services:
  cryostat:
    expose:
      - "${CRYOSTAT_HTTP_PORT}"
    environment:
      CRYOSTAT_HTTP_PROXY_HOST: auth
      CRYOSTAT_HTTP_PROXY_PORT: "${CRYOSTAT_HTTP_PORT}"
      QUARKUS_HTTP_PROXY_PROXY_ADDRESS_FORWARDING: "true"
      QUARKUS_HTTP_PROXY_ALLOW_X_FORWARDED: "true"
      QUARKUS_HTTP_PROXY_TRUSTED_PROXIES: "auth"
      QUARKUS_HTTP_PROXY_ENABLE_FORWARDED_HOST: "true"
      QUARKUS_HTTP_PROXY_ENABLE_FORWARDED_PREFIX: "true"
  auth:
    # the proxy does not actually depend on cryostat being up, but we use this
    # to ensure that when the smoketest tries to open the auth login page in a
    # browser tab, it does so only after the upstream cryostat is actually
    # available to be proxied to
    depends_on:
      cryostat:
        condition: service_healthy
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 128m
    image: ${OAUTH2_PROXY_IMAGE:-quay.io/oauth2-proxy/oauth2-proxy:latest-alpine}
    command:
      - --alpha-config=/tmp/auth_proxy_alpha_config.yml
    volumes:
      - auth_proxy_cfg:/tmp
    hostname: auth
    ports:
      - "${CRYOSTAT_PROXY_PORT}:${CRYOSTAT_PROXY_PORT}"
    environment:
      OAUTH2_PROXY_HTPASSWD_FILE: /tmp/auth_proxy_htpasswd
      OAUTH2_PROXY_HTPASSWD_USER_GROUP: write
      OAUTH2_PROXY_REDIRECT_URL: ${CRYOSTAT_PROXY_PROTOCOL}://localhost:${CRYOSTAT_PROXY_PORT}/oauth2/callback
      OAUTH2_PROXY_COOKIE_SECRET: __24_BYTE_COOKIE_SECRET_
      OAUTH2_PROXY_SKIP_AUTH_ROUTES: "^/health(/liveness)?$$"
      CRYOSTAT_PROXY_PROTOCOL: ${CRYOSTAT_PROXY_PROTOCOL}
      CRYOSTAT_PROXY_PORT: ${CRYOSTAT_PROXY_PORT}
    restart: unless-stopped
    healthcheck:
      test: wget --no-check-certificate -q --spider ${CRYOSTAT_PROXY_PROTOCOL}://localhost:${CRYOSTAT_PROXY_PORT}/ping || exit 1
      interval: 10s
      retries: 3
      start_period: 10s
      timeout: 5s

volumes:
  auth_proxy_cfg:
    external: true