docker-compose.yml

networks:
  internal:

services:
  nginx:
    ports:
      - 80:80
    image: registry.jakubkrawczyk.com/rpg-calendar/nginx
    networks:
      - internal
    restart: on-failure
    depends_on:
      api:
        condition: service_started

  api:
    image: registry.jakubkrawczyk.com/rpg-calendar/api
    networks:
      - internal
    hostname: api
    restart: on-failure
    depends_on:
      keycloak:
        condition: service_healthy
      graylog_seeder:
        condition: service_completed_successfully
      mariadb:
        condition: service_healthy
    environment:
      GRAYLOG_URL: graylog
      API_RELATIONAL_DB_HOST: mariadb
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
      KEYCLOAK_REALM: ${KEYCLOAK_REALM}
      KEYCLOAK_INTERNAL_URL: ${KEYCLOAK_INTERNAL_URL}
      KEYCLOAK_AUDIENCE: rpg-calendar
      FILESYSTEM_ROOT: /files
    volumes:
      - api_data:/files
        
  mariadb:
    image: mariadb:11.5
    hostname: mariadb
    ports:
      - 3306:3306
    volumes:
      - mariadb_data:/var/lib/mysql
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
      MYSQL_DATABASE: rpgcalendar
    networks:
      - internal
    healthcheck:
      test: [ "CMD", "healthcheck.sh", "--connect", "--innodb_initialized" ]
      start_period: 10s
      interval: 10s
      timeout: 5s
      retries: 3
    restart: on-failure

  postgres:
    image: postgres:16.2
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    networks:
      - internal
    restart: on-failure
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready" ]
      interval: 10s
      timeout: 5s
      retries: 5

  keycloak:
    hostname: keycloak
    image: quay.io/keycloak/keycloak:26.0.0
    command: start --import-realm # --log-level=DEBUG 
    environment:
      KC_HOSTNAME: ${KEYCLOAK_EXTERNAL_URL}
      KC_HOSTNAME_PORT: 8080
      KC_HOSTNAME_STRICT_BACKCHANNEL: false
      KC_HTTP_ENABLED: true
      KC_HOSTNAME_STRICT_HTTPS: false
      KC_HEALTH_ENABLED: true
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres/${POSTGRES_DB}
      KC_DB_USERNAME: ${POSTGRES_USER}
      KC_DB_PASSWORD: ${POSTGRES_PASSWORD}
    ports:
      - 8080:8080
    restart: always
    volumes:
      - ./keycloak:/opt/keycloak/data/import
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - internal
    healthcheck:
      test: [ "CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/8080" ]
      interval: 5s
      timeout: 15s
      retries: 20
  
  mongodb:
    image: "mongo:6.0.14"
    volumes:
      - mongodb_data:/data/db
    restart: "on-failure"
    ports:
      - 27017:27017
    networks:
      - internal
    healthcheck:
      test: echo 'db.runCommand("ping").ok' | mongosh mongodb:27017/test --quiet
      interval: 10s
      timeout: 10s
      retries: 5
  graylog_seeder:
    image: registry.jakubkrawczyk.com/rpg-calendar/graylog_seeder
    depends_on:
      graylog:
        condition: service_healthy
    environment:
      GRAYLOG_ROOT_PASSWORD: ${GRAYLOG_ROOT_PASSWORD}
      GRAYLOG_ROOT_USERNAME: ${GRAYLOG_ROOT_USERNAME}
    networks:
      - internal

  opensearch:
    image: "opensearchproject/opensearch:2.12.0"
    environment:
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
      - "bootstrap.memory_lock=true"
      - "discovery.type=single-node"
      - "action.auto_create_index=false"
      - "plugins.security.ssl.http.enabled=false"
      - "plugins.security.disabled=true"
      # Can generate a password for `OPENSEARCH_INITIAL_ADMIN_PASSWORD` using a linux device via:
      # tr -dc A-Z-a-z-0-9_@#%^-_=+ < /dev/urandom  | head -c${1:-32}
      - OPENSEARCH_INITIAL_ADMIN_PASSWORD=${OPENSEARCH_INITIAL_ADMIN_PASSWORD}
    restart: "on-failure"
    networks:
      - internal

  # Graylog: https://hub.docker.com/r/graylog/graylog/
  graylog:
    hostname: graylog
    image: "graylog/graylog:6.0"
    depends_on:
      mongodb:
        condition: service_healthy
      opensearch:
        condition: service_started
    entrypoint: "/usr/bin/tini -- wait-for-it opensearch:9200 --  /docker-entrypoint.sh"
    environment:
      GRAYLOG_NODE_ID_FILE: /usr/share/graylog/data/config/node-id
      GRAYLOG_HTTP_BIND_ADDRESS: 0.0.0.0:9000
      GRAYLOG_ELASTICSEARCH_HOSTS: http://opensearch:9200
      GRAYLOG_MONGODB_URI: mongodb://mongodb:27017/graylog
      # To make reporting (headless_shell) work inside a Docker container
      GRAYLOG_REPORT_DISABLE_SANDBOX: true
      # CHANGE ME (must be at least 16 characters)!
      GRAYLOG_PASSWORD_SECRET: ${GRAYLOG_PASSWORD_SECRET}
      # Password: "admin"
      GRAYLOG_ROOT_PASSWORD_SHA2: ${GRAYLOG_ROOT_PASSWORD_SHA2}
      GRAYLOG_HTTP_EXTERNAL_URI: ${GRAYLOG_HTTP_EXTERNAL_URI}/
    ports:
      # Graylog web interface and REST API
      - "9000:9000/tcp"
      # Serilog
      - "12201:12201"
    volumes:
      - graylog_data:/usr/share/graylog/data/data
      - graylog_journal:/usr/share/graylog/data/journal
    restart: "on-failure"
    networks:
      - internal

volumes:
  postgres_data:
    driver: local
  graylog_data:
  graylog_journal:
  mongodb_data:
  mariadb_data:
  api_data: