KeepNote/docker-compose.debug.yaml

# Source: https://oneuptime.com/blog/post/2026-01-07-go-hot-reloading-docker-air/view#step-4-set-up-docker-compose

# docker-compose.yml
# Development environment with hot reloading

services:
  # Main Go application with Air hot reloading
  keepnote-debug:
    extra_hosts:
      - "host.docker.internal:host-gateway"

    image: keepnote-debug
    container_name: keepnote-debug

    # Cold `docker compose -f docker-compose.debug.yaml up -d` builds this image
    # directly — no pre-build step needed. Do NOT add `network: host` here:
    # `docker compose up`/`build` cannot grant the `network.host` build
    # entitlement (that needs `--allow=network.host`, which only `docker build`
    # accepts), so a cold up would fail with "additional privileges requested".
    # The default bridge reaches the dev Gitea (192.168.122.183), so
    # Dockerfile.debug's GOPROXY resolves shared modules without host networking.
    build:
      context: .
      dockerfile: Dockerfile.debug

    # `keepnote-debug` is a local-only tag: build it, never look it up in a
    # registry (otherwise a cold `up` warns "pull access denied").
    pull_policy: build


    # Expose ports: host:container
    ports:
      - "8081:8080"     # The SINGLE port: API + SPA + /web/* (contract rev 9)
      # Delve: unique host port per service (auth-debug owns 2345), so the Go
      # attach launch config reaches Air's Delve listener (in-container 2345)
      # from the host without conflicts.
      - "2346:2345"     # Delve debugger port


    # Volume mounts - THE KEY TO HOT RELOADING
    # Mount source code as a volume so changes are reflected immediately
    volumes:
      - ./src:/app
      - go-mod-cache:/go/pkg/mod
      - go-build-cache:/root/.cache/go-build
      - /app/src/tmp # Exclude Air's tmp dir from syncing
      # mTLS identity for the auth edge: the certs Maestro issued for the dev
      # fleet (devboot, DCNTRLIZED_DEV=true) at the shared-module default paths,
      # so the authproxy client authenticates to the mTLS auth hub.
      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/ca.crt:/dcntrlized/pki/ca.crt:ro
      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/services/keepnote/tls.crt:/dcntrlized/pki/tls.crt:ro
      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/services/keepnote/tls.key:/dcntrlized/pki/tls.key:ro

    working_dir: /app/

    # Environment variables for the application
    environment:
      # DCNTRLIZED_DEV is the single dev selector (registry/auth URLs).
      - DCNTRLIZED_DEV=true
      # Security theme M2 §2: keep THIS listener plaintext so the RN client
      # (direct mode) and hot reload work without certs. The auth proxy edge
      # is still mTLS (mounted identity above).
      - DCNTRLIZED_DEBUG=true
      # Application configuration
      # - PORT=8080
      # - ENVIRONMENT=development
      # - LOG_LEVEL=debug

      # Database connection (shared database on the dcntrlized network)
      - DATABASE_URL=postgres://postgres:@dcntrlized-db:5432/dcntrlized

      # Go specific settings
      - GO111MODULE=on
      - GOPROXY=http://192.168.122.183:3000/api/packages/Dcntrlized/go,https://proxy.golang.org,direct
      - GONOSUMDB=git.dcntrlized.org

    depends_on:
      - migrate

    # Restart policy for development
    restart: unless-stopped

    # Network for service communication
    networks:
      - dcntrlized_net

    cap_add:
      - SYS_PTRACE
    security_opt:
      - apparmor:unconfined

  migrate:
    image: postgres:16-alpine
    container_name: keepnote-migrate
    labels:
      org.dcntrlized.oneoff: "true"
    networks:
      - dcntrlized_net
    volumes:
      - ./database/migrations:/migrations:ro
    environment:
      - PGHOST=dcntrlized-db
      - PGPORT=5432
      - PGUSER=postgres
      - PGPASSWORD=
      - PGDATABASE=dcntrlized
    command: >
      sh -c 'until pg_isready -h dcntrlized-db -U postgres -d dcntrlized; do sleep 2; done;
      for f in /migrations/*.sql; do [ -f "$$f" ] || continue; echo "Applying $$f"; psql -v ON_ERROR_STOP=1 -d dcntrlized -f "$$f" || exit 1; done'

# Named volumes for data persistence and caching
volumes:
  # Go module cache - shared across rebuilds
  go-mod-cache:
    driver: local

  # Go build cache - speeds up compilation
  go-build-cache:
    driver: local

networks:
  dcntrlized_net:
    external: true