compose.prod.yaml

services:
  postgres:
    image: postgres:17.6-alpine
    environment:
      - POSTGRES_DB=${POSTGRES_DB}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_USER=${POSTGRES_USER}
    ports:
      - '5432:5432'
    volumes:
      - db-data:/var/lib/postgresql/data
    command: >
      bash -c "
        set -m

        # Start default entrypoint in the background:
        docker-entrypoint.sh postgres &

        # Wait for Postgres to come up (pg_isready blocks until server is accepting connections)
        until pg_isready -h localhost -p 5432 --timeout=0; do
          echo 'Waiting for Postgres to be ready...';
          sleep 1;
        done;

        # Create 'keycloak' DB if it doesn’t exist
        psql -v ON_ERROR_STOP=1 -U ${POSTGRES_USER} -tc \"SELECT 1 FROM pg_database WHERE datname = 'keycloak'\" | grep -q 1 || psql -U ${POSTGRES_USER} -c \"CREATE DATABASE keycloak;\"

        # Bring Postgres (still running in background) to the foreground
        fg %1
      "
    networks:
      - helios-network

  webhook-listener:
    image: "ghcr.io/ls1intum/helios/webhook-listener:${WEBHOOK_LISTENER_IMAGE_TAG}"
    ports:
      - '4200:4200'
    environment:
      - NATS_AUTH_TOKEN=${NATS_AUTH_TOKEN}
      - WEBHOOK_SECRET=${WEBHOOK_SECRET}
      - NATS_URL=nats-server
    depends_on:
      - nats-server
    networks:
      - helios-network

  nats-server:
    image: nats:2.12.4-alpine
    ports:
      - "4222:4222"
      - "8222:8222"
    command:
      [
        "/bin/sh",
        "-c",
        "echo 'listen: \"0.0.0.0:4222\"


          http_port: 8222


          jetstream {

          \  store_dir: \"/data\"

          }


          authorization {

          \  token: \"${NATS_AUTH_TOKEN}\"

          }' > /etc/nats/nats-server.conf.template && sed 's|{{NATS_AUTH_TOKEN}}|'\"$NATS_AUTH_TOKEN\"'|g' /etc/nats/nats-server.conf.template > /etc/nats/nats-server.conf && exec nats-server --config /etc/nats/nats-server.conf"
      ]
    environment:
      - NATS_AUTH_TOKEN=${NATS_AUTH_TOKEN}
    volumes:
      - nats-data:/data
    healthcheck:
      test: [ "CMD", "wget", "--spider", "--quiet", "http://localhost:8222/healthz" ]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 3s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - helios-network

  client:
    image: "ghcr.io/ls1intum/helios/client:${CLIENT_IMAGE_TAG}"
    ports:
      # Do not expose the client to 80 or 443
      - "90:80"
    restart: always
    networks:
      - helios-network

  application-server:
    image: "ghcr.io/ls1intum/helios/application-server:${APPLICATION_SERVER_IMAGE_TAG}"
    ports:
      - '8080:8080'
    restart: on-failure:3
    environment:
      - SPRING_PROFILES_ACTIVE=${SPRING_PROFILES_ACTIVE}
      - DATASOURCE_URL=${DATASOURCE_URL}
      - DATASOURCE_USERNAME=${DATASOURCE_USERNAME}
      - DATASOURCE_PASSWORD=${DATASOURCE_PASSWORD}
      - NATS_SERVER=${NATS_SERVER}
      - NATS_AUTH_TOKEN=${NATS_AUTH_TOKEN}
      - NATS_DURABLE_CONSUMER_NAME=${NATS_DURABLE_CONSUMER_NAME}
      - NATS_CONSUMER_INACTIVE_THRESHOLD_MINUTES=${NATS_CONSUMER_INACTIVE_THRESHOLD_MINUTES}
      - NATS_CONSUMER_ACK_WAIT_SECONDS=${NATS_CONSUMER_ACK_WAIT_SECONDS}
      - ORGANIZATION_NAME=${ORGANIZATION_NAME}
      - GITHUB_AUTH_TOKEN=${GITHUB_AUTH_TOKEN}
      - REPOSITORY_NAME=${REPOSITORY_NAME}
      - RUN_ON_STARTUP_COOLDOWN=${RUN_ON_STARTUP_COOLDOWN}
      - OAUTH_ISSUER_URL=${OAUTH_ISSUER_URL}
      - GITHUB_APP_NAME=${GITHUB_APP_NAME}
      - GITHUB_APP_ID=${GITHUB_APP_ID}
      - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID}
      - GITHUB_INSTALLATION_ID=${GITHUB_INSTALLATION_ID}
      - GITHUB_PRIVATE_KEY_PATH=${GITHUB_PRIVATE_KEY_PATH}
      - SENTRY_DSN=${SENTRY_DSN}
      - HELIOS_TOKEN_EXCHANGE_CLIENT=${HELIOS_TOKEN_EXCHANGE_CLIENT}
      - HELIOS_TOKEN_EXCHANGE_SECRET=${HELIOS_TOKEN_EXCHANGE_SECRET}
      - DATA_SYNC_RUN_ON_STARTUP=${DATA_SYNC_RUN_ON_STARTUP}
      - CLEANUP_WORKFLOW_RUN_DRY_RUN=${CLEANUP_WORKFLOW_RUN_DRY_RUN}
      - HELIOS_ENVIRONMENT_NAME=${HELIOS_ENVIRONMENT_NAME}
      - HELIOS_PROD_SECRET_KEY=${HELIOS_PROD_SECRET_KEY}
      - HELIOS_STAGING_SECRET_KEY=${HELIOS_STAGING_SECRET_KEY}
      - HELIOS_DEVELOPERS_GITHUB_USERNAMES=${HELIOS_DEVELOPERS_GITHUB_USERNAMES}
      - JAVA_TOOL_OPTIONS=-XX:+HeapDumpOnOutOfMemoryError -XX:+ExitOnOutOfMemoryError -XX:HeapDumpPath=/dumps -Xlog:gc*:file=/logs/gc.log:time,uptime,level,tags
    depends_on:
      - postgres
      - nats-server
      - webhook-listener
    volumes:
      - ./heliosapp.converted_key_pkcs8.pem:/app/heliosapp.converted_key_pkcs8.pem
      - ./dumps:/dumps
      - ./logs:/logs
    networks:
      - helios-network

  notification:
    image: "ghcr.io/ls1intum/helios/notification:${NOTIFICATION_SERVER_IMAGE_TAG}"
    environment:
      - SPRING_PROFILES_ACTIVE=${SPRING_PROFILES_ACTIVE}
      - NATS_SERVER=${NATS_SERVER}
      - NATS_AUTH_TOKEN=${NATS_AUTH_TOKEN}
      - NATS_DURABLE_CONSUMER_NAME=notification-consumer
      - NATS_CONSUMER_INACTIVE_THRESHOLD_MINUTES=${NATS_CONSUMER_INACTIVE_THRESHOLD_MINUTES}
      - NATS_CONSUMER_ACK_WAIT_SECONDS=${NATS_CONSUMER_ACK_WAIT_SECONDS}
      - MAIL_HOST=${MAIL_HOST}
      - MAIL_PORT=${MAIL_PORT}
      - EMAIL_ENABLED=${EMAIL_ENABLED}
      - EMAIL_FROM=${EMAIL_FROM}
    depends_on:
      - nats-server
    networks:
      - helios-network
    extra_hosts:
      - "postfix.host:172.30.0.1"

  keycloak:
    image: ghcr.io/ls1intum/helios/keycloak:${KEYCLOAK_IMAGE_TAG}
    container_name: keycloak
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_BOOTSTRAP_ADMIN_USERNAME}
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_BOOTSTRAP_ADMIN_PASSWORD}
      KC_DB: postgres
      KC_DB_URL_HOST: postgres
      KC_DB_USERNAME: ${POSTGRES_USER}
      KC_DB_PASSWORD: ${POSTGRES_PASSWORD}
      KC_HOSTNAME: ${KC_HOSTNAME}
      KC_HTTP_ENABLED: ${KC_HTTP_ENABLED}
    ports:
      - '8081:8081'
    depends_on:
      - postgres
    volumes:
      - ./helios-realm.json:/opt/keycloak/data/import/prod-realm-export.json
    command: start-dev --import-realm --http-port=8081 --proxy-headers xforwarded --hostname-strict=true --features="token-exchange,admin-fine-grained-authz:v1"
    networks:
      - helios-network

volumes:
  db-data:
  nats-data:


networks:
  helios-network:
    name: helios-network
    driver: bridge
    ipam:
      config:
        - subnet: 172.30.0.0/16
          gateway: 172.30.0.1