docker-compose.yml

# NOTE: This Compose file defines a SINGLE-REPLICA topology.
# Do not use `docker compose up --scale server=N` — the SQLite default supports
# only one writer and the published host ports collide. Multi-replica deployments
# require the Helm chart with PostgreSQL and leader election (deploy/helm/codex-lb).
services:
  server:
    build:
      context: .
      dockerfile: Dockerfile
    env_file:
      - path: .env.local
        required: false
    ports:
      - "2455:2455"
      - "1455:1455"
    command:
      # Keep development on the same pre-connection drain launcher as
      # production. Compose watch restarts the service after source sync.
      - python
      - -m
      - app.cli
      - --host
      - 0.0.0.0
      - --port
      - "2455"
      - --ws-max-size
      - "134217728"
    volumes:
      - codex-lb-data:/var/lib/codex-lb
    develop:
      watch:
        - action: sync+restart
          path: ./app
          target: /app/app
        - action: rebuild
          path: ./pyproject.toml
        - action: rebuild
          path: ./uv.lock
        - action: rebuild
          path: ./Dockerfile
    restart: unless-stopped

  frontend:
    build:
      context: ./frontend
      dockerfile_inline: |
        FROM oven/bun:1.3.14-alpine
        WORKDIR /app
        RUN chown bun:bun /app
        USER bun
        COPY --chown=bun:bun package.json bun.lock ./
        RUN bun install --frozen-lockfile
        COPY --chown=bun:bun . .
        CMD ["bun", "run", "dev", "--host", "0.0.0.0"]
    ports:
      - "5173:5173"
    environment:
      API_PROXY_TARGET: http://server:2455
    develop:
      watch:
        - action: sync
          path: ./frontend
          target: /app
          ignore:
            - node_modules/
            - .env
            - .env.*
            - .git/
        - action: rebuild
          path: ./frontend/package.json
        - action: rebuild
          path: ./frontend/bun.lock

  postgres:
    image: postgres:18-alpine
    profiles: ["postgres"]
    entrypoint:
      - sh
      - -ceu
      - |
        if [ -f /var/lib/postgresql/PG_VERSION ]; then
          echo >&2 "Detected a pre-Postgres-18 data directory at /var/lib/postgresql."
          echo >&2 "Run: docker compose --profile postgres-upgrade run --rm postgres-upgrade"
          echo >&2 "Refusing to start postgres:18-alpine before the named volume is upgraded."
          exit 1
        fi
        if [ -f /var/lib/postgresql/data/PG_VERSION ]; then
          pg_major="$$(cat /var/lib/postgresql/data/PG_VERSION)"
          if [ "$$pg_major" != "18" ]; then
            echo >&2 "Detected a nested Postgres $$pg_major data directory at /var/lib/postgresql/data."
            echo >&2 "Run pg_upgrade against that data directory before starting postgres:18-alpine."
            echo >&2 "For the default Compose volume layout, run: docker compose --profile postgres-upgrade run --rm postgres-upgrade"
            exit 1
          fi
        fi
        if [ "$#" -eq 0 ]; then
          set -- postgres
        fi
        exec docker-entrypoint.sh "$@"
      - codex-lb-postgres-entrypoint-guard
    # Docker's default /dev/shm is 64MB. PostgreSQL parallel workers exchange
    # tuples through dynamic shared memory under /dev/shm, so hash joins that
    # spill past 64MB abort with "could not resize shared memory segment ...
    # No space left on device". 1GB gives parallel query realistic headroom.
    # (The Helm chart needs no equivalent: the bundled Bitnami PostgreSQL
    # sub-chart mounts a memory-backed /dev/shm by default via shmVolume.)
    shm_size: 1gb
    environment:
      POSTGRES_USER: codex_lb
      POSTGRES_PASSWORD: codex_lb
      POSTGRES_DB: codex_lb
    ports:
      - "5432:5432"
    healthcheck:
      # Use the container network address, not initdb's loopback trust rules.
      test: ["CMD-SHELL", "PGPASSWORD=\"$${POSTGRES_PASSWORD}\" psql -h \"$${HOSTNAME}\" -U \"$${POSTGRES_USER}\" -d \"$${POSTGRES_DB}\" -v ON_ERROR_STOP=1 -c 'SELECT 1' >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 5
    volumes:
      - codex-lb-postgres-data:/var/lib/postgresql
    restart: unless-stopped

  postgres-upgrade:
    image: pgautoupgrade/pgautoupgrade:18-alpine@sha256:48b44882565694a297c62b07e8384b89c0e4264b169b67a655569974752327d0
    profiles: ["postgres-upgrade"]
    environment:
      POSTGRES_USER: codex_lb
      POSTGRES_PASSWORD: codex_lb
      POSTGRES_DB: codex_lb
      PGAUTO_ONESHOT: "yes"
    volumes:
      - codex-lb-postgres-data:/var/lib/postgresql
    restart: "no"

  mysql:
    image: mysql:8.4
    profiles: ["mysql"]
    environment:
      MYSQL_ROOT_PASSWORD: codex_lb_root
      MYSQL_USER: codex_lb
      MYSQL_PASSWORD: codex_lb
      MYSQL_DATABASE: codex_lb
    ports:
      - "3306:3306"
    healthcheck:
      test: ["CMD-SHELL", "MYSQL_PWD=\"$${MYSQL_PASSWORD}\" mysql --protocol=TCP -h 127.0.0.1 -u\"$${MYSQL_USER}\" \"$${MYSQL_DATABASE}\" -e 'SELECT 1' >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 10
    volumes:
      - codex-lb-mysql-data:/var/lib/mysql
    restart: unless-stopped

networks:
  default:
    driver: bridge

volumes:
  codex-lb-data:
    name: codex-lb-data
  codex-lb-postgres-data:
    name: codex-lb-postgres-data
  codex-lb-mysql-data:
    name: codex-lb-mysql-data