# RELAY-PHASE1 · E1 — Postgres + Redis for the rendezvous-relay control-plane (P3) on the VPS.
#
# Both services bind to 127.0.0.1 ONLY — they are the relay's private state, never exposed on the
# public interface (INV9-adjacent; open only :443 + AGENT_PORT in the cloud security group). The
# control-plane / relay processes reach them over loopback.
#
# Usage on 8.138.1.192:
#   cp deploy/.env.example deploy/.env   # then fill secrets
#   docker compose --env-file deploy/.env -f deploy/docker-compose.yml up -d
#
# PG_URL   for the app  = postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@127.0.0.1:5432/${POSTGRES_DB}
# REDIS_URL for the app = redis://127.0.0.1:6379

services:
  postgres:
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-relay}
      POSTGRES_USER: ${POSTGRES_USER:-relay}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in deploy/.env}
    ports:
      - "127.0.0.1:5432:5432" # loopback-only
    volumes:
      - relay_pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-relay} -d ${POSTGRES_DB:-relay}"]
      interval: 5s
      timeout: 3s
      retries: 10

  redis:
    image: redis:7
    restart: unless-stopped
    command: ["redis-server", "--appendonly", "yes"]
    ports:
      - "127.0.0.1:6379:6379" # loopback-only
    volumes:
      - relay_redisdata:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10

volumes:
  relay_pgdata:
  relay_redisdata: