# syntax=docker/dockerfile:1.4

# Copyright (c) Helio Chissini de Castro, 2025. Part of the SW360 Frontend Project.
# SPDX-FileContributor: Gaurav Mishra
# SPDX-FileCopyrightText: (C) 2026 Siemens AG

# This program and the accompanying materials are made
# available under the terms of the Eclipse Public License 2.0
# which is available at https://www.eclipse.org/legal/epl-2.0/

# SPDX-License-Identifier: EPL-2.0
# License-Filename: LICENSE

services:
  sw360:
    image: "ghcr.io/eclipse-sw360/sw360:${SW360_VERSION:-main}"
    restart: unless-stopped
    container_name: sw360
    env_file: config/sw360/.env.backend
    secrets:
      - COUCHDB_SECRETS
      - SW360_SECRETS
      - JWT_KEYSTORE
    depends_on:
      - couchdb
    ports:
      - "8080:8080"
    networks:
      - sw360net
    stdin_open: true
    tty: true
    volumes:
      - etc:/etc/sw360
      # If using SVM, material expected under /etc/sw360 by backend runtime
      # - ./config/svm_sw360_certificate.pfx:/etc/sw360/svm_sw360_certificate.pfx:ro
      # - ./config/svm_sw360_keystore.jks:/etc/sw360/svm_sw360_keystore.jks:ro
    healthcheck:
      test: [ "CMD-SHELL", "curl -fsS http://localhost:8080/resource/api/health | grep -iq 'status\":\"up' || exit 1" ]
      interval: 30s
      timeout: 2s
      retries: 3
      start_period: 60s

  couchdb-nouveau:
    image: docker.io/library/couchdb:3.5-nouveau
    restart: unless-stopped
    container_name: couchdb_nouveau
    environment:
      # Fix needed because upstream uses `./data/nouveau` which resolves to `/data/nouveau`
      JAVA_TOOL_OPTIONS: "-Ddw.rootDir=/opt/nouveau/data/nouveau"
    ports:
      - "5987:5987"
      - "5988:5988"
    networks:
      - sw360net
    volumes:
      - couchdb-nouveau:/var/lib/nouveau

  couchdb:
    image: docker.io/library/couchdb:3.5
    restart: unless-stopped
    container_name: couchdb
    env_file:
      - ./config/couchdb/default_secrets # CouchDB does not support secrets
    ports:
      - "5984:5984"
    networks:
      - sw360net
    depends_on:
      - couchdb-nouveau
    volumes:
      - couchdb:/opt/couchdb/data
      - ./config/couchdb/sw360_setup.ini:/opt/couchdb/etc/local.d/sw360_setup.ini
      - ./config/couchdb/sw360_log.ini:/opt/couchdb/etc/local.d/sw360_log.ini
      - ./config/couchdb/nouveau.ini:/opt/couchdb/etc/local.d/nouveau.ini
    healthcheck:
      test: [ "CMD-SHELL", "curl --fail -s http://couchdb:5984/_up" ]
      interval: 30s
      timeout: 5s
      retries: 5

  sw360-frontend:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        BUILDKIT_INLINE_CACHE: 1
        NEXT_PUBLIC_SW360_API_URL: ${NEXT_PUBLIC_SW360_API_URL:-https://localhost}
        NEXT_PUBLIC_SW360_AUTH_PROVIDER: ${NEXT_PUBLIC_SW360_AUTH_PROVIDER:-sw360basic}
        NEXTAUTH_URL: https://localhost
    secrets:
      - NEXTAUTH_SECRET
      - SW360_FRONTEND_KC_SECRET
    image: "ghcr.io/eclipse-sw360/sw360-frontend:${SW360_FRONTEND_VERSION:-main}"
    container_name: sw360-frontend
    restart: unless-stopped
    env_file:
      - ./config/front-end/.env.frontend
    ports:
      - '3000:3000'
    networks:
      - sw360net
    depends_on:
      - sw360

  keycloak:
    image: "ghcr.io/eclipse-sw360/sw360/keycloak:26.7.0"
    container_name: keycloak
    restart: unless-stopped
    env_file:
      - ./config/sw360/.env.backend     # for COUCHDB properties
      - ./config/keycloak/.env.keycloak # will override any COUCHDB properties if needed
    volumes:
      - ./config/keycloak/orgmapping.properties:/etc/sw360/orgmapping.properties:ro
    secrets:
      - COUCHDB_SECRETS
# Uncomment following for development
#    command:
#      - start-dev
#      - --debug
    depends_on:
      - postgres
    ports:
      - "8083:8083"
    networks:
      - sw360net
    healthcheck:
      test: [ "CMD-SHELL", "bash -ec ': > /dev/tcp/127.0.0.1/9000'" ]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 60s

  # PG for KeyCloak
  postgres:
    image: docker.io/library/postgres:18.6-alpine
    container_name: postgres
    restart: unless-stopped
    env_file: ./config/postgres/.env.postgres
    environment:
      - POSTGRES_USER=keycloak
      - POSTGRES_DB=keycloak
      - POSTGRES_PASSWORD_FILE=/run/secrets/POSTGRES_PASSWORD
    networks:
      - sw360net
    volumes:
      - postgres_storage:/var/lib/postgresql
    secrets:
      - POSTGRES_PASSWORD
    ports:
      - "5432:5432"
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready --dbname $$POSTGRES_DB --username $$POSTGRES_USER" ]
      interval: 30s
      timeout: 5s
      retries: 5

  # Nginx reverse proxy
  web:
    image: docker.io/library/nginx:1.31.3-trixie
    container_name: sw360_web
    restart: unless-stopped
    env_file: ./config/nginx/.env.web
    volumes:
      - ./config/nginx/rev_proxy.template:/etc/nginx/templates/default.conf.template:ro
      - ./config/nginx/proxy_params:/etc/nginx/proxy_params:ro
    command: >
      /bin/sh -c "
        export DEBIAN_FRONTEND=noninteractive &&
        apt-get update &&
        apt-get install -y ssl-cert &&
        exec /docker-entrypoint.sh nginx -g 'daemon off;'
      "
    ports:
      # If ports changed, update nginx/proxy_params
      - "443:443"
    networks:
      - sw360net
    depends_on:
      - sw360-frontend
      - sw360
      - keycloak

volumes:
  couchdb: {}
  couchdb-nouveau: {}
  etc: {}
  postgres_storage: {}

networks:
  sw360net:
    name: sw360net
    driver: bridge

secrets:
  SW360_SECRETS:
    file: ./config/sw360/default_secrets
  COUCHDB_SECRETS:
    file: ./config/couchdb/default_secrets
  JWT_KEYSTORE:
    file: ./config/sw360/jwt-keystore.jks
  POSTGRES_PASSWORD:
    file: ./config/postgres/postgresql_password
  NEXTAUTH_SECRET:
    file: ./config/front-end/nextauth_secret
  SW360_FRONTEND_KC_SECRET:
    file: ./config/front-end/sw360_frontend_kc_secret