services:
  mysql:
    image: mysql:8.4
    environment:
      MYSQL_DATABASE: osg_account_smoke
      MYSQL_ROOT_PASSWORD: ${SMOKE_MYSQL_ROOT_PASSWORD:?generated by deploy/smoke-local.sh}
      TZ: UTC
    volumes:
      - smoke-mysql-data:/var/lib/mysql
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "MYSQL_PWD=$$MYSQL_ROOT_PASSWORD mysqladmin ping --host=127.0.0.1 --user=root --silent",
        ]
      interval: 2s
      timeout: 3s
      retries: 60
    networks:
      - smoke-internal

  schema-migrator:
    profiles: ["setup"]
    image: osg-account-server-smoke:${SMOKE_RUN_ID:?generated by deploy/smoke-local.sh}
    build:
      context: .
      dockerfile: Dockerfile
    init: true
    user: "10001:10001"
    env_file:
      - ${SMOKE_RUNTIME_ENV:?generated by deploy/smoke-local.sh}
    environment:
      ADMIN_ENABLED: "false"
      ADMIN_BOOTSTRAP_ENABLED: "false"
      DATABASE_USER: osg_smoke_migrator
      DATABASE_PASSWORD: ${SMOKE_MYSQL_MIGRATION_PASSWORD:?generated by deploy/smoke-local.sh}
    depends_on:
      mysql:
        condition: service_healthy
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777,noexec,nosuid,nodev
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    networks:
      - smoke-internal

  credential-generator:
    profiles: ["setup"]
    image: osg-account-server-smoke:${SMOKE_RUN_ID:?generated by deploy/smoke-local.sh}
    build:
      context: .
      dockerfile: Dockerfile
    entrypoint:
      - java
      - -cp
      - /app/lib/*
      - com.osglab.account.tools.AdminCredentialGenerator
    command:
      - smoke-admin
      - /run/smoke/admin.generated.env
      - /run/smoke/admin-handoff.txt
    user: "${SMOKE_HOST_UID:?generated by deploy/smoke-local.sh}:${SMOKE_HOST_GID:?generated by deploy/smoke-local.sh}"
    volumes:
      - ${SMOKE_SECRET_DIR:?generated by deploy/smoke-local.sh}:/run/smoke
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    network_mode: none

  account-server:
    image: osg-account-server-smoke:${SMOKE_RUN_ID:?generated by deploy/smoke-local.sh}
    build:
      context: .
      dockerfile: Dockerfile
    init: true
    user: "10001:10001"
    env_file:
      - ${SMOKE_RUNTIME_ENV:?generated by deploy/smoke-local.sh}
      - ${SMOKE_ADMIN_ENV:?generated by deploy/smoke-local.sh}
    depends_on:
      mysql:
        condition: service_healthy
    ports:
      - "127.0.0.1:${SMOKE_APP_PORT:?generated by deploy/smoke-local.sh}:8080"
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777,noexec,nosuid,nodev
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "-q",
          "-O",
          "/dev/null",
          "http://127.0.0.1:8080/health/ready",
        ]
      interval: 2s
      timeout: 3s
      retries: 60
    networks:
      - smoke-internal
      - smoke-loopback

volumes:
  smoke-mysql-data:

networks:
  smoke-internal:
    internal: true
  smoke-loopback:
    driver: bridge