# Compose override for inventory-api development/full-kessel stack.
# Applied by scripts/local_stack/up-full.sh when starting the integrated stack.
#
# Enables Read-Your-Writes for workspace creates and configures a local PSK so
# Host Inventory can call RBAC internal APIs without BYPASS_RBAC.

services:
  # Podman can omit the service-name alias when attaching an existing external
  # network. Make the broker name used by the RBAC consumer explicit.
  kafka:
    environment:
      # The full local stack runs within a small Docker VM. Keep Kafka from
      # consuming the memory needed by the RBAC, Kessel, and Debezium services.
      KAFKA_HEAP_OPTS: "-Xms64M -Xmx192M"
      KAFKA_LOG_CLEANER_DEDUPE_BUFFER_SIZE: "33554432"
    command:
      - sh
      - -c
      - >-
        bin/kafka-server-start.sh config/server.properties
        --override listeners=$${KAFKA_LISTENERS}
        --override advertised.listeners=$${KAFKA_ADVERTISED_LISTENERS}
        --override zookeeper.connect=$${KAFKA_ZOOKEEPER_CONNECT}
        --override listener.security.protocol.map=$${KAFKA_LISTENER_SECURITY_PROTOCOL_MAP}
        --override inter.broker.listener.name=$${KAFKA_INTER_BROKER_LISTENER_NAME}
        --override log.cleaner.dedupe.buffer.size=$${KAFKA_LOG_CLEANER_DEDUPE_BUFFER_SIZE}
    healthcheck:
      # The broker API probe can exceed the healthcheck timeout while Kafka
      # loads its local metadata. A listener probe is sufficient for compose
      # ordering and avoids starting another JVM client in the small VM.
      test: ["CMD-SHELL", "bash -c '</dev/tcp/localhost/9093'"]
      interval: 10s
      timeout: 5s
      retries: 15
      start_period: 60s
    networks:
      kessel:
        aliases:
          - kafka

  rbac-server:
    environment:
      # Full-Kessel is a development stack. Keep Django from requiring a
      # production secret key that is intentionally not checked into the repo.
      DJANGO_DEBUG: "True"
      # The init container migrates and seeds before this service starts.
      # Avoid repeating database-backed seeding from AppConfig.ready().
      PERMISSION_SEEDING_ENABLED: "False"
      ROLE_SEEDING_ENABLED: "False"
      GROUP_SEEDING_ENABLED: "False"
      # The local VM exposes two CPUs, which otherwise starts four Gunicorn
      # workers and leaves too little memory for the rest of the stack.
      POD_CPU_LIMIT: "1"
      GUNICORN_WORKER_MULTIPLIER: "1"
      GUNICORN_THREAD_LIMIT: "2"
      READ_YOUR_WRITES_WORKSPACE_ENABLED: "True"
      READ_YOUR_WRITES_TIMEOUT_SECONDS: "30"
      SERVICE_PSKS: '{"inventory":{"secret":"local-dev-psk"}}'

  rbac-migrate:
    environment:
      DJANGO_DEBUG: "True"
      # rbac-migrate seeds platform roles with the same UUIDs used by
      # rbac-server. The base compose file defines these only on rbac-server.
      SYSTEM_DEFAULT_ROOT_WORKSPACE_ROLE_UUID: "23592f00-71f7-482d-be2c-e82eeb704406"
      SYSTEM_DEFAULT_TENANT_ROLE_UUID: "d8e9d8c6-1edf-41b8-951d-805e9e701f49"
      SYSTEM_ADMIN_ROOT_WORKSPACE_ROLE_UUID: "411ef1a0-75a8-4765-8e9f-377297e8ee28"
      SYSTEM_ADMIN_TENANT_ROLE_UUID: "a62b9113-593d-471b-96aa-971d6e748a9b"
  inventory-api:
    # The full-kessel config permits unauthenticated gRPC transport but does
    # not set its compatibility option. The generated local config enables it
    # so Inventory selects its local tuple authorizer and RBAC can acquire the
    # fencing lock used by the Kafka consumer.
    volumes:
      - "${RBAC_INVENTORY_API_CONFIG}:/inventory-api-compose.yaml:ro,z"

  invmigrate:
    volumes:
      - "${RBAC_INVENTORY_API_CONFIG}:/inventory-api-compose.yaml:ro,z"

  kafka-connect:
    environment:
      KAFKA_HEAP_OPTS: "-Xms64M -Xmx128M"

  relations-api:
    # The RBAC consumer must acquire its fencing lock over this gRPC listener
    # before it can process Kafka messages.
    healthcheck:
      test: ["CMD-SHELL", "bash -c '</dev/tcp/localhost/9000'"]
      interval: 5s
      timeout: 5s
      retries: 12

  # Keep the migration and serving containers on the same current SpiceDB
  # release; the upstream Compose file otherwise follows the mutable latest tag.
  spicedb-migrate:
    image: authzed/spicedb:v1.56.2

  spicedb:
    image: authzed/spicedb:v1.56.2

  zookeeper:
    environment:
      KAFKA_HEAP_OPTS: "-Xms32M -Xmx64M"

  rbac-kafka-consumer:
    environment:
      DJANGO_DEBUG: "True"
      # Partition fencing is implemented by Kessel Inventory, whose gRPC
      # listener is on 9081. Without this, settings.py defaults to localhost:9000.
      INVENTORY_API_SERVER: inventory-api:9081
      READ_YOUR_WRITES_WORKSPACE_ENABLED: "True"
      READ_YOUR_WRITES_TIMEOUT_SECONDS: "30"
    depends_on:
      inventory-api:
        condition: service_healthy
      relations-api:
        condition: service_healthy

  rbac-worker:
    environment:
      DJANGO_DEBUG: "True"
      PERMISSION_SEEDING_ENABLED: "False"
      ROLE_SEEDING_ENABLED: "False"
      GROUP_SEEDING_ENABLED: "False"
      READ_YOUR_WRITES_WORKSPACE_ENABLED: "True"
      READ_YOUR_WRITES_TIMEOUT_SECONDS: "30"
    # `celery status` starts a broker RPC for every probe and is unreliable
    # while the constrained local stack is starting. The process check still
    # lets rbac-server wait for the worker container to be running.
    healthcheck:
      test: ["CMD-SHELL", "kill -0 1"]
      interval: 30s
      timeout: 10s
      retries: 3

  # The upstream check probes Celery workers, but beat is not a worker.
  # Keep the scheduler dependency meaningful by checking that its PID is alive.
  rbac-scheduler:
    environment:
      DJANGO_DEBUG: "True"
      PERMISSION_SEEDING_ENABLED: "False"
      ROLE_SEEDING_ENABLED: "False"
      GROUP_SEEDING_ENABLED: "False"
    healthcheck:
      test: ["CMD-SHELL", "kill -0 1"]
      interval: 30s
      timeout: 10s
      retries: 3