# Fixed name so the network is always "rise_default", even when run from a git worktree.
# The managed BuildKit daemon connects to this network via RISE_MANAGED_BUILDKIT_NETWORK_NAME
# (set in .envrc) to reach rise-registry.
name: rise

volumes:
  registry_data:
  postgres_data:
  dex_data:
  vault_plugins:

services:
  postgres:
    image: postgres:18-trixie
    container_name: rise-postgres
    restart: unless-stopped
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-rise}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-rise123}
      - POSTGRES_DB=${POSTGRES_DB:-rise}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U rise"]
      interval: 5s
      timeout: 5s
      retries: 5

  # OIDC provider for authentication in the development environment.
  dex:
    image: dexidp/dex:v2.45.1
    container_name: rise-dex
    restart: unless-stopped
    user: "0:0"
    ports:
      - "5556:5556"
    volumes:
      - ./dev/dex:/dex-config:ro
      - dex_data:/var/dex
    entrypoint: ["/usr/local/bin/dex"]
    command: ["serve", "/dex-config/config.yaml"]
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:5556/dex/healthz"]
      interval: 5s
      timeout: 5s
      retries: 5

  # Docker registry for images pushed by the rise CLI in the development environment.
  registry:
    image: registry:3
    container_name: rise-registry
    restart: unless-stopped
    ports:
      - "5000:5000"
    volumes:
      - registry_data:/var/lib/registry
    environment:
      - REGISTRY_STORAGE_DELETE_ENABLED=true

  # Helper UI to explore images pushed to the registry.
  registry-ui:
    image: quiq/registry-ui
    container_name: rise-registry-ui
    restart: unless-stopped
    ports:
      - "5001:5001"
    environment:
      - REGISTRY_HOSTNAME=rise-registry:5000
      - REGISTRY_INSECURE=true
      - PERFORMANCE_CATALOG_REFRESH_INTERVAL=0.1
      - TAGS_COUNT_REFRESH_INTERVAL=0.1
      - LISTEN_ADDR=0.0.0.0:5001
    depends_on:
      - registry

  # HashiCorp Vault with JFrog Artifactory secrets plugin.
  # Automatically configures itself and JFrog on startup.
  # Access: VAULT_ADDR=http://localhost:8200 VAULT_TOKEN=root
  # Start locally with: docker compose --profile jfrog-vault up -d jfrog vault
  vault:
    profiles: ["jfrog-vault"]
    image: hashicorp/vault:1.21
    container_name: rise-vault
    restart: unless-stopped
    ports:
      - "8200:8200"
    volumes:
      - ./dev/vault:/vault-config:ro
      - vault_plugins:/vault/plugins
    environment:
      - VAULT_DEV_ROOT_TOKEN_ID=root
      - VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:8200
    entrypoint: ["/bin/sh", "/vault-config/entrypoint.sh"]
    cap_add:
      - IPC_LOCK
    depends_on:
      - jfrog

  # JFrog Artifactory JCR for testing the JFrog repository controller.
  # Also serves as a Docker registry at localhost:3082 (repo: rise-docker-local).
  # Login: admin / password
  # Start locally with: docker compose --profile jfrog-vault up -d jfrog vault
  jfrog:
    profiles: ["jfrog-vault"]
    image: releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.15
    container_name: rise-jfrog
    restart: unless-stopped
    ports:
      # - "3080:8080"
      # - "3081:8081"
      - "3082:8082"
    environment:
      - "JF_SHARED_DATABASE_ALLOWNONPOSTGRESQL=true"
