docker-compose.dev.yml

# Google credentials for the Hub's Vertex enrichment providers (the google-gemini provider) are read
# from a file *inside* the container, so a host path can never resolve on its own. Bind-mount
# whatever the host points at to one fixed in-container path and set the in-container variable to
# match (see the hub service's environment).
#
# The host knob is HUB_GOOGLE_APPLICATION_CREDENTIALS, deliberately *not* the standard
# GOOGLE_APPLICATION_CREDENTIALS. That name is Google's global Application Default Credentials
# convention and gcloud users commonly export it from a shell profile; compose gives the shell
# environment precedence over .env, so reading it here would let ambient state nobody set for
# Formbricks drive this mount. A stale export (key since moved) would fail hub and hub-worker
# creation under create_host_path: false and take the whole db:up chain down with it, for someone
# who never touched enrichment; a live one would silently bind a personal or production key into
# both containers and activate it. HUB_ also matches the other Hub knobs here (HUB_API_KEY,
# HUB_DATABASE_URL, HUB_IMAGE_TAG); only the in-container name stays standard, which is what the
# Hub actually reads.
#
# The /dev/null default keeps the mount spec valid when the variable is unset — nothing reads the
# file in that case, because the ${VAR:+...} form below leaves the in-container variable empty and
# Application Default Credentials falls through exactly as it did before.
#
# A YAML merge key (<<:) only works on mappings, and volumes is a sequence, so this is a plain
# alias and each service has to reference it explicitly. Both hub and hub-worker need it: the
# worker classifies and the API embeds search queries, so mounting only one leaves the other
# unable to authenticate.
#
# Long syntax on purpose. In the "source:target:ro" short form, compose reads a source that is not
# an absolute or ./-prefixed path as a *named volume* reference, so a relative value here
# (HUB_GOOGLE_APPLICATION_CREDENTIALS=creds.json) fails the whole project with "refers to undefined
# volume" — taking postgres and everything else down with it, for an error that never mentions
# credentials. With an explicit type: bind, a relative value is resolved against the project
# directory instead.
#
# create_host_path: false because Docker's default is to CREATE a missing bind source, as a
# directory. A typo'd or since-moved path would therefore leave a stray "creds.json/" directory on
# the host and mount it as a directory here, so the read fails with "is a directory" and hub-worker
# crash-loops on a path that looks correct. Refusing to start is the better failure: the daemon
# names the exact path it could not find, and only the hub containers fail rather than the whole
# project (unlike the undefined-volume case above, which fails at config parse).
x-hub-volumes: &hub-volumes
  - type: bind
    source: ${HUB_GOOGLE_APPLICATION_CREDENTIALS:-/dev/null}
    target: /secrets/gcp.json
    read_only: true
    bind:
      create_host_path: false

services:
  # PostgreSQL must load the vector library so Hub (and Formbricks) can use the pgvector extension.
  postgres:
    image: pgvector/pgvector:pg18
    volumes:
      - postgres:/var/lib/postgresql
    environment:
      - POSTGRES_DB=postgres
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=postgres
    ports:
      - ${POSTGRES_PORT:-5432}:5432
    command: >
      postgres
      -c shared_preload_libraries=vector
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d postgres || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 30
      start_period: 10s

  authzed-db-bootstrap:
    image: pgvector/pgvector:pg18
    restart: "no"
    entrypoint: ["/bin/sh", "/usr/local/bin/authzed-postgres-bootstrap.sh"]
    environment:
      POSTGRES_ADMIN_URL: postgresql://postgres:postgres@postgres:5432/postgres?sslmode=disable
      AUTHZED_DATABASE_NAME: spicedb
      AUTHZED_DATABASE_USERNAME: spicedb
      AUTHZED_DATABASE_PASSWORD: ${AUTHZED_DATABASE_PASSWORD:?AUTHZED_DATABASE_PASSWORD is required}
    volumes:
      - ./docker/authzed-postgres-bootstrap.sh:/usr/local/bin/authzed-postgres-bootstrap.sh:ro
    depends_on:
      postgres:
        condition: service_healthy

  spicedb-migrate:
    image: ${SPICEDB_IMAGE_REF:-authzed/spicedb:v1.52.0}
    restart: "no"
    command: datastore migrate head
    environment:
      SPICEDB_DATASTORE_ENGINE: postgres
      SPICEDB_DATASTORE_CONN_URI: postgresql://spicedb:${AUTHZED_DATABASE_PASSWORD:?AUTHZED_DATABASE_PASSWORD is required}@postgres:5432/spicedb?sslmode=disable
    depends_on:
      authzed-db-bootstrap:
        condition: service_completed_successfully

  spicedb:
    image: ${SPICEDB_IMAGE_REF:-authzed/spicedb:v1.52.0}
    restart: unless-stopped
    command: serve
    mem_limit: 512m
    environment:
      SPICEDB_DATASTORE_ENGINE: postgres
      SPICEDB_DATASTORE_CONN_URI: postgresql://spicedb:${AUTHZED_DATABASE_PASSWORD:?AUTHZED_DATABASE_PASSWORD is required}@postgres:5432/spicedb?sslmode=disable
      SPICEDB_GRPC_PRESHARED_KEY: ${AUTHZED_TOKEN:?AUTHZED_TOKEN is required}
      SPICEDB_LOG_FORMAT: json
      SPICEDB_LOG_LEVEL: info
      SPICEDB_TELEMETRY_ENDPOINT: ""
    ports:
      - 127.0.0.1:${SPICEDB_GRPC_PORT:-50051}:50051
    depends_on:
      spicedb-migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "/usr/local/bin/grpc_health_probe", "-addr=localhost:50051"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s

  authzed-cli:
    image: ${ZED_IMAGE_REF:-authzed/zed:v1.1.1}
    profiles: ["authzed-tools"]
    entrypoint: ["zed"]
    volumes:
      - ./authzed/schema.zed:/schema.zed:ro

  authzed-ui:
    image: ${GRPCUI_IMAGE_REF:-fullstorydev/grpcui:v1.5.2}
    profiles: ["authzed-ui"]
    command:
      - -plaintext
      - -bind
      - 0.0.0.0
      - -port
      - "8080"
      - -H
      - "authorization: Bearer ${AUTHZED_TOKEN:?AUTHZED_TOKEN is required}"
      - spicedb:50051
    ports:
      - 127.0.0.1:${AUTHZED_GRPCUI_PORT:-50052}:8080
    depends_on:
      spicedb:
        condition: service_healthy

  mailhog:
    image: arjenz/mailhog
    ports:
      - 8025:8025
      - 1025:1025

  valkey:
    image: valkey/valkey@sha256:e0eb7c480958d32bdc4357a74bdd70653ae15f2f9b4c93c4a5a9fad1dc471c84
    command: "valkey-server --maxmemory-policy noeviction"
    ports:
      - 6379:6379
    volumes:
      - valkey-data:/data

  rustfs-perms:
    image: busybox:1.36.1
    user: "0:0"
    command: ["sh", "-c", "mkdir -p /data && chown -R 10001:10001 /data"]
    volumes:
      - rustfs-data:/data

  rustfs:
    image: rustfs/rustfs:1.0.0-rc.2@sha256:7d6d361c49c08d427250fb59aae5d78df83d644c3405d9ccf4b21cda0b0692d0
    depends_on:
      rustfs-perms:
        condition: service_completed_successfully
    command: /data
    environment:
      - RUSTFS_ACCESS_KEY=devrustfs
      - RUSTFS_SECRET_KEY=devrustfs123
      - RUSTFS_ADDRESS=:9000
      - RUSTFS_CONSOLE_ENABLE=true
      - RUSTFS_CONSOLE_ADDRESS=:9001
    ports:
      - "9000:9000" # S3 API direct access
      - "9001:9001" # Web console
    volumes:
      - rustfs-data:/data

  rustfs-init:
    image: minio/mc@sha256:95b5f3f7969a5c5a9f3a700ba72d5c84172819e13385aaf916e237cf111ab868
    depends_on:
      - rustfs
    environment:
      - RUSTFS_ADMIN_USER=devrustfs
      - RUSTFS_ADMIN_PASSWORD=devrustfs123
      - RUSTFS_BUCKET_NAME=formbricks
      - RUSTFS_POLICY_NAME=formbricks-policy
      - RUSTFS_SERVICE_USER=devrustfs-service
      - RUSTFS_SERVICE_PASSWORD=devrustfs-service123
      - RUSTFS_CORS_ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000,http://localhost:3001,http://127.0.0.1:3001,http://localhost:3002,http://127.0.0.1:3002
    volumes:
      - ./docker/rustfs-init.sh:/usr/local/bin/rustfs-init.sh:ro
    entrypoint:
      - /bin/sh
      - /usr/local/bin/rustfs-init.sh

  # Create Hub's dedicated dev database before migrations run. Idempotent; runs on every compose up.
  hub-db-create:
    image: pgvector/pgvector:pg18
    restart: "no"
    entrypoint: ["sh", "-c"]
    command:
      [
        'if [ "$$(psql "$$POSTGRES_DATABASE_URL" -tAc "SELECT 1 FROM pg_database WHERE datname = ''hub''")" != "1" ]; then psql "$$POSTGRES_DATABASE_URL" -v ON_ERROR_STOP=1 -c "CREATE DATABASE hub"; fi',
      ]
    environment:
      POSTGRES_DATABASE_URL: postgresql://postgres:postgres@postgres:5432/postgres?sslmode=disable
    depends_on:
      postgres:
        condition: service_healthy

  # Run Hub DB migrations (goose + river) before the API starts. Idempotent; runs on every compose up.
  # Hub image pinned via HUB_IMAGE_TAG so docker does not silently reuse a stale :latest cache.
  # Keep hub, hub-migrate, and any future hub-worker on the same tag — they share one image and
  # drift breaks migrations or job processing.
  hub-migrate:
    image: ghcr.io/formbricks/hub:${HUB_IMAGE_TAG:-0.8.5}
    restart: "no"
    entrypoint: ["sh", "-c"]
    command:
      [
        'if [ -x /usr/local/bin/goose ] && [ -x /usr/local/bin/river ]; then /usr/local/bin/goose -dir /app/migrations postgres "$$DATABASE_URL" up && /usr/local/bin/river migrate-up --database-url "$$DATABASE_URL"; else echo ''Migration tools (goose/river) not in image.''; exit 1; fi',
      ]
    environment:
      DATABASE_URL: ${HUB_DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/hub?sslmode=disable}
    depends_on:
      hub-db-create:
        condition: service_completed_successfully

  # Formbricks Hub API (ghcr.io/formbricks/hub). Uses a dedicated local Hub database by default.
  hub:
    image: ghcr.io/formbricks/hub:${HUB_IMAGE_TAG:-0.8.5}
    depends_on:
      hub-migrate:
        condition: service_completed_successfully
    ports:
      - "8080:8080"
    volumes: *hub-volumes
    environment: &hub-runtime-environment
      API_KEY: ${HUB_API_KEY:-dev-api-key}
      DATABASE_URL: ${HUB_DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/hub?sslmode=disable}
      # Explicit Postgres env so migrations and any libpq fallback use the service host, not localhost
      PGHOST: postgres
      PGPORT: "5432"
      PGUSER: postgres
      PGPASSWORD: postgres
      PGDATABASE: hub
      PGSSLMODE: disable
      # Hub embeddings are disabled unless EMBEDDING_PROVIDER and EMBEDDING_MODEL are set.
      EMBEDDING_PROVIDER: ${EMBEDDING_PROVIDER:-}
      EMBEDDING_MODEL: ${EMBEDDING_MODEL:-}
      EMBEDDING_PROVIDER_API_KEY: ${EMBEDDING_PROVIDER_API_KEY:-}
      EMBEDDING_BASE_URL: ${EMBEDDING_BASE_URL:-}
      EMBEDDING_MAX_CONCURRENT: ${EMBEDDING_MAX_CONCURRENT:-5}
      EMBEDDING_MAX_ATTEMPTS: ${EMBEDDING_MAX_ATTEMPTS:-3}
      EMBEDDING_NORMALIZE: ${EMBEDDING_NORMALIZE:-false}
      EMBEDDING_GOOGLE_CLOUD_PROJECT: ${EMBEDDING_GOOGLE_CLOUD_PROJECT:-}
      EMBEDDING_GOOGLE_CLOUD_LOCATION: ${EMBEDDING_GOOGLE_CLOUD_LOCATION:-}
      # Point at the in-container mount (see x-hub-volumes) rather than passing the host path
      # through, which could never resolve inside the container. The ${VAR:+...} form substitutes
      # only when the host variable is set and non-empty, so leaving it unset keeps this empty and
      # Application Default Credentials behaves as before.
      #
      # Only the google-gemini (Vertex) providers need this; the plain `google` provider takes an
      # API key instead, which is the simpler option for local dev. Note the mount reaches both
      # containers because they share one credential — the API needs it only when embeddings use
      # Vertex (it embeds search queries synchronously), the worker whenever it classifies.
      GOOGLE_APPLICATION_CREDENTIALS: ${HUB_GOOGLE_APPLICATION_CREDENTIALS:+/secrets/gcp.json}
      # Hub sentiment/emotion/translation enrichment (0.7.x) are disabled unless the
      # matching *_PROVIDER and *_MODEL pair is set (translation additionally needs a
      # target language — TRANSLATION_DEFAULT_LANGUAGE, or a per-tenant setting). The
      # anchor feeds both the API (enqueues) and the worker (classifies) — configuring
      # only one side leaves jobs unprocessed.
      SENTIMENT_PROVIDER: ${SENTIMENT_PROVIDER:-}
      SENTIMENT_MODEL: ${SENTIMENT_MODEL:-}
      SENTIMENT_PROVIDER_API_KEY: ${SENTIMENT_PROVIDER_API_KEY:-}
      SENTIMENT_GOOGLE_CLOUD_PROJECT: ${SENTIMENT_GOOGLE_CLOUD_PROJECT:-}
      SENTIMENT_GOOGLE_CLOUD_LOCATION: ${SENTIMENT_GOOGLE_CLOUD_LOCATION:-}
      EMOTIONS_PROVIDER: ${EMOTIONS_PROVIDER:-}
      EMOTIONS_MODEL: ${EMOTIONS_MODEL:-}
      EMOTIONS_PROVIDER_API_KEY: ${EMOTIONS_PROVIDER_API_KEY:-}
      EMOTIONS_GOOGLE_CLOUD_PROJECT: ${EMOTIONS_GOOGLE_CLOUD_PROJECT:-}
      EMOTIONS_GOOGLE_CLOUD_LOCATION: ${EMOTIONS_GOOGLE_CLOUD_LOCATION:-}
      TRANSLATION_PROVIDER: ${TRANSLATION_PROVIDER:-}
      TRANSLATION_MODEL: ${TRANSLATION_MODEL:-}
      TRANSLATION_PROVIDER_API_KEY: ${TRANSLATION_PROVIDER_API_KEY:-}
      TRANSLATION_DEFAULT_LANGUAGE: ${TRANSLATION_DEFAULT_LANGUAGE:-}
      TRANSLATION_GOOGLE_CLOUD_PROJECT: ${TRANSLATION_GOOGLE_CLOUD_PROJECT:-}
      TRANSLATION_GOOGLE_CLOUD_LOCATION: ${TRANSLATION_GOOGLE_CLOUD_LOCATION:-}
      TAXONOMY_SERVICE_URL: ${TAXONOMY_SERVICE_URL:-}
      TAXONOMY_SERVICE_TOKEN: ${TAXONOMY_SERVICE_TOKEN:-}
      HUB_INTERNAL_API_TOKEN: ${HUB_INTERNAL_API_TOKEN:-}

  # Hub worker processes async jobs enqueued by the API, including embeddings.
  hub-worker:
    image: ghcr.io/formbricks/hub:${HUB_IMAGE_TAG:-0.8.5}
    depends_on:
      hub-migrate:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
    entrypoint: ["/app/hub-worker"]
    healthcheck:
      disable: true
    volumes: *hub-volumes
    environment:
      <<: *hub-runtime-environment

  # Optional AI taxonomy beta service. Enable with COMPOSE_PROFILES=taxonomy.
  taxonomy:
    image: ghcr.io/formbricks/taxonomy${TAXONOMY_IMAGE_REF:-:latest}
    profiles: ["taxonomy"]
    depends_on:
      hub:
        condition: service_started
    environment:
      APP_ENV: production
      TAXONOMY_SERVICE_TOKEN: ${TAXONOMY_SERVICE_TOKEN:-}
      HUB_INTERNAL_API_URL: http://hub:8080
      HUB_INTERNAL_API_TOKEN: ${HUB_INTERNAL_API_TOKEN:-}
      TAXONOMY_LLM_PROVIDER: ${TAXONOMY_LLM_PROVIDER:-openai-compatible}
      TAXONOMY_LLM_MODEL: ${TAXONOMY_LLM_MODEL:-}
      TAXONOMY_LLM_BASE_URL: ${TAXONOMY_LLM_BASE_URL:-}
      TAXONOMY_LLM_API_KEY: ${TAXONOMY_LLM_API_KEY:-}
      TAXONOMY_VERTEX_PROJECT: ${TAXONOMY_VERTEX_PROJECT:-}
      TAXONOMY_VERTEX_LOCATION: ${TAXONOMY_VERTEX_LOCATION:-}
      TAXONOMY_GOOGLE_CLOUD_CREDENTIALS_JSON: ${TAXONOMY_GOOGLE_CLOUD_CREDENTIALS_JSON:-}
      AWS_REGION: ${AWS_REGION:-}
      AWS_BEARER_TOKEN_BEDROCK: ${AWS_BEARER_TOKEN_BEDROCK:-}
    healthcheck:
      test:
        [
          "CMD",
          "python",
          "-c",
          "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=5).read()",
        ]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 30s

  # Optional bundled Qwen/vLLM OpenAI-compatible runtime. Enable with COMPOSE_PROFILES=qwen.
  vllm:
    image: ${QWEN_VLLM_IMAGE:-vllm/vllm-openai:v0.14.0}
    profiles: ["qwen"]
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities: [gpu]
    command:
      - vllm
      - serve
      - ${QWEN_MODEL_ID:-Qwen/Qwen3-14B-AWQ}
      - --host
      - 0.0.0.0
      - --port
      - "8000"
      - --no-enable-prefix-caching
      - --max-model-len
      - ${QWEN_MAX_MODEL_LEN:-8192}
      - --dtype
      - ${QWEN_DTYPE:-float16}
      - --tensor-parallel-size
      - ${QWEN_TENSOR_PARALLEL_SIZE:-1}
      - --max-num-seqs
      - ${QWEN_MAX_NUM_SEQS:-8}
      - --gpu_memory_utilization
      - ${QWEN_GPU_MEMORY_UTILIZATION:-0.9}
      - --served-model-name
      - ${QWEN_SERVED_MODEL_NAME:-qwen3-14b-awq}
      - --default-chat-template-kwargs
      - '{"enable_thinking": false}'
    environment:
      HF_HOME: /data
    volumes:
      - qwen-model-cache:/data
    ports:
      - "${QWEN_VLLM_HOST:-127.0.0.1}:${QWEN_VLLM_PORT:-8000}:8000"
    healthcheck:
      test:
        [
          "CMD",
          "python3",
          "-c",
          "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=5).read()",
        ]
      interval: 30s
      timeout: 10s
      retries: 40
      start_period: 10m

  cube:
    image: cubejs/cube:v1.6.6
    env_file:
      - path: apps/web/.env
        required: false
    command:
      - sh
      - -c
      - |
        if [ -z "$$CUBEJS_API_SECRET" ]; then
          echo "CUBEJS_API_SECRET is required for Cube JWT authentication" >&2
          exit 1
        fi
        exec cubejs server
    depends_on:
      postgres:
        condition: service_healthy
      hub-migrate:
        condition: service_completed_successfully
    ports:
      - 4000:4000
      - 4001:4001 # Cube Playground UI (dev only)
    environment:
      CUBEJS_DB_TYPE: postgres
      CUBEJS_DB_HOST: ${CUBEJS_DB_HOST:-postgres}
      CUBEJS_DB_NAME: ${CUBEJS_DB_NAME:-postgres}
      CUBEJS_DB_USER: ${CUBEJS_DB_USER:-postgres}
      CUBEJS_DB_PASS: ${CUBEJS_DB_PASS:-postgres}
      CUBEJS_DB_PORT: ${CUBEJS_DB_PORT:-5432}
      CUBEJS_DEV_MODE: "true"
      CUBEJS_API_SECRET: ${CUBEJS_API_SECRET:-}
      CUBEJS_JWT_ISSUER: ${CUBEJS_JWT_ISSUER:-formbricks-web}
      CUBEJS_JWT_AUDIENCE: ${CUBEJS_JWT_AUDIENCE:-formbricks-cube}
      CUBEJS_DEFAULT_API_SCOPES: meta,data
      CUBEJS_CACHE_AND_QUEUE_DRIVER: memory
    volumes:
      - ./docker/cube/cube.js:/cube/conf/cube.js:ro
      - ./docker/cube/schema:/cube/conf/model:ro
    restart: on-failure

volumes:
  postgres:
    driver: local
  valkey-data:
    driver: local
  rustfs-data:
    driver: local
  qwen-model-cache:
    driver: local