# The `pdc-private` network deliberately has no route to/from the default
# network Grafana lives on. Only `socks-proxy` is dual-homed, so the
# `trino-private` instance below is reachable exclusively through the secure
# SOCKS proxy - which is what makes the PDC e2e tests meaningful. See
# DEVELOPMENT.md.
networks:
  default:
  pdc-private:

services:
  trino:
    image: trinodb/trino:484
    healthcheck:
      test: ["CMD", "/usr/lib/trino/bin/health-check"]
      interval: 5s
      timeout: 5s
      retries: 20

  # Both of these only start under the `pdc` profile, i.e.
  # `docker compose --profile pdc up --build`.
  trino-private:
    profiles: [pdc]
    image: trinodb/trino:484
    networks:
      - pdc-private
    volumes:
      - ./test-data/trino/test-trino-config-pdc.properties:/etc/trino/config.properties
      - ./test-data/trino/catalog/hive.properties:/etc/trino/catalog/hive.properties
    healthcheck:
      test: ["CMD", "/usr/lib/trino/bin/health-check"]
      interval: 5s
      timeout: 5s
      retries: 20

  socks-proxy:
    profiles: [pdc]
    image: serjs/go-socks5-proxy:v0.0.4
    networks:
      - default
      - pdc-private
    environment:
      REQUIRE_AUTH: "false"

  # Both of these only start under the `kerberos` profile, i.e.
  # `docker compose --profile kerberos up --build`. trino-kerberos only
  # accepts Kerberos over HTTPS. The KDC image is the one Trino's own product
  # tests use; its init script creates the coordinator's service principal,
  # named after the trino-kerberos hostname, the data source's client
  # principal and a self-signed certificate in the trino-kerberos volume.
  # The data source takes the client keytab as a setting, so Grafana does not
  # mount the volume; DEVELOPMENT.md shows how to copy the keytab out of it.
  kdc:
    profiles: [kerberos]
    image: ghcr.io/trinodb/testing/kdc:127
    hostname: kdc
    volumes:
      - trino-kerberos:/etc/trino-kerberos
      - ./test-data/kerberos/init.sh:/docker/kerberos-init.d/init.sh:ro
    healthcheck:
      test: ["CMD", "test", "-f", "/etc/trino-kerberos/ready"]
      interval: 2s
      timeout: 5s
      retries: 30

  trino-kerberos:
    profiles: [kerberos]
    image: trinodb/trino:484
    hostname: trino-kerberos
    depends_on:
      kdc:
        condition: service_healthy
    volumes:
      - trino-kerberos:/etc/trino-kerberos:ro
      - ./test-data/kerberos/krb5.conf:/etc/krb5.conf:ro
      - ./test-data/trino/test-trino-config-kerberos.properties:/etc/trino/config.properties
    healthcheck:
      test: ["CMD", "/usr/lib/trino/bin/health-check"]
      interval: 5s
      timeout: 5s
      retries: 20

  grafana:
    extends:
      file: .config/docker-compose-base.yaml
      service: grafana
    depends_on:
      trino:
        condition: service_healthy
    environment:
      # --- Trino connection config hook ---
      # Defaults to the bundled `trino` service above for a self-contained
      # dev stack. To point at a different (e.g. real internal) instance
      # instead, copy .env.example to .env and override TRINO_URL plus
      # whichever auth fields you need. See DEVELOPMENT.md.
      TRINO_URL: ${TRINO_URL:-http://trino:8080}
      TRINO_BASIC_AUTH_ENABLED: ${TRINO_BASIC_AUTH_ENABLED:-false}
      TRINO_BASIC_AUTH_USER: ${TRINO_BASIC_AUTH_USER:-}
      TRINO_BASIC_AUTH_PASSWORD: ${TRINO_BASIC_AUTH_PASSWORD:-}
      TRINO_ACCESS_TOKEN: ${TRINO_ACCESS_TOKEN:-}
      TRINO_ENABLE_IMPERSONATION: ${TRINO_ENABLE_IMPERSONATION:-false}
      TRINO_IMPERSONATION_IDENTITY: ${TRINO_IMPERSONATION_IDENTITY:-login}
      TRINO_IMPERSONATION_USER: ${TRINO_IMPERSONATION_USER:-}
      TRINO_ROLES: ${TRINO_ROLES:-}
      TRINO_CLIENT_TAGS: ${TRINO_CLIENT_TAGS:-}
      TRINO_TOKEN_URL: ${TRINO_TOKEN_URL:-}
      TRINO_CLIENT_ID: ${TRINO_CLIENT_ID:-}
      TRINO_CLIENT_SECRET: ${TRINO_CLIENT_SECRET:-}
      TRINO_TLS_SKIP_VERIFY: ${TRINO_TLS_SKIP_VERIFY:-false}
      TRINO_OAUTH_PASS_THRU: ${TRINO_OAUTH_PASS_THRU:-false}
      TRINO_ENABLE_SECURE_SOCKS_PROXY: ${TRINO_ENABLE_SECURE_SOCKS_PROXY:-false}
      TRINO_KERBEROS_ENABLED: ${TRINO_KERBEROS_ENABLED:-false}
      TRINO_KERBEROS_PRINCIPAL: ${TRINO_KERBEROS_PRINCIPAL:-}
      TRINO_KERBEROS_REALM: ${TRINO_KERBEROS_REALM:-}
      TRINO_KERBEROS_CONFIG: ${TRINO_KERBEROS_CONFIG:-}
      TRINO_KERBEROS_KEYTAB: ${TRINO_KERBEROS_KEYTAB:-}
      TRINO_KERBEROS_REMOTE_SERVICE_NAME: ${TRINO_KERBEROS_REMOTE_SERVICE_NAME:-}
      TRINO_KERBEROS_SERVICE_PRINCIPAL_PATTERN: ${TRINO_KERBEROS_SERVICE_PRINCIPAL_PATTERN:-}
      TRINO_KERBEROS_DISABLE_CANONICAL_HOSTNAME: ${TRINO_KERBEROS_DISABLE_CANONICAL_HOSTNAME:-false}

      # --- Secure SOCKS proxy (PDC) ---
      # Makes the "Secure Socks Proxy" toggle available in the datasource
      # settings, pointed at the `socks-proxy` service above. The proxy only
      # runs under the `pdc` profile; the toggle is simply a no-op otherwise.
      GF_SECURE_SOCKS_DATASOURCE_PROXY_ENABLED: "true"
      GF_SECURE_SOCKS_DATASOURCE_PROXY_PROXY_ADDRESS: socks-proxy:1080
      GF_SECURE_SOCKS_DATASOURCE_PROXY_ALLOW_INSECURE: "true"

volumes:
  trino-kerberos: