start project

docker-compose.yml

@@ -93,7 +93,9 @@ services:
       ELASTICSEARCH_HOSTS: http://elasticsearch:9200
       ELASTICSEARCH_USERNAME: ${ELASTICSEARCH_USERNAME:-}
       ELASTICSEARCH_PASSWORD: ${ELASTICSEARCH_PASSWORD:-}
-      xpack.monitoring.enabled: "false"
+      # No `xpack.monitoring.enabled` here on purpose: any logstash.* variable
+      # makes the image entrypoint rewrite config/logstash.yml, which is
+      # mounted read-only below.  The setting already lives in that file.
     volumes:
       - ./elk/logstash/pipeline:/usr/share/logstash/pipeline:ro
       - ./elk/logstash/templates:/usr/share/logstash/templates:ro
@@ -142,6 +144,9 @@ services:
     build:
       context: .
       dockerfile: backend/Dockerfile
+      # Explicit: the Dockerfile has a later `dev` stage that must not leak
+      # into the default stack.
+      target: runtime
     <<: *service-defaults
     environment:
       DJANGO_SETTINGS_MODULE: ${DJANGO_SETTINGS_MODULE:-config.settings.prod}
@@ -150,6 +155,10 @@ services:
       DJANGO_ALLOWED_HOSTS: ${DJANGO_ALLOWED_HOSTS:-localhost,127.0.0.1,backend}
       DJANGO_ADMIN_URL: ${DJANGO_ADMIN_URL:-admin/}
       SECURE_SSL_REDIRECT: ${SECURE_SSL_REDIRECT:-false}
+      # This stack is the local/demo one, so the interactive API docs are on.
+      # The production overlay turns them off - they document every endpoint
+      # and are served unauthenticated.
+      SERVE_API_DOCS: ${SERVE_API_DOCS:-true}
       ENVIRONMENT: ${ENVIRONMENT:-development}
       SERVICE_NAME: ${SERVICE_NAME:-linkedin-search-api}
       CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost:8080}
@@ -197,6 +206,37 @@ services:
       - no-new-privileges:true
     networks: [backend-net, frontend-net]
 
+  # ---------------------------------------------------------------------------
+  # Test runner - never started by `up`/`dev`/`prod` (the "test" profile keeps
+  # it out of the default set); invoked only via `make test`, which runs
+  # `docker compose run --rm backend-test`.
+  #
+  # The `backend` service above intentionally runs the `runtime` build stage,
+  # which ships no test tooling - that is what keeps the production image
+  # minimal. `pytest`, `django-extensions` etc. live only in the `dev` stage,
+  # so the test runner builds that stage instead. It talks to the same
+  # Postgres the rest of the stack uses; pytest-django creates and migrates
+  # its own throwaway `test_<db>` database there, and `config.settings.test`
+  # forces the search backend to Postgres, so Elasticsearch/Redis are not
+  # dependencies here.
+  # ---------------------------------------------------------------------------
+  backend-test:
+    build:
+      context: .
+      dockerfile: backend/Dockerfile
+      target: dev
+    profiles: ["test"]
+    entrypoint: []
+    command: ["pytest"]
+    environment:
+      DJANGO_SETTINGS_MODULE: config.settings.test
+      DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:?DJANGO_SECRET_KEY is required}
+      DATABASE_URL: postgres://${POSTGRES_USER:-linkedin}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-linkedin}
+    depends_on:
+      postgres:
+        condition: service_healthy
+    networks: [backend-net]
+
   frontend:
     build:
       context: .
@@ -209,10 +249,12 @@ services:
     security_opt:
       - no-new-privileges:true
     read_only: true
+    # A tmpfs mount is created root:root 0755 and shadows whatever the image
+    # chowned at build time, so nginx (uid 101) needs the mode set explicitly.
     tmpfs:
-      - /tmp
-      - /var/run
-      - /var/cache/nginx
+      - /tmp:mode=1777
+      - /var/run:mode=1777
+      - /var/cache/nginx:mode=1777
     networks: [frontend-net]
 
 networks: