docker-compose.yml

version: "3.9"

x-healthcheck-settings: &healthcheck-settings
  interval: 10s
  retries: 10
  start_period: 15s
  timeout: 5s

x-db-env-conf: &db-env
  DATABASE_NAME: ${DATABASE_NAME}
  DATABASE_USERNAME: ${PSQL_USER}
  DATABASE_PASSWORD: ${PSQL_PASSWORD}
  DATABASE_ENDPOINT: postgres
  DATABASE_PORT: 5432

x-db-schema-creation: &db-schema-creation
  image: quay.io/ukhomeofficedigital/postgres:latest
  volumes:
    - ./sql:/sql
  environment:
    <<: *db-env
  entrypoint: ["/sql/create-db-schema.sh"]
  depends_on:
    postgres:
      condition: service_healthy
  networks:
    - callisto

x-liquibase-settings: &liquibase-setting
  pull_policy: ${PULL_POLICY}
  volumes:
    - ./liquibase/liquibase-setup.sh:/liquibase-setup.sh
  entrypoint: /liquibase-setup.sh
  networks:
    - callisto
  depends_on:
    postgres:
      condition: service_healthy

x-certificate-creation: &certificate-creation
  pull_policy: ${PULL_POLICY}
  image: eclipse-temurin:17-jre-focal
  volumes:
    - ./kafka:/kafka
    - keystore:/keystore
  working_dir: /kafka
  entrypoint: ["/kafka/create_keystore.sh"]

services:
  postgres:
    image: postgres:13.1
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_PASSWORD=${PSQL_PASSWORD}
      - POSTGRES_USER=${PSQL_USER}
      - POSTGRES_DB=${DATABASE_NAME}
    networks:
      - callisto
    healthcheck:
      test: ["CMD", "psql", "-U", "${PSQL_USER}", "-d", "${DATABASE_NAME}"]
      interval: 500ms
      timeout: 1s
      retries: 5

  kafka-setup:
    <<: *certificate-creation
    command: ["kafka"]

  kafka:
    image: confluentinc/cp-kafka:7.3.1
    ports:
      - "9093"
    volumes:
      - keystore:/etc/kafka/secrets/keystore
      - ./kafka/update_run.sh:/tmp/update_run.sh
      - ./kafka/kafka.properties:/tmp/kafka.properties
    networks:
      - callisto
    environment:
      KAFKA_ADVERTISED_LISTENERS: SSL://kafka:9093
      KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND: false
      KAFKA_AUTHORIZER_CLASS_NAME: org.apache.kafka.metadata.authorizer.StandardAuthorizer
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: false
      KAFKA_BROKER_ID: 1
      KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
      KAFKA_CONTROLLER_QUORUM_VOTERS: 1@kafka:9092
      KAFKA_INTER_BROKER_LISTENER_NAME: SSL
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: CONTROLLER:SSL,SSL:SSL
      KAFKA_LISTENERS: CONTROLLER://kafka:9092,SSL://kafka:9093
      KAFKA_LOG_DIRS: '/tmp/kraft-combined-logs'
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_PROCESS_ROLES: broker,controller
      KAFKA_SSL_CLIENT_AUTH: required
      KAFKA_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM: " "
      KAFKA_SSL_KEY_CREDENTIALS: keystore/kafka/kafka_creds
      KAFKA_SSL_KEYSTORE_CREDENTIALS: keystore/kafka/kafka_creds
      KAFKA_SSL_KEYSTORE_FILENAME: keystore/kafka/kafka.keystore.jks
      KAFKA_SSL_PRINCIPAL_MAPPING_RULES: RULE:^C=GB,O=UK Home Office,CN=Callisto (.+)$$/$$1/,DEFAULT
      KAFKA_SSL_TRUSTSTORE_CREDENTIALS: keystore/kafka/kafka_creds
      KAFKA_SSL_TRUSTSTORE_FILENAME: keystore/kafka/kafka.truststore.jks
      KAFKA_SUPER_USERS: "User:kafka"
    command: "bash -c '(/tmp/update_run.sh && /etc/confluent/docker/run) || sleep infinity'"
    healthcheck:
      <<: *healthcheck-settings
      test: kafka-topics --bootstrap-server kafka:9093 --list --command-config /tmp/kafka.properties || exit 1
    depends_on:
      kafka-setup:
        condition: service_completed_successfully

  kafka-topics-acls:
    image: confluentinc/cp-kafka:7.3.1
    volumes:
      - keystore:/etc/kafka/secrets/keystore
      - ./kafka/kafka.properties:/tmp/kafka.properties
      - ./kafka/setup_scripts:/setup_scripts
    entrypoint:
      [
        "/setup_scripts/setup-topics-acls.sh",
        "/tmp/kafka.properties",
      ]
    depends_on:
      kafka:
        condition: service_healthy
    networks:
      - callisto

  kafka-producer-setup:
    <<: *certificate-creation
    command: ["kafka-producer"]

  kafka-consumer-setup:
    <<: *certificate-creation
    command: ["kafka-consumer"]

  kafka-tester:
    image: confluentinc/cp-kafka:7.3.1
    volumes:
      - keystore:/etc/kafka/secrets/keystore
      - ./kafka/kafka-producer.properties:/tmp/kafka-producer.properties
      - ./kafka/kafka-consumer.properties:/tmp/kafka-consumer.properties
    entrypoint: ["sleep", "1h"]
    depends_on:
      kafka:
        condition: service_healthy
      kafka-producer-setup:
        condition: service_completed_successfully
      kafka-consumer-setup:
        condition: service_completed_successfully
      kafka-topics-acls:
        condition: service_completed_successfully
    networks:
      - callisto

  ingress:
    image: nginx:1.19.2-alpine
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./ingress/default.conf:/etc/nginx/conf.d/default.conf
      - ./ingress/nginx-selfsigned.crt:/etc/ssl/certs/nginx-selfsigned.crt:ro
      - ./ingress/nginx-selfsigned.key:/etc/ssl/private/nginx-selfsigned.key:ro
    networks:
      - callisto
    healthcheck:
      <<: *healthcheck-settings
      test: "nc -z ingress 443 || exit -1"

  keycloak:
    image: "quay.io/ukhomeofficedigital/callisto-auth-keycloak:$KEYCLOAK_TAG"
    pull_policy: ${PULL_POLICY}
    environment:
      - DB_VENDOR=h2
      - PROXY_ADDRESS_FORWARDING=true
    healthcheck:
      <<: *healthcheck-settings
      test: ["CMD", "curl", "-f", "http://keycloak:9090/auth"]
    command:
      - "-Djboss.http.port=9090"
    ports:
      - "50000:9090"
    networks:
      - callisto

  web:
    image: "quay.io/ukhomeofficedigital/callisto-ui:$WEB_TAG"
    pull_policy: ${PULL_POLICY}
    ports:
      - "50001:9090"
    networks:
      - callisto
    depends_on:
      keycloak:
        condition: service_healthy
    healthcheck:
      <<: *healthcheck-settings
      test: ["CMD", "curl", "-f", "http://web:9090/index.html"]

  timecard-schema-creation:
    <<: *db-schema-creation
    command: ["timecard"]

  timecard-database-migrations:
    <<: *liquibase-setting
    image: "quay.io/ukhomeofficedigital/callisto-timecard-database:$TIMECARD_RESTAPI_TAG"
    environment:
      <<: *db-env
    command: ["timecard"]
    depends_on:
      timecard-schema-creation:
        condition: service_completed_successfully

  accruals-schema-creation:
    <<: *db-schema-creation
    command: ["accruals"]

  accruals-database-migrations:
    <<: *liquibase-setting
    image: "quay.io/ukhomeofficedigital/callisto-accruals-database:$ACCRUALS_RESTAPI_TAG"
    environment:
      <<: *db-env
    command: ["accruals"]
    depends_on:
      accruals-schema-creation:
        condition: service_completed_successfully

  person-schema-creation:
    <<: *db-schema-creation
    command: ["person"]

  person-database-migrations:
    <<: *liquibase-setting
    image: "quay.io/ukhomeofficedigital/callisto-person-database:$PERSON_RESTAPI_TAG"
    environment:
      <<: *db-env
    command: ["person"]
    depends_on:
      person-schema-creation:
        condition: service_completed_successfully

  timecard-restapi-kafka-setup:
    <<: *certificate-creation
    command: ["timecard-restapi"]

  person-restapi-kafka-setup:
    <<: *certificate-creation
    command: ["person-restapi"]

  balance-calculator-kafka-setup:
    <<: *certificate-creation
    command: ["balance-calculator"]

  callisto-timecard-restapi:
    image: "quay.io/ukhomeofficedigital/callisto-timecard-restapi:$TIMECARD_RESTAPI_TAG"
    environment:
      <<: *db-env
      BOOTSTRAP_SERVER: kafka:9093
      KEYSTORE_LOCATION: file://keystore/timecard-restapi/timecard-restapi.keystore.jks
      TIMECARD_KEYSTORE_PASSWORD: changeit
      SPRING_APPLICATION_JSON: '{
        "spring.kafka.ssl.trust-store-location": "file://keystore/timecard-restapi/timecard-restapi.truststore.jks",
        "spring.kafka.ssl.trust-store-password": "changeit"
      }'
    ports:
      - "50100:9090"
    depends_on:
      timecard-database-migrations:
        condition: service_completed_successfully
      timecard-restapi-kafka-setup:
        condition: service_completed_successfully
    volumes:
      - keystore:/keystore
    healthcheck:
      <<: *healthcheck-settings
      test: wget --no-verbose --tries=1 --spider http://callisto-timecard-restapi:9090/swagger-ui/index.html || exit 1
    networks:
      - callisto

  callisto-accruals-restapi:
    image: "quay.io/ukhomeofficedigital/callisto-accruals-restapi:$ACCRUALS_RESTAPI_TAG"
    environment:
      <<: *db-env
    command:
      - "--server.port=9090" # Having to override server port as application.properties is setting it to a different port
    ports:
      - "50200:9090"
    depends_on:
      accruals-database-migrations:
        condition: service_completed_successfully
    healthcheck:
      <<: *healthcheck-settings
      test: wget --no-verbose --tries=1 --spider http://callisto-accruals-restapi:9090/swagger-ui/index.html || exit 1
    networks:
      - callisto

  callisto-person-restapi:
    image: "quay.io/ukhomeofficedigital/callisto-person-restapi:$PERSON_RESTAPI_TAG"
    environment:
      <<: *db-env
      BOOTSTRAP_SERVER: kafka:9093
      KEYSTORE_LOCATION: file://keystore/person-restapi/person-restapi.keystore.jks
      KEYSTORE_PASSWORD: changeit
      SPRING_APPLICATION_JSON: '{
        "spring.kafka.ssl.trust-store-location": "file://keystore/person-restapi/person-restapi.truststore.jks",
        "spring.kafka.ssl.trust-store-password": "changeit"
      }'
    ports:
      - "50300:9090"
    depends_on:
      person-database-migrations:
        condition: service_completed_successfully
      person-restapi-kafka-setup:
        condition: service_completed_successfully
    volumes:
      - keystore:/keystore
    healthcheck:
      <<: *healthcheck-settings
      test: wget --no-verbose --tries=1 --spider http://callisto-person-restapi:9090/swagger-ui/index.html || exit 1
    networks:
      - callisto

  balance-calculator:
    image: "quay.io/ukhomeofficedigital/callisto-balance-calculator:$BALANCE_CALCULATOR_TAG"
    environment:
      BOOTSTRAP_SERVER: kafka:9093
      ACCRUALS_URL: http://callisto-accruals-restapi:9090
      KEYSTORE_LOCATION: file://keystore/balance-calculator/balance-calculator.keystore.jks
      KEYSTORE_PASSWORD: changeit
      SPRING_APPLICATION_JSON: '{
        "spring.kafka.ssl.trust-store-location": "file://keystore/balance-calculator/balance-calculator.truststore.jks",
        "spring.kafka.ssl.trust-store-password": "changeit"
      }'
    ports:
      - "50500:9090"
    depends_on:
      balance-calculator-kafka-setup:
        condition: service_completed_successfully
    volumes:
      - keystore:/keystore
    healthcheck:
      <<: *healthcheck-settings
      test: wget --no-verbose --tries=1 --spider http://balance-calculator:9090/actuator/health || exit 1
    networks:
      - callisto

networks:
  callisto:
    driver: bridge

volumes:
  keystore:
    driver: local