compose.yaml

# Local development dependencies for Lightbridge.
# Brought up with `just up` (docker compose up -d). Not for production — see docs/kubernetes-deployment.md.
name: lightbridge

services:
  postgres:
    # Postgres + pgvector in one image (semantic chunk store and control-plane metadata).
    image: pgvector/pgvector:pg17
    environment:
      POSTGRES_USER: lightbridge
      POSTGRES_PASSWORD: lightbridge
      POSTGRES_DB: lightbridge
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U lightbridge"]
      interval: 5s
      timeout: 5s
      retries: 10

  neo4j:
    # Structural code graph.
    image: neo4j:5
    environment:
      NEO4J_AUTH: neo4j/lightbridge
    ports:
      - "7474:7474" # HTTP browser
      - "7687:7687" # Bolt
    volumes:
      - neo4jdata:/data
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:7474 >/dev/null 2>&1 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10

  keycloak:
    # OIDC provider for local dev (ADR-0014). The web app is an OIDC client and the control plane a
    # resource server; both trust tokens this realm issues. Imports the `lightbridge` realm on boot.
    # Exposed on 8081 to avoid clashing with the control plane (8080).
    image: quay.io/keycloak/keycloak:26.0
    command: ["start-dev", "--import-realm"]
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
      KC_HTTP_PORT: "8080"
    ports:
      - "8081:8080"
    volumes:
      - ./deploy/keycloak/realm-lightbridge.json:/opt/keycloak/data/import/realm-lightbridge.json:ro
    healthcheck:
      # The image ships no curl/wget; use bash's /dev/tcp to confirm the HTTP port is accepting.
      test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8080"]
      interval: 10s
      timeout: 5s
      retries: 30

volumes:
  pgdata:
  neo4jdata: