feat: jpa, messaging, notification, mongo, graphql 어댑터터 리펙토링

docker-compose.prod-smoke.yml

@@ -0,0 +1,37 @@
+# =============================================================================
+# prod-smoke — a production-shaped runtime, for evidence, on a laptop.
+#
+# Not "production Compose". What it is for is proving that the prod profile's fail-closed validators
+# can be satisfied at all: TLS on the JDBC URL, a schema Flyway owns, JSON logging, secret
+# references rather than values. A prod lane that only ever gets as far as `config` proves the file
+# parses, which was never the thing in doubt.
+#
+# The credentials here are generated per run by the lane wrapper. Nothing local is reused: a
+# prod-smoke that borrows the local MinIO password is a prod-smoke that tests the local setup.
+# =============================================================================
+
+services:
+  app:
+    environment:
+      # Explicit, not inherited. A Compose profile selects services and says nothing about which
+      # environment the application believes it is in.
+      SPRING_PROFILES_ACTIVE: "prod"
+      TZ: "UTC"
+      # verify-full, which is the point: PostgreSqlTransportSecurityValidator refuses anything less,
+      # and that refusal is the behaviour this lane exists to satisfy rather than bypass.
+      APP_DATASOURCE_URL: "jdbc:postgresql://db:5432/${POSTGRES_DB:-ca_skeleton}?sslmode=verify-full&sslrootcert=/run/secrets/postgres-ca"
+      APP_DATASOURCE_USERNAME: "${APP_DATASOURCE_USERNAME:-ca_skeleton}"
+      # The password is deliberately absent here. An `environment:` entry beats `env_file:`, so
+      # declaring it as "${APP_DATASOURCE_PASSWORD:-}" read the host shell rather than the lane's
+      # generated file and injected an empty string — which the prod env validator then refused, for
+      # the right reason, about a value the lane had actually supplied.
+      APP_DATASOURCE_DDL_AUTO: "validate"
+      APP_LOG_JSON_ENABLED: "true"
+      APP_SECURITY_JWT_ISSUER: "http://keycloak:8080/realms/ca-skeleton"
+      APP_SECURITY_JWT_AUDIENCE: "ca-skeleton-api"
+    networks:
+      - caskeleton-infra
+
+networks:
+  caskeleton-infra:
+    external: false