---
name: portal-documentacao

services:
  traefik:
    image: traefik:v2.11

    ports:
      - 80:80

    labels:
      - traefik.enable=true
      - traefik.constraint-label=public
      - traefik.http.routers.traefik-public-http.rule=Host(`traefik.docs.localhost`)
      - traefik.http.routers.traefik-public-http.entrypoints=http
      - traefik.http.routers.traefik-public-http.service=api@internal
      - traefik.http.services.traefik-public.loadbalancer.server.port=8000

      # GENERIC MIDDLEWARES
      - traefik.http.middlewares.gzip.compress=true
      - traefik.http.middlewares.gzip.compress.excludedcontenttypes=image/png, image/jpeg, font/woff2

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

    command:
      - --providers.docker
      - --providers.docker.constraints=Label(`traefik.constraint-label`, `public`)
      - --providers.docker.exposedbydefault=false
      - --entrypoints.http.address=:80
      - --accesslog
      - --log
      - --api

    networks:
      internal:
        aliases:
          - docs.localhost
          - sso.localhost
          - traefik.docs.localhost

  frontend:
    image: ghcr.io/ericof/portal-documentacao-frontend:latest
    platform: linux/amd64
    environment:
      RAZZLE_INTERNAL_API_PATH: http://backend:8080/Plone
    depends_on:
      - backend
    labels:
      - traefik.enable=true
      - traefik.constraint-label=public
      # Service
      - traefik.http.services.svc-frontend.loadbalancer.server.port=3000
      # Routers
      ## /
      - traefik.http.routers.rt-frontend.rule=Host(`docs.localhost`)
      - traefik.http.routers.rt-frontend.entrypoints=http
      - traefik.http.routers.rt-frontend.service=svc-frontend
      - traefik.http.routers.rt-frontend.middlewares=gzip
    networks:
      - internal

  backend:
    image: ghcr.io/ericof/portal-documentacao-backend:latest
    platform: linux/amd64
    environment:
      RELSTORAGE_DSN: "dbname='${DB_NAME:-plone}' user='${DB_NAME:-plone}' host='${DB_HOST:-db}' password='${DB_PASSWORD:-ufQnylROgELP}' port='${DB_PORT:-5432}'"
      KEYCLOAK_SERVICE: "http://sso.localhost"
    depends_on:
      - db
    labels:
      - traefik.enable=true
      - traefik.constraint-label=public
      # Services
      - traefik.http.services.svc-backend.loadbalancer.server.port=8080

      # Middlewares
      ## VHM rewrite /++api++/
      - "traefik.http.middlewares.mw-backend-vhm-api.replacepathregex.regex=^/\\+\\+api\\+\\+($$|/.*)"
      - "traefik.http.middlewares.mw-backend-vhm-api.replacepathregex.replacement=/VirtualHostBase/http/docs.localhost/Plone/++api++/VirtualHostRoot$$1"

      ## VHM rewrite /ClassicUI/
      - "traefik.http.middlewares.mw-backend-vhm-classic.replacepathregex.regex=^/ClassicUI($$|/.*)"
      - "traefik.http.middlewares.mw-backend-vhm-classic.replacepathregex.replacement=/VirtualHostBase/http/docs.localhost/Plone/VirtualHostRoot/_vh_ClassicUI$$1"

      ## Basic Authentication
      ### Note: all dollar signs in the hash need to be doubled for escaping.
      ### To create user:password pair, it's possible to use this command:
      ### echo $(htpasswd -nb user password) | sed -e s/\\$/\\$\\$/g
      ### Defaults to admin:admin
      - traefik.http.middlewares.mw-backend-auth.basicauth.users=admin:$$apr1$$uZPT5Fgu$$AmlIdamxT5ipBvPlsdfD70
      # Routers
      - traefik.http.routers.rt-backend-api.rule=Host(`docs.localhost`) && (PathPrefix(`/++api++`))
      - traefik.http.routers.rt-backend-api.entrypoints=http
      - traefik.http.routers.rt-backend-api.service=svc-backend
      - traefik.http.routers.rt-backend-api.middlewares=gzip,mw-backend-vhm-api
      ## /ClassicUI
      - traefik.http.routers.rt-backend-classic.rule=Host(`docs.localhost`) && PathPrefix(`/ClassicUI`)
      - traefik.http.routers.rt-backend-classic.entrypoints=http
      - traefik.http.routers.rt-backend-classic.service=svc-backend
      - traefik.http.routers.rt-backend-classic.middlewares=gzip,mw-backend-auth,mw-backend-vhm-classic
    networks:
      - internal

  db:
    image: postgres:14.15
    environment:
      POSTGRES_USER: plone
      POSTGRES_PASSWORD: ufQnylROgELP
      POSTGRES_DB: plone
    volumes:
      - vol-site-data:/var/lib/postgresql/data
    networks:
      - internal

  keycloak:
    image: ghcr.io/ericof/portal-documentacao-keycloak:latest
    platform: linux/amd64
    command: ['start-dev', '--import-realm']
    depends_on:
      - db_keycloak
    environment:
      JAVA_OPTS_APPEND: -Dkeycloak.profile.feature.upload_scripts=enabled
      KC_DB: postgres
      KC_DB_PASSWORD: postgres
      KC_DB_URL: jdbc:postgresql://db_keycloak/keycloak
      KC_DB_USERNAME: postgres
      KC_HEALTH_ENABLED: false
      KC_HTTP_ENABLED: true
      KC_METRICS_ENABLED: false
      KC_HOSTNAME_URL: http://sso.localhost/
      KC_PROXY: reencrypt
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
    labels:
      - traefik.enable=true
      - traefik.constraint-label=public
      # Service
      - traefik.http.services.svc-keycloak.loadbalancer.server.port=8080
      # Routers
      ## /
      - traefik.http.routers.rt-keycloak.rule=Host(`sso.localhost`)
      - traefik.http.routers.rt-keycloak.entrypoints=http
      - traefik.http.routers.rt-keycloak.service=svc-keycloak
      - traefik.http.routers.rt-keycloak.middlewares=gzip
    volumes:
      - ./devops/keycloak/import:/opt/keycloak/data/import
    networks:
      - internal

  db_keycloak:
    image: postgres:14.15
    healthcheck:
      test: [ "CMD", "pg_isready", "-q", "-d", "postgres", "-U", "root" ]
      timeout: 45s
      interval: 5s
      retries: 10
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: keycloak
      POSTGRES_HOST: postgres
    networks:
      - internal

volumes:
  vol-site-data: {}

networks:
  internal: