add users logic

users/docker-compose.yml

@@ -0,0 +1,81 @@
+# A self-contained stack for the userservice: its own PostgreSQL (a separate
+# database from the coordinator's — different bounded context), a one-shot
+# migration step, and the service. The project name and host ports differ from
+# the coordinator's so both stacks can run side by side on one machine.
+name: scimesh-users
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-scimesh}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-scimesh}
+      POSTGRES_DB: ${POSTGRES_DB:-scimesh_users}
+    ports:
+      # 5433 on the host, so it never clashes with the coordinator's 5432.
+      - "${POSTGRES_PORT:-5433}:5432"
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      # Everything else waits on this, so the check must prove the server
+      # accepts queries — not merely that the port is open.
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-scimesh} -d ${POSTGRES_DB:-scimesh_users}"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+      start_period: 5s
+
+  # One-shot: applies migrations, then exits. Schema changes stay an explicit
+  # deployment step — the service binary never migrates on startup.
+  migrate:
+    image: migrate/migrate:v4.17.1
+    depends_on:
+      postgres:
+        condition: service_healthy
+    volumes:
+      - ./migrations:/migrations:ro
+    command:
+      - -path=/migrations
+      - -database=postgres://${POSTGRES_USER:-scimesh}:${POSTGRES_PASSWORD:-scimesh}@postgres:5432/${POSTGRES_DB:-scimesh_users}?sslmode=disable
+      - up
+    restart: on-failure
+
+  userservice:
+    build:
+      context: .
+    depends_on:
+      postgres:
+        condition: service_healthy
+      # Start only once the schema exists, otherwise the first query fails.
+      migrate:
+        condition: service_completed_successfully
+    environment:
+      USERSERVICE_ADDR: ":8081"
+      # Host is the service name: compose resolves it on the project network.
+      DATABASE_URL: postgres://${POSTGRES_USER:-scimesh}:${POSTGRES_PASSWORD:-scimesh}@postgres:5432/${POSTGRES_DB:-scimesh_users}?sslmode=disable
+      # MUST match the coordinator's JWT secret so it can verify these tokens.
+      JWT_SECRET: ${JWT_SECRET:-dev-secret-change-me-at-least-32-bytes}
+      JWT_TTL: ${JWT_TTL:-24h}
+      DB_MAX_CONNS: "10"
+      REQUEST_TIMEOUT: "15s"
+      LOG_LEVEL: ${LOG_LEVEL:-info}
+      # Logs are teed to stdout (docker logs) and this rotated file on a named
+      # volume, so they survive a rebuild.
+      LOG_FILE: /var/log/scimesh/userservice.log
+    ports:
+      - "${USERSERVICE_PORT:-8081}:8081"
+    # A named volume (not a host bind mount): it inherits the image's directory
+    # ownership, so the non-root process can write to it.
+    volumes:
+      - userservice_logs:/var/log/scimesh
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8081/health"]
+      interval: 10s
+      timeout: 3s
+      retries: 3
+      start_period: 5s
+    restart: unless-stopped
+
+volumes:
+  pgdata:
+  userservice_logs: