temetro/backend/docker-compose.yml

# Full-stack dev/run orchestration for temetro.
#
#   docker compose up -d            # run prebuilt images (clinics — fast)
#   docker compose up --build       # build from source (developers)
#   docker compose pull && docker compose up -d   # update to the latest release
#
# Each service has both `image:` (published on Docker Hub) and `build:` (the
# source), so the same file serves clinics pulling releases and developers
# building locally. `TEMETRO_VERSION` (default `latest`) pins the image tag.
#
# No .env or secret setup is required: the backend generates any missing
# secrets on first start and persists them (see docker-entrypoint.sh). Create a
# .env only if you want to override something (SMTP, a real auth secret, etc.).
#
# Frontend  -> http://localhost:3000   (also reachable at http://<this-host-LAN-IP>:3000)
# Backend   -> http://localhost:4000
# Postgres  -> localhost:5432
#
# LAN access: the frontend finds the backend from the address you open it on, so
# other departments can just visit http://<server-LAN-IP>:3000 — no rebuild. The
# in-app Settings → "About & updates" page shows the shareable network address.
#
# The frontend service builds the sibling ../frontend app. Run just the API
# with:  docker compose up db backend
#
# Optional DB browser (Adminer) lives behind a profile:
#   docker compose --profile tools up adminer   # http://localhost:8080
#
# Host ports are configurable to avoid clashing with software already running on
# this machine. Override any of them in a .env file (or inline), e.g.:
#   POSTGRES_PORT=5433  BACKEND_PORT=4001  FRONTEND_PORT=3001  docker compose up -d
# Only the published host port changes; the services still talk to each other on
# their internal ports (db:5432, backend:4000).

services:
  db:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: temetro
      POSTGRES_PASSWORD: temetro
      POSTGRES_DB: temetro
    ports:
      # Host port is configurable to avoid clashing with an existing Postgres.
      - "${POSTGRES_PORT:-5432}:5432"
    volumes:
      - temetro_pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U temetro -d temetro"]
      interval: 5s
      timeout: 5s
      retries: 10

  backend:
    image: khalidxv/temetro-backend:${TEMETRO_VERSION:-latest}
    build:
      context: .
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      DATABASE_URL: postgres://temetro:temetro@db:5432/temetro
      # Secrets are optional: if unset, the entrypoint generates and persists
      # them (to the temetro_secrets volume). Pass real values here to override.
      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:-}
      AI_CREDENTIALS_KEY: ${AI_CREDENTIALS_KEY:-}
      BETTER_AUTH_URL: http://localhost:4000
      FRONTEND_URL: http://localhost:3000
      PORT: "4000"
      # Temetro Network relay (github.com/temetro/temetro-network). Set RELAY_URL
      # to your deployed relay's public URL and RELAY_TOKEN to the shared secret
      # you configured on it — both are required for patient-wallet import.
      RELAY_URL: ${RELAY_URL:-}
      RELAY_TOKEN: ${RELAY_TOKEN:-}
      NODE_ENV: production
      # Uploaded patient/lab files live here, on the temetro_uploads volume.
      UPLOAD_DIR: /var/lib/temetro/uploads
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASS: ${SMTP_PASS:-}
      SMTP_FROM: ${SMTP_FROM:-temetro <no-reply@temetro.local>}
    volumes:
      # Persists auto-generated secrets so they stay stable across restarts.
      - temetro_secrets:/var/lib/temetro
      # Persists uploaded files across restarts/rebuilds.
      - temetro_uploads:/var/lib/temetro/uploads
    ports:
      # Host port is configurable to avoid clashing with an existing service.
      - "${BACKEND_PORT:-4000}:4000"

  frontend:
    image: khalidxv/temetro-frontend:${TEMETRO_VERSION:-latest}
    build:
      context: ../frontend
      args:
        # Empty by default -> the app derives the backend URL from the host the
        # browser uses (localhost or a LAN IP). Set to pin a fixed/proxied URL.
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-}
    restart: unless-stopped
    depends_on:
      - backend
    ports:
      # Host port is configurable to avoid clashing with an existing service.
      - "${FRONTEND_PORT:-3000}:3000"

  adminer:
    image: adminer:5
    profiles: ["tools"]
    restart: unless-stopped
    depends_on:
      - db
    ports:
      - "${ADMINER_PORT:-8080}:8080"

volumes:
  temetro_pgdata:
  temetro_secrets:
  temetro_uploads: