compose.build.yml

services:
  hanzo-web:
    build:
      dockerfile: ./web/Dockerfile
      context: .
      args:
        - NEXT_PUBLIC_HANZO_CLOUD_REGION=${NEXT_PUBLIC_HANZO_CLOUD_REGION}
    depends_on: &hanzo-depends-on
      postgres:
        condition: service_healthy
      s3:
        condition: service_healthy
      redis:
        condition: service_healthy
      datastore:
        condition: service_healthy
    ports:
      - "3000:3000"
    environment: &hanzo-web-env
      # Bind to all interfaces so health checks via localhost work in containers
      HOSTNAME: "0.0.0.0"
      DATABASE_URL: ${DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/postgres}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:-mysecret}
      SALT: ${SALT:-mysalt}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:-0000000000000000000000000000000000000000000000000000000000000000} # generate via `openssl rand -hex 32`
      NEXTAUTH_URL: ${NEXTAUTH_URL:-http://localhost:3000}
      TELEMETRY_ENABLED: ${TELEMETRY_ENABLED:-true}
      HANZO_ENABLE_EXPERIMENTAL_FEATURES: ${HANZO_ENABLE_EXPERIMENTAL_FEATURES:-false}
      INIT_ORG_ID: ${INIT_ORG_ID:-}
      INIT_ORG_NAME: ${INIT_ORG_NAME:-}
      INIT_ORG_IDS: ${INIT_ORG_IDS:-}
      INIT_ORG_NAMES: ${INIT_ORG_NAMES:-}
      INIT_PROJECT_ID: ${INIT_PROJECT_ID:-}
      INIT_PROJECT_ORG_ID: ${INIT_PROJECT_ORG_ID:-}
      INIT_PROJECT_NAME: ${INIT_PROJECT_NAME:-}
      INIT_PROJECT_PUBLIC_KEY: ${INIT_PROJECT_PUBLIC_KEY:-}
      INIT_PROJECT_SECRET_KEY: ${INIT_PROJECT_SECRET_KEY:-}
      INIT_USER_EMAIL: ${INIT_USER_EMAIL:-}
      INIT_USER_NAME: ${INIT_USER_NAME:-}
      INIT_USER_PASSWORD: ${INIT_USER_PASSWORD:-}
      DATASTORE_MIGRATION_URL: ${DATASTORE_MIGRATION_URL:-datastore://hanzo:hanzo@datastore:9000}
      DATASTORE_URL: ${DATASTORE_URL:-http://datastore:8123}
      DATASTORE_USER: ${DATASTORE_USER:-hanzo}
      DATASTORE_PASSWORD: ${DATASTORE_PASSWORD:-hanzo}
      DATASTORE_CLUSTER_ENABLED: ${DATASTORE_CLUSTER_ENABLED:-false}
      S3_EVENT_UPLOAD_BUCKET: ${S3_EVENT_UPLOAD_BUCKET:-hanzo}
      S3_EVENT_UPLOAD_REGION: ${S3_EVENT_UPLOAD_REGION:-us-east-1}
      S3_EVENT_UPLOAD_ACCESS_KEY_ID: ${S3_EVENT_UPLOAD_ACCESS_KEY_ID:-minio}
      S3_EVENT_UPLOAD_SECRET_ACCESS_KEY: ${S3_EVENT_UPLOAD_SECRET_ACCESS_KEY:-miniosecret}
      S3_EVENT_UPLOAD_ENDPOINT: ${S3_EVENT_UPLOAD_ENDPOINT:-http://s3:9000}
      S3_EVENT_UPLOAD_FORCE_PATH_STYLE: ${S3_EVENT_UPLOAD_FORCE_PATH_STYLE:-true}
      S3_EVENT_UPLOAD_PREFIX: ${S3_EVENT_UPLOAD_PREFIX:-events/}
      REDIS_HOST: ${REDIS_HOST:-redis}
      REDIS_PORT: ${REDIS_PORT:-6379}
      REDIS_AUTH: ${REDIS_AUTH:-myredissecret}
      REDIS_TLS_ENABLED: ${REDIS_TLS_ENABLED:-false}
      REDIS_TLS_CA: ${REDIS_TLS_CA:-/certs/ca.crt}
      REDIS_TLS_CERT: ${REDIS_TLS_CERT:-/certs/redis.crt}
      REDIS_TLS_KEY: ${REDIS_TLS_KEY:-/certs/redis.key}
      IAM_CLIENT_ID: ${IAM_CLIENT_ID:-}
      IAM_CLIENT_SECRET: ${IAM_CLIENT_SECRET:-}
      IAM_SERVER_URL: ${IAM_SERVER_URL:-}
      IAM_ORG_NAME: ${IAM_ORG_NAME:-}
      IAM_APP_NAME: ${IAM_APP_NAME:-}
      IAM_ALLOW_ACCOUNT_LINKING: ${IAM_ALLOW_ACCOUNT_LINKING:-false}
    restart: always
    healthcheck:
      # Use node http module — curl/wget may be absent or broken in node:24-alpine
      test: ["CMD", "node", "-e", "const h=require('http');h.get('http://localhost:3000/api/public/health',{timeout:5000},r=>{r.resume();process.exit(r.statusCode===200?0:1)}).on('error',()=>process.exit(1))"]
      interval: 10s
      timeout: 10s
      retries: 18
      start_period: 60s

  hanzo-worker:
    build:
      dockerfile: ./worker/Dockerfile
      context: .
      args:
        - NEXT_PUBLIC_HANZO_CLOUD_REGION=${NEXT_PUBLIC_HANZO_CLOUD_REGION}
    depends_on: *hanzo-depends-on
    ports:
      - "3030:3030"
    environment:
      <<: *hanzo-web-env
    restart: always
    healthcheck:
      # Use node http module — curl/wget may be absent or broken in node:24-alpine
      test: ["CMD", "node", "-e", "const h=require('http');h.get('http://localhost:3030/api/health',{timeout:5000},r=>{r.resume();process.exit(r.statusCode===200?0:1)}).on('error',()=>process.exit(1))"]
      interval: 10s
      timeout: 10s
      retries: 18
      start_period: 60s

  datastore:
    image: ghcr.io/hanzoai/datastore:26
    environment:
      DATASTORE_DB: default
      DATASTORE_USER: ${DATASTORE_USER:-hanzo}
      DATASTORE_PASSWORD: ${DATASTORE_PASSWORD:-hanzo}
    volumes:
      - hanzo_datastore_data:/var/lib/hanzo-datastore
      - hanzo_datastore_logs:/var/log/hanzo-datastore-server
    ports:
      - "8123:8123"
      - "9000:9000"
    depends_on:
      - postgres
    healthcheck:
      # Verify BOTH HTTP (8123) and native protocol (9000) are ready.
      # The native protocol lags behind HTTP; migrations use port 9000.
      test: ["CMD-SHELL", "wget -qO- http://localhost:8123/ping && datastore client --user ${DATASTORE_USER:-hanzo} --password ${DATASTORE_PASSWORD:-hanzo} --port 9000 --query 'SELECT 1' > /dev/null 2>&1"]
      interval: 5s
      timeout: 10s
      retries: 30
      start_period: 30s

  s3:
    image: minio/minio
    # create the 'hanzo' bucket before starting the service
    entrypoint: sh
    command: -c 'mkdir -p /data/hanzo && minio server --address ":9000" --console-address ":9001" /data'
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minio}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-miniosecret}
    ports:
      - "9090:9000"
      - "9091:9001"
    volumes:
      - hanzo_s3_data:/data
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:9000/minio/health/live"]
      interval: 1s
      timeout: 5s
      retries: 5
      start_period: 1s

  redis:
    image: ghcr.io/hanzoai/kv:latest
    restart: always
    command: >
      --requirepass ${REDIS_AUTH:-myredissecret}
      --maxmemory-policy noeviction
    ports:
      - 6379:6379
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 3s
      timeout: 10s
      retries: 10

  postgres:
    image: postgres:18-alpine
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 3s
      timeout: 3s
      retries: 10
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      POSTGRES_DB: ${POSTGRES_DB:-postgres}
      TZ: UTC
      PGTZ: UTC
    ports:
      - 5432:5432
    volumes:
      - hanzo_postgres_data:/var/lib/postgresql/data

volumes:
  hanzo_postgres_data:
    driver: local
  hanzo_datastore_data:
    driver: local
  hanzo_datastore_logs:
    driver: local
  hanzo_s3_data:
    driver: local