docker-compose.dev.yml

###
# Worktree-isolated dev stack. Boot via `npm run dev:up` (see packages/dev/src/cli.ts).
# COMPOSE_PROJECT_NAME=carbon-<slug> namespaces every container, network, volume.
# Required env (provided by .env via --env-file): PORT_*, SUPABASE_JWT_SECRET,
# SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY, plus user secrets passed through.
###

services:
  postgres:
    image: supabase/postgres:15.14.1.112
    restart: unless-stopped
    networks:
      default:
        aliases:
          - db
    ports:
      - "${PORT_DB}:5432"
    environment:
      POSTGRES_HOST: /var/run/postgresql
      POSTGRES_PORT: 5432
      PGPORT: 5432
      POSTGRES_DB: postgres
      PGDATABASE: postgres
      POSTGRES_PASSWORD: postgres
      PGPASSWORD: postgres
      JWT_SECRET: ${SUPABASE_JWT_SECRET}
      JWT_EXP: 3600
    volumes:
      - pgdata:/var/lib/postgresql/data
      - pgconfig:/etc/postgresql-custom
      - ./packages/dev/docker/init.sql:/docker-entrypoint-initdb.d/zz-carbon-roles.sql:ro
    command:
      - postgres
      - -c
      - config_file=/etc/postgresql/postgresql.conf
      - -c
      - log_min_messages=fatal
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "postgres", "-h", "localhost"]
      interval: 5s
      timeout: 5s
      retries: 20

  gotrue:
    image: supabase/gotrue:v2.189.0
    restart: unless-stopped
    environment:
      GOTRUE_API_HOST: 0.0.0.0
      GOTRUE_API_PORT: 9999
      API_EXTERNAL_URL: ${SUPABASE_URL}
      GOTRUE_DB_DRIVER: postgres
      GOTRUE_DB_DATABASE_URL: postgres://supabase_auth_admin:postgres@postgres:5432/postgres
      GOTRUE_SITE_URL: ${ERP_URL}
      GOTRUE_URI_ALLOW_LIST: ${ERP_URL},${MES_URL},${GTM_URL}
      GOTRUE_DISABLE_SIGNUP: "false"
      GOTRUE_JWT_SECRET: ${SUPABASE_JWT_SECRET}
      GOTRUE_JWT_EXP: 3600
      GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
      GOTRUE_JWT_ADMIN_ROLES: service_role
      GOTRUE_JWT_AUD: authenticated
      GOTRUE_EXTERNAL_EMAIL_ENABLED: "true"
      GOTRUE_MAILER_AUTOCONFIRM: "true"
      GOTRUE_SMTP_HOST: ${GOTRUE_SMTP_HOST:-inbucket}
      GOTRUE_SMTP_PORT: ${GOTRUE_SMTP_PORT:-2500}
      GOTRUE_SMTP_USER: ${GOTRUE_SMTP_USER:-}
      GOTRUE_SMTP_PASS: ${GOTRUE_SMTP_PASS:-}
      GOTRUE_SMTP_ADMIN_EMAIL: ${GOTRUE_SMTP_ADMIN_EMAIL:-admin@carbon.local}
      GOTRUE_SMTP_SENDER_NAME: Carbon
      GOTRUE_EXTERNAL_GOOGLE_ENABLED: "true"
      GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID: ${SUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_ID:-}
      GOTRUE_EXTERNAL_GOOGLE_SECRET: ${SUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_SECRET:-}
      GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI: ${SUPABASE_AUTH_EXTERNAL_GOOGLE_REDIRECT_URI}
      GOTRUE_EXTERNAL_AZURE_ENABLED: "true"
      GOTRUE_EXTERNAL_AZURE_CLIENT_ID: ${SUPABASE_AUTH_EXTERNAL_AZURE_CLIENT_ID:-}
      GOTRUE_EXTERNAL_AZURE_SECRET: ${SUPABASE_AUTH_EXTERNAL_AZURE_CLIENT_SECRET:-}
      GOTRUE_EXTERNAL_AZURE_REDIRECT_URI: ${SUPABASE_AUTH_EXTERNAL_AZURE_REDIRECT_URI}
      GOTRUE_MAILER_TEMPLATES_MAGIC_LINK: ${ERP_URL}/templates/magic-link.html
      GOTRUE_MAILER_TEMPLATES_INVITE: ${ERP_URL}/templates/invite.html
      SSL_CERT_FILE: /etc/ssl/certs/portless-ca.pem
    extra_hosts:
      - "host.docker.internal:host-gateway"
      - "${DOMAIN}:host-gateway"
    volumes:
      - ${HOME}/.portless/ca.pem:/etc/ssl/certs/portless-ca.pem:ro
    depends_on:
      postgres:
        condition: service_healthy

  postgrest:
    image: postgrest/postgrest:v13.0.8
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PGRST_DB_URI: postgres://authenticator:postgres@postgres:5432/postgres
      PGRST_DB_SCHEMAS: public,storage,graphql_public
      PGRST_DB_ANON_ROLE: anon
      PGRST_JWT_SECRET: ${SUPABASE_JWT_SECRET}
      PGRST_DB_USE_LEGACY_GUCS: "false"
      PGRST_APP_SETTINGS_JWT_SECRET: ${SUPABASE_JWT_SECRET}
      PGRST_APP_SETTINGS_JWT_EXP: 3600

  realtime:
    image: supabase/realtime:v2.89.0
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      default:
        aliases:
          - realtime-dev
    environment:
      PORT: 4000
      DB_HOST: postgres
      DB_PORT: 5432
      DB_USER: supabase_admin
      DB_PASSWORD: postgres
      DB_NAME: postgres
      DB_AFTER_CONNECT_QUERY: 'SET search_path TO _realtime'
      DB_ENC_KEY: supabaserealtime
      API_JWT_SECRET: ${SUPABASE_JWT_SECRET}
      METRICS_JWT_SECRET: ${SUPABASE_JWT_SECRET}
      SECRET_KEY_BASE: UpNVntn3cDxHJpq99YMc1T1AQgQpc8kfYTuRgBiYa15BLrx8etQoXz3gZv1/u2oq
      APP_NAME: realtime
      ERL_AFLAGS: -proto_dist inet_tcp
      DNS_NODES: "''"
      RLIMIT_NOFILE: "10000"
      SEED_SELF_HOST: "true"
      RUN_JANITOR: "true"
      DISABLE_HEALTHCHECK_LOGGING: "true"

  storage:
    image: supabase/storage-api:v1.58.4
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      ANON_KEY: ${SUPABASE_ANON_KEY}
      SERVICE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
      POSTGREST_URL: http://postgrest:3000
      PGRST_JWT_SECRET: ${SUPABASE_JWT_SECRET}
      DATABASE_URL: postgres://supabase_storage_admin:postgres@postgres:5432/postgres
      FILE_SIZE_LIMIT: 52428800
      STORAGE_BACKEND: file
      FILE_STORAGE_BACKEND_PATH: /var/lib/storage
      TENANT_ID: stub
      REGION: stub
      GLOBAL_S3_BUCKET: stub
      ENABLE_IMAGE_TRANSFORMATION: "false"
    volumes:
      - storage:/var/lib/storage:z

  meta:
    image: supabase/postgres-meta:v0.96.5
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PG_META_PORT: 8080
      PG_META_DB_HOST: postgres
      PG_META_DB_PORT: 5432
      PG_META_DB_NAME: postgres
      PG_META_DB_USER: supabase_admin
      PG_META_DB_PASSWORD: postgres

  studio:
    image: supabase/studio:2026.04.28-sha-89d08a2
    restart: unless-stopped
    depends_on:
      meta:
        condition: service_started
    ports:
      - "${PORT_STUDIO}:3000"
    environment:
      STUDIO_PG_META_URL: http://meta:8080
      POSTGRES_PASSWORD: postgres
      DEFAULT_ORGANIZATION_NAME: Carbon
      DEFAULT_PROJECT_NAME: carbon-${CARBON_WORKTREE}
      SUPABASE_URL: http://kong:8000
      SUPABASE_PUBLIC_URL: ${SUPABASE_URL}
      SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY}
      SUPABASE_SERVICE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}

  inbucket:
    image: inbucket/inbucket:3.1.1
    restart: unless-stopped
    ports:
      - "${PORT_INBUCKET}:9000"

  edge-runtime:
    image: supabase/edge-runtime:v1.74.0
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      JWT_SECRET: ${SUPABASE_JWT_SECRET}
      SUPABASE_URL: http://kong:8000
      SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY}
      SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
      SUPABASE_DB_URL: postgresql://postgres:postgres@postgres:5432/postgres
      VERIFY_JWT: "false"
    volumes:
      - ./packages/database/supabase/functions:/home/deno/functions:ro
      - ./packages/database/src:/home/src:ro
      # Dev-only dispatcher; lives outside supabase/functions/ so prod
      # `supabase functions deploy --all` can't pick it up.
      - ./packages/dev/docker/edge-main:/home/deno/main:ro
    command:
      - start
      - --main-service
      - /home/deno/main

  kong:
    image: kong:2.8.1
    restart: unless-stopped
    depends_on:
      - gotrue
      - postgrest
      - realtime
      - storage
      - meta
      - edge-runtime
    ports:
      - "${PORT_API}:8000"
    environment:
      KONG_DATABASE: "off"
      KONG_DECLARATIVE_CONFIG: /home/kong/kong.yml
      KONG_DNS_ORDER: LAST,A,CNAME
      KONG_PLUGINS: request-transformer,cors,key-auth,acl,basic-auth
    volumes:
      - ./packages/dev/docker/kong.yml:/home/kong/kong.yml:ro

  # Redis is shared across worktrees — see root docker-compose.yml.
  # Each worktree gets its own logical DB index (0-15) via REDIS_URL.

  inngest:
    image: inngest/inngest:v1.19.4
    restart: unless-stopped
    ports:
      - "${PORT_INNGEST}:8288"
    command:
      - inngest
      - dev
      - --sdk-url=${ERP_URL}/api/inngest
    environment:
      SSL_CERT_FILE: /etc/ssl/certs/portless-ca.pem
    extra_hosts:
      - "host.docker.internal:host-gateway"
      - "${INNGEST_TLS_HOST}:host-gateway"
    volumes:
      - inngest:/data
      - ${HOME}/.portless/ca.pem:/etc/ssl/certs/portless-ca.pem:ro

volumes:
  pgdata:
  pgconfig:
  storage:
  inngest: