services:
  # ---- MetaFlow Backend ----
  backend:
    build:
      context: ./backend
    container_name: metaflow_backend
    env_file: ./backend/.env
    ports:
      - "8000:8000"
    depends_on:
      - openmetadata-server
    networks:
      - metaflow_net
    restart: unless-stopped

  # ---- MetaFlow Frontend ----
  frontend:
    build:
      context: ./frontend
    container_name: metaflow_frontend
    ports:
      - "3000:80"
    depends_on:
      - backend
    networks:
      - metaflow_net
    restart: unless-stopped

  # ---- OpenMetadata v1.12.4 (official release) ----
  mysql:
    image: docker.getcollate.io/openmetadata/db:1.12.4
    container_name: metaflow_mysql
    command: "--sort_buffer_size=10M"
    environment:
      MYSQL_ROOT_PASSWORD: password
    ports:
      - "3306:3306"
    networks:
      - metaflow_net
    healthcheck:
      test: mysql --user=root --password=$$MYSQL_ROOT_PASSWORD --silent --execute "use openmetadata_db"
      interval: 15s
      timeout: 10s
      retries: 10
    volumes:
      - mysql-data:/var/lib/mysql

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:9.3.0
    container_name: metaflow_elasticsearch
    environment:
      - discovery.type=single-node
      - ES_JAVA_OPTS=-Xms1024m -Xmx1024m
      - xpack.security.enabled=false
    ports:
      - "9200:9200"
      - "9300:9300"
    networks:
      - metaflow_net
    healthcheck:
      test: "curl -s http://localhost:9200/_cluster/health?pretty | grep status | grep -qE 'green|yellow' || exit 1"
      interval: 15s
      timeout: 10s
      retries: 10
    volumes:
      - es-data:/usr/share/elasticsearch/data

  execute-migrate-all:
    image: docker.getcollate.io/openmetadata/server:1.12.4
    container_name: metaflow_migrate
    command: "./bootstrap/openmetadata-ops.sh migrate"
    environment:
      OPENMETADATA_CLUSTER_NAME: openmetadata
      SERVER_PORT: 8585
      SERVER_ADMIN_PORT: 8586
      LOG_LEVEL: INFO

      # DB
      DB_DRIVER_CLASS: com.mysql.cj.jdbc.Driver
      DB_SCHEME: mysql
      DB_PARAMS: allowPublicKeyRetrieval=true&useSSL=false&serverTimezone=UTC
      DB_USER: openmetadata_user
      DB_USER_PASSWORD: openmetadata_password
      DB_HOST: mysql
      DB_PORT: 3306
      OM_DATABASE: openmetadata_db

      # Search
      ELASTICSEARCH_HOST: elasticsearch
      ELASTICSEARCH_PORT: 9200
      ELASTICSEARCH_SCHEME: http
      SEARCH_TYPE: elasticsearch

      # Auth
      AUTHORIZER_CLASS_NAME: org.openmetadata.service.security.DefaultAuthorizer
      AUTHORIZER_REQUEST_FILTER: org.openmetadata.service.security.JwtFilter
      AUTHORIZER_ADMIN_PRINCIPALS: '[admin]'
      AUTHORIZER_ALLOWED_REGISTRATION_DOMAIN: '["all"]'
      AUTHORIZER_INGESTION_PRINCIPALS: '[ingestion-bot]'
      AUTHORIZER_PRINCIPAL_DOMAIN: open-metadata.org
      AUTHORIZER_ALLOWED_DOMAINS: '[]'
      AUTHORIZER_ENFORCE_PRINCIPAL_DOMAIN: "false"
      AUTHORIZER_ENABLE_SECURE_SOCKET: "false"
      AUTHENTICATION_PROVIDER: basic
      AUTHENTICATION_RESPONSE_TYPE: id_token
      CUSTOM_OIDC_AUTHENTICATION_PROVIDER_NAME: ""
      AUTHENTICATION_PUBLIC_KEYS: '[http://localhost:8585/api/v1/system/config/jwks]'
      AUTHENTICATION_AUTHORITY: https://accounts.google.com
      AUTHENTICATION_CLIENT_ID: ""
      AUTHENTICATION_CALLBACK_URL: ""
      AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: '[email,preferred_username,sub]'
      AUTHENTICATION_JWT_PRINCIPAL_CLAIMS_MAPPING: '[]'
      AUTHENTICATION_ENABLE_SELF_SIGNUP: "true"
      AUTHENTICATION_CLIENT_TYPE: public

      # JWT
      RSA_PUBLIC_KEY_FILE_PATH: ./conf/public_key.der
      RSA_PRIVATE_KEY_FILE_PATH: ./conf/private_key.der
      JWT_ISSUER: open-metadata.org
      JWT_KEY_ID: Gb389a-9f76-gdjs-a92j-0242bk94356
    depends_on:
      elasticsearch:
        condition: service_healthy
      mysql:
        condition: service_healthy
    networks:
      - metaflow_net

  openmetadata-server:
    image: docker.getcollate.io/openmetadata/server:1.12.4
    container_name: metaflow_openmetadata
    environment:
      OPENMETADATA_CLUSTER_NAME: openmetadata
      SERVER_PORT: 8585
      SERVER_ADMIN_PORT: 8586
      LOG_LEVEL: INFO

      # Auth
      AUTHORIZER_CLASS_NAME: org.openmetadata.service.security.DefaultAuthorizer
      AUTHORIZER_REQUEST_FILTER: org.openmetadata.service.security.JwtFilter
      AUTHORIZER_ADMIN_PRINCIPALS: '[admin]'
      AUTHORIZER_ALLOWED_REGISTRATION_DOMAIN: '["all"]'
      AUTHORIZER_INGESTION_PRINCIPALS: '[ingestion-bot]'
      AUTHORIZER_PRINCIPAL_DOMAIN: open-metadata.org
      AUTHORIZER_ALLOWED_DOMAINS: '[]'
      AUTHORIZER_ENFORCE_PRINCIPAL_DOMAIN: "false"
      AUTHORIZER_ENABLE_SECURE_SOCKET: "false"
      AUTHENTICATION_PROVIDER: basic
      AUTHENTICATION_RESPONSE_TYPE: id_token
      CUSTOM_OIDC_AUTHENTICATION_PROVIDER_NAME: ""
      AUTHENTICATION_PUBLIC_KEYS: '[http://localhost:8585/api/v1/system/config/jwks]'
      AUTHENTICATION_AUTHORITY: https://accounts.google.com
      AUTHENTICATION_CLIENT_ID: ""
      AUTHENTICATION_CALLBACK_URL: ""
      AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: '[email,preferred_username,sub]'
      AUTHENTICATION_JWT_PRINCIPAL_CLAIMS_MAPPING: '[]'
      AUTHENTICATION_ENABLE_SELF_SIGNUP: "true"
      AUTHENTICATION_CLIENT_TYPE: public

      # JWT
      RSA_PUBLIC_KEY_FILE_PATH: ./conf/public_key.der
      RSA_PRIVATE_KEY_FILE_PATH: ./conf/private_key.der
      JWT_ISSUER: open-metadata.org
      JWT_KEY_ID: Gb389a-9f76-gdjs-a92j-0242bk94356

      # DB
      DB_DRIVER_CLASS: com.mysql.cj.jdbc.Driver
      DB_SCHEME: mysql
      DB_PARAMS: allowPublicKeyRetrieval=true&useSSL=false&serverTimezone=UTC
      DB_USER: openmetadata_user
      DB_USER_PASSWORD: openmetadata_password
      DB_HOST: mysql
      DB_PORT: 3306
      OM_DATABASE: openmetadata_db

      # Search
      ELASTICSEARCH_HOST: elasticsearch
      ELASTICSEARCH_PORT: 9200
      ELASTICSEARCH_SCHEME: http
      SEARCH_TYPE: elasticsearch

      # Pipeline
      PIPELINE_SERVICE_CLIENT_ENDPOINT: http://ingestion:8080
      SERVER_HOST_API_URL: http://openmetadata-server:8585/api

      OPENMETADATA_HEAP_OPTS: -Xmx1G -Xms1G
    ports:
      - "8585:8585"
    depends_on:
      execute-migrate-all:
        condition: service_completed_successfully
    networks:
      - metaflow_net
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8586/healthcheck"]
      interval: 15s
      timeout: 10s
      retries: 15
    restart: unless-stopped

  ingestion:
    image: docker.getcollate.io/openmetadata/ingestion:1.12.4
    container_name: metaflow_ingestion
    command: standalone
    environment:
      AIRFLOW__API__AUTH_BACKENDS: "airflow.api.auth.backend.basic_auth,airflow.api.auth.backend.session"
      AIRFLOW__CORE__EXECUTOR: LocalExecutor
      _AIRFLOW_DB_MIGRATE: "true"
      _AIRFLOW_WWW_USER_CREATE: "true"
      _AIRFLOW_WWW_USER_USERNAME: admin
      _AIRFLOW_WWW_USER_PASSWORD: admin
      DB_HOST: mysql
      DB_PORT: 3306
      AIRFLOW_DB: airflow_db
      DB_SCHEME: mysql+mysqldb
      DB_USER: airflow_user
      DB_PASSWORD: airflow_pass
    ports:
      - "8080:8080"
    depends_on:
      mysql:
        condition: service_healthy
      openmetadata-server:
        condition: service_healthy
    networks:
      - metaflow_net
    restart: unless-stopped
    volumes:
      - ingestion-volume-dag-airflow:/opt/airflow/dag_generated_configs
      - ingestion-volume-dags:/opt/airflow/dags
      - ingestion-volume-tmp:/tmp

volumes:
  mysql-data:
  es-data:
  ingestion-volume-dag-airflow:
  ingestion-volume-dags:
  ingestion-volume-tmp:

networks:
  metaflow_net:
    name: metaflow_network