins__1=http://localhost:5170
      - Fido2__Origins__2=http://localhost:5180
      # Llama AI service configuration
      - LlamaService__BaseUrl=http://llama-service:11434
      - LlamaService__Model=llama3.2:11b
      - LlamaService__TimeoutSeconds=180
    depends_on:
      db:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      llama-service:
        condition: service_started
    networks:
      - nexus-backend-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "curl --fail http://localhost:8080/health || exit 1"]
      interval: 30s
      timeout: 10s
      start_period: 60s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 2G
        reservations:
          memory: 512M

  # ---------------------------------------------------------------------------
  # Database (PostgreSQL 16)
  # ---------------------------------------------------------------------------
  db:
    image: postgres:16.4-bookworm
    container_name: nexus-backend-db
    # DB is internal-only by default (no host port exposed)
    # Uncomment the next two lines if you need direct DB access from host:
    # ports:
    #   - "5435:5432"
    environment:
      POSTGRES_DB: nexus_dev
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
    volumes:
      - nexus-backend-db-data:/var/lib/postgresql/data
    networks:
      - nexus-backend-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d nexus_dev"]
      interval: 5s
      timeout: 5s
      retries: 5

  # ---------------------------------------------------------------------------
  # Message Broker (RabbitMQ)
  # ---------------------------------------------------------------------------
  rabbitmq:
    image: rabbitmq:3.13-management
    container_name: nexus-backend-rabbitmq
    ports:
      - "5672:5672"   # AMQP protocol
      - "15672:15672" # Management UI (http://localhost:15672)
    environment:
      RABBITMQ_DEFAULT_USER: guest
      RABBITMQ_DEFAULT_PASS: guest
    volumes:
      - nexus-backend-rabbitmq-data:/var/lib/rabbitmq
    networks:
      - nexus-backend-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "check_port_connectivity"]
      interval: 10s
      timeout: 10s
      retries: 5

  # ---------------------------------------------------------------------------
  # AI Service (Ollama with Llama 3.2)
  # ---------------------------------------------------------------------------
  # NOTE: After starting, you must pull the model:
  #   docker compose exec llama-service ollama pull llama3.2:3b
  # ---------------------------------------------------------------------------
  llama-service:
    image: ollama/ollama:latest
    container_name: nexus-backend-llama
    # No port exposed — accessible only via Docker network (http://llama-service:11434)
    environment:
      - OLLAMA_HOST=0.0.0.0
    volumes:
      - nexus-backend-llama-models:/root/.ollama
    networks:
      - nexus-backend-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:11434/api/tags || exit 1"]
      interval: 60s
      timeout: 30s
      start_period: 180s
      retries: 5
    deploy:
      resources:
        limits:
          memory: 12G
        reservations:
          memory: 8G


  # ---------------------------------------------------------------------------
  # GOV.IE Design System Frontend (Nexus Community - web-govie)
  # NOTE: Not an official government service. Uses @govie-ds/* open-source
  # packages as a UI foundation only. See apps/web-govie/BRANDING.md.
  # ---------------------------------------------------------------------------
  web-govie:
    build:
      context: ./apps/web-govie
      dockerfile: Dockerfile
      args:
        VITE_API_BASE_URL: http://localhost:5080
        VITE_APP_NAME: Nexus Community
        VITE_APP_VERSION: 0.1.0
        VITE_TENANT_SLUG: acme
    container_name: nexus-web-govie
    ports:
      - "5200:80"
    networks:
      - nexus-backend-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1/health || exit 1"]
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3
    deploy:
      resources:
        limits:
          memory: 256M
        reservations:
          memory: 128M


  # ---------------------------------------------------------------------------
  # Admin Panel (Nexus Admin - apps/admin)
  # Refine v4 + Ant Design + Vite - migrated from htdocs/nexus-admin
  # ---------------------------------------------------------------------------
  admin:
    build:
      context: ./apps/admin
      dockerfile: Dockerfile
      target: dev
    container_name: nexus-admin-dev
    ports:
      - "5190:5190"
    volumes:
      - ./apps/admin:/app
      - /app/node_modules
    environment:
      - NODE_ENV=development
      - VITE_API_URL=http://api:8080
    depends_on:
      api:
        condition: service_healthy
    networks:
      - nexus-backend-net
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 256M


  # ---------------------------------------------------------------------------
  # Modern Frontend (apps/web-modern) - Next.js + HeroUI
  # Previously at htdocs/nexus-modern-frontend/
  # ---------------------------------------------------------------------------
  web-modern:
    build:
      context: ./apps/web-modern
      dockerfile: Dockerfile
      target: dev
    container_name: nexus-frontend-dev
    ports:
      - "5170:3002"
    volumes:
      - ./apps/web-modern:/app
      - /app/node_modules
      - /app/.next
    env_file:
      - ./apps/web-modern/.env.docker
    environment:
      - NODE_ENV=development
    networks:
      - nexus-backend-net
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 1G
        reservations:
          memory: 512M

  # ---------------------------------------------------------------------------
  # UK Frontend (apps/web-uk) - GOV.UK Design System (Express/Node)
  # Previously at htdocs/nexus-uk-frontend/
  # ---------------------------------------------------------------------------
  web-uk:
    build:
      context: ./apps/web-uk
      dockerfile: Dockerfile
      target: development
    container_name: nexus-uk-frontend-dev
    ports:
      - "5180:3001"
    volumes:
      - ./apps/web-uk:/app
      - /app/node_modules
    env_file:
      - ./apps/web-uk/.env.docker
    networks:
      - nexus-backend-net
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 256M
        reservations:
          memory: 128M

# -----------------------------------------------------------------------------
# Networks (isolated from other Docker projects)
# -----------------------------------------------------------------------------
networks:
  nexus-backend-net:
    name: nexus-backend-net
    driver: bridge

# -----------------------------------------------------------------------------
# Volumes (persistent, isolated)
# -----------------------------------------------------------------------------
volumes:
  nexus-backend-db-data:
    name: nexus-backend-db-data
  nexus-backend-rabbitmq-data:
    name: nexus-backend-rabbitmq-data
  nexus-backend-llama-models:
    name: nexus-backend-llama-models