version: "3.7"

services:
  dnpm-mysql:
    image: mysql:9
    healthcheck:
      test: [ "CMD", "mysqladmin" ,"ping", "-h", "localhost" ]
      interval: 3s
      timeout: 5s
      retries: 5
    environment:
      MYSQL_ROOT_HOST: "%"
      MYSQL_ROOT_PASSWORD: ${DNPM_MYSQL_ROOT_PASSWORD}
    volumes:
      - /var/cache/bridgehead/dnpm/mysql:/var/lib/mysql

  dnpm-authup:
    image: authup/authup:latest
    container_name: bridgehead-dnpm-authup
    volumes:
      - /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable
    depends_on:
      dnpm-mysql:
        condition: service_healthy
    command: server/core start
    environment:
      - PUBLIC_URL=https://${HOST}/auth/
      - AUTHORIZE_REDIRECT_URL=https://${HOST}
      - ROBOT_ADMIN_ENABLED=true
      - ROBOT_ADMIN_SECRET=${DNPM_AUTHUP_SECRET}
      - ROBOT_ADMIN_SECRET_RESET=true
      - DB_TYPE=mysql
      - DB_HOST=dnpm-mysql
      - DB_USERNAME=root
      - DB_PASSWORD=${DNPM_MYSQL_ROOT_PASSWORD}
      - DB_DATABASE=auth
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.authup-strip.stripprefix.prefixes=/auth/"
      - "traefik.http.routers.dnpm-auth.middlewares=authup-strip"
      - "traefik.http.routers.dnpm-auth.rule=PathPrefix(`/auth`)"
      - "traefik.http.services.dnpm-auth.loadbalancer.server.port=3000"
      - "traefik.http.routers.dnpm-auth.tls=true"

  dnpm-portal:
    image: ghcr.io/dnpm-dip/portal:${DNPM_IMAGE_TAG:-latest}
    container_name: bridgehead-dnpm-portal
    environment:
      - NUXT_API_URL=http://dnpm-backend:9000/
      - NUXT_PUBLIC_API_URL=https://${HOST}/api/
      - NUXT_AUTHUP_URL=http://dnpm-authup:3000/
      - NUXT_PUBLIC_AUTHUP_URL=https://${HOST}/auth/
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dnpm-frontend.rule=PathPrefix(`/`)"
      - "traefik.http.services.dnpm-frontend.loadbalancer.server.port=3000"
      - "traefik.http.routers.dnpm-frontend.tls=true"

  dnpm-backend:
    container_name: bridgehead-dnpm-backend
    image: ghcr.io/dnpm-dip/api-gateway:latest
    environment:
      - LOCAL_SITE=${ZPM_SITE}:${SITE_NAME}   # Format: {Site-ID}:{Site-name}, e.g. UKT:Tübingen
      - RD_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}
      - MTB_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}
      - HATEOAS_HOST=https://${HOST}
      - CONNECTOR_TYPE=broker
      - AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000
      - TZ=Europe/Berlin
    volumes:
      - /etc/bridgehead/dnpm/config:/dnpm_config
      - /var/cache/bridgehead/dnpm/backend-data:/dnpm_data
    depends_on:
      dnpm-authup:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.dnpm-backend.loadbalancer.server.port=9000"
      # expose everything
      - "traefik.http.routers.dnpm-backend.rule=PathPrefix(`/api`)"
      - "traefik.http.routers.dnpm-backend.tls=true"
      - "traefik.http.routers.dnpm-backend.service=dnpm-backend"
      # except ETL
      - "traefik.http.routers.dnpm-backend-etl.rule=PathRegexp(`^/api(/.*)?etl(/.*)?$`)"
      - "traefik.http.routers.dnpm-backend-etl.tls=true"
      - "traefik.http.routers.dnpm-backend-etl.service=dnpm-backend"
      # this needs an ETL processor with support for basic auth
      - "traefik.http.routers.dnpm-backend-etl.middlewares=auth"
      # except peer-to-peer
      - "traefik.http.routers.dnpm-backend-peer.rule=PathRegexp(`^/api(/.*)?/peer2peer(/.*)?$`)"
      - "traefik.http.routers.dnpm-backend-peer.tls=true"
      - "traefik.http.routers.dnpm-backend-peer.service=dnpm-backend"
      - "traefik.http.routers.dnpm-backend-peer.middlewares=dnpm-backend-peer"
      # this effectively denies all requests
      # this is okay, because requests from peers don't go through Traefik
      - "traefik.http.middlewares.dnpm-backend-peer.ipWhiteList.sourceRange=0.0.0.0/32"

  landing:
    labels:
      - "traefik.http.routers.landing.rule=PathPrefix(`/landing`)"
