services:
  postgres:
    image: postgres:18-alpine
    environment:
      POSTGRES_DB: kca
      POSTGRES_USER: kca
      POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-password}
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U kca"]
      interval: 5s
      timeout: 3s
      retries: 10

  # Mock OIDC provider (navikt/mock-oauth2-server). Interactive login accepts
  # any username; alice, bob, carol and dave carry profile claims.
  # The issuer is http://mockoauth:8180/kca, so both the browser and the app
  # need the /etc/hosts entry documented in README.md.
  mockoauth:
    build: ./server/dev/mockoauth
    environment:
      SERVER_PORT: "8180"
      LOG_LEVEL: INFO
    ports:
      - "8180:8180"

  mockoauth-init:
    image: curlimages/curl
    depends_on:
      - mockoauth
    entrypoint: >
      /bin/sh -c "
      until curl -sf http://mockoauth:8180/kca/.well-known/openid-configuration > /dev/null; do
        echo 'waiting for mockoauth...'; sleep 2;
      done
      "

  redis:
    image: redis:8-alpine
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10

  db-migrate:
    build:
      context: .
      dockerfile: server/Dockerfile
    working_dir: /app
    command: ["aerich", "upgrade"]
    environment:
      DATABASE_ENGINE: postgres
      DATABASE_HOST: postgres
      DATABASE_PORT: "5432"
      DATABASE_NAME: kca
      DATABASE_USER: kca
      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
    depends_on:
      postgres:
        condition: service_healthy

  kca:
    build:
      context: .
      dockerfile: server/Dockerfile
    depends_on:
      postgres:
        condition: service_healthy
      db-migrate:
        condition: service_completed_successfully
      mockoauth-init:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    environment:
      DATABASE_ENGINE: postgres
      DATABASE_HOST: postgres
      DATABASE_PORT: "5432"
      DATABASE_NAME: kca
      DATABASE_USER: kca
      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
      OIDC_0_PROVIDER: ${OIDC_0_PROVIDER:-default}
      OIDC_0_ISSUER: ${OIDC_0_ISSUER:-http://mockoauth:8180/kca}
      OIDC_0_CLIENT_ID: ${OIDC_0_CLIENT_ID:-kca}
      OIDC_0_CLIENT_SECRET: ${OIDC_0_CLIENT_SECRET:-dev-secret}
      OIDC_0_REDIRECT_URI: ${OIDC_0_REDIRECT_URI:-http://localhost:8080/auth/default/callback}
      OIDC_0_POST_LOGIN_REDIRECT: ${OIDC_0_POST_LOGIN_REDIRECT:-http://localhost:8080/}
      OIDC_0_POST_LOGOUT_REDIRECT: ${OIDC_0_POST_LOGOUT_REDIRECT:-http://localhost:8080/}
      REDIS_URL: redis://redis:6379/0
      # Development master key. Override for any real deployment:
      #   openssl rand -base64 32
      KCA_MASTER_KEY: ${KCA_MASTER_KEY:-MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=}
      MAX_UPLOAD_BYTES: ${MAX_UPLOAD_BYTES:-20971520}
    ports:
      - "127.0.0.1:${APP_PORT:-8080}:8080"

volumes:
  pgdata: