docker-compose.yml

volumes:
  ffun_postgresql_data_18: {}
  ffun_caddy_data: {}
  ffun_caddy_markers: {}
  ffun_filebrowser_database: {}

networks:
  ffun_network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.22.0.0/16

x-backend-api-environment: &backend-api-environment
  FFUN_ENABLE_API_SPA: "${FFUN_ENABLE_API_SPA:-True}"
  FFUN_ENABLE_API_ROOT: "${FFUN_ENABLE_API_ROOT:-True}"
  FFUN_ENABLE_SENTRY: "${FFUN_ENABLE_SENTRY:-False}"
  FFUN_SENTRY__DSN: "${FFUN_SENTRY__DSN:-not-specified}"
  # set to /repository/feeds_collections/collections in case you want to use the default collection
  FFUN_FEEDS_COLLECTIONS_COLLECTION_CONFIGS: "${FFUN_FEEDS_COLLECTIONS_COLLECTION_CONFIGS-}"

x-backend-api: &backend-api
  image: ffun-backend-dev

  depends_on:
    postgresql:
      condition: service_healthy

  command:
    - /bin/bash
    - -c
    - |
      poetry run ffun migrate
      echo "migrations successed"
      poetry run uvicorn ffun.application.application:app --host 0.0.0.0 --port 8000 --workers 1 --reload

  volumes:
    - ${PWD}/ffun:/repository
    - ${PWD}/.env:/repository/.env
    - ${PWD}/.configs:/repository/.configs
    - ${PWD}/.shared:/repository/.shared
    - ${PWD}/feeds_collections:/repository/feeds_collections

  environment:
    <<: *backend-api-environment

  networks:
    ffun_network:
        aliases:
          - backend

services:

  postgresql:
    image: postgres:18.3-trixie

    volumes:
      - type: tmpfs
        target: /var/lib/postgresql/18/docker
        tmpfs:
          size: 2g
      - ./docker/dev/postgresql/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d
      - ./docker/dev/postgresql/healthcheck.sh:/healthcheck.sh

    environment:
      POSTGRES_MULTIPLE_DATABASES: ffun,keycloak
      # set to root because of the bug in pg_isready (?) it
      # it looks like it expect the DB name be the same as the POSTGRES_USER
      POSTGRES_DB: root
      POSTGRES_USER: root
      POSTGRES_PASSWORD: root

    ports:
      - "5432:5432"

    networks:
      ffun_network: {}

    healthcheck:
      test: "/healthcheck.sh"
      interval: 1s
      timeout: 5s
      retries: 10

  idp:
    image: tiendil/keycloak-simple:latest

    profiles: ["multi-user"]

    depends_on:
      postgresql:
        condition: service_healthy

    volumes:
      - ./docker/dev/keycloak/import:/opt/keycloak/data/import:ro

    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin

      KC_DB: postgres
      KC_DB_URL_HOST: postgresql
      KC_DB_URL_PORT: "5432"
      KC_DB_URL_DATABASE: keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: keycloak

      KC_HTTP_ENABLED: "true"
      KC_PROXY_HEADERS: xforwarded
      KC_HOSTNAME_STRICT: "false"

      KC_HEALTH_ENABLED: "true"
      KC_MANAGEMENT_ENABLED: "true"

    command: start --optimized --import-realm

    networks:
      ffun_network: {}

    healthcheck:
      test: >
        bash -c "exec 3<>/dev/tcp/127.0.0.1/9000 &&
        printf 'HEAD /health/ready HTTP/1.1\r\nHost: localhost:9000\r\nConnection: close\r\n\r\n' >&3 &&
        grep -q 'HTTP/1.1 200 OK' <&3"
      interval: 1s
      timeout: 5s
      retries: 10
      start_period: 60s

  auth-proxy-multi-user:
    profiles: ["multi-user"]

    depends_on:
      backend-multi-user:
        condition: service_started
      idp:
        condition: service_healthy

    networks:
      ffun_network:
        aliases:
          - auth-proxy

    #############################################################
    # OAuth2 Proxy is now recomened proxy for OIDC authentication
    #############################################################
    image: quay.io/oauth2-proxy/oauth2-proxy:v7.13.0-alpine

    volumes:
      - ./docker/dev/oauth2-proxy/config.cfg:/etc/oauth2-proxy/config.cfg:ro
      - ./docker/dev/oauth2-proxy/config-alpha.yaml:/etc/oauth2-proxy/config-alpha.yaml:ro
      - ./docker/dev/oauth2-proxy/templates:/etc/oauth2-proxy/templates:ro
      - ffun_caddy_data:/caddy-data:ro

    command: --config /etc/oauth2-proxy/config.cfg --alpha-config /etc/oauth2-proxy/config-alpha.yaml

    ########
    # APISIX
    ########
    # image: apache/apisix:3.14.1-ubuntu

    # volumes:
    #   - ./docker/dev/apisix/apisix.yaml:/usr/local/apisix/conf/apisix.yaml:ro
    #   - ./docker/dev/apisix/config.yaml:/usr/local/apisix/conf/config.yaml:ro

    # environment:
    #   APISIX_STAND_ALONE: "true"


    ####################################################
    # Pomerium for testing aduptability of OIDC setup
    # How to turn on:
    # - frontend (spa) should be placed behind Pomerium auth-proxy (Caddyfile)
    # - add auth.feeds.fun.local domain pointing to he Pomerium auth-proxy (/etc/hosts, Caddyfile, Keycloak client)
    # - remove "pkce.code.challenge.method" from the Keycloak auth-proxy-client settings
    # Known problems:
    # - Can not smartly redirect user to login/registration page.
    # - Makes +1 redirect on the root of the SPA with custom URL query (that's why we need to place SPA behind Pomerium)
    # - Uses hardcoded technical URLs, lile /.pomerium/*
    ####################################################
    # image: pomerium/pomerium:v0.31

    # volumes:
    #   - ./docker/dev/pomerium/config.yaml:/pomerium/config.yaml:ro
    #   - ffun_caddy_data:/caddy-data:ro

    # environment:
    #   POMERIUM_DEBUG: "true"

  auth-proxy-single-user:
    image: inanimate/echo-server

    profiles: ["single-user"]

    environment:
      PORT: "8000"
      ADD_HEADERS: '{"X-FFun-User-Id":"dev-user","X-FFun-Identity-Provider-Id":"single_user"}'

    networks:
      ffun_network:
        aliases:
          - auth-proxy

  backend-build:
    image: ffun-backend-dev
    build:
      context: ./
      dockerfile: ./docker/dev/backend/Dockerfile
    command: /bin/true

    profiles:
      - dev-build

  backend-multi-user:
    <<: *backend-api
    profiles: ["multi-user"]

  backend-single-user:
    <<: *backend-api
    profiles: ["single-user"]

    environment:
      <<: *backend-api-environment
      FFUN_AUTH_FORCE_EXTERNAL_USER_ID: "dev-user"
      FFUN_AUTH_FORCE_EXTERNAL_IDENTITY_PROVIDER_ID: "single_user"

  backend-utils:
    image: ffun-backend-dev

    depends_on:
      postgresql:
        condition: service_started

    volumes:
      - ${PWD}/ffun:/repository
      - ${PWD}/.env:/repository/.env
      - ${PWD}/.configs:/repository/.configs
      - ${PWD}/.shared:/repository/.shared
      - ${PWD}/tags_quality_base:/repository/tags_quality_base
      - ${PWD}/feeds_collections:/repository/feeds_collections
      - ${PWD}/changes:/repository/changes
      - ${PWD}/CHANGELOG.md:/repository/CHANGELOG.md

    environment:
      FFUN_ENABLE_SENTRY: "${FFUN_ENABLE_SENTRY:-False}"
      FFUN_SENTRY__DSN: "${FFUN_SENTRY__DSN:-not-specified}"
      # set to /repository/feeds_collections/collections in case you want to use the default collection
      FFUN_FEEDS_COLLECTIONS_COLLECTION_CONFIGS: "${FFUN_FEEDS_COLLECTIONS_COLLECTION_CONFIGS-}"

    networks:
      ffun_network: {}

    extra_hosts:
      # required to test with local LLM services like LMStudio
      - "host.docker.internal:host-gateway"

    profiles:
      - dev

  frontend-build:
    image: ffun-frontend-dev
    build:
      context: ./
      dockerfile: ./docker/dev/frontend/Dockerfile
    command: /bin/true

    profiles:
      - dev-build

  frontend:
    image: ffun-frontend-dev

    command: "npm run dev -- --host 0.0.0.0 --port 8000"

    volumes:
      - ${PWD}/site/src:/repository/src

    environment:
      VITE_FFUN_ENABLE_SENTRY: "${FFUN_ENABLE_SENTRY:-False}"
      VITE_FFUN_SENTRY_DSN: "${FFUN_SENTRY__DSN:-not-specified}"

      VITE_FFUN_PLAUSIBLE_ENABLED: "${FFUN_PLAUSIBLE_ENABLED:-False}"
      VITE_FFUN_PLAUSIBLE_DOMAIN: "${FFUN_PLAUSIBLE_DOMAIN:-localhost}"
      VITE_FFUN_PLAUSIBLE_SCRIPT: "${FFUN_PLAUSIBLE_SCRIPT:-not-specified}"

      VITE_FFUN_TRACK_EVENTS: "true"

      VITE_FFUN_CRM_TERMS: "${FFUN_CRM_TERMS:-not-specified}"
      VITE_FFUN_CRM_PRIVACY: "${FFUN_CRM_PRIVACY:-not-specified}"
      VITE_FFUN_CRM_IMPRESSUM: "${FFUN_CRM_IMPRESSUM:-not-specified}"

      VITE_FFUN_HAS_COLLECTIONS: "true"

    networks:
      ffun_network: {}

  frontend-utils:
    image: ffun-frontend-dev

    volumes:
      - ${PWD}/site/src:/repository/src
      - ${PWD}/site/codespell.toml:/repository/codespell.toml

    networks:
      ffun_network: {}

  # We use Caddy in dev environment for the next reasons:
  # - OIDC protocol assumes communication over HTTPS
  #   and not all proxies and related tools support communication over HTTP
  #   that complicates development, testing and experimentation.
  # - SPA's Vite backend recently got too complex proxy behavior because of OIDC
  edge-proxy:
    image: caddy:2.10-alpine

    volumes:
      - ./docker/dev/caddy:/etc/caddy:ro
      - ffun_caddy_data:/data
      - ffun_caddy_markers:/markers

    ports:
      - "80:80"
      - "443:443"

    networks:
      ffun_network:
        aliases:
          - feeds.fun.local
          - idp.feeds.fun.local
          - auth.feeds.fun.local  # is required by Pomerium
          - filebrowser.feeds.fun.local

  filebrowser:
    image: filebrowser/filebrowser:v2.61.1

    profiles: ["filebrowser"]

    command: "--noauth"

    user: "0:0" # need to have ./markers writable

    volumes:
      - ffun_filebrowser_database:/database
      - ffun_caddy_markers:/srv/markers

    networks:
      ffun_network: {}