docker-compose.yml

# SPDX-FileCopyrightText: Magenta ApS <https://magenta.dk>
# SPDX-License-Identifier: MPL-2.0
services:
  # We use two images in development.
  # * One frontend that runs `vue-cli-service serve`, named `frontend` and
  # * One that runs fastapi named `mo`.
  # The frontend image proxies requests to fastapi.
  # Both of these are served through our nginx proxy.
  proxy:
    image: docker.io/library/caddy:2
    volumes:
      - ./dev-environment/proxy:/etc/caddy/:ro,z
    ports:
      - "127.0.0.1:5001:80"
      - "127.0.0.1:5000:80"
    restart: unless-stopped

  naldo:
    image: magentaaps/os2mo-naldo:3
    environment:
      ORIGIN: http://localhost:5000 # svelte
      PUBLIC_BASE_URL: http://localhost:5000
      PUBLIC_SHOW_ADMIN_PANEL: "true"
      PUBLIC_SHOW_INSIGHTS: "true"
      PUBLIC_AUDITLOG: "true"
      PUBLIC_SHOW_ROLEBINDINGS: "true"
      PUBLIC_SHOW_KLE: "true"
      PUBLIC_SHOW_TIME_PLANNING: "true"
      PUBLIC_SHOW_PRIMARY_ENGAGEMENT: "true"
      PUBLIC_SHOW_PRIMARY_ASSOCIATION: "true"
      PUBLIC_SHOW_IT_ASSOCIATIONS_TAB: "true"
      PUBLIC_SHOW_EMPLOYEE_BIRTHDAY_IN_SEARCH: "true"
      PUBLIC_ONBOARDING_LINK: "true"
    restart: unless-stopped

  mo:
    # Enabling tty and stdin allows setting a breakpoint() and doing
    # `docker attach os2mo-mo-1` to enter pdb. Detach with Ctrl+P Ctrl+Q.
    tty: true
    stdin_open: true
    build:
      context: .
      args:
        # Use uid/gid <= 65536 to allow rootless podman
        uid: 52020
        gid: 52020
    deploy:
      mode: replicated
      replicas: 3
    volumes:
      # Uncomment this with the path you would like to use for queries, and set
      # the setting FILE_STORAGE=filesystem
      # - /tmp:/queries
      # For reload
      - ./poetry.lock:/app/poetry.lock:z
      - ./pyproject.toml:/app/pyproject.toml:z
      - ./backend:/app/backend:z
      - ./.pytest_cache:/app/.pytest_cache:z
      - ./.cov-report:/tmp/.cov-report:rw,z
      - ./dev-environment/wait-for-rabbitmq.sh:/wait-for-rabbitmq.sh:z
    entrypoint: ["/wait-for-rabbitmq.sh"]
    command: ["./docker/start.sh"]
    env_file: dev-environment/os2mo.env
    restart: unless-stopped

  amqp-subsystem:
    tty: true
    build:
      context: .
      args:
        # Use uid/gid <= 65536 to allow rootless podman
        uid: 52020
        gid: 52020
    volumes:
      - ./backend:/app/backend:z
      - ./dev-environment/wait-for-rabbitmq.sh:/wait-for-rabbitmq.sh:z
    entrypoint: ["/wait-for-rabbitmq.sh"]
    command: ["python", "-m", "mora.cli", "amqp", "start"]
    env_file: dev-environment/os2mo.env
    restart: unless-stopped

  mox:
    image: docker.io/library/caddy:2
    volumes:
      - ./dev-environment/mox:/etc/caddy/:ro,z
    ports:
      - "127.0.0.1:8080:80"
    restart: unless-stopped

  fixture-loader:
    image: magentaaps/os2mo-fixture-loader:1.4.0
    # For a list of supported fixtures, see:
    # https://git.magenta.dk/rammearkitektur/os2mo-fixture-loader.
    command: ["${FIXTURE:-kolding}"]
    environment:
      PGHOST: mox-db
      PGDATABASE: mox
      PGUSER: mox
      PGPASSWORD: mox
      # Remove GRACEFUL to overwrite your DB
      GRACEFUL: si
    # volumes:
    #   - ./custom-fixture.pgdump:/fixtures/kolding.pgdump:ro
    restart: on-failure

  mo-init:
    image: magentaaps/os2mo-init:5
    environment:
      MO_URL: "http://mo:5000"
      CLIENT_ID: "dipex"
      CLIENT_SECRET: "603f1c82-d012-4d04-9382-dbe659c533fb"
      AUTH_SERVER: "http://keycloak:8080/auth"
      AUTH_REALM: "mo"
    #volumes:
    #  - type: bind
    #    source: ./init.config.yml
    #    target: /config/config.yml
    #    read_only: true
    restart: on-failure

  mox-db:
    image: postgres:18
    environment:
      POSTGRES_DB: mox
      POSTGRES_PASSWORD: mox
      POSTGRES_USER: mox
    volumes:
      - ./dev-environment/moxdb-install-pgtap.sh:/docker-entrypoint-initdb.d/10-install-pgtap.sh:ro,z
    # The following will mount the database data directory to RAM. It
    # significantly speeds up the database at the cost of dataloss on shutdown.
    # This is useful for running tests, but should never be used if you want to
    # save the data.
    # tmpfs:
    #   - /var/lib/postgresql/data
    restart: unless-stopped

  msg-broker:
    # Normally, we expect the `rabbitmq` image. The -management images come
    # with a set of management plugins installed and enabled by default. They
    # can be accessed through the web interface on port 15672. The credentials
    # are guest/guest.
    image: rabbitmq:3-management
    # RabbitMQ stores data based on what it calls the "Node Name", which
    # defaults to the hostname. We set this, so we can keep track of our data.
    hostname: msg-broker
    # We expose the ports here, so decoupled agents can be developed with more
    # ease.
    ports:
      - "127.0.0.1:5672:5672" # amqp port
      - "127.0.0.1:15672:15672" # management port
    restart: unless-stopped

  keycloak:
    build:
      context: keycloak/
    environment:
      KC_HOSTNAME_URL: http://localhost:5000/auth
      KC_HOSTNAME_ADMIN_URL: http://localhost:5000/auth

      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin

      KC_DB_URL_HOST: keycloak-db
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: keycloak
    restart: unless-stopped
    volumes:
      - keycloak-volume:/srv/:ro,z

  keycloak-realm-builder:
    image: magentaaps/os2mo-keycloak-realm-builder:7 # please also update gitlab-ci-templates
    environment:
      KEYCLOAK_VERSION: 14.0.0

      POSTGRES_CONNECTION_STRING: postgres://keycloak:keycloak@keycloak-db/keycloak?sslmode=disable
      KEYCLOAK_ADMIN_USERNAME: "admin"
      KEYCLOAK_ADMIN_PASSWORD: "admin"
      KEYCLOAK_URL: "http://keycloak:8080"

      KEYCLOAK_SSL_REQUIRED_MO: external
      KEYCLOAK_SSL_REQUIRED_LORA: external
      KEYCLOAK_LORA_REALM_ENABLED: "true"
      KEYCLOAK_LORA_CLIENT_SECRET: 158a2075-aa8a-421c-94a4-2df35377014a
      KEYCLOAK_MO_CLIENT_REDIRECT_URI: '["http://localhost:5050/*", "http://localhost:5000/*", "http://localhost:5001/*", "http://localhost:5173/*", "http://localhost:4173/*"]'
      KEYCLOAK_MO_CLIENT_WEB_ORIGIN: '["http://localhost:5050", "http://localhost:5000", "http://localhost:5001", "http://localhost:5173", "http://localhost:4173"]'
      KEYCLOAK_RBAC_ENABLED: "true"
      KEYCLOAK_REALM_USERS: |
        [
          {
            "enabled": true,
            "uuid": "0fb62199-cb9e-4083-ba45-2a63bfd142d7",
            "email": "alvidan@kolding.dk",
            "username": "alvida",
            "password": "alvida",
            "firstname": "Alvida",
            "lastname": "Nibe",
            "roles": [
              "admin",
              "service_api"
            ]
          },
          {
            "enabled": true,
            "uuid": "99e7b256-7dfa-4ee8-95c6-e3abe82e236a",
            "email": "bruce@kung.fu",
            "username": "bruce",
            "password": "bruce",
            "firstname": "Bruce",
            "lastname": "Lee",
            "roles": [
              "reader",
              "service_api"
            ]
          },
          {
            "enabled": true,
            "uuid": "1c571f8f-0e3e-4ffa-9ff0-d35505781924",
            "email": "elinec@kolding.dk",
            "username": "eline",
            "password": "eline",
            "firstname": "Eline",
            "lastname": "Wedsgaard Christensen",
            "roles": [
              "owner",
              "reader",
              "service_api"
            ]
          },
          {
            "enabled": true,
            "uuid": "53181ed2-f1de-4c4a-a8fd-ab358c2c454a",
            "email": "anders@andeby.dk",
            "username": "anders",
            "password": "anders",
            "firstname": "Anders",
            "lastname": "And",
            "roles": [
              "owner",
              "reader",
              "service_api"
            ]
          }
        ]
    restart: on-failure
    volumes:
      - keycloak-volume:/srv/:z

  keycloak-dipex-builder:
    image: magentaaps/os2mo-keycloak-integration-builder:6
    environment:
      POSTGRES_CONNECTION_STRING: postgres://keycloak:keycloak@keycloak-db/keycloak?sslmode=disable
      POSTGRES_SCHEMA_NAME: terraform_remote_state_dipex_client

      TF_VAR_url: "http://keycloak:8080"
      TF_VAR_admin_password: admin

      TF_VAR_client_name: dipex
      TF_VAR_client_secret: "603f1c82-d012-4d04-9382-dbe659c533fb"
      TF_VAR_client_uuid: "d1fec000-baad-c0de-0000-004449504558"
      TF_VAR_client_roles: '["admin", "service_api"]'
    restart: on-failure

  keycloak-db:
    image: postgres:18
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: keycloak
    restart: unless-stopped

  amqp-metrics:
    image: magentaaps/os2mo-amqp-trigger-metrics:latest
    #build:
    #  context: ../os2mo-amqp-trigger-metrics
    #  dockerfile: Dockerfile
    environment:
      AMQP_URL: amqp://guest:guest@msg-broker:5672/
    ports:
      - "127.0.0.1:8012:8000"
    restart: unless-stopped
    profiles:
      - amqp-metrics

volumes:
  keycloak-volume: