# IceGuard application stack, in three tiers via Compose profiles.
#
#   Level 1 — app (official):    docker compose up -d --build
#       frontend + backend only. Point the backend at YOUR Postgres via .env
#       (ICEGUARD_DB_URL / ICEGUARD_DB_USER / ICEGUARD_DB_PASSWORD).
#
#   Level 2 — + database:        docker compose --profile db up -d --build
#       adds a Postgres container — self-contained app + its required DB.
#
#   Level 3 — + test sandbox:    docker compose --profile db --profile sandbox up -d --build
#       adds MinIO (S3) + an Iceberg REST catalog so you can browse/create tables.
#       Register it from the UI with URI http://rest-catalog:8181.
#
#   UI:   http://localhost:8090        API/Swagger: http://localhost:8080/q/swagger-ui
#
# Backend here is the SLIM image (no Spark). For the full multi-catalog sandbox
# (Nessie, Polaris, real Spark), use docker-compose.dev.yml.

name: iceguard

services:
  # ── Level 1: the two shippable services ──
  frontend:
    build:
      context: ./frontend
    image: iceguard-frontend
    environment:
      BACKEND_URL: http://backend:8080
    ports:
      - "8090:80"
    depends_on:
      - backend
    networks: [iceguard]

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile          # slim (no Spark)
    image: iceguard-backend
    environment:
      QUARKUS_DATASOURCE_DB_KIND: postgresql
      QUARKUS_DATASOURCE_USERNAME: ${ICEGUARD_DB_USER:-iceguard}
      QUARKUS_DATASOURCE_PASSWORD: ${ICEGUARD_DB_PASSWORD:-iceguard}
      # Level 1: set ICEGUARD_DB_URL to your external Postgres. Level 2/3: the
      # bundled `postgres` service is used by default.
      QUARKUS_DATASOURCE_JDBC_URL: ${ICEGUARD_DB_URL:-jdbc:postgresql://postgres:5432/iceguard}
      # Schema is provisioned by Flyway (migrate-at-start) and checked by Hibernate
      # validate — these are the app defaults, so no override here. The target DB
      # must be empty on first run (Flyway owns the schema).
      QUARKUS_OIDC_ENABLED: "false"
      # The UI is served by nginx on :8090, so the browser's Origin is http://localhost:8090.
      # The image's baked default only allows the Vite dev origin (:5173); override it here.
      QUARKUS_HTTP_CORS_ORIGINS: ${ICEGUARD_CORS_ORIGINS:-http://localhost:8090}
      # Only used with the sandbox profile (MinIO); harmless otherwise.
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-minioadmin}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-minioadmin}
      AWS_REGION: ${AWS_REGION:-us-east-1}
    ports:
      - "8080:8080"
    depends_on:
      postgres:
        condition: service_healthy
        required: false             # only waited on when the `db` profile is active
    networks: [iceguard]

  # ── Level 2: Postgres (IceGuard's required dependency) ──
  postgres:
    image: postgres:16-alpine
    profiles: ["db"]
    environment:
      POSTGRES_DB: iceguard
      POSTGRES_USER: ${ICEGUARD_DB_USER:-iceguard}
      POSTGRES_PASSWORD: ${ICEGUARD_DB_PASSWORD:-iceguard}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${ICEGUARD_DB_USER:-iceguard}"]
      interval: 5s
      timeout: 3s
      retries: 10
    networks: [iceguard]

  # ── Level 3: test sandbox — MinIO + a working Iceberg REST catalog ──
  minio:
    image: minio/minio:latest
    profiles: ["sandbox"]
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    command: server /data --console-address ":9001"
    ports:
      - "9000:9000"
      - "9001:9001"
    volumes:
      - minio-data:/data
    networks: [iceguard]

  minio-init:
    image: minio/mc:latest
    profiles: ["sandbox"]
    depends_on:
      minio:
        condition: service_started
    entrypoint: >
      /bin/sh -c "
        sleep 3;
        mc alias set local http://minio:9000 minioadmin minioadmin;
        mc mb --ignore-existing local/warehouse;
        echo 'Bucket warehouse created';
      "
    networks: [iceguard]

  rest-catalog:
    image: apache/iceberg-rest-fixture:latest
    profiles: ["sandbox"]
    ports:
      - "8181:8181"
    environment:
      AWS_ACCESS_KEY_ID: minioadmin
      AWS_SECRET_ACCESS_KEY: minioadmin
      AWS_REGION: us-east-1
      CATALOG_WAREHOUSE: s3://warehouse/rest/
      CATALOG_IO__IMPL: org.apache.iceberg.aws.s3.S3FileIO
      CATALOG_S3_ENDPOINT: http://minio:9000
      CATALOG_S3_PATH__STYLE__ACCESS: "true"
    depends_on:
      minio-init:
        condition: service_completed_successfully
    networks: [iceguard]

volumes:
  postgres-data:
  minio-data:

networks:
  iceguard: