name: authapp-proxy

services:
  postgres:
    image: postgres:17.6-bookworm
    restart: unless-stopped
    environment:
      POSTGRES_DB: authproxy
      POSTGRES_USER: authproxy
      POSTGRES_PASSWORD: ${AUTH_PROXY_POSTGRES_PASSWORD:-change-me}
    volumes:
      - auth-proxy-postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U authproxy -d authproxy"]
      interval: 5s
      timeout: 5s
      retries: 20

  redis:
    image: redis:8.2.1-bookworm
    restart: unless-stopped
    command: ["redis-server", "--appendonly", "yes"]
    volumes:
      - auth-proxy-redis:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 20

  api:
    env_file:
      - path: .env
        required: false
    build:
      context: .
      dockerfile: dockerfiles/api.Dockerfile
      args:
        BUILD_HASH: ${BUILD_HASH:-unknown}
    restart: unless-stopped
    init: true
    environment:
      NODE_ENV: production
      AUTH_PROXY_CONFIG_FILE: /app/config/config.json5
      AUTH_PROXY_SECRETS_FILE: /app/config/secrets.json5
      AUTH_PROXY_BOOTSTRAP_ADMIN_PASSWORD_RECOVERY: ${AUTH_PROXY_BOOTSTRAP_ADMIN_PASSWORD_RECOVERY:-false}
      AUTH_PROXY_POSTGRES_DSN: postgres://authproxy:${AUTH_PROXY_POSTGRES_PASSWORD:-change-me}@postgres:5432/authproxy
      AUTH_PROXY_REDIS_DSN: redis://redis:6379
      AUTH_PROXY_SIGNING_KEY_DIRECTORY: /app/data/keys/signing
      AUTH_PROXY_GENERATED_TLS_DIRECTORY: /app/data/certs/generated
      LOG_K8S_METADATA_ENABLED: "false"
    volumes:
      - ./config:/app/config:ro
      - auth-proxy-keys:/app/data/keys
      - auth-proxy-certs:/app/data/certs
    ports:
      - "${AUTH_PROXY_API_PORT:-8080}:8080"
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "node", "dist/api/healthcheck.js"]
      interval: 10s
      timeout: 5s
      retries: 20
      start_period: 20s
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy

  wui:
    env_file:
      - path: .env
        required: false
    build:
      context: .
      dockerfile: dockerfiles/wui.Dockerfile
      args:
        BUILD_HASH: ${BUILD_HASH:-unknown}
    restart: unless-stopped
    init: true
    environment:
      NODE_ENV: production
      HOST: 0.0.0.0
      PORT: 3000
      AUTH_PROXY_WUI_API_URL: http://api:8080
      BUILD_HASH: ${BUILD_HASH:-unknown}
    volumes:
      - ./config/config.json5:/app/config/config.json5:ro
      - auth-proxy-wui-certs:/app/data/certs/wui
    ports:
      - "${AUTH_PROXY_WUI_PORT:-3000}:3000"
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "node", "dist/wui/runtime/healthcheck.mjs"]
      interval: 10s
      timeout: 5s
      retries: 20
      start_period: 15s
    depends_on:
      api:
        condition: service_healthy

  test-upstream:
    profiles: ["e2e"]
    build:
      context: test-apps/upstream
      dockerfile: Dockerfile
    environment:
      PORT: 9000
      AUTH_PROXY_ISSUER: http://api:8080
    ports:
      - "9000:9000"

  mock-app-1:
    profiles: ["mesh"]
    build:
      context: test-apps/mock-mesh
      dockerfile: Dockerfile
    command: ["--config", "configs/app-1.docker.json5"]
    init: true
    ports:
      - "4101:4101"

  mock-app-2:
    profiles: ["mesh"]
    build:
      context: test-apps/mock-mesh
      dockerfile: Dockerfile
    command: ["--config", "configs/app-2.docker.json5"]
    init: true
    ports:
      - "4102:4102"

  mock-app-3:
    profiles: ["mesh"]
    build:
      context: test-apps/mock-mesh
      dockerfile: Dockerfile
    command: ["--config", "configs/app-3.docker.json5"]
    init: true
    ports:
      - "4103:4103"

  mock-app-4:
    profiles: ["mesh"]
    build:
      context: test-apps/mock-mesh
      dockerfile: Dockerfile
    command: ["--config", "configs/app-4.docker.json5"]
    init: true
    ports:
      - "4104:4104"

  mock-app-5:
    profiles: ["mesh"]
    build:
      context: test-apps/mock-mesh
      dockerfile: Dockerfile
    command: ["--config", "configs/app-5.docker.json5"]
    init: true
    ports:
      - "4105:4105"

  mock-app-6:
    profiles: ["mesh"]
    build:
      context: test-apps/mock-mesh
      dockerfile: Dockerfile
    command: ["--config", "configs/app-6.docker.json5"]
    init: true
    ports:
      - "4106:4106"

  mock-app-7:
    profiles: ["mesh"]
    build:
      context: test-apps/mock-mesh
      dockerfile: Dockerfile
    command: ["--config", "configs/app-7.docker.json5"]
    init: true
    ports:
      - "4107:4107"

  mock-app-8:
    profiles: ["mesh"]
    build:
      context: test-apps/mock-mesh
      dockerfile: Dockerfile
    command: ["--config", "configs/app-8.docker.json5"]
    init: true
    ports:
      - "4108:4108"

volumes:
  auth-proxy-postgres:
  auth-proxy-redis:
  auth-proxy-keys:
  auth-proxy-certs:
  auth-proxy-wui-certs: