name: openlicensd-stack

services:
  postgres:
    image: postgres:18-alpine
    environment:
      POSTGRES_USER: openlicensd
      POSTGRES_PASSWORD: openlicensd
      POSTGRES_DB: openlicensd
    volumes:
      - postgres_data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U openlicensd -d openlicensd"]
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  openlicensd:
    image: ghcr.io/alvarorg14/openlicensd:${OPENLICENSD_IMAGE_TAG:-latest}
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      - "${OPENLICENSD_PORT:-8080}:8080"
    environment:
      OPENLICENSD_ADDR: ":8080"
      OPENLICENSD_DATABASE_HOST: postgres
      OPENLICENSD_DATABASE_PORT: 5432
      OPENLICENSD_DATABASE_USER: openlicensd
      OPENLICENSD_DATABASE_PASSWORD: openlicensd
      OPENLICENSD_DATABASE_NAME: openlicensd
      OPENLICENSD_DATABASE_SSLMODE: disable
      OPENLICENSD_DATABASE_MAX_CONNS: ${OPENLICENSD_DATABASE_MAX_CONNS:-0}
      OPENLICENSD_DATABASE_MIN_CONNS: ${OPENLICENSD_DATABASE_MIN_CONNS:-0}
      OPENLICENSD_DATABASE_MAX_CONN_IDLE_MINUTES: ${OPENLICENSD_DATABASE_MAX_CONN_IDLE_MINUTES:-0}
      OPENLICENSD_DATABASE_STATEMENT_TIMEOUT_SECONDS: ${OPENLICENSD_DATABASE_STATEMENT_TIMEOUT_SECONDS:-0}
      OPENLICENSD_BOOTSTRAP_ADMIN_EMAIL: ${OPENLICENSD_BOOTSTRAP_ADMIN_EMAIL:-admin@example.com}
      OPENLICENSD_BOOTSTRAP_ADMIN_NAME: ${OPENLICENSD_BOOTSTRAP_ADMIN_NAME:-Administrator}
      OPENLICENSD_BOOTSTRAP_ADMIN_PASSWORD_HASH: ${OPENLICENSD_BOOTSTRAP_ADMIN_PASSWORD_HASH:-$$2a$$10$$w6lsMGg4BZVLWv0dqUXT2eUWcWhbh99FIECbPlBNeE.pu089T5E/2}
      OPENLICENSD_SESSION_TTL_HOURS: ${OPENLICENSD_SESSION_TTL_HOURS:-24}
      OPENLICENSD_REQUEST_TIMEOUT_SECONDS: ${OPENLICENSD_REQUEST_TIMEOUT_SECONDS:-30}
      OPENLICENSD_SESSION_CLEANUP_INTERVAL_MINUTES: ${OPENLICENSD_SESSION_CLEANUP_INTERVAL_MINUTES:-60}
      OPENLICENSD_COOKIE_SECURE: ${OPENLICENSD_COOKIE_SECURE:-false}
      OPENLICENSD_LOCAL_LOGIN_ENABLED: ${OPENLICENSD_LOCAL_LOGIN_ENABLED:-true}
      OPENLICENSD_LOG_LEVEL: ${OPENLICENSD_LOG_LEVEL:-info}
      OPENLICENSD_LOG_FORMAT: ${OPENLICENSD_LOG_FORMAT:-json}
      OPENLICENSD_TRUSTED_PROXIES: ${OPENLICENSD_TRUSTED_PROXIES:-}
      OPENLICENSD_RATE_LIMIT_ENABLED: ${OPENLICENSD_RATE_LIMIT_ENABLED:-true}
      OPENLICENSD_RATE_LIMIT_PUBLIC_PER_MINUTE: ${OPENLICENSD_RATE_LIMIT_PUBLIC_PER_MINUTE:-600}
      OPENLICENSD_RATE_LIMIT_PUBLIC_BURST: ${OPENLICENSD_RATE_LIMIT_PUBLIC_BURST:-60}
      OPENLICENSD_RATE_LIMIT_LOGIN_PER_MINUTE: ${OPENLICENSD_RATE_LIMIT_LOGIN_PER_MINUTE:-30}
      OPENLICENSD_RATE_LIMIT_LOGIN_BURST: ${OPENLICENSD_RATE_LIMIT_LOGIN_BURST:-10}
      OPENLICENSD_RATE_LIMIT_AUTHENTICATED_PER_MINUTE: ${OPENLICENSD_RATE_LIMIT_AUTHENTICATED_PER_MINUTE:-300}
      OPENLICENSD_RATE_LIMIT_AUTHENTICATED_BURST: ${OPENLICENSD_RATE_LIMIT_AUTHENTICATED_BURST:-60}
      OPENLICENSD_RATE_LIMIT_IDLE_MINUTES: ${OPENLICENSD_RATE_LIMIT_IDLE_MINUTES:-10}
      OPENLICENSD_OIDC_ENABLED: ${OPENLICENSD_OIDC_ENABLED:-false}
      OPENLICENSD_OIDC_ISSUER_URL: ${OPENLICENSD_OIDC_ISSUER_URL:-https://accounts.google.com}
      OPENLICENSD_OIDC_CLIENT_ID: ${OPENLICENSD_OIDC_CLIENT_ID:-}
      OPENLICENSD_OIDC_CLIENT_SECRET: ${OPENLICENSD_OIDC_CLIENT_SECRET:-}
      OPENLICENSD_OIDC_REDIRECT_URL: ${OPENLICENSD_OIDC_REDIRECT_URL:-http://localhost:8080/api/v1/auth/oidc/callback}
      OPENLICENSD_OIDC_SCOPES: ${OPENLICENSD_OIDC_SCOPES:-openid,profile,email}
      OPENLICENSD_OIDC_DEFAULT_ROLE: ${OPENLICENSD_OIDC_DEFAULT_ROLE:-viewer}
      OPENLICENSD_OIDC_PROVIDER_NAME: ${OPENLICENSD_OIDC_PROVIDER_NAME:-Google}
      OPENLICENSD_OIDC_ADMIN_EMAILS: ${OPENLICENSD_OIDC_ADMIN_EMAILS:-}
      OPENLICENSD_HARBOR_ENABLED: ${OPENLICENSD_HARBOR_ENABLED:-false}
      OPENLICENSD_HARBOR_URL: ${OPENLICENSD_HARBOR_URL:-https://harbor.example.com}
      OPENLICENSD_HARBOR_ADMIN_USERNAME: ${OPENLICENSD_HARBOR_ADMIN_USERNAME:-admin}
      OPENLICENSD_HARBOR_ADMIN_PASSWORD: ${OPENLICENSD_HARBOR_ADMIN_PASSWORD:-change-me}
      OPENLICENSD_HARBOR_PROJECTS: ${OPENLICENSD_HARBOR_PROJECTS:-myproject}
      OPENLICENSD_HARBOR_ROBOT_DURATION_DAYS: ${OPENLICENSD_HARBOR_ROBOT_DURATION_DAYS:-1}
      OPENLICENSD_HARBOR_ROBOT_NAME_PREFIX: ${OPENLICENSD_HARBOR_ROBOT_NAME_PREFIX:-openlicensd}
      OPENLICENSD_HARBOR_INSECURE_SKIP_VERIFY: ${OPENLICENSD_HARBOR_INSECURE_SKIP_VERIFY:-false}
      OPENLICENSD_HARBOR_DEBUG: ${OPENLICENSD_HARBOR_DEBUG:-false}
    restart: unless-stopped

volumes:
  postgres_data: