version: '3.8'

services:
  labcas-ubuntubase:
    build:
      context: ./common/ubuntubase
    image: labcas-ubuntubase
    networks:
      - labcas-net
  ldap:
    build: ./ldap
    container_name: ldap
    environment:
      - LDAP_ROOT=dc=labcas,dc=jpl,dc=nasa,dc=gov
      - LDAP_ADMIN_USERNAME=admin
      - LDAP_ADMIN_PASSWORD=secret
      - LDAP_LOGLEVEL=stats,stats2,config,acl
      - LDAP_DEBUG=true
      - BITNAMI_DEBUG=true
      # Enable LDAPS with the self-signed certificate generated during image build
      - LDAP_ENABLE_TLS=yes
      - LDAP_TLS_CERT_FILE=/etc/ldap/ssl/ldap-cert.pem
      - LDAP_TLS_KEY_FILE=/etc/ldap/ssl/ldap-key.pem
      - LDAP_TLS_CA_FILE=/etc/ldap/ssl/ldap-cert.pem
      - LDAP_LDAPS_PORT_NUMBER=1636
      - LDAP_TLS_VERIFY_CLIENT=never
      # Force TLS protocol to TLSv1.2 so that Java 8 clients (e.g., LabCAS backend) can establish LDAPS connections
      - LDAP_TLS_PROTOCOL_MIN=3.3
      - LDAP_CUSTOM_LDIF_DIR=/container-init.d
    ports:
      - "1636:1636"
    volumes:
      - ./ldap/custom_ldifs:/container-init.d
      - ./data/logs/ldap:/var/log/ldap
    networks:
      - labcas-net

  labcas-backend:
    build: ./labcas-backend
    container_name: labcas-backend
    depends_on:
      - ldap
    environment:
      - LABCAS_HOME=/tmp/labcas
    ports:
      - "8444:8444"  # Map the backend service port
      - "8984:8984"  # Added for Solr access by publish and airflow
    expose:
      - "8081"
      - "8444"
      - "8984"
    volumes:
      - ./labcas-backend/labcas.properties:/root/labcas.properties
      - ./labcas-backend/server.xml:/tmp/labcas/apache-tomcat/conf/server.xml
      - labcas-solr-index:/tmp/labcas/solr-index
      - ./shared-config/labcas-backend:/config
      - ./data/logs/labcas-backend:/var/log/labcas-backend
    networks:
      - labcas-net

  labcas-ui:
    build: ./labcas-ui
    container_name: labcas-ui
    depends_on:
      - labcas-ubuntubase
      - labcas-backend
    ports:
      - "8081:8081"
    volumes:
      - ./labcas-ui/environment.cfg:/usr/local/apache2/htdocs/labcas-ui/assets/conf/environment.cfg
      - ./data/logs/labcas-ui:/var/log/labcas-ui
      - ./shared-config/labcas-ui:/config/labcas-ui
    networks:
      - labcas-net
  mock-auth:
    build: ./mock-auth
    container_name: mock-auth
    depends_on:
      - labcas-backend
      - labcas-ui
    ports:
      - "3001:3001"
    expose:
      - "3001"
    networks:
      - labcas-net
    # environment:
    #   - REDIRECT_DEFAULT=http://localhost:80

  labcas-proxy:
      build: ./labcas-proxy
      volumes:
        - ./data/logs/nginx/:/var/log/nginx/
      expose:
          - "80"
          - "443"
          - "8099"
      ports:
          - "443:443"
          - "80:80"
          - "8099:8099"
      depends_on:
        - labcas-ui
        - labcas-ubuntubase
        - labcas-backend
      links:
        - labcas-ui:labcas-ui
        - labcas-backend:labcas-backend
      image: labcas-proxy
      container_name: labcas-proxy
      restart: "on-failure:5"
      security_opt: [ no-new-privileges ]
      pids_limit: 50
      cap_drop:
            - NET_ADMIN
            - SYS_ADMIN
            - SYS_MODULE
      networks:
       - labcas-net

  postgres:
    image: postgres:13
    container_name: postgres
    environment:
      - POSTGRES_USER=airflow
      - POSTGRES_PASSWORD=airflow
      - POSTGRES_DB=airflow
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - labcas-net

  airflow:
    build:
      context: ./airflow
      args:
        GITHUB_TOKEN: ${GITHUB_TOKEN}
    container_name: airflow
    depends_on:
      - labcas-backend
      - postgres
    environment:
      - AIRFLOW__CORE__EXECUTOR=LocalExecutor
      - AIRFLOW__CORE__LOAD_EXAMPLES=False
      - AIRFLOW__DATABASE__SQL_ALCHEMY_CONN=postgresql+psycopg2://airflow:airflow@postgres/airflow
      - HOST_DATA_PATH=${HOST_DATA_PATH}
      # Pass through optional metadata, publish config, archive, and labcas-data host paths
      - HOST_METADATA_PATH=${HOST_METADATA_PATH}
      - HOST_PUBLISH_CONFIG=${HOST_PUBLISH_CONFIG}
      - HOST_ARCHIVE_PATH=${HOST_ARCHIVE_PATH}
      - HOST_LABCAS_DATA=${HOST_LABCAS_DATA}
    volumes:
      - ./airflow/dags:/opt/airflow/dags
      - ./airflow/scripts:/opt/airflow/scripts
      - ./airflow/logs:/opt/airflow/logs
      - ./data:/data
      - ./metadata:/metadata
      - /var/run/docker.sock:/var/run/docker.sock
      - ./shared-config/airflow:/config/airflow
      # Allow the DAG’s BashOperator to reference the project compose file.
      - ./docker-compose.yml:/opt/airflow/docker-compose.yml:ro
      # Mount project read-only elsewhere so build contexts resolve
      - ./:/project:ro
    ports:
      - "8082:8080"
    networks:
      - labcas-net
    entrypoint: ["bash", "/opt/airflow/scripts/start_local_executor.sh"]
    command: []

  publish:
    build:
      context: ./publish
      args:
        GITHUB_TOKEN: ${GITHUB_TOKEN}
    container_name: labcas-publish
    depends_on:
      - labcas-backend
    environment:
      - solr=https://labcas-backend:8984/solr/
      - SOLR_URL=https://labcas-backend:8984/solr/
      - consortium=${PUBLISH_CONSORTIUM:-NIST}
      - collection=${PUBLISH_COLLECTION}
      - publish=True
      - steps=${PUBLISH_STEPS}

    # Health-check so Airflow can wait until labcas-publish is ready
    healthcheck:
      test: ["CMD-SHELL", "pgrep -f publishing_pipeline.py >/dev/null || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 5
    volumes:
      - ${HOST_METADATA_PATH:-./metadata}:/mnt/metadata:ro
      - ${HOST_DATA_PATH:-./data}:/data
      - ${HOST_LABCAS_DATA:-./data/labcas-data}:/labcas-data
      - ${HOST_ARCHIVE_PATH:-./data/archive}:/data/archive
      - ${HOST_PUBLISH_CONFIG:-./shared-config/publish}:/config/publish:ro
    networks:
      - labcas-net

networks:
  labcas-net:
volumes:
  labcas-solr-index:
  postgres-data: