services:
  registry:
    build:
      context: ./registry
    container_name: registry-core
    restart: unless-stopped
    ports:
      - "127.0.0.1:5000:5000"
    environment:
      REGISTRY_HTTP_SECRET: ${REGISTRY_HTTP_SECRET:-change_me_registry_http_secret}
      R2_ACCESS_KEY_ID: ${R2_ACCESS_KEY_ID}
      R2_SECRET_ACCESS_KEY: ${R2_SECRET_ACCESS_KEY}
      R2_ACCOUNT_ID: ${R2_ACCOUNT_ID}
      R2_BUCKET_NAME: ${R2_BUCKET_NAME}
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      REGISTRY_TOKEN_REALM: ${REGISTRY_TOKEN_REALM}
      REGISTRY_SERVICE: ${REGISTRY_SERVICE}
      REGISTRY_TOKEN_ISSUER: ${REGISTRY_TOKEN_ISSUER}
      WEBHOOK_SECRET: ${WEBHOOK_SECRET}
    volumes:
      - ./registry/config.yml:/etc/distribution/config.yml.template:ro
      - ./registry/certs:/certs:ro
    depends_on:
      redis:
        condition: service_healthy

  postgres:
    image: postgres:16
    container_name: registry-postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7
    container_name: registry-redis
    restart: unless-stopped
    command:
      - redis-server
      - --requirepass
      - ${REDIS_PASSWORD}
      - --appendonly
      - "yes"
      - --maxmemory
      - 256mb
      - --maxmemory-policy
      - allkeys-lru
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5

  api:
    build:
      context: .
      dockerfile: api/Dockerfile
      args:
        VITE_REGISTRY_PUBLIC_URL: ${REGISTRY_PUBLIC_URL}
    container_name: registry-api
    restart: unless-stopped
    ports:
      - "127.0.0.1:${API_PORT:-3000}:3000"
    environment:
      API_PORT: 3000
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?sslmode=disable
      REDIS_ADDR: redis:6379
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      REGISTRY_INTERNAL_URL: http://registry:5000
      REGISTRY_PUBLIC_URL: ${REGISTRY_PUBLIC_URL}
      REGISTRY_SERVICE: ${REGISTRY_SERVICE}
      REGISTRY_TOKEN_ISSUER: ${REGISTRY_TOKEN_ISSUER}
      REGISTRY_TOKEN_REALM: ${REGISTRY_TOKEN_REALM}
      REGISTRY_TOKEN_PRIVATE_KEY_PATH: /run/secrets/auth.key
      WEBHOOK_SECRET: ${WEBHOOK_SECRET}
      API_JWT_SECRET: ${API_JWT_SECRET}
      CONSOLE_ORIGIN: ${CONSOLE_ORIGIN:-http://localhost:3000}
      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-}
      BOOTSTRAP_ADMIN_EMAIL: ${BOOTSTRAP_ADMIN_EMAIL}
      BOOTSTRAP_ADMIN_PASSWORD: ${BOOTSTRAP_ADMIN_PASSWORD}
      R2_ACCOUNT_ID: ${R2_ACCOUNT_ID}
      R2_ACCESS_KEY_ID: ${R2_ACCESS_KEY_ID}
      R2_SECRET_ACCESS_KEY: ${R2_SECRET_ACCESS_KEY}
      R2_BUCKET_NAME: ${R2_BUCKET_NAME}
    volumes:
      - ./registry/certs/auth.key:/run/secrets/auth.key:ro
      # Mounted so the API can generate jwks.json from auth.crt on startup
      # when scripts/generate-auth-cert.sh was not run first.
      - ./registry/certs:/certs
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      registry:
        condition: service_started

volumes:
  postgres_data:
  redis_data: