compose.prod.yaml

services:
  postgres:
    image: 'postgres:16'
    environment:
      - POSTGRES_DB=${POSTGRES_DB}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_USER=${POSTGRES_USER}
    ports:
      - '5432:5432'
    volumes:
      - db-data:/var/lib/postgresql/data
    command: >
      bash -c "
        set -m

        # Start default entrypoint in the background:
        docker-entrypoint.sh postgres &

        # Wait for Postgres to come up (pg_isready blocks until server is accepting connections)
        until pg_isready -h localhost -p 5432 --timeout=0; do
          echo 'Waiting for Postgres to be ready...';
          sleep 1;
        done;

        # Create 'keycloak' DB if it doesn’t exist
        psql -v ON_ERROR_STOP=1 -U ${POSTGRES_USER} -tc \"SELECT 1 FROM pg_database WHERE datname = 'keycloak'\" | grep -q 1 || psql -U ${POSTGRES_USER} -c \"CREATE DATABASE keycloak;\"

        # Bring Postgres (still running in background) to the foreground
        fg %1
      "
    networks:
      - helios-network

  webhook-listener:
    image: "ghcr.io/ls1intum/helios/webhook-listener:${WEBHOOK_LISTENER_IMAGE_TAG}"
    ports:
      - '4200:4200'
    environment:
      - NATS_AUTH_TOKEN=${NATS_AUTH_TOKEN}
      - WEBHOOK_SECRET=${WEBHOOK_SECRET}
      - NATS_URL=nats-server
    depends_on:
      - nats-server
    networks:
      - helios-network

  nats-server:
    image: nats:alpine
    ports:
      - "4222:4222"
      - "8222:8222"
    command: [ "/bin/sh", "-c", "echo 'listen: \"0.0.0.0:4222\"\n\nhttp_port: 8222\n\njetstream {\n  store_dir: \"/data\"\n}\n\nauthorization {\n  token: \"${NATS_AUTH_TOKEN}\"\n}' > /etc/nats/nats-server.conf.template && sed 's|{{NATS_AUTH_TOKEN}}|'\"$NATS_AUTH_TOKEN\"'|g' /etc/nats/nats-server.conf.template > /etc/nats/nats-server.conf && exec nats-server --config /etc/nats/nats-server.conf" ]
    environment:
      - NATS_AUTH_TOKEN=${NATS_AUTH_TOKEN}
    volumes:
      - nats-data:/data
    healthcheck:
      test: [ "CMD", "wget", "--spider", "--quiet", "http://localhost:8222/healthz" ]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 3s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - helios-network

  client:
    image: "ghcr.io/ls1intum/helios/client:${CLIENT_IMAGE_TAG}"
    ports:
      # Do not expose the client to 80 or 443
      - "90:80"
    restart: always
    networks:
      - helios-network

  application-server:
    image: "ghcr.io/ls1intum/helios/application-server:${APPLICATION_SERVER_IMAGE_TAG}"
    ports:
      - '8080:8080'
    environment:
      - SPRING_PROFILES_ACTIVE=${SPRING_PROFILES_ACTIVE}
      - DATASOURCE_URL=${DATASOURCE_URL}
      - DATASOURCE_USERNAME=${DATASOURCE_USERNAME}
      - DATASOURCE_PASSWORD=${DATASOURCE_PASSWORD}
      - NATS_SERVER=${NATS_SERVER}
      - NATS_AUTH_TOKEN=${NATS_AUTH_TOKEN}
      - ORGANIZATION_NAME=${ORGANIZATION_NAME}
      - GITHUB_AUTH_TOKEN=${GITHUB_AUTH_TOKEN}
      - REPOSITORY_NAME=${REPOSITORY_NAME}
      - RUN_ON_STARTUP_COOLDOWN=${RUN_ON_STARTUP_COOLDOWN}
      - OAUTH_ISSUER_URL=${OAUTH_ISSUER_URL}
    depends_on:
      - postgres
      - nats-server
      - webhook-listener
    networks:
      - helios-network

  keycloak:
    image: quay.io/keycloak/keycloak:latest
    container_name: keycloak
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_BOOTSTRAP_ADMIN_USERNAME}
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_BOOTSTRAP_ADMIN_PASSWORD}
      KC_DB: postgres
      KC_DB_URL_HOST: postgres
      KC_DB_USERNAME: ${POSTGRES_USER}
      KC_DB_PASSWORD: ${POSTGRES_PASSWORD}
      KC_HOSTNAME: ${KC_HOSTNAME}
      KC_HTTP_ENABLED: ${KC_HTTP_ENABLED}
    ports:
      - '8081:8081'
    depends_on:
      - postgres
    volumes:
      - ./helios-realm.json:/opt/keycloak/data/import/prod-realm-export.json
      - ./keycloakify/dist_keycloak:/opt/keycloak/providers/
    command: start-dev --import-realm --http-port=8081 --proxy-headers xforwarded --hostname-strict=true
    networks:
      - helios-network

volumes:
  db-data:
  nats-data:


networks:
  # Create network manually in advance: docker network create helios-network
  helios-network:
    name: helios-network
    external: true