# gmonk — self-hosted quickstart.
#
# Save this file as docker-compose.yml in an empty directory, then run:
#
#   docker compose up
#
# It brings up Postgres, applies gmonk's schema once, and serves the review UI
# on http://127.0.0.1:4319 (loopback only). The only prerequisite is Docker.
#
# Pin a specific version by exporting GMONK_IMAGE first, e.g.:
#   GMONK_IMAGE=gmonkdev/gmonk:0.5.0 docker compose up
#
# The gmonk image is closed-source (bytecode); this file only orchestrates the
# published image plus a stock Postgres — no engine source is involved.

services:
  postgres:
    image: postgres:16
    environment:
      POSTGRES_USER: gmonk
      POSTGRES_PASSWORD: gmonk
      POSTGRES_DB: gmonk
    volumes:
      - gmonk-pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U gmonk -d gmonk"]
      interval: 3s
      timeout: 3s
      retries: 10

  # one-shot: create/update the schema, then exit. The web service waits for it.
  migrate:
    image: ${GMONK_IMAGE:-gmonkdev/gmonk:0.5.0}
    command: ["migrate"]
    environment:
      # sslmode=disable: gmonk encrypts remote store connections by default, but
      # this store is a stock Postgres on the internal Docker network with no TLS.
      # Scoped to the store URL only — it does NOT affect TLS to databases you
      # later protect with `gmonk protect --backend-ref`.
      GMONK_DATABASE_URL: postgres://gmonk:gmonk@postgres:5432/gmonk?sslmode=disable
    depends_on:
      postgres:
        condition: service_healthy

  gmonk:
    image: ${GMONK_IMAGE:-gmonkdev/gmonk:0.5.0}
    # fixed name so the capture hook can reach it from any directory
    container_name: gmonk
    # bind 0.0.0.0 INSIDE the container; the port mapping below pins it to the
    # host's loopback, so the reverse-capable UI is never exposed off-machine.
    command: ["web", "--host", "0.0.0.0", "--port", "4319"]
    environment:
      # sslmode=disable: gmonk encrypts remote store connections by default, but
      # this store is a stock Postgres on the internal Docker network with no TLS.
      # Scoped to the store URL only — it does NOT affect TLS to databases you
      # later protect with `gmonk protect --backend-ref`.
      GMONK_DATABASE_URL: postgres://gmonk:gmonk@postgres:5432/gmonk?sslmode=disable
      # before-images of file changes live here (mounted volume below, so an
      # undo survives a restart). For production use GMONK_S3_BUCKET instead.
      GMONK_OBJECT_STORE: /var/lib/gmonk/objects
      # lets the UI bind off-loopback INSIDE the container (the port map keeps it
      # on the host's 127.0.0.1). For a real/exposed deployment, set GMONK_WEB_TOKEN
      # instead and drop this.
      GMONK_WEB_ALLOW_NONLOOPBACK: "1"
      # fast capture hook: the web process auto-provisions a token here; a later
      # `docker compose run --rm ... gmonk install-hook` reuses it.
      GMONK_HOOK_TOKEN_FILE: /var/lib/gmonk/state/hook-token
    ports:
      - "127.0.0.1:4319:4319"
    volumes:
      - gmonk-objects:/var/lib/gmonk/objects
      - gmonk-state:/var/lib/gmonk/state
    depends_on:
      migrate:
        condition: service_completed_successfully

volumes:
  gmonk-pgdata:
  gmonk-objects:
  gmonk-state: