docker-compose.yml

services:
  memory-api:
    build: ./api
    container_name: zengram-api
    ports:
      - "${API_BIND:-127.0.0.1}:8084:8084"
    env_file:
      - .env
    environment:
      - HOST=0.0.0.0  # Must be 0.0.0.0 inside container for Docker port mapping
      - STRUCTURED_STORE=postgres
    # POSTGRES_URL comes from .env — point at the `zengram-postgres` container name
    # (not `postgres`) to avoid DNS collisions when zengram-api shares networks with
    # other stacks that have their own postgres service.
    depends_on:
      postgres:
        condition: service_healthy
    restart: unless-stopped
    # Hardening: block privilege escalation and strip all Linux caps — the API is
    # a plain Node process binding an unprivileged port, so it needs none.
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      # /health now returns 503 when a dependency is down, so r.ok already fails
      # the check correctly — no shape change needed.
      test: ["CMD-SHELL", "node -e \"fetch('http://localhost:8084/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))\""]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  postgres:
    image: pgvector/pgvector:pg16
    container_name: zengram-postgres
    # Network alias so other containers on the same network can reach us as "zengram-postgres"
    # regardless of the compose service name, avoiding collisions with other `postgres` services.
    networks:
      default:
        aliases:
          - zengram-postgres
    ports:
      - "127.0.0.1:5433:5432"
    environment:
      POSTGRES_DB: shared_brain
      POSTGRES_USER: brain
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-brain_secret}
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    restart: unless-stopped
    # Hardening: no privilege escalation, drop all caps, then re-add exactly the
    # ones the official postgres entrypoint requires — CHOWN/DAC_OVERRIDE/FOWNER
    # to fix up the data dir, SETGID/SETUID for the gosu drop to the postgres user.
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U brain -d shared_brain"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"