services:
  postgres:
    image: postgres:18-alpine
    environment:
      POSTGRES_DB: kca
      POSTGRES_USER: kca
      POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-password}
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U kca"]
      interval: 5s
      timeout: 3s
      retries: 10

  # Mock OIDC provider (navikt/mock-oauth2-server). Interactive login accepts
  # any username; alice, bob, carol and dave carry profile claims.
  # The issuer is http://mockoauth:8180/kca, so both the browser and the app
  # need the /etc/hosts entry documented in README.md.
  mockoauth:
    build: ./server/dev/mockoauth
    environment:
      SERVER_PORT: "8180"
      LOG_LEVEL: INFO
    ports:
      - "8180:8180"

  mockoauth-init:
    image: curlimages/curl
    depends_on:
      - mockoauth
    entrypoint: >
      /bin/sh -c "
      until curl -sf http://mockoauth:8180/kca/.well-known/openid-configuration > /dev/null; do
        echo 'waiting for mockoauth...'; sleep 2;
      done
      "

  redis:
    image: redis:8-alpine
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10

  db-migrate:
    build:
      context: .
      dockerfile: server/Dockerfile
    working_dir: /app
    command: ["aerich", "upgrade"]
    environment:
      DATABASE_ENGINE: postgres
      DATABASE_HOST: postgres
      DATABASE_PORT: "5432"
      DATABASE_NAME: kca
      DATABASE_USER: kca
      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
    depends_on:
      postgres:
        condition: service_healthy

  kca:
    build:
      context: .
      dockerfile: server/Dockerfile
    depends_on:
      postgres:
        condition: service_healthy
      db-migrate:
        condition: service_completed_successfully
      mockoauth-init:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    environment:
      DATABASE_ENGINE: postgres
      DATABASE_HOST: postgres
      DATABASE_PORT: "5432"
      DATABASE_NAME: kca
      DATABASE_USER: kca
      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
      OIDC_0_PROVIDER: ${OIDC_0_PROVIDER:-default}
      OIDC_0_ISSUER: ${OIDC_0_ISSUER:-http://mockoauth:8180/kca}
      OIDC_0_CLIENT_ID: ${OIDC_0_CLIENT_ID:-kca}
      OIDC_0_CLIENT_SECRET: ${OIDC_0_CLIENT_SECRET:-dev-secret}
      OIDC_0_REDIRECT_URI: ${OIDC_0_REDIRECT_URI:-http://localhost:8080/auth/default/callback}
      OIDC_0_POST_LOGIN_REDIRECT: ${OIDC_0_POST_LOGIN_REDIRECT:-http://localhost:8080/}
      OIDC_0_POST_LOGOUT_REDIRECT: ${OIDC_0_POST_LOGOUT_REDIRECT:-http://localhost:8080/}
      REDIS_URL: redis://redis:6379/0
      # Development master key. Override for any real deployment:
      #   openssl rand -base64 32
      KCA_MASTER_KEY: ${KCA_MASTER_KEY:-MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=}
      MAX_UPLOAD_BYTES: ${MAX_UPLOAD_BYTES:-20971520}
      # Optional OpenTelemetry export (OTLP/HTTP). Set OTEL_ENABLED=1 and
      # point OTEL_EXPORTER_OTLP_ENDPOINT at a collector, e.g.
      # http://otel-collector:4318
      OTEL_ENABLED: ${OTEL_ENABLED:-false}
      OTEL_SERVICE_NAME: ${OTEL_SERVICE_NAME:-kca}
      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
      OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
      OTEL_EXCLUDED_PATHS: ${OTEL_EXCLUDED_PATHS:-/api/health}
      # OCSP snapshots default to the session Redis. Set KCA_OCSP_REDIS_URL to
      # use a dedicated instance instead.
      KCA_OCSP_REDIS_URL: ${KCA_OCSP_REDIS_URL:-}
      KCA_OCSP_REDIS_PREFIX: ${KCA_OCSP_REDIS_PREFIX:-ocsp}
      KCA_OCSP_PUBLISH_INTERVAL_SECONDS: ${KCA_OCSP_PUBLISH_INTERVAL_SECONDS:-1}
      KCA_OCSP_HEARTBEAT_INTERVAL_SECONDS: ${KCA_OCSP_HEARTBEAT_INTERVAL_SECONDS:-30}
      KCA_OCSP_REDIS_EXPIRY_SECONDS: ${KCA_OCSP_REDIS_EXPIRY_SECONDS:-60}
    ports:
      - "127.0.0.1:${APP_PORT:-8080}:8080"

  # Optional standalone OCSP responder. It has no database or KCA master-key
  # environment, but reads OCSP keys from the configured Redis (the session
  # Redis by default).
  # Enable with:
  #   docker compose --profile ocsp up --build
  ocsp:
    profiles: ["ocsp"]
    image: gitea.woggioni.net/woggioni/kca-ocsp:${OCSP_IMAGE_TAG:-latest}
    build:
      context: .
      dockerfile: ocsp-responder/Dockerfile
    depends_on:
      redis:
        condition: service_healthy
    environment:
      OCSP_CONFIG: /etc/ocsp/responder.yaml
      OCSP_REDIS_URL: ${OCSP_REDIS_URL:-redis://redis:6379/0}
    volumes:
      - ${OCSP_CONFIG_FILE:-./ocsp-responder/responder.example.yaml}:/etc/ocsp/responder.yaml:ro
      - ${OCSP_CA_DIR:-./ocsp-responder/ca}:/etc/ocsp/ca:ro
      - ${OCSP_SIGNER_DIR:-./ocsp-responder/signers}:/etc/ocsp/signers:ro
    ports:
      - "127.0.0.1:${OCSP_PORT:-2560}:2560"
    read_only: true
    security_opt:
      - no-new-privileges:true

volumes:
  pgdata: