# Backing services for v2x-server.
#
# Used two ways:
#   * on its own                -> `docker compose up -d` for a local stack
#   * with .devcontainer/compose.override.yaml -> adds the "app" dev container
#
# Credentials here are development-only and intentionally committed.

name: v2x-server

services:
  mysql:
    image: mysql:8.4
    command:
      - --character-set-server=utf8mb4
      - --collation-server=utf8mb4_0900_ai_ci
    environment:
      MYSQL_ROOT_PASSWORD: rootpassword
      MYSQL_DATABASE: v2x
      MYSQL_USER: v2x
      MYSQL_PASSWORD: v2xpassword
    ports:
      - "3306:3306"
    volumes:
      - mysql-data:/var/lib/mysql
      # Init scripts run only on the first boot of an empty data volume.
      - ./docker/mysql/init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "127.0.0.1", "-uroot", "-prootpassword"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 30s

  keycloak:
    image: quay.io/keycloak/keycloak:26.7.0
    command: ["start-dev", "--import-realm"]
    environment:
      # Keycloak 26 renamed these from KEYCLOAK_ADMIN / KEYCLOAK_ADMIN_PASSWORD.
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
      # Pin the public identity so every issued token carries
      # iss=http://localhost:8080/realms/v2x, regardless of which network path
      # produced it. See README "The two URL traps".
      KC_HOSTNAME: http://localhost:8080
      KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
      KC_HTTP_ENABLED: "true"
      KC_HEALTH_ENABLED: "true"
      # Dev mode keeps the realm in an embedded H2 file inside this volume --
      # deliberately not MySQL, so wiping app data never destroys identity data.
      KC_DB: dev-file
    ports:
      - "8080:8080"
      - "9000:9000"
    volumes:
      - keycloak-data:/opt/keycloak/data
      - ./docker/keycloak:/opt/keycloak/data/import:ro
    healthcheck:
      # The image ships no curl or wget, so probe the management port through
      # bash's /dev/tcp. Informational only -- nothing blocks on it, because a
      # failed probe here should not stop you from opening the devcontainer.
      test:
        - "CMD-SHELL"
        - >-
          exec 3<>/dev/tcp/127.0.0.1/9000 &&
          printf 'GET /health/ready HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 &&
          cat <&3 | grep -q 'UP'
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 60s

volumes:
  mysql-data:
  keycloak-data: