docker-compose.yml

services:
  api:
    build:
      context: .
      target: dev
    # Run as the host user so files written into the bind-mounted data directory
    # are owned by the current user, not root. Set UID/GID in .env (see .env.example).
    # DOCKER_GID must match the GID of /var/run/docker.sock on the host so the
    # non-root user can still reach the Docker socket.
    user: "${UID:-0}:${GID:-0}"
    group_add:
      - "${DOCKER_GID:-0}"
    ports:
      - "${NICHART_PORT:-8000}:8000"
    volumes:
      # Bind-mount source so --reload picks up edits without rebuilding
      - .:/app
      # Host bind-mount for user data (not a named volume) so that sibling
      # containers spawned by DockerBackend can reach the same directory.
      # Set NICHART_HOST_DATA_PATH on the host to control where data lands.
      - ${NICHART_HOST_DATA_PATH:-./data}:/data
      # Docker socket — required for local pipeline execution (DockerBackend).
      - /var/run/docker.sock:/var/run/docker.sock
      # Optional corporate CA bundle for SSL-inspection proxies (e.g. work VPN).
      # Set HOST_CA_BUNDLE=/absolute/path/on/host/ca.pem in .env.
      # The file is always mounted at /certs/ca-bundle.pem inside the container.
      # When HOST_CA_BUNDLE is unset, /dev/null is mounted harmlessly and the
      # code detects the empty file and skips it.
      - ${HOST_CA_BUNDLE:-/dev/null}:/certs/ca-bundle.pem:ro
    environment:
      NICHART_EXECUTION_MODE: ${NICHART_EXECUTION_MODE:-local}
      NICHART_DATA_ROOT: /data
      # Tell DockerBackend the host-side path it should use when mounting
      # /data into sibling containers. Must match NICHART_HOST_DATA_PATH.
      NICHART_HOST_DATA_ROOT: ${NICHART_HOST_DATA_PATH:-./data}
      NICHART_COGNITO_REGION: ${NICHART_COGNITO_REGION:-us-east-1}
      NICHART_COGNITO_USER_POOL_ID: ${NICHART_COGNITO_USER_POOL_ID:-us-east-1_BSBhcKA66}
      NICHART_COGNITO_IDENTITY_POOL_ID: ${NICHART_COGNITO_IDENTITY_POOL_ID:-us-east-1:12c87a16-8336-450c-bf25-b98990c7dcf8}
      NICHART_STAGING_TTL_HOURS: ${NICHART_STAGING_TTL_HOURS:-24}
      # Fixed container-side path; only meaningful when HOST_CA_BUNDLE is set.
      # The code checks whether the file is non-empty before trusting it.
      NICHART_CA_BUNDLE: /certs/ca-bundle.pem

      # Allowed CORS origins — set to the UI's domain in production.
      # JSON array, e.g.: '["https://nichart.example.com"]'
      NICHART_CORS_ORIGINS: ${NICHART_CORS_ORIGINS:-["http://localhost:3000"]}
    command: uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload