# Copyright (c) Abstract Machines
# SPDX-License-Identifier: Apache-2.0

# This docker-compose file contains optional certs services. Since it's optional, this file is
# dependent of docker-compose file from <project_root>/docker. In order to run this services, execute command:
# docker compose -f docker/docker-compose.yaml -f docker/addons/certs/docker-compose.yaml up
# from project root.

networks:
  supermq-base-net:
    name: supermq-base-net
    external: true

# Volumes for OpenBao data and configuration
volumes:
  supermq-openbao-volume:
  supermq-certs-db-volume:

services:
  certs-db:
    image: postgres:16.1-alpine
    container_name: supermq-certs-db
    restart: on-failure
    environment:
      POSTGRES_USER: ${SMQ_CERTS_DB_USER}
      POSTGRES_PASSWORD: ${SMQ_CERTS_DB_PASS}
      POSTGRES_DB: ${SMQ_CERTS_DB_NAME}
    networks:
      - supermq-base-net
    volumes:
      - supermq-certs-db-volume:/var/lib/postgresql/data

  certs:
    image: supermq/certs:${SMQ_RELEASE_TAG}
    container_name: supermq-certs
    depends_on:
      - openbao
      - certs-db
    restart: on-failure
    networks:
      - supermq-base-net
    ports:
      - ${SMQ_CERTS_HTTP_PORT}:${SMQ_CERTS_HTTP_PORT}
    environment:
      SMQ_CERTS_LOG_LEVEL: ${SMQ_CERTS_LOG_LEVEL}
      SMQ_CERTS_SIGN_CA_PATH: ${SMQ_CERTS_SIGN_CA_PATH}
      SMQ_CERTS_SIGN_CA_KEY_PATH: ${SMQ_CERTS_SIGN_CA_KEY_PATH}
      SMQ_CERTS_OPENBAO_HOST: http://${SMQ_OPENBAO_HOST}:${SMQ_OPENBAO_PORT}
      SMQ_CERTS_OPENBAO_APP_ROLE: ${SMQ_OPENBAO_APP_ROLE}
      SMQ_CERTS_OPENBAO_APP_SECRET: ${SMQ_OPENBAO_APP_SECRET}
      SMQ_CERTS_OPENBAO_NAMESPACE: ${SMQ_OPENBAO_NAMESPACE}
      SMQ_CERTS_OPENBAO_PKI_PATH: ${SMQ_OPENBAO_PKI_PATH}
      SMQ_CERTS_OPENBAO_ROLE: ${SMQ_OPENBAO_PKI_ROLE}
      SMQ_CERTS_HTTP_HOST: ${SMQ_CERTS_HTTP_HOST}
      SMQ_CERTS_HTTP_PORT: ${SMQ_CERTS_HTTP_PORT}
      SMQ_CERTS_HTTP_SERVER_CERT: ${SMQ_CERTS_HTTP_SERVER_CERT}
      SMQ_CERTS_HTTP_SERVER_KEY: ${SMQ_CERTS_HTTP_SERVER_KEY}
      SMQ_CERTS_DB_HOST: ${SMQ_CERTS_DB_HOST}
      SMQ_CERTS_DB_PORT: ${SMQ_CERTS_DB_PORT}
      SMQ_CERTS_DB_PASS: ${SMQ_CERTS_DB_PASS}
      SMQ_CERTS_DB_USER: ${SMQ_CERTS_DB_USER}
      SMQ_CERTS_DB_NAME: ${SMQ_CERTS_DB_NAME}
      SMQ_CERTS_DB_SSL_MODE: ${SMQ_CERTS_DB_SSL_MODE}
      SMQ_CERTS_DB_SSL_CERT: ${SMQ_CERTS_DB_SSL_CERT}
      SMQ_CERTS_DB_SSL_KEY: ${SMQ_CERTS_DB_SSL_KEY}
      SMQ_CERTS_DB_SSL_ROOT_CERT: ${SMQ_CERTS_DB_SSL_ROOT_CERT}
      SMQ_AUTH_GRPC_URL: ${SMQ_AUTH_GRPC_URL}
      SMQ_AUTH_GRPC_TIMEOUT: ${SMQ_AUTH_GRPC_TIMEOUT}
      SMQ_AUTH_GRPC_CLIENT_CERT: ${SMQ_AUTH_GRPC_CLIENT_CERT:+/auth-grpc-client.crt}
      SMQ_AUTH_GRPC_CLIENT_KEY: ${SMQ_AUTH_GRPC_CLIENT_KEY:+/auth-grpc-client.key}
      SMQ_AUTH_GRPC_SERVER_CA_CERTS: ${SMQ_AUTH_GRPC_SERVER_CA_CERTS:+/auth-grpc-server-ca.crt}
      SMQ_CLIENTS_URL: ${SMQ_CLIENTS_URL}
      SMQ_JAEGER_URL: ${SMQ_JAEGER_URL}
      SMQ_JAEGER_TRACE_RATIO: ${SMQ_JAEGER_TRACE_RATIO}
      SMQ_SEND_TELEMETRY: ${SMQ_SEND_TELEMETRY}
      SMQ_CERTS_INSTANCE_ID: ${SMQ_CERTS_INSTANCE_ID}
      SMQ_ALLOW_UNVERIFIED_USER: ${SMQ_ALLOW_UNVERIFIED_USER}
    volumes:
      - ../../ssl/certs/ca.key:/etc/ssl/certs/ca.key
      - ../../ssl/certs/ca.crt:/etc/ssl/certs/ca.crt
      - type: bind
        source: ${SMQ_ADDONS_CERTS_PATH_PREFIX}${SMQ_AUTH_GRPC_CLIENT_CERT:-./ssl/certs/dummy/client_cert}
        target: /auth-grpc-client${SMQ_AUTH_GRPC_CLIENT_CERT:+.crt}
        bind:
          create_host_path: true
      - type: bind
        source: ${SMQ_ADDONS_CERTS_PATH_PREFIX}${SMQ_AUTH_GRPC_CLIENT_KEY:-./ssl/certs/dummy/client_key}
        target: /auth-grpc-client${SMQ_AUTH_GRPC_CLIENT_KEY:+.key}
        bind:
          create_host_path: true
      - type: bind
        source: ${SMQ_ADDONS_CERTS_PATH_PREFIX}${SMQ_AUTH_GRPC_SERVER_CA_CERTS:-./ssl/certs/dummy/server_ca}
        target: /auth-grpc-server-ca${SMQ_AUTH_GRPC_SERVER_CA_CERTS:+.crt}
        bind:
          create_host_path: true

  openbao:
    image: openbao/openbao:latest
    container_name: supermq-openbao
    restart: on-failure
    networks:
      - supermq-base-net
    ports:
      - ${SMQ_OPENBAO_PORT}:${SMQ_OPENBAO_PORT}
    environment:
      - BAO_DEV_ROOT_TOKEN_ID=${SMQ_OPENBAO_ROOT_TOKEN}
      - BAO_ADDR=http://127.0.0.1:${SMQ_OPENBAO_PORT}
      - SMQ_OPENBAO_PKI_ROLE=${SMQ_OPENBAO_PKI_ROLE}
      - SMQ_OPENBAO_APP_ROLE=${SMQ_OPENBAO_APP_ROLE}
      - SMQ_OPENBAO_APP_SECRET=${SMQ_OPENBAO_APP_SECRET}
      - SMQ_OPENBAO_PORT=${SMQ_OPENBAO_PORT}
      - SMQ_OPENBAO_NAMESPACE=${SMQ_OPENBAO_NAMESPACE}
      - SMQ_OPENBAO_UNSEAL_KEY_1=${SMQ_OPENBAO_UNSEAL_KEY_1}
      - SMQ_OPENBAO_UNSEAL_KEY_2=${SMQ_OPENBAO_UNSEAL_KEY_2}
      - SMQ_OPENBAO_UNSEAL_KEY_3=${SMQ_OPENBAO_UNSEAL_KEY_3}
      - SMQ_OPENBAO_TOKEN=${SMQ_OPENBAO_TOKEN}
      - SMQ_OPENBAO_PKI_CA_CN=${SMQ_OPENBAO_PKI_CA_CN}
      - SMQ_OPENBAO_PKI_CA_OU=${SMQ_OPENBAO_PKI_CA_OU}
      - SMQ_OPENBAO_PKI_CA_O=${SMQ_OPENBAO_PKI_CA_O}
      - SMQ_OPENBAO_PKI_CA_C=${SMQ_OPENBAO_PKI_CA_C}
      - SMQ_OPENBAO_PKI_CA_L=${SMQ_OPENBAO_PKI_CA_L}
      - SMQ_OPENBAO_PKI_CA_ST=${SMQ_OPENBAO_PKI_CA_ST}
      - SMQ_OPENBAO_PKI_CA_ADDR=${SMQ_OPENBAO_PKI_CA_ADDR}
      - SMQ_OPENBAO_PKI_CA_PO=${SMQ_OPENBAO_PKI_CA_PO}
      - SMQ_OPENBAO_PKI_ROLE_NAME=${SMQ_OPENBAO_PKI_ROLE_NAME}
    cap_add:
      - IPC_LOCK
    mem_swappiness: 0
    volumes:
      - supermq-openbao-volume:/opt/openbao/data
      - supermq-openbao-volume:/opt/openbao/config
      - ./prod-entrypoint.sh:/entrypoint.sh
    entrypoint: /bin/sh
    command: /entrypoint.sh
