docker-compose.yml

volumes:
  pgdata: {}
  statics: {}
  rustfs-data: {}

x-django-env: &django-env
  DATABASE_URL: "postgis://postgres:${POSTGRES_PASSWORD}@postgres:5432/postgres?sslmode=disable"
  DJANGO_SETTINGS_MODULE: dms.core.settings.production
  USE_DOCKER: "yes"
  OIDC_PROVIDER_ID: nina
  OIDC_CLIENT_ID: "${OIDC_CLIENT_ID:-}"
  OIDC_SECRET: "${OIDC_SECRET:-}"
  OIDC_PROVIDER_URL: "${OIDC_PROVIDER_URL:-}"
  OIDC_PROVIDER_NAME: NINA
  DJANGO_AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
  DJANGO_AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
  DJANGO_AWS_STORAGE_BUCKET_NAME: ${AWS_STORAGE_BUCKET_NAME}
  DJANGO_AWS_S3_ENDPOINT_URL: ${AWS_S3_ENDPOINT_URL}
  AUTH_LDAP_SERVER_URI: ${AUTH_LDAP_SERVER_URI}
  AUTH_LDAP_BIND_DN: ${AUTH_LDAP_BIND_DN}
  AUTH_LDAP_BIND_PASSWORD: ${AUTH_LDAP_BIND_PASSWORD}
  AUTH_LDAP_USER_SEARCH_BASE: ${AUTH_LDAP_USER_SEARCH_BASE}
  AUTH_LDAP_UID: ${AUTH_LDAP_UID}
  AUTH_LDAP_USER_ATTR_MAP: ${AUTH_LDAP_USER_ATTR_MAP}
  SENTRY_DSN: ${SENTRY_DSN:-}
  AWS_REQUEST_CHECKSUM_CALCULATION: WHEN_REQUIRED
  AWS_RESPONSE_CHECKSUM_VALIDATION: WHEN_REQUIRED
  DATASETS_TITILER_URL: ${DATASETS_TITILER_URL:-/titiler}
  DJANGO_ALLOWED_HOSTS: "localhost,django,${HOSTNAME:-}"
  DATASETS_NINA_MAP_PREVIEW: ${DATASETS_NINA_MAP_PREVIEW:-}
  DATASETS_DUCKUI_URL: ${DATASETS_DUCKUI_URL:-https://duckui.nina.no}
  FASTDOC_CONVERT_API_URL: http://fastdoc:8000/convert

x-django-prod-env: &django-prod-env
  <<: *django-env
  DJANGO_SECRET_KEY: "${DJANGO_SECRET_KEY}"
  DJANGO_SERVER_EMAIL: ""
  DJANGO_ADMIN_URL: admin/
  DJANGO_SECURE_SSL_REDIRECT: False
  WEB_CONCURRENCY: 4
  DJANGO_ALLOWED_HOSTS: "localhost,django,${HOSTNAME:-}"

x-django-dev-env: &django-dev-env
  <<: *django-env
  DJANGO_SETTINGS_MODULE: dms.core.settings.local

x-django: &django
  build: .
  #   target: django
  depends_on:
    - postgres
  environment:
    <<: *django-env

x-django-prod: &django-prod
  <<: *django
  depends_on:
    - postgres
  profiles:
    - prod
  command: uv run gunicorn dms.core.wsgi --bind 0.0.0.0:8000 --chdir=/app

x-django-dev: &django-dev
  <<: *django
  # build:
  # target: dev
  profiles:
    - dev
  environment:
    <<: *django-dev-env
  volumes:
    - ./src:/app/src
    - ./media:/app/media
    - ./certs/:/usr/local/share/ca-certificates/
    - ./uv.lock:/app/uv.lock
    - ./docs/schema.yml:/app/schema.yml
  command: uv run manage.py runserver 0.0.0.0:8000

services:
  django:
    <<: *django-prod
    environment:
      <<: *django-prod-env
      DJANGO_COLLECTSTATIC: 1
      DJANGO_MIGRATE: 1
      CONN_MAX_AGE: 0
      # LDAP_CA_FILE_PATH:
    volumes:
      - statics:/app/staticfiles
      # - ./certs/:/usr/local/share/ca-certificates/
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.django.rule=PathPrefix(`/`)"
      - "traefik.http.routers.django.entrypoints=web"
      - "traefik.http.routers.django.priority=1"
      - "traefik.http.services.django.loadbalancer.server.port=8000"
      - "traefik.http.middlewares.upload-limit.buffering.maxRequestBodyBytes=8000000000"
      - "traefik.http.routers.django.middlewares=upload-limit"

  django-dev:
    <<: *django-dev
    tty: true
    stdin_open: true
    hostname: django
    environment:
      <<: *django-dev-env
      DJANGO_MIGRATE: 1
      INSTALL_CERTS: 1
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.django-dev.rule=PathPrefix(`/`)"
      - "traefik.http.routers.django-dev.entrypoints=web"
      - "traefik.http.routers.django-dev.priority=1"
      - "traefik.http.services.django-dev.loadbalancer.server.port=8000"
      - "traefik.http.middlewares.upload-limit-dev.buffering.maxRequestBodyBytes=8000000000"
      - "traefik.http.routers.django-dev.middlewares=upload-limit-dev"

  queue:
    <<: *django-prod
    environment:
      <<: *django-prod-env
      WAIT_FOR_HTTP: http://django:8000/ht/
      CONN_MAX_AGE: 60
    command: uv run manage.py procrastinate worker

  queue-dev:
    <<: *django-dev
    environment:
      <<: *django-dev-env
      WAIT_FOR_HTTP: http://django:8000/ht/
      INSTALL_CERTS: 1
    command: uv run manage.py procrastinate worker
    develop:
      watch:
        - action: restart
          path: ./src
        - action: rebuild
          path: ./Dockerfile
        - action: rebuild
          path: ./uv.lock
        - action: rebuild
          path: ./.env

  tailwind:
    <<: *django-dev
    tty: true
    stdin_open: true
    command: uv run manage.py tailwind start
    environment:
      <<: *django-dev-env
      DJANGO_TAILWIND: 1

  postgres:
    image: postgis/postgis:16-3.4
    volumes:
      - pgdata:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    ports:
      - 5432:5432

  static:
    image: nginx:alpine
    profiles:
      - prod
    volumes:
      - statics:/usr/share/nginx/html/static:ro
      - ./media:/usr/share/nginx/html/media:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.static.rule=PathPrefix(`/static/`) || PathPrefix(`/media/`)"
      - "traefik.http.routers.static.entrypoints=web"
      - "traefik.http.services.static.loadbalancer.server.port=80"
      - "traefik.http.routers.static.priority=10"

  frontend:
    profiles:
      - dev
    build:
      target: frontend
    command: pnpm run dev --host 0.0.0.0 --cors
    ports:
      - 5173:5173
    volumes:
      - ./src/dms/frontend/src:/app/src
      - ./src/dms/frontend/vite.config.ts:/app/vite.config.ts

  traefik:
    image: traefik:v3.6.1
    command:
      - --api.insecure=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --log.level=DEBUG

    ports:
      - 8000:80
      - 8080:8080
    volumes:
      - ${DOCKER_SOCK:-/var/run/docker.sock}:/var/run/docker.sock:ro

  rustfs:
    image: rustfs/rustfs:latest
    command: /data
    ports:
      - 9000:9000
      - 9001:9001
    volumes:
      - rustfs-data:/data
    environment:
      RUSTFS_ACCESS_KEY: ${AWS_ACCESS_KEY_ID:-}
      RUSTFS_SECRET_KEY: ${AWS_SECRET_ACCESS_KEY:-}
      RUSTFS_CONSOLE_ENABLE: true
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.rustfs.rule=Host(`${RUSTFS_HOSTNAME:-rustfs.local}`)"
      - "traefik.http.routers.rustfs.entrypoints=web"
      - "traefik.http.routers.rustfs.priority=100"
      - "traefik.http.services.rustfs.loadbalancer.server.port=9000"

  rustfs-setup:
    build:
      context: rustfs-setup
    depends_on:
      - rustfs
    environment:
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
      BUCKET_HOST: http://rustfs:9000
      BUCKET_NAME: ${AWS_STORAGE_BUCKET_NAME:-}

  titiler:
    image: ghcr.io/ninanor/titiler-app-titiler:next
    environment:
      - TITILER_API_CORS_ORIGINS=*
      - TITILER_API_CACHECONTROL=no-cache
      - TITILER_API_ROOT_PATH=/titiler
      - FORWARDED_ALLOW_IPS=*
      - REDIS_HOST=redis
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.titiler.rule=PathPrefix(`/titiler/`)"
      - "traefik.http.routers.titiler.entrypoints=web"
      - "traefik.http.routers.titiler.priority=20"
      - "traefik.http.services.titiler.loadbalancer.server.port=80"

  fastdoc:
    image: ghcr.io/ninanor/fastdoc:main

  redis:
    image: redis

  tusd:
    image: tusproject/tusd:v2.8
    environment:
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
      AWS_REGION: eu-central-1
      AWS_RESPONSE_CHECKSUM_VALIDATION: when_required
      AWS_REQUEST_CHECKSUM_CALCULATION: when_required
    command: " -hooks-enabled-events pre-create,post-finish -hooks-http-retry 5 -behind-proxy -disable-download -disable-termination -hooks-http http://django:8000/api/v1/uploads/tusd/webhook/ -s3-bucket=${AWS_STORAGE_BUCKET_NAME} -s3-endpoint=${AWS_S3_ENDPOINT_URL} -s3-object-prefix=uploads/ -hooks-http-forward-headers Authorization"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.tusd.rule=PathPrefix(`/files/`)"
      - "traefik.http.routers.tusd.entrypoints=web"
      - "traefik.http.routers.tusd.priority=20"
      - "traefik.http.services.tusd.loadbalancer.server.port=8080"