# Server overlay for the TeamHUB VM (Stage 5, debug window before the gateway).
#
# Usage (teamhub-deploy does this via deploy/teamhub-deploy.json):
#   docker compose -f docker-compose.yml -f docker-compose.server.yml up -d --build
#
# Compared with the standalone dev compose this overlay:
#   - moves every backing service onto the internal-only legacyhub_db network
#     and strips their published host ports (postgres/minio/opensearch/qdrant/
#     redis stay module-internal; OpenSearch keeps the security plugin disabled,
#     which is acceptable ONLY while it is strictly internal);
#   - publishes the api on ${LEGACYHUB_API_BIND:-127.0.0.1}:8050 — the server
#     sets LEGACYHUB_API_BIND=<VM IP> so the teamhub-deploy health gate works;
#     once the platform gateway fronts the module, switch to the federation
#     overlay docker-compose.teamhub.yml (no host port at all);
#   - attaches api and worker to the shared external teamhub_net for the
#     dispatch bus (alias legacyhub-api) — teamhub_net is a regular bridge, so
#     it also provides the egress needed for first-run HuggingFace downloads;
#   - identity enforcement is env-driven: AUTH_REQUIRE_IDENTITY (set true on
#     the server; machine paths keep X-API-Key auth);
#   - applies alembic migrations before uvicorn starts. The base compose api
#     command is a bare `uvicorn` (no migrate step, unlike ToolsHUB/SalesHUB),
#     so a fresh server DB stayed empty and every DB-backed request 500'd on
#     `relation does not exist` while /health (liveness) still returned 200.
#     The worker (restart: always) tolerates the brief startup race until the
#     schema exists.
#
# The shared network must exist first: docker network create teamhub_net

networks:
  teamhub_net:
    external: true
    name: teamhub_net

services:
  postgres:
    networks: !override [legacyhub_db]
    ports: !reset []
    restart: always

  minio:
    networks: !override [legacyhub_db]
    ports: !reset []
    restart: always

  opensearch:
    networks: !override [legacyhub_db]
    ports: !reset []
    restart: always

  qdrant:
    networks: !override [legacyhub_db]
    ports: !reset []
    restart: always

  redis:
    networks: !override [legacyhub_db]
    ports: !reset []
    restart: always

  api:
    command: ["sh", "-c", "alembic upgrade head && exec uvicorn app.main:app --host 0.0.0.0 --port 8000"]
    ports: !override
      - "${LEGACYHUB_API_BIND:-127.0.0.1}:${API_HOST_PORT:-8050}:8000"
    networks: !override
      legacyhub_db: {}
      teamhub_net:
        aliases: [legacyhub-api]
    environment:
      AUTH_REQUIRE_IDENTITY: ${AUTH_REQUIRE_IDENTITY:-false}
    restart: always

  worker:
    networks: !override
      legacyhub_db: {}
      teamhub_net: {}
    restart: always