docker-compose.yml

version: '3.8'

services:
  db:
    image: postgres:15-alpine
    read_only: true
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp
      - /var/run/postgresql
    environment:
      POSTGRES_DB: openshield
      POSTGRES_USER: openshield
      POSTGRES_PASSWORD: openshield
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U openshield"]
      interval: 10s
      timeout: 5s
      retries: 5

  api:
    build: .
    ports:
      - "8000:8000"
    environment:
      DATABASE_URL: postgresql://openshield:openshield@db:5432/openshield
      JWT_SECRET: change-me-in-production
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      NVD_API_KEY: ${NVD_API_KEY:-}
    depends_on:
      db:
        condition: service_healthy

  frontend:
    image: node:20-alpine
    read_only: true
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp
    working_dir: /app
    volumes:
      - ./frontend:/app
    command: sh -c "npm install && npm run dev -- --host"
    ports:
      - "5173:5173"
    environment:
      VITE_API_BASE_URL: http://localhost:8000

volumes:
  postgres_data: