Docker-first development architecture

HOST MACHINE
├── Docker Compose (dev stack)
│   ├── API container (secrets via Infisical)
│   ├── PostgreSQL, Redis
│   └── Frontend (public vars only)
├── AI Sandbox (Claude Code / Codex)
│   ├── Source code (mounted)
│   └── NO secrets, NO env vars
├── Infisical CLI (fetches secrets, injects into Docker)
└── 1Password (personal passwords, SSH keys, 2FA)

services:
  api:
    build: { context: ., dockerfile: Dockerfile.dev }
    volumes: [./apps/api/src:/app/apps/api/src]
    ports: ["3333:3333"]
    environment:
      - DATABASE_URL # No value = inherited from host
      - DATABASE_PASSWORD # Infisical populates these
      - STRIPE_SECRET_KEY
      - JWT_SECRET
    depends_on: [postgres, redis]

  web:
    build: { context: ., dockerfile: Dockerfile.dev }
    volumes: [./apps/web/src:/app/apps/web/src]
    ports: ["3000:3000"]
    environment:
      - NEXT_PUBLIC_API_URL=http://localhost:3333

  postgres:
    image: postgres:16-alpine
    environment:
      {
        POSTGRES_DB: myapp_dev,
        POSTGRES_USER: myapp,
        POSTGRES_PASSWORD: dev-password,
      }
    # No host ports. Only reachable by other containers on the same network.

  redis:
    image: redis:7-alpine
    # No host ports. Only reachable by other containers on the same network.