version: '3.7'

services:

  ovis-traefik-forward-auth:
      image: quay.io/oauth2-proxy/oauth2-proxy:latest
      environment:
        - http_proxy=${http_proxy:-http://forward_proxy:3128}
        - https_proxy=${https_proxy:-http://forward_proxy:3128}
        - OAUTH2_PROXY_PROVIDER=oidc
        - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
        - OAUTH2_PROXY_OIDC_ISSUER_URL=${OAUTH_ISSUER_URL}
        - OAUTH2_PROXY_CLIENT_ID=${OAUTH_CLIENT_ID}
        - OAUTH2_PROXY_CLIENT_SECRET=${OAUTH_CLIENT_SECRET}
        - OAUTH2_PROXY_COOKIE_SECRET=${AUTHENTICATION_SECRET}
        - OAUTH2_PROXY_COOKIE_DOMAINS=.${HOST:-localhost}
        - OAUTH2_PROXY_COOKIE_REFRESH=4m
        - OAUTH2_PROXY_COOKIE_EXPIRE=24h
        - OAUTH2_PROXY_HTTP_ADDRESS=:4180
        - OAUTH2_PROXY_REVERSE_PROXY=true
        - OAUTH2_PROXY_WHITELIST_DOMAINS=.${HOST:-localhost}
        - OAUTH2_PROXY_UPSTREAMS=static://202
        - OAUTH2_PROXY_EMAIL_DOMAINS=*
        - OAUTH2_PROXY_ALLOWED_GROUPS=app-ovis
        - OAUTH2_PROXY_ERRORS_TO_INFO_LOG=true
        - OAUTH2_PROXY_CODE_CHALLENGE_METHOD=S256
        # For some reason, login.verbis.dkfz.de does not have a "groups" scope but this comes automatically through a
        # scope called microprofile-jwt. Remove the following line once we have a "groups" scope.
        - OAUTH2_PROXY_SCOPE=openid profile email
        # Pass Authorization Header and some user information to spot
        - OAUTH2_PROXY_SET_AUTHORIZATION_HEADER=true
        - OAUTH2_PROXY_SET_XAUTHREQUEST=true
      labels:
        - "traefik.enable=true"
        - "traefik.http.middlewares.ovis-traefik-forward-auth.forwardauth.address=http://ovis-traefik-forward-auth:4180"
        - "traefik.http.middlewares.ovis-traefik-forward-auth.forwardauth.authResponseHeaders=Authorization, X-Forwarded-User, X-Auth-Request-User, X-Auth-Request-Email"
        - "traefik.http.services.ovis-traefik-forward-auth.loadbalancer.server.port=4180"
        - "traefik.http.routers.oauth2.rule=Host(`${HOST:-localhost}`) && PathPrefix(`/oauth2-ovis/`)"
        - "traefik.http.routers.oauth2.tls=true"

  fhir-transformer:
    image: docker.verbis.dkfz.de/ovis/adt-mon-gql-fhir-transformer:latest
    restart: on-failure
    environment:
      - FHIR_SERVER_URL=${FHIR_SERVER_URL:-http://bridgehead-ccp-blaze:8080/fhir}
      - FHIR_USERNAME=${FHIR_USERNAME}
      - FHIR_PASSWORD=${FHIR_PASSWORD}
    volumes:
      - /var/cache/bridgehead/ccp/ovis/shared_data:/app/output

  mongo:
    image: mongo:${MONGO_VER:-latest}
    restart: always
    command: mongod
      - /var/cache/bridgehead/ccp/ovis/mongo/init/init.js:/docker-entrypoint-initdb.d/init.js

  backend:
    image: docker.verbis.dkfz.de/ovis/adt-mon-gql-backend:latest
    restart: always
    user: root
    working_dir: /app
    environment:
      - APOLLO_PORT=${APOLLO_PORT:-4001}
      - CREDOS_PORT=${CREDOS_PORT:-4000}
      - MONGO_VER=latest
      - CORS_ORIGIN=*
      - DB=${DB:-onc_test}
      - ADRESS=${ADRESS:-mongodb://mongo:27017}
    depends_on:
      - mongo
      - fhir-transformer
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:${APOLLO_PORT:-4001}/health"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    entrypoint: >
      sh -c "
        # First run the initialization process
        while [ ! -f /shared/omock.json ]; do
          echo 'Waiting for omock.json...'
          sleep 5
        done;
        mkdir -p ./prep &&
        cp /shared/omock.json ./prep/omock.json &&
        node ./mgDB/prep/preprocessor.mjs &&
        echo 'Processing complete' &&
        exec node --watch index.js"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.backend-gql.rule=Host(`${HOST:-localhost}`) && PathPrefix(`/graphql`)"
      - "traefik.http.routers.backend-gql.tls=true"
      - "traefik.http.services.backend-gql.loadbalancer.server.port=${APOLLO_PORT:-4001}"
    volumes:
      - /var/cache/bridgehead/ccp/ovis/shared_data:/shared

  frontend:
    image: docker.verbis.dkfz.de/ovis/adt-mon-gql-frontend:latest
    restart: always
    environment:
      - PUBLIC_GRAPHQL_URL=https://${HOST:-localhost}/graphql
    depends_on:
      backend:
        condition: service_healthy
    working_dir: /app
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.ovis-frontend.tls=true"
      - "traefik.http.routers.ovis-frontend.rule=Host(`${HOST:-localhost}`)"
      - "traefik.http.routers.lens.middlewares=traefik-forward-auth"
      - "traefik.http.services.ovis-frontend.loadbalancer.server.port=5173"