name: hris-platform
services:
  database:
    image: postgres:18.6-alpine
    environment:
      POSTGRES_DB: hris
      POSTGRES_USER: hris_migrator
      POSTGRES_PASSWORD: ${HRIS_MIGRATION_PASSWORD:?Set HRIS_MIGRATION_PASSWORD}
      HRIS_DATABASE_PASSWORD: ${HRIS_DATABASE_PASSWORD:?Set HRIS_DATABASE_PASSWORD}
      HRIS_WORKER_DATABASE_PASSWORD: ${HRIS_WORKER_DATABASE_PASSWORD:?Set HRIS_WORKER_DATABASE_PASSWORD}
    ports:
      - "127.0.0.1:55432:5432"
    volumes:
      - postgres-data:/var/lib/postgresql
      - ./deploy/postgres/init-runtime.sh:/docker-entrypoint-initdb.d/10-runtime.sh:ro
      - ./deploy/postgres/configure-worker.sh:/docker-entrypoint-initdb.d/20-worker.sh:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U hris_migrator -d hris"]
      interval: 3s
      timeout: 3s
      retries: 20
    restart: unless-stopped
  migrate:
    image: redgate/flyway:12.4.0
    environment:
      FLYWAY_URL: jdbc:postgresql://database:5432/hris
      FLYWAY_USER: hris_migrator
      FLYWAY_PASSWORD: ${HRIS_MIGRATION_PASSWORD}
    volumes:
      - ./core/database/src/main/resources/db/migration:/flyway/sql:ro
    command: ["-connectRetries=30", "migrate"]
    depends_on:
      database:
        condition: service_healthy
  api:
    build: .
    environment:
      HRIS_DATABASE_URL: jdbc:postgresql://database:5432/hris
      HRIS_DATABASE_USER: hris_app
      HRIS_DATABASE_PASSWORD: ${HRIS_DATABASE_PASSWORD}
      HRIS_SECURE_COOKIES: ${HRIS_SECURE_COOKIES:-true}
      HRIS_API_DOCS_ENABLED: ${HRIS_API_DOCS_ENABLED:-false}
      HRIS_IDENTITY_ACTIVE_KEY: ${HRIS_IDENTITY_ACTIVE_KEY:-v1}
      HRIS_IDENTITY_KEYS: ${HRIS_IDENTITY_KEYS:?Set the identity encryption keyring}
      HRIS_SYNC_ACTIVE_KEY: ${HRIS_SYNC_ACTIVE_KEY:-v1}
      HRIS_SYNC_KEYS: ${HRIS_SYNC_KEYS:-}
      HRIS_DOCUMENT_SCANNER_ENABLED: ${HRIS_DOCUMENT_SCANNER_ENABLED:-false}
      HRIS_DOCUMENT_SCANNER_HOST: ${HRIS_DOCUMENT_SCANNER_HOST:-antivirus}
      HRIS_DOCUMENT_SCANNER_PORT: ${HRIS_DOCUMENT_SCANNER_PORT:-3310}
      HRIS_STORAGE_ENABLED: ${HRIS_STORAGE_ENABLED:-false}
      HRIS_STORAGE_ENDPOINT: ${HRIS_STORAGE_ENDPOINT:-}
      HRIS_STORAGE_REGION: ${HRIS_STORAGE_REGION:-garage}
      HRIS_STORAGE_BUCKET: ${HRIS_STORAGE_BUCKET:-}
      HRIS_STORAGE_ACCESS_KEY: ${HRIS_STORAGE_ACCESS_KEY:-}
      HRIS_STORAGE_SECRET_KEY: ${HRIS_STORAGE_SECRET_KEY:-}
      HRIS_STORAGE_ALLOW_PLAINTEXT: ${HRIS_STORAGE_ALLOW_PLAINTEXT:-false}
      HRIS_MAIL_ENABLED: ${HRIS_MAIL_ENABLED:-false}
      HRIS_MAIL_HOST: ${HRIS_MAIL_HOST:-}
      HRIS_MAIL_PORT: ${HRIS_MAIL_PORT:-587}
      HRIS_MAIL_FROM: ${HRIS_MAIL_FROM:-}
      HRIS_MAIL_USERNAME: ${HRIS_MAIL_USERNAME:-}
      HRIS_MAIL_PASSWORD: ${HRIS_MAIL_PASSWORD:-}
      HRIS_MAIL_TRANSPORT: ${HRIS_MAIL_TRANSPORT:-STARTTLS}
      HRIS_MAIL_ALLOW_LOOPBACK_PLAINTEXT: ${HRIS_MAIL_ALLOW_LOOPBACK_PLAINTEXT:-false}
      HRIS_AUTH_LINKS_ALLOW_LOOPBACK_HTTP: ${HRIS_AUTH_LINKS_ALLOW_LOOPBACK_HTTP:-false}
      HRIS_BOOTSTRAP_EMAIL: ${HRIS_BOOTSTRAP_EMAIL}
      HRIS_BOOTSTRAP_PASSWORD: ${HRIS_BOOTSTRAP_PASSWORD}
      HRIS_OIDC_ENABLED: ${HRIS_OIDC_ENABLED:-false}
      HRIS_PUBLIC_URL: ${HRIS_PUBLIC_URL:-}
      HRIS_OIDC_ISSUER: ${HRIS_OIDC_ISSUER:-}
      HRIS_OIDC_CLIENT_ID: ${HRIS_OIDC_CLIENT_ID:-}
      HRIS_OIDC_CLIENT_SECRET: ${HRIS_OIDC_CLIENT_SECRET:-}
      HRIS_OIDC_AUTHORIZATION_URI: ${HRIS_OIDC_AUTHORIZATION_URI:-}
      HRIS_OIDC_TOKEN_URI: ${HRIS_OIDC_TOKEN_URI:-}
      HRIS_OIDC_JWK_SET_URI: ${HRIS_OIDC_JWK_SET_URI:-}
      HRIS_OIDC_CLIENT_AUTH: ${HRIS_OIDC_CLIENT_AUTH:-client_secret_basic}
      HRIS_OIDC_ALLOW_LOOPBACK_HTTP: ${HRIS_OIDC_ALLOW_LOOPBACK_HTTP:-false}
    ports:
      - "127.0.0.1:8088:8080"
    depends_on:
      migrate:
        condition: service_completed_successfully
    init: true
    restart: unless-stopped
    stop_grace_period: 90s
    mem_limit: 2g
  worker:
    build:
      context: .
      args:
        APP_JAR: apps/worker/build/libs/apps-worker.jar
    environment:
      HRIS_PUBLIC_URL: ${HRIS_PUBLIC_URL:-}
      HRIS_DATABASE_URL: jdbc:postgresql://database:5432/hris
      HRIS_WORKER_DATABASE_USER: hris_worker
      HRIS_WORKER_DATABASE_PASSWORD: ${HRIS_WORKER_DATABASE_PASSWORD}
      HRIS_NATIVE_SESSION_CLEANUP_ENABLED: ${HRIS_NATIVE_SESSION_CLEANUP_ENABLED:-true}
      HRIS_NATIVE_SESSION_CLEANUP_INTERVAL_SECONDS: ${HRIS_NATIVE_SESSION_CLEANUP_INTERVAL_SECONDS:-60}
      HRIS_IDENTITY_ACTIVE_KEY: ${HRIS_IDENTITY_ACTIVE_KEY:-v1}
      HRIS_IDENTITY_KEYS: ${HRIS_IDENTITY_KEYS:?Set the identity encryption keyring}
      HRIS_DOCUMENT_SCANNER_ENABLED: ${HRIS_DOCUMENT_SCANNER_ENABLED:-false}
      HRIS_DOCUMENT_SCANNER_HOST: ${HRIS_DOCUMENT_SCANNER_HOST:-antivirus}
      HRIS_DOCUMENT_SCANNER_PORT: ${HRIS_DOCUMENT_SCANNER_PORT:-3310}
      HRIS_STORAGE_ENABLED: ${HRIS_STORAGE_ENABLED:-false}
      HRIS_STORAGE_ENDPOINT: ${HRIS_STORAGE_ENDPOINT:-}
      HRIS_STORAGE_REGION: ${HRIS_STORAGE_REGION:-garage}
      HRIS_STORAGE_BUCKET: ${HRIS_STORAGE_BUCKET:-}
      HRIS_STORAGE_ACCESS_KEY: ${HRIS_STORAGE_ACCESS_KEY:-}
      HRIS_STORAGE_SECRET_KEY: ${HRIS_STORAGE_SECRET_KEY:-}
      HRIS_STORAGE_ALLOW_PLAINTEXT: ${HRIS_STORAGE_ALLOW_PLAINTEXT:-false}
      HRIS_MAIL_ENABLED: ${HRIS_MAIL_ENABLED:-false}
      HRIS_MAIL_HOST: ${HRIS_MAIL_HOST:-}
      HRIS_MAIL_PORT: ${HRIS_MAIL_PORT:-587}
      HRIS_MAIL_FROM: ${HRIS_MAIL_FROM:-}
      HRIS_MAIL_USERNAME: ${HRIS_MAIL_USERNAME:-}
      HRIS_MAIL_PASSWORD: ${HRIS_MAIL_PASSWORD:-}
      HRIS_MAIL_TRANSPORT: ${HRIS_MAIL_TRANSPORT:-STARTTLS}
      HRIS_MAIL_ALLOW_LOOPBACK_PLAINTEXT: ${HRIS_MAIL_ALLOW_LOOPBACK_PLAINTEXT:-false}
      HRIS_AUTH_LINKS_ALLOW_LOOPBACK_HTTP: ${HRIS_AUTH_LINKS_ALLOW_LOOPBACK_HTTP:-false}
    depends_on:
      migrate:
        condition: service_completed_successfully
    init: true
    restart: unless-stopped
    stop_grace_period: 120s
    mem_limit: 1g
volumes:
  postgres-data: