docker-compose.dev.yml

# =============================================================================
# Scoped - Docker Compose Dev Overlay (Hot Reload)
# =============================================================================
#
# Overrides service build targets to use the "dev" stage and adds
# Docker Compose Watch (develop.watch) for live file sync.
#
# Usage:
#   docker compose -f docker-compose.yml -f docker-compose.dev.yml watch
#   pnpm docker:dev                    # shorthand (see package.json)
#
# How it works:
#   - Each service builds the "dev" Dockerfile stage (tsx watch / Vite dev server)
#   - Source file changes are synced into the container via Compose Watch
#   - tsx watch detects synced files and restarts the service (~1-2s)
#   - shared package changes are recompiled in-container via tsc --watch
#   - package.json / lockfile changes trigger a full image rebuild
#
# =============================================================================

services:
  # ===========================================================================
  # Application services
  # ===========================================================================

  api:
    # dev target (tsx + in-container tsc --watch) needs headroom above prod 512m runtime limit
    mem_limit: 1g
    build:
      target: dev
    ports:
      # Node inspector for VS Code. Keep host access loopback-only; .env.base
      # offsets the host port so multiple worktrees can run concurrently.
      - "127.0.0.1:${API_DEBUG_PORT:-9200}:9229"
    environment:
      NODE_INSPECT_PORT: "9229"
    develop:
      watch:
        - action: sync
          path: ./apps/api/src
          target: /app/apps/api/src
        - action: sync
          path: ./packages/shared/src
          target: /app/packages/shared/src
        - action: sync
          path: ./config
          target: /app/config
        - action: rebuild
          path: ./apps/api/package.json
        - action: rebuild
          path: ./pnpm-lock.yaml

  judge:
    build:
      target: dev
    develop:
      watch:
        - action: sync
          path: ./apps/judge/src
          target: /app/apps/judge/src
        - action: sync
          path: ./packages/shared/src
          target: /app/packages/shared/src
        - action: sync
          path: ./config
          target: /app/config
        - action: rebuild
          path: ./apps/judge/package.json
        - action: rebuild
          path: ./pnpm-lock.yaml

  token-manager:
    # dev target (tsx + in-container tsc --watch) needs headroom above prod 256m runtime limit
    mem_limit: 1g
    build:
      target: dev
    develop:
      watch:
        - action: sync
          path: ./apps/token-manager/src
          target: /app/apps/token-manager/src
        - action: sync
          path: ./packages/shared/src
          target: /app/packages/shared/src
        - action: rebuild
          path: ./apps/token-manager/package.json
        - action: rebuild
          path: ./pnpm-lock.yaml

  scheduler:
    # dev target (tsx + in-container tsc --watch) needs headroom above prod 256m runtime limit
    mem_limit: 1g
    build:
      target: dev
    develop:
      watch:
        - action: sync
          path: ./apps/scheduler/src
          target: /app/apps/scheduler/src
        - action: sync
          path: ./packages/shared/src
          target: /app/packages/shared/src
        - action: rebuild
          path: ./apps/scheduler/package.json
        - action: rebuild
          path: ./pnpm-lock.yaml

  # ===========================================================================
  # Portal (Vite HMR)
  # ===========================================================================

  portal:
    # dev target (Vite dev server + esbuild dep-optimization) OOMs at 512m; needs headroom above prod 128m runtime limit
    mem_limit: 1g
    build:
      target: dev
    environment:
      VITE_API_PROXY_TARGET: http://api:80
      GIT_BRANCH: ${GIT_BRANCH:-}
      GIT_COMMIT: ${GIT_COMMIT:-}
      BUILD_TIME: ${BUILD_TIME:-}
      # Dev auth: point MSAL at the entra-local emulator over HTTPS (mkcert-
      # trusted) using the per-worktree host port. redirectUri/postLogoutRedirectUri
      # default to window.location.origin, so they auto-match this worktree's
      # portal port.
      VITE_AUTH_CLIENT_ID: "${VITE_AUTH_CLIENT_ID:-cccccccc-0000-0000-0000-000000000001}"
      VITE_AUTH_AUTHORITY: "${VITE_AUTH_AUTHORITY:-https://localhost:${ENTRA_LOCAL_PORT:-8443}/${AUTH_TENANT_ID:-11111111-1111-1111-1111-111111111111}/v2.0}"
      VITE_AUTH_KNOWN_AUTHORITIES: "${VITE_AUTH_KNOWN_AUTHORITIES-localhost:${ENTRA_LOCAL_PORT:-8443}}"
      VITE_AUTH_SCOPES: "${VITE_AUTH_SCOPES:-api://cccccccc-0000-0000-0000-000000000005/access_as_user}"
      VITE_AUTH_PROTOCOL_MODE: "${VITE_AUTH_PROTOCOL_MODE:-OIDC}"
      VITE_AUTH_REDIRECT_URI: "${VITE_AUTH_REDIRECT_URI:-}"
      VITE_AUTH_POST_LOGOUT_REDIRECT_URI: "${VITE_AUTH_POST_LOGOUT_REDIRECT_URI:-}"
      VITE_AUTH_CACHE_LOCATION: "${VITE_AUTH_CACHE_LOCATION:-localStorage}"
      # Auth feature toggle (see ENV_VARIABLES.md → "Feature toggle"). Auth is ON
      # by default. To iterate on the Portal locally WITHOUT sign-in (e.g. before
      # the API verifies tokens), export VITE_AUTH_ENABLED_LOCAL=false. This flag
      # governs local dev only; integration/production are toggled at runtime via
      # SCOPE_AUTH_ENABLED on their deploy overlays.
      VITE_AUTH_ENABLED_LOCAL: "${VITE_AUTH_ENABLED_LOCAL:-true}"
    depends_on:
      entra-local:
        condition: service_healthy
      entra-local-init:
        condition: service_completed_successfully
    develop:
      watch:
        - action: sync
          path: ./apps/portal/src
          target: /app/apps/portal/src
        - action: rebuild
          path: ./apps/portal/package.json
        - action: rebuild
          path: ./apps/portal/tailwind.config.ts
        - action: rebuild
          path: ./apps/portal/vite.config.ts
        - action: rebuild
          path: ./pnpm-lock.yaml

  # ===========================================================================
  # Worker services
  # ===========================================================================

  coder-acp-claude-code:
    build:
      target: dev
    develop:
      watch:
        - action: sync
          path: ./apps/workers/coder-acp-claude-code/src
          target: /app/apps/workers/coder-acp-claude-code/src
        - action: sync
          path: ./packages/shared/src
          target: /app/packages/shared/src
        - action: sync
          path: ./config
          target: /app/config
        - action: rebuild
          path: ./apps/workers/coder-acp-claude-code/package.json
        - action: rebuild
          path: ./pnpm-lock.yaml

  coder-acp-copilot:
    build:
      target: dev
    develop:
      watch:
        - action: sync
          path: ./apps/workers/coder-acp-copilot/src
          target: /app/apps/workers/coder-acp-copilot/src
        - action: sync
          path: ./packages/shared/src
          target: /app/packages/shared/src
        - action: sync
          path: ./config
          target: /app/config
        - action: rebuild
          path: ./apps/workers/coder-acp-copilot/package.json
        - action: rebuild
          path: ./pnpm-lock.yaml

  report-generator:
    build:
      target: dev
    develop:
      watch:
        - action: sync
          path: ./apps/workers/report-generator/src
          target: /app/apps/workers/report-generator/src
        - action: sync
          path: ./packages/shared/src
          target: /app/packages/shared/src
        - action: sync
          path: ./config
          target: /app/config
        - action: rebuild
          path: ./apps/workers/report-generator/package.json
        - action: rebuild
          path: ./pnpm-lock.yaml

  register-version-post-processor:
    build:
      target: dev

  post-processor:
    build:
      target: dev
    develop:
      watch:
        - action: sync
          path: ./apps/workers/post-processor/src
          target: /app/apps/workers/post-processor/src
        - action: sync
          path: ./packages/shared/src
          target: /app/packages/shared/src
        - action: sync
          path: ./config
          target: /app/config
        - action: rebuild
          path: ./apps/workers/post-processor/package.json
        - action: rebuild
          path: ./pnpm-lock.yaml

  # Gateway: cargo-watch inside dev container, sync source files in
  gateway:
    build:
      target: dev
    # The dev stage compiles the Rust gateway in-container via `cargo watch`.
    # A cold `cargo build` peaks well above the prod 512m runtime cap and would
    # thrash/OOM at that limit (rustc stalls near the cap at ~2% CPU), so give it
    # headroom — mirrors the 1g dev bump the other in-container-compiled services
    # (api, judge, portal, ...) already get.
    mem_limit: 2g
    # Persist the cargo `target/` cache in a named volume so the cold build only
    # happens once and survives container recreation. Re-declare the base
    # `gateway_cert` mount so this list fully specifies the dev mounts.
    volumes:
      - gateway_cert:/certs
      - gateway_target:/build/target
    # A cold cargo build takes several minutes on the very first run (empty cache,
    # throttled to the base `cpus: 0.5`); the base `start_period: 120s` is enough
    # once the target/ cache volume is populated but not on a fresh volume. Bump
    # it for the dev profile only.
    healthcheck:
      start_period: 360s
    develop:
      watch:
        - action: sync
          path: ./apps/gateway/src
          target: /build/src
        - action: sync
          path: ./apps/gateway/config
          target: /build/config
        - action: rebuild
          path: ./apps/gateway/Cargo.toml
        - action: rebuild
          path: ./apps/gateway/Cargo.lock

# Dev-only named volumes.
volumes:
  # Persistent cargo target/ cache for the gateway dev build (see gateway service).
  gateway_target: