docker-compose.yml

# NOTE!!: Use bump2version to bump the RELEASE_TAG default value
x-domains_env:
  SERVER_DOMAIN: &serverdomain ${SERVER_DOMAIN:?domain must be defined}
  MTLS_DOMAIN: &mtlsdomein "mtls.${SERVER_DOMAIN:?domain must be defined}"
  API_HTTPS_PORT: &apiport ${NGINX_HTTPS_PORT:-443}
  PRODUCT_HTTPS_PORT: &productport ${NGINX_HTTPS_PRODUCT_PORT:-4625}
  PRODUCT_DOMAIN: &productdomain "fake.${SERVER_DOMAIN:?domain must be defined}"
  TAK_DOMAIN: &takdomain "tak.${SERVER_DOMAIN:?domain must be defined}"
  KC_DOMAIN:  &kcdomain "kc.${SERVER_DOMAIN:?domain must be defined}"
  TAK_RMAPI_PORT: &takapiport ${TAK_RMAPI_PORT:-4626}
  DNS_RESOLVER_IP: &dnsresolver ${DNS_RESOLVER_IP:-127.0.0.11}  # Must be able to resolve docker internal names
  OCSCP_RESPONDER:  &publicocsp "https://${SERVER_DOMAIN:?domain must be defined}:${NGINX_HTTPS_PORT:-443}/ca/ocsp"  # The public URL

x-kc_dbconfig_env: &kcdbconfig_env
  KEYCLOAK_DATABASE_NAME: &kcdbname ${KEYCLOAK_DATABASE_NAME:-keycloak}
  KEYCLOAK_DATABASE_HOST: postgres
  KEYCLOAK_DATABASE_USER: &kcdbuser ${KEYCLOAK_DATABASE_USER:-keycloak}
  KEYCLOAK_DATABASE_PASSWORD: &kcdbpass ${KEYCLOAK_DATABASE_PASSWORD:?must be defined} # pragma: allowlist secret

x-raesenmaeher_dbconfig_env: &rmdbconfig_env
  RM_DATABASE_NAME: &rmdbname ${RM_DATABASE_NAME:-raesenmaeher}
  RM_DATABASE_HOST: postgres
  RM_DATABASE_USER: &rmdbuser ${RM_DATABASE_USER:-raesenmaeher}
  RM_DATABASE_PASSWORD: &rmdbpass ${RM_DATABASE_PASSWORD:?must be defined} # pragma: allowlist secret

x-ldap_admin_env: &ldap_admin_env
  LDAP_ADMIN_PASSWORD: &ldapadminpass ${LDAP_ADMIN_PASSWORD:?must be defined} # pragma: allowlist secret
  LDAP_ADMIN_USERNAME: &ldapadminuser ${LDAP_ADMIN_USERNAME:-admin}

x-tak_dbconfig_env: &takdbconfig_env
  POSTGRES_DB: &takdbname ${TAK_DATABASE_NAME:-tak}
  POSTGRES_ADDRESS: postgres
  POSTGRES_USER: &takdbuser ${TAK_DATABASE_USER:-tak}
  POSTGRES_PASSWORD: &takdbpass ${TAK_DATABASE_PASSWORD:?must be defined} # pragma: allowlist secret
  LDAP_BIND_PASSWORD: *ldapadminpass

x-postgres_env: &postgres_env
  KEYCLOAK_PASSWORD: *kcdbpass # pragma: allowlist secret
  POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?must be defined} # pragma: allowlist secret
  RAESENMAEHER_PASSWORD: *rmdbpass # pragma: allowlist secret
  TAK_PASSWORD: *takdbpass # pragma: allowlist secret

x-keycloak_users_env: &keycloak_users_env
  KEYCLOAK_CREATE_ADMIN_USER: "true"
  KEYCLOAK_ADMIN_USER: &kcadminuser admin
  KEYCLOAK_ADMIN_PASSWORD: &kcadminpass ${KEYCLOAK_ADMIN_PASSWORD:?must be defined} # pragma: allowlist secret

x-keycloak_tls_env: &keycloak_tls_env
  KEYCLOAK_ENABLE_HTTPS: true
  KCI_SERVER_HOSTNAME: *serverdomain  # TODO: Should we use a subdomain so we can do smart proxying ??
  KEYCLOAK_HTTPS_KEY_STORE_PASSWORD: ${KEYCLOAK_HTTPS_KEY_STORE_PASSWORD:?must be defined}  # pragma: allowlist secret
  KEYCLOAK_HTTPS_TRUST_STORE_PASSWORD: ${KEYCLOAK_HTTPS_TRUST_STORE_PASSWORD:?must be defined}  # pragma: allowlist secret
  KEYCLOAK_HTTPS_TRUST_STORE_FILE: /bitnami/keycloak/kcserver-truststore.jks
  KEYCLOAK_HTTPS_KEY_STORE_FILE: /bitnami/keycloak/kcserver-keys.jks
  #KEYCLOAK_EXTRA_ARGS: "--https-client-auth=request --hostname-debug=true --cache=local"
  KEYCLOAK_EXTRA_ARGS: "--https-client-auth=request"
  KEYCLOAK_HOSTNAME: *kcdomain
  KEYCLOAK_HTTPS_PORT: 9443


x-keycloak_profile_env: &keycloak_profile_env
  # These can be expanded in keycloak-config/profile.json
  KCP_REALM: &kc_realm "${KCP_REALM:-RASENMAEHER}"
  KCP_MAIN_ID: "${KEYCLOAK_PROFILEROOT_UUID:?must be defined}"

x-keycloakinit_users_env: &keycloakinit_users_env
  KEYCLOAK_USER: *kcadminuser # pragma: allowlist secret
  KEYCLOAK_PASSWORD: *kcadminpass # pragma: allowlist secret

x-takbuilds: &takbuildinfo
  image: &takimage "pvarki/takserver:${TAK_RELEASE:-5.2-RELEASE-30}-d${RELEASE_TAG:-1.6.0}${DOCKER_TAG_EXTRA:-}"
  build:
    context: ./takserver
    dockerfile: Dockerfile
    args:
      TAK_RELEASE: ${TAK_RELEASE:-5.2-RELEASE-30}

x-nginxbuilds: &nginxbuildinfo
  image: pvarki/nginx:1.25-d${RELEASE_TAG:-1.6.0}${DOCKER_TAG_EXTRA:-}
  build:
    context: ./nginx
    dockerfile: Dockerfile
    target: production
  labels:
      - "autoheal=true"


x-cfssl_env: &cfssl_env
  INT_SHARED_CERT_FOLDER: /ca_public
  CFSSL_BIND_ADDRESS: ${CFSSL_BIND_ADDRESS:-0.0.0.0}
  CFSSL_BIND_PORT: &cfsslport ${CFSSL_BIND_PORT:-8888}
  CFSSL_OCSP_BIND_PORT: &oscpport ${CFSSL_OCSP_BIND_PORT:-8889}
  CFSSL_CA_NAME: ${CFSSL_CA_NAME:?ca name must be defined}
  OCSP_HOST: *serverdomain
  OCSP_PORT: *apiport
  CFSSL_PERSISTENT_FOLDER: /data/persistent
  OR_PORT: &ocsprestport 8887
  OR_UPSTREAM: &ocspresthost ocsprest
  CFSSL_CA_EXPIRY: &caexpiry ${CFSSL_CA_EXPIRY:-2016h}
  CFSSL_SIGN_CA_EXPIRY: *caexpiry
  CFSSL_SIGN_DEFAULT_EXPIRY: ${CFSSL_SIGN_DEFAULT_EXPIRY:-1008h}

x-takserver_env: &takserver_env
  TAK_SERVER_ADDRESS: *takdomain
  # The passwords here are just for takservers internal PKCS12 containers because it can't deal with PEM
  TAKSERVER_CERT_PASS: &takserver_cert_pass ${TAKSERVER_CERT_PASS:?must be defined} # pragma: allowlist secret
  TAKSERVER_KEYSTORE_PASS: *takserver_cert_pass
  CA_PASS: &tak_ca_pass ${TAK_CA_PASS:?must be defined} # pragma: allowlist secret
  KEYSTORE_PASS: *tak_ca_pass
  TAK_OCSP_UPSTREAM: &ocsphost "ocsp"
  TAK_OCSP_PORT: *oscpport




services:
  miniwerk:
    image: pvarki/miniwerk:1.1.0-d${RELEASE_TAG:-1.6.0}${DOCKER_TAG_EXTRA:-}
    build:
      context: ./miniwerk
      dockerfile: Dockerfile
      target: production
    environment:
      MW_DOMAIN: *serverdomain
      MW_RASENMAEHER__API_PORT: *apiport
      MW_FAKE__API_PORT: *productport
      MW_TAK__API_PORT: *takapiport
      MW_LE_EMAIL: ${MW_LE_EMAIL?LE contact email must be defined}
      MW_LE_TEST: ${MW_LE_TEST:-true}  # see example_env.sh
      MW_MKCERT: ${MW_MKCERT:-false}  # When LetEncrypt cannot be used set to "true"
      MW_KEYTYPE: "rsa"
      MW_PRODUCTS: "tak,kc"
    volumes:
      - kraftwerk_shared_fake:/pvarkishares/fake
      - kraftwerk_shared_tak:/pvarkishares/tak
      - kraftwerk_shared_rasenmaeher:/pvarkishares/rasenmaeher
      - kraftwerk_data:/data/persistent
      - ./le_state:/data/persistent/le/conf  # At least during testing we want to keep LE certs outside of the volumes
      - le_certs:/le_certs
    ports:
      - "80:80"

  cfssl:
    image: pvarki/cfssl:api-1.2.0-d${RELEASE_TAG:-1.6.0}${DOCKER_TAG_EXTRA:-}
    build:
      context: ./cfssl
      dockerfile: Dockerfile
      target: api
    labels:
        - "autoheal=true"
    networks:
      - canet
    environment:
      <<: *cfssl_env
    volumes:
      - cfssl_data:/data/persistent
      - ca_public:/ca_public
    healthcheck:
      test: 'cfssl info -remote http://127.0.0.1:8888 || exit 1'
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 15s
    restart: unless-stopped

  ocsp:
    image: pvarki/cfssl:ocsp-1.2.0-d${RELEASE_TAG:-1.6.0}${DOCKER_TAG_EXTRA:-}
    build:
      context: ./cfssl
      dockerfile: Dockerfile
      target: ocsp
    labels:
        - "autoheal=true"
    networks:
      - ocspnet
    environment:
      <<: *cfssl_env
    volumes:
      - cfssl_data:/data/persistent
      - ca_public:/ca_public
    healthcheck:
      test: 'true'  # FIXME
      interval: 5s
      timeout: 5s
      retries: 3
      start_period: 5s
    depends_on:
      cfssl:
        condition: service_healthy
    restart: unless-stopped

  ocsprest:
    image: pvarki/cfssl:ocsprest-1.0.4-d${RELEASE_TAG:-1.6.0}${DOCKER_TAG_EXTRA:-}
    build:
      context: ./cfssl
      dockerfile: Dockerfile
      target: ocsprest
    labels:
        - "autoheal=true"
    networks:
      - canet
    environment:
      <<: *cfssl_env
    volumes:
      - cfssl_data:/data/persistent
      - ca_public:/ca_public
    healthcheck:
      test: 'ocsprest healthcheck || exit 1'
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
    depends_on:
      cfssl:
        condition: service_healthy
    restart: unless-stopped

  postgres:
    image: postgis/postgis:15-3.4
    labels:
        - "autoheal=true"
    networks:
      - dbnet
    volumes:
      - ./pg_init:/docker-entrypoint-initdb.d
      - pg_data:/var/lib/postgresql/data
      - ca_public:/ca_public
    environment:
      <<: *postgres_env
    depends_on:
      miniwerk:
        condition: service_completed_successfully
      cfssl:
        condition: service_healthy
    healthcheck:
      test: "pg_isready --dbname=$$POSTGRES_DB --username=$$POSTGRES_USER || exit 1"
      interval: 5s
      timeout: 5s
      retries: 3
      start_period: 5s
    restart: unless-stopped

  openldap_cert_perms:  # FIXME: make a separate volume or something and copy the certs for correct user under it
    image: bash:latest
    volumes:
      - le_certs:/le_certs
    command: ["/usr/local/bin/bash", "-c", "chmod a+rwx -R /le_certs"]
    depends_on:
      miniwerk:
        condition: service_completed_successfully

  openldap:
    image: pvarki/openldap:1.0.0-d${RELEASE_TAG:-1.6.0}${DOCKER_TAG_EXTRA:-}
    build:
      context: ./keycloak/openldap
      dockerfile: Dockerfile
    networks:
      - kcnet
      - dbnet
    ports:
      - '1636:1636'  # LDAPs
    environment:
      <<: *ldap_admin_env
      LDAP_SKIP_DEFAULT_TREE: "yes"
      LDAP_ALLOW_ANON_BINDING: "no"
      # FIXME: get from env ??
      LDAP_ROOT: "dc=example,dc=org"  # Probably needs to match the custom ldfis
      LDAP_LOGLEVEL: 0
      LDAP_ENABLE_TLS: "yes"
      LDAP_TLS_CERT_FILE: /le_certs/rasenmaeher/fullchain.pem
      LDAP_TLS_KEY_FILE: /le_certs/rasenmaeher/privkey.pem
      LDAP_TLS_CA_FILE: /ca_public/ca_chain.pem
      LDAP_TLS_DH_PARAM_FILENAME: /dhparam.pem
    volumes:
      - openldap_data:/bitnami/openldap
      - ca_public:/ca_public
      - le_certs:/le_certs
      - ./nginx/includes/dhparam.pem:/dhparam.pem
    depends_on:
      openldap_cert_perms:
        condition: service_completed_successfully
      miniwerk:
        condition: service_completed_successfully
      cfssl:
        condition: service_healthy
    healthcheck:
      # error 32 is back
      #test: 'ldapsearch -Q -tt -LLL -Y EXTERNAL -H ldapi:/// "(uid=admin)" -b dc=example,dc=org memberOf  || exit 1'
      test: "true"
      interval: 5s
      timeout: 5s
      retries: 3
      start_period: 20s
    restart: unless-stopped

  keycloak_cert_perms:  # FIXME: make a separate volume or something and copy the certs for correct user under it
    image: bash:latest
    volumes:
      - le_certs:/le_certs
    command: ["/usr/local/bin/bash", "-c", "chmod a+rwx -R /le_certs"]
    depends_on:
      miniwerk:
        condition: service_completed_successfully

  keycloak:
    image: bitnami/keycloak:${KEYCLOAK_VERSION:-24.0.5}
    user: root
    environment:
      <<: [*kcdbconfig_env, *keycloak_users_env, *keycloak_tls_env]
      KC_HEALTH_ENABLED: "true"
      KEYCLOAK_PRODUCTION: "true"
      KC_RUN_IN_CONTAINER: "false"  # Setting this to true will just make Java hog RAM like there is no tomorrow
      KC_LOG_LEVEL: info
      #KC_LOG_LEVEL: debug
      # REMINDER: KEYCLOAK_EXTRA_ARGS is defined in keycloak_tls_env
    networks:
      - kcnet
      - dbnet
    ports:
      - '9443:9443'
    volumes:
      - keycloak_data:/bitnami/keycloak/
      - ca_public:/ca_public
      - le_certs:/le_certs
      - ./nginx/includes/dhparam.pem:/dhparam.pem
      - ./keycloak/init_scripts:/docker-entrypoint-initdb.d
    depends_on:
      keycloak_cert_perms:
        condition: service_completed_successfully
      openldap:
        condition: service_healthy
      postgres:
        condition: service_healthy
    healthcheck:
      test: "curl -s http://keycloak:8080/health/ready | grep status | grep UP || exit 1"
      interval: 10s
      timeout: 10s
      retries: 5
      start_period: 20s
    restart: unless-stopped

  # init container that sets up profile with realm on keycloak instance
  keycloak-init:
    image: adorsys/keycloak-config-cli:6.1.6-${INIT_KEYCLOAK_VERSION:-24}
    networks:
      - kcnet
    volumes:
      - ./keycloak/keycloak-config:/config
      - ca_public:/ca
    environment:
      <<: [*keycloak_profile_env, *ldap_admin_env, *keycloakinit_users_env]
      KEYCLOAK_URL: http://keycloak:8080/
      KEYCLOAK_SSL-VERIFY: "false"  # We are using the internal port
      KEYCLOAK_AVAILABILITYCHECK_ENABLED: "false"
      KEYCLOAK_AVAILABILITYCHECK_TIMEOUT: 15s
      IMPORT_VAR_SUBSTITUTION_ENABLED: "true"
      LDAP_CONNECTION_URL: ldap://openldap:1389
    depends_on:
      keycloak:
        condition: service_healthy

  rmapi:
    image: pvarki/rmapi:1.5.0-d${RELEASE_TAG:-1.6.0}${DOCKER_TAG_EXTRA:-}
    build:
      context: ./api
      dockerfile: Dockerfile
      target: production
    labels:
        - "autoheal=true"
    environment:
      <<: [*rmdbconfig_env]
      JWT_PUBKEY_PATH: "/data/persistent/public"
      JWT_PRIVKEY_PATH: "/data/persistent/private/rm_jwtsign.key"
      RM_CFSSL_HOST: "http://cfssl"
      RM_CFSSL_PORT: *cfsslport
      RM_OCSPREST_HOST: "http://ocsprest"
      RM_OCSPREST_PORT: 8887
      JWT_LIFETIME: "7200"
      RM_OCSCP_RESPONDER: *publicocsp
      RM_TILAUSPALVELU_JWT: "https://${TILAUSPALVELU_DOMAIN:-tilaa.pvarki.fi}/api/v1/config/jwtPublicKey.pem"
      RM_KC_USERNAME: *kcadminuser
      RM_KC_PASSWORD: *kcadminpass  # pragma: allowlist secret
      RM_KC_REALM: *kc_realm
    networks:
      - apinet
      - kcnet
      - canet
      - intranet
      - dbnet
      - ocspnet
    volumes:
      - ca_public:/ca_public
      - rmapi_data:/data/persistent
      - kraftwerk_shared_rasenmaeher:/pvarki
    depends_on:
      cfssl:
        condition: service_healthy
      ocsprest:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      postgres:  # keycloak already depends on pg but for completenes' sake
        condition: service_healthy
      keycloak-init:
        condition: service_completed_successfully
      miniwerk:
        condition: service_completed_successfully
    healthcheck:
      test: 'rasenmaeher_api healthcheck || exit 1'
      interval: 5s
      timeout: 5s
      retries: 3
      start_period: 5s
    restart: unless-stopped

  rmui:
    image: pvarki/rmui:1.3.0-${VITE_ASSET_SET:-neutral}-d${RELEASE_TAG:-1.6.0}${DOCKER_TAG_EXTRA:-}
    build:
      context: ./ui
      dockerfile: Dockerfile
      target: production
      args:
        VITE_ASSET_SET: ${VITE_ASSET_SET:-neutral}
    volumes:
      - rmui_files:/deliver

  nginx_templates:
    image: pvarki/nginx:templates-d${RELEASE_TAG:-1.6.0}${DOCKER_TAG_EXTRA:-}
    build:
      context: ./nginx
      dockerfile: Dockerfile
      target: configs
    volumes:
      - nginx_templates:/deliver

  rmnginx:
    <<: *nginxbuildinfo
    volumes:
      - nginx_templates:/nginx_templates
      - ca_public:/ca_public
      - le_certs:/le_certs
      - rmui_files:/rmui_files
    environment:
      <<: *cfssl_env
      NGINX_HOST: *serverdomain
      NGINX_HTTP_PORT: ${NGINX_HTTP_PORT:-80}
      NGINX_HTTPS_PORT: *apiport
      NGINX_UPSTREAM: "rmapi"
      NGINX_UPSTREAM_PORT: "8000"
      NGINX_CERT_NAME: "rasenmaeher"
      NGINX_UI_UPSTREAM: "rmui"
      NGINX_UI_UPSTREAM_PORT: ${NGINX_UI_UPSTREAM_PORT:-8002}
      NGINX_OCSP_UPSTREAM: *ocsphost
      DNS_RESOLVER_IP: *dnsresolver
      NGINX_TEMPLATE_DIR: "templates_rasenmaeher"
    networks:
      - apinet
      - kcnet
      - intranet
      - ocspnet
    ports:
      - "${NGINX_HTTPS_PORT:-443}:${NGINX_HTTPS_PORT:-443}"
    depends_on:
      keycloak:
        condition: service_healthy
      rmapi:
        condition: service_healthy
      rmui:
        condition: service_completed_successfully
      nginx_templates:
        condition: service_completed_successfully
      ocsp:
        condition: service_healthy
      cfssl:
        condition: service_healthy
      miniwerk:
        condition: service_completed_successfully
    healthcheck:
      test: 'curl -s localhost:5666/healthcheck || exit 1'
      interval: 5s
      timeout: 5s
      retries: 3
      start_period: 5s
    restart: unless-stopped

  kwinit:  # Mostly to make sure it's built
    image: pvarki/kw_product_init:1.0.0-d${RELEASE_TAG:-1.6.0}${DOCKER_TAG_EXTRA:-}
    build:
      context: ./kw_product_init
      dockerfile: Dockerfile
      target: production
    command: ["help"]
    volumes:
      - ca_public:/ca_public
      - le_certs:/le_certs
      - kraftwerk_shared_fake:/pvarki
      - kwinit_data:/data/persistent


##############
# Begin: TAK #
##############
  takinit:
    <<: *takbuildinfo
    environment:
      <<: [*takdbconfig_env, *takserver_env]
    depends_on:
      postgres:
        condition: service_healthy
      rmnginx:
        condition: service_healthy
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - taknet
      - dbnet
    volumes:
      - ./takserver/updates:/opt/tak/webcontent/update
      - kraftwerk_shared_tak:/pvarki
      - tak_data:/opt/tak/data
      - le_certs:/le_certs
      - ca_public:/ca_public
    command: /opt/scripts/firstrun_rm.sh

  takconfig:
    <<: *takbuildinfo
    environment:
      <<: [*takdbconfig_env, *takserver_env]
    depends_on:
      takinit:
          condition: service_completed_successfully
    volumes:
      - ./takserver/updates:/opt/tak/webcontent/update
      - tak_data:/opt/tak/data
      - ca_public:/ca_public
      - le_certs:/le_certs
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - taknet
      - dbnet
      - intranet
      - ocspnet
    ports:
      - '8089:8089'
      - '8443:8443'
    command: ./opt/scripts/start-tak.sh config
    healthcheck:
      test: 'true'  # FIXME
      interval: 5s
      timeout: 5s
      retries: 3
      start_period: 5s
    restart: unless-stopped

  takmsg:
    <<: *takbuildinfo
    environment:
      <<: [*takdbconfig_env, *takserver_env]
    depends_on:
      postgres:
        condition: service_healthy
      takconfig:
        condition: service_healthy
    volumes:
      - ./takserver/updates:/opt/tak/webcontent/update
      - tak_data:/opt/tak/data
      - ca_public:/ca_public
      - le_certs:/le_certs
    network_mode: "service:takconfig"
    command: ./opt/scripts/start-tak.sh messaging
    healthcheck:
      test: 'true'  # FIXME
      interval: 5s
      timeout: 5s
      retries: 3
      start_period: 5s
    restart: unless-stopped

  takapi:
    <<: *takbuildinfo
    environment:
      <<: [*takdbconfig_env, *takserver_env]
    depends_on:
      postgres:
        condition: service_healthy
      takmsg:
        condition: service_healthy
    volumes:
      - ./takserver/updates:/opt/tak/webcontent/update
      - tak_data:/opt/tak/data
      - ca_public:/ca_public
      - le_certs:/le_certs
    network_mode: "service:takconfig"
    command: ./opt/scripts/start-tak.sh api
    healthcheck:
      test: 'true'  # FIXME
      interval: 5s
      timeout: 5s
      retries: 3
      start_period: 5s
    restart: unless-stopped

  takreten:
    <<: *takbuildinfo
    environment:
      <<: [*takdbconfig_env, *takserver_env]
    depends_on:
      postgres:
        condition: service_healthy
      takmsg:
        condition: service_healthy
    volumes:
      - ./takserver/updates:/opt/tak/webcontent/update
      - tak_data:/opt/tak/data
      - ca_public:/ca_public
    network_mode: "service:takconfig"
    command: ./opt/scripts/start-tak.sh retention
    healthcheck:
      test: 'true'  # FIXME
      interval: 5s
      timeout: 5s
      retries: 3
      start_period: 5s
    restart: unless-stopped

  takplug:
    <<: *takbuildinfo
    environment:
      <<: [*takdbconfig_env, *takserver_env]
    depends_on:
      postgres:
        condition: service_healthy
      takapi:
        condition: service_healthy
    volumes:
      - ./takserver/updates:/opt/tak/webcontent/update
      - tak_data:/opt/tak/data
      - ca_public:/ca_public
    network_mode: "service:takconfig"
    command: ./opt/scripts/start-tak.sh pm
    healthcheck:
      test: 'true'  # FIXME
      interval: 5s
      timeout: 5s
      retries: 3
      start_period: 5s
    restart: unless-stopped

  takrmapi:
    image: pvarki/takrmapi:1.3.0-tak${TAK_RELEASE:-5.2-RELEASE-30}-d${RELEASE_TAG:-1.6.0}${DOCKER_TAG_EXTRA:-}
    build:
      context: ./takintegration
      dockerfile: Dockerfile
      target: production
      args:
        TAKSERVER_IMAGE: *takimage
    labels:
        - "autoheal=true"
    network_mode: "service:takconfig"
    volumes:
      - ca_public:/ca_public
      - le_certs:/le_certs
      - kraftwerk_shared_tak:/pvarki
      - tak_data:/opt/tak/data
      - takrmapi_data:/data/persistent
    depends_on:
      rmnginx:
        condition: service_healthy
      takmsg:
        condition: service_healthy
      takapi:
        condition: service_healthy
    healthcheck:
      test: 'takrmapi healthcheck || exit 1'
      interval: 15s
      timeout: 35s
      retries: 3
      start_period: 45s
    restart: unless-stopped

  taknginx:
    <<: *nginxbuildinfo
    volumes:
      - nginx_templates:/nginx_templates
      - ca_public:/ca_public
      - le_certs:/le_certs
    environment:
      NGINX_HOST: *takdomain
      NGINX_HTTPS_PORT: *takapiport
      NGINX_UPSTREAM: "takconfig"  # Due to the sidecar thing we must use the config container as host
      NGINX_UPSTREAM_PORT: "8003"
      NGINX_CERT_NAME: "rasenmaeher"
      CFSSL_OCSP_BIND_PORT: *oscpport
      NGINX_OCSP_UPSTREAM: *ocsphost
      DNS_RESOLVER_IP: *dnsresolver
      NGINX_TEMPLATE_DIR: "templates_productapi"
    networks:
      - taknet
      - intranet
      - ocspnet
    ports:
      - "${TAK_RMAPI_PORT:-4626}:${TAK_RMAPI_PORT:-4626}"
    depends_on:
      miniwerk:
        condition: service_completed_successfully
      takrmapi:
        condition: service_healthy
    healthcheck:
      test: 'curl -s localhost:5666/healthcheck || exit 1'
      interval: 5s
      timeout: 5s
      retries: 3
      start_period: 5s
    restart: unless-stopped
############
# End: TAK #
############


##############################################################################
# Workaround docker compose not having opton to restart unhealthy containers #
##############################################################################
  autoheal:
    image: willfarrell/autoheal:latest
    tty: true
    restart: always
    environment:
      - AUTOHEAL_INTERVAL=10
      - AUTOHEAL_START_PERIOD=300
      - AUTOHEAL_DEFAULT_STOP_TIMEOUT=10
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock


####################
# Shared resources #
####################
networks:
  productnet:
  apinet:
  kcnet:
  canet:
  ocspnet:
  dbnet:
  intranet:
  taknet:

volumes:
  kraftwerk_data:
  kwinit_data:
  kraftwerk_shared_fake:
  kraftwerk_shared_tak:
  kraftwerk_shared_rasenmaeher:
  pg_data:
  cfssl_data:
  openldap_data:
  keycloak_data:
  rmapi_data:
  rmfpapi_data:
  ca_public:
  le_certs:
  tak_data:
  takrmapi_data:
  rmui_files:
  nginx_templates: