docker-compose.yaml

#
# SPDX-FileCopyrightText: 2024 Lifely
# SPDX-License-Identifier: EUPL-1.2+
#
services:
  keycloak:
    image: quay.io/keycloak/keycloak:25.0.6@sha256:82c5b7a110456dbd42b86ea572e728878549954cc8bd03cd65410d75328095d2
    depends_on:
      keycloak-database:
        condition: service_healthy
    ports:
      - "8081:8080"
      - "9001:9000"
    environment:
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=admin
      - DB_VENDOR=postgres
      - DB_ADDR=keycloak-database
      - DB_USER=keycloak
      - DB_NAME=keycloak
      - DB_PASSWORD=keycloak
      - LDAP_URL=ldap://openldap:1389
      - ZAC_GROUP_A_EMAIL_ADDRESS=${DOCKER_COMPOSE_LDAP_GROUP_A_EMAIL_ADDRESS:-test-group-a@example.com}
      - ZAC_GROUP_FUNCTIONEEL_BEHEERDERS_EMAIL_ADDRESS=${DOCKER_COMPOSE_LDAP_GROUP_FUNCTIONEEL_BEHEERDERS_EMAIL_ADDRESS:-test-group-functioneel-beheerders@example.com}
      - ZAC_GROUP_RECORD_MANAGERS_EMAIL_ADDRESS=${DOCKER_COMPOSE_LDAP_GROUP_RECORD_MANAGERS_EMAIL_ADDRESS:-test-group-record-managers@example.com}
      - ZAC_GROUP_DOMEIN_TEST_1_EMAIL_ADDRESS=${DOCKER_COMPOSE_LDAP_GROUP_DOMEIN_TEST_1_EMAIL_ADDRESS:-test-group-domein-test-1@example.com}
    volumes:
      - ./scripts/docker-compose/imports/keycloak:/opt/keycloak/data/import
    command:
      - "start-dev"
      - "--import-realm"
      - "--features=hostname:v1"
      - "--hostname-url=http://localhost:8081"
      - "--http-enabled=true"
      - "--health-enabled=true"

  keycloak-database:
    image: docker.io/postgres:17.2@sha256:fe4efc6901dda0d952306fd962643d8022d7bb773ffe13fe8a21551b9276e50c
    ports:
      - "54326:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 10s
      timeout: 10s
      retries: 10
      start_period: 30s
    environment:
      - POSTGRES_USER=keycloak
      - POSTGRES_PASSWORD=keycloak
      - POSTGRES_DB=keycloak
    volumes:
      - ./scripts/docker-compose/volume-data/zac-keycloak-database-data:/var/lib/postgresql/data

  zac-database:
    image: docker.io/postgres:17.2@sha256:fe4efc6901dda0d952306fd962643d8022d7bb773ffe13fe8a21551b9276e50c
    ports:
      - "54320:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 10s
      timeout: 10s
      retries: 10
      start_period: 30s
    environment:
      POSTGRES_USER: zac
      POSTGRES_PASSWORD: password
      POSTGRES_DB: zac
    volumes:
      - ./scripts/docker-compose/imports/zac-database/init-zac-database.sql:/docker-entrypoint-initdb.d/init-zac-database.sql
      - ./scripts/docker-compose/volume-data/zac-database-data:/var/lib/postgresql/data

  openzaak-database:
    image: docker.io/postgis/postgis:17-3.4@sha256:d0b5a6ecab18997637f55a83cb4a9467391de5645916cfa1b6f2a8d19eee7be5
    ports:
      - "54322:5432"
    platform: linux/amd64
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 10s
      timeout: 10s
      retries: 10
      start_period: 30s
    environment:
      - POSTGRES_USER=openzaak
      - POSTGRES_PASSWORD=openzaak
      - POSTGRES_DB=openzaak
      - BAG_API_CLIENT_MP_REST_URL=${BAG_API_CLIENT_MP_REST_URL:-https://api.bag.kadaster.nl/lvbag/individuelebevragingen/v2/}
      - BAG_API_KEY=${BAG_API_KEY:-please-request-a-bag-api-key}
    volumes:
      - ./scripts/docker-compose/imports/openzaak-database:/docker-entrypoint-initdb.d
      - ./scripts/docker-compose/volume-data/openzaak-database-data:/var/lib/postgresql/data

  # This container name must contain a '.' or else Open Zaak will respond with a 400
  # error on certain API requests caused by an internal 'invalid URL' error.
  openzaak.local:
    image: docker.io/openzaak/open-zaak:1.15.0@sha256:281450b155d7bd5dc3f910a329f50ae76f49b7db3762e699183921787b724650
    platform: linux/amd64
    environment: &openzaak-env
      - ALLOWED_HOSTS=localhost,host.docker.internal,openzaak.local,opennotificaties
      - DB_HOST=openzaak-database
      - DB_NAME=openzaak
      - DB_PASSWORD=openzaak
      - DB_USER=openzaak
      - CACHE_DEFAULT=redis:6379/0
      - CACHE_AXES=redis:6379/0
      - DEBUG=true
      - DISABLE_2FA=true
      - DJANGO_SETTINGS_MODULE=openzaak.conf.docker
      - DJANGO_SUPERUSER_PASSWORD=admin
      - LOG_LEVEL=DEBUG
      - NOTIFICATIONS_DISABLED=${OPENZAAK_NOTIFICATIONS_DISABLED:-true}
      - OPENZAAK_SUPERUSER_USERNAME=admin
      - OPENZAAK_SUPERUSER_EMAIL=noreply@example.com
      - SECRET_KEY=openZaakSecretKey
      - SENDFILE_BACKEND=django_sendfile.backends.simple
      - CELERY_BROKER_URL=redis://redis:6379/1
      - CELERY_RESULT_BACKEND=redis://redis:6379/1
      - CELERY_LOGLEVEL=DEBUG
    ports:
      - "8001:8000"
    volumes:
      - ./scripts/docker-compose/imports/openzaak/zac-scripts:/zac-scripts
      - ./scripts/docker-compose/imports/openzaak/uploads/dummy-test-document.pdf:/dummy-test-document.pdf
    command: ["/zac-scripts/copy-test-pdf-and-start-openzaak.sh"]
    healthcheck:
      test: [ "CMD", "python", "-c", "import requests; exit(requests.head('http://localhost:8000/admin/').status_code not in [200, 302])" ]
      interval: 30s
      timeout: 5s
      retries: 3
      # This should allow for enough time for migrations to run before the max
      # retries have passed. This healthcheck in turn allows other containers
      # to wait for the database migrations.
      start_period: 30s
    depends_on:
      openzaak-database:
        condition: service_healthy
      redis:
        condition: service_started

  # Open Zaak Celery worker
  # Used for sending notifications from Open Zaak to Open Notificaties
  openzaak-celery:
    image: docker.io/openzaak/open-zaak:1.15.0@sha256:281450b155d7bd5dc3f910a329f50ae76f49b7db3762e699183921787b724650
    platform: linux/amd64
    environment: *openzaak-env
    command: /celery_worker.sh
    healthcheck:
      test: [ "CMD", "python", "/app/bin/check_celery_worker_liveness.py" ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    depends_on:
      openzaak.local:
        condition: service_healthy
    profiles: [ "opennotificaties" ]

  redis:
    image: redis:7.4.1@sha256:ea96c435dc17b011f54c6a883c3c45e7726242b075de61c6fe40a10ae6ae0f83

  # This container name must contain a '.' or else Open Zaak will respond with a 400
  # error on certain API requests caused by an internal 'invalid URL' error.
  objecten-api.local:
    image: docker.io/maykinmedia/objects-api:2.4.4@sha256:2980ce1b62c4ae9575003a694c700e06d0ed77a55e8214a4984aded2d9e7d8c4
    platform: linux/amd64
    ports:
      - "8010:8000"
    environment: &objects-env
      - ALLOWED_HOSTS=localhost,host.docker.internal,objecten-api.local
      - CORS_ALLOW_ALL_ORIGINS=true
      - DB_HOST=objecten-api-database
      - DEBUG=true
      - DISABLE_2FA=true
      - DJANGO_SETTINGS_MODULE=objects.conf.docker
      - SECRET_KEY=objectenApiSecretKey
      - TWO_FACTOR_FORCE_OTP_ADMIN=False # this is not available yet in this version
      - TWO_FACTOR_PATCH_ADMIN=False
      - CACHE_DEFAULT=redis:6379/0
      - CACHE_AXES=redis:6379/0
      - EMAIL_HOST=localhost
    healthcheck:
      test: "bash -c 'printf \"GET / HTTP/1.1\n\n\" > /dev/tcp/127.0.0.1/8000; exit $?;'"
      interval: 10s
      timeout: 10s
      retries: 10
      start_period: 10s
    depends_on:
      objecten-api-database:
        condition: service_healthy

  objecten-api-database:
    image: docker.io/postgis/postgis:17-3.4@sha256:d0b5a6ecab18997637f55a83cb4a9467391de5645916cfa1b6f2a8d19eee7be5
    ports:
      - "54323:5432"
    platform: linux/amd64
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 10s
      timeout: 10s
      retries: 10
      start_period: 30s
    environment:
      - POSTGRES_USER=objects
      - POSTGRES_PASSWORD=objects
      - POSTGRES_DB=objects

  objecten-api-import:
    image: docker.io/maykinmedia/objects-api:2.4.4@sha256:2980ce1b62c4ae9575003a694c700e06d0ed77a55e8214a4984aded2d9e7d8c4
    platform: linux/amd64
    environment: *objects-env
    # in the current version of django it is not possible to create a new user with password without user interaction by using the createsuperuser command
    command: sh init/init.sh
    volumes:
      - ./scripts/docker-compose/imports/objects-api/fixtures:/app/src/objects/fixtures
      - ./scripts/docker-compose/imports/objects-api/init:/app/init
    depends_on:
      objecten-api.local:
        condition: service_healthy

  objecttypen-api:
    image: docker.io/maykinmedia/objecttypes-api:2.2.2@sha256:d2d1b6715232d1ae2a92e82073ad78eda82b2da8df3615cba307b91f4d8473fd
    platform: linux/amd64
    ports:
      - "8011:8000"
    environment: &objecttypes-env
      - CORS_ALLOW_ALL_ORIGINS=true
      - SECRET_KEY=objecttypenApiSecretKey
      - DJANGO_SETTINGS_MODULE=objecttypes.conf.docker
      - DB_HOST=objecttypen-api-database
      - DB_NAME=objecttypes
      - DB_USER=objecttypes
      - DB_PASSWORD=objecttypes
      - DEBUG=true
      - TWO_FACTOR_FORCE_OTP_ADMIN=False # this is not available yet in this version
      - TWO_FACTOR_PATCH_ADMIN=False
      - CACHE_DEFAULT=redis:6379/0
      - CACHE_AXES=redis:6379/0
      - EMAIL_HOST=localhost
      - DISABLE_2FA=True
    depends_on:
      objecttypen-api-database:
        condition: service_healthy

  objecttypen-api-database:
    image: docker.io/postgres:17.2@sha256:fe4efc6901dda0d952306fd962643d8022d7bb773ffe13fe8a21551b9276e50c
    ports:
      - "54324:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 10s
      timeout: 10s
      retries: 10
      start_period: 30s
    environment:
      - POSTGRES_USER=objecttypes
      - POSTGRES_PASSWORD=objecttypes
      - POSTGRES_DB=objecttypes

  objecttypen-api-import:
    image: docker.io/maykinmedia/objecttypes-api:2.2.2@sha256:d2d1b6715232d1ae2a92e82073ad78eda82b2da8df3615cba307b91f4d8473fd
    platform: linux/amd64
    environment: *objecttypes-env
    command: sh init/init.sh
    volumes:
      - ./scripts/docker-compose/imports/objecttypes-api/fixtures:/app/src/objecttypes/fixtures
      - ./scripts/docker-compose/imports/objecttypes-api/init:/app/init
    depends_on:
      - objecttypen-api

  solr:
    image: docker.io/solr:9.7.0-slim@sha256:5eb3e2e6791020c6d098514594bc6bd16f2a95a7df0f855801af6f5af98169f5
    platform: linux/amd64
    ports:
      - "8983:8983"
    volumes:
      - ./scripts/docker-compose/volume-data/solr-data:/var/solr
    # run as root to change the permissions of the solr folder
    user: root
    # Change permissions of the solr folder, create the 'zac' core and start solr
    command: bash -c "
      chown -R 8983:8983 /var/solr
      && runuser -u solr -- solr-precreate zac"

  # Open Policy Agent (OPA)
  opa:
    # Keep this OPA binary version in sync with the one used in the ZAC Helm chart (values.yaml file)
    image: docker.io/openpolicyagent/opa:0.70.0-static@sha256:5679cbbedd1908063b7a68e8af28e662dce4ae3e069b4b5459531b141c6b6ff0
    command: run --server --log-level debug
    ports:
      - "8181:8181"

  openldap:
    image: docker.io/bitnami/openldap:2.6.9@sha256:8e3f28db7a8c05d7db99ec688b8ca1044f0deaf8f98ea5b1f71c42276e3c1583
    ports:
      - "1389:1389"
      - "1636:1636"
    volumes:
      - ./scripts/docker-compose/imports/openldap/schemas:/schemas
      - ./scripts/docker-compose/imports/openldap/zac-scripts:/zac-scripts
    environment:
      - LDAP_ADMIN_USERNAME=admin
      - LDAP_ADMIN_PASSWORD=admin
      - LDAP_ROOT=dc=example,dc=org
      - LDAP_SKIP_DEFAULT_TREE=yes
      - LDAP_CUSTOM_LDIF_DIR=/tmp
      - ZAC_TESTUSER1_EMAIL_ADDRESS=${DOCKER_COMPOSE_LDAP_TEST_USER_1_EMAIL_ADDRESS:-testuser1@example.com}
      - ZAC_TESTUSER2_EMAIL_ADDRESS=${DOCKER_COMPOSE_LDAP_TEST_USER_2_EMAIL_ADDRESS:-testuser2@example.com}
      - ZAC_RECORD_MANAGER_1_EMAIL_ADDRESS=${DOCKER_COMPOSE_LDAP_RECORD_MANAGER_1_EMAIL_ADDRESS:-recordmanager1@example.com}
      - ZAC_FUNCTIONAL_ADMIN_1_EMAIL_ADDRESS=${DOCKER_COMPOSE_LDAP_FUNCTIONAL_ADMIN_1_EMAIL_ADDRESS:-functionaladmin1@example.com}
      - ZAC_TESTUSER_DOMEIN_TEST_1_EMAIL_ADDRESS=${DOCKER_COMPOSE_LDAP_TESTUSER_DOMEIN_TEST_1_EMAIL_ADDRESS:-testuser-domein-test-1@example.com}
      - ZAC_GROUP_A_EMAIL_ADDRESS=${DOCKER_COMPOSE_LDAP_GROUP_A_EMAIL_ADDRESS:-test-group-a@example.com}
      - ZAC_GROUP_FUNCTIONEEL_BEHEERDERS_EMAIL_ADDRESS=${DOCKER_COMPOSE_LDAP_GROUP_FUNCTIONEEL_BEHEERDERS_EMAIL_ADDRESS:-test-group-functioneel-beheerders@example.com}
      - ZAC_GROUP_RECORD_MANAGERS_EMAIL_ADDRESS=${DOCKER_COMPOSE_LDAP_GROUP_RECORD_MANAGERS_EMAIL_ADDRESS:-test-group-record-managers@example.com}
      - ZAC_GROUP_DOMEIN_TEST_1_EMAIL_ADDRESS=${DOCKER_COMPOSE_LDAP_GROUP_DOMEIN_TEST_1_EMAIL_ADDRESS:-test-group-domein-test-1@example.com}
    entrypoint: ["/zac-scripts/generate-zac-import-ldif-and-start-openldap.sh"]
    command: ["/opt/bitnami/scripts/openldap/run.sh"]

  brp-personen-mock:
    image: ghcr.io/brp-api/personen-mock:2.3.0-202409180940@sha256:eacbf6bb9d7ccd74c283506072c0d11e5695b04c0d5ed587f61fd3a4db689220
    environment:
      - ASPNETCORE_ENVIRONMENT=Release
      - ASPNETCORE_URLS=http://+:5010
    ports:
      - "5010:5010"

  openklant-database:
    image: docker.io/postgres:17.2@sha256:fe4efc6901dda0d952306fd962643d8022d7bb773ffe13fe8a21551b9276e50c
    ports:
      - "54325:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 10s
      timeout: 10s
      retries: 10
      start_period: 30s
    environment:
      - POSTGRES_USER=openklant
      - POSTGRES_PASSWORD=openklant
      - POSTGRES_DB=openklant
    volumes:
      - ./scripts/docker-compose/imports/openklant-database:/docker-entrypoint-initdb.d
      - ./scripts/docker-compose/volume-data/openklant-database-data:/var/lib/postgresql/data

  openklant.local:
    image: docker.io/maykinmedia/open-klant:2.3.0@sha256:deeccf6c1e0c76538169443ffe960895da98188540fec69e127d9e78fdce23da
    platform: linux/amd64
    environment:
      - ALLOWED_HOSTS=localhost,host.docker.internal,openklant.local
      - DB_HOST=openklant-database
      - DB_USER=openklant
      - DB_PASSWORD=openklant
      - DB_NAME=openklant
      - CACHE_DEFAULT=redis:6379/0
      - CACHE_AXES=redis:6379/0
      - DJANGO_SETTINGS_MODULE=openklant.conf.docker
      - EMAIL_HOST=localhost
      - IS_HTTPS=no
      - NOTIFICATIONS_DISABLED=True
      - SECRET_KEY=openZaakSecretKey
      - DISABLE_2FA=true
    ports:
      - "8002:8000"
    depends_on:
      openklant-database:
        condition: service_healthy
      redis:
        condition: service_started

  smartdocuments-wiremock:
    image: docker.io/wiremock/wiremock:3.10.0@sha256:052f7d05b585d5cc956ecf2f1543b1a721858ec83baf0d11b507a113e3b023ee
    volumes:
      # these WireMock mappings are used by the ZAC integration tests
      - ./scripts/docker-compose/imports/smartdocuments-wiremock/mappings:/home/wiremock/mappings
      - ./scripts/docker-compose/imports/smartdocuments-wiremock/__files:/home/wiremock/__files
    entrypoint: [ "/docker-entrypoint.sh", "--global-response-templating", "--disable-gzip", "--verbose" ]
    ports:
      - "18080:8080"
    profiles: [ "itest" ]

  kvk-wiremock:
    image: docker.io/wiremock/wiremock:3.10.0@sha256:052f7d05b585d5cc956ecf2f1543b1a721858ec83baf0d11b507a113e3b023ee
    volumes:
      # these WireMock mappings are used by the ZAC integration tests
      - ./scripts/docker-compose/imports/kvk-wiremock/mappings:/home/wiremock/mappings
      - ./scripts/docker-compose/imports/kvk-wiremock/__files:/home/wiremock/__files
    entrypoint: [ "/docker-entrypoint.sh", "--global-response-templating", "--disable-gzip", "--verbose" ]
    ports:
      - "18081:8080"
    profiles: [ "itest" ]

  opa-tests:
    # Keep this OPA binary version in sync with the one used in the ZAC Helm chart (values.yaml file)
    image: docker.io/openpolicyagent/opa:0.70.0@sha256:2b1c4b231f6dfa6a2baea4af4109203b10cd4b65e836d72f03bfe5d8dfce7095
    volumes:
      - ./src/test/resources/policies:/home/tests
      - ./src/main/resources/policies:/home/policies
    entrypoint: [ "opa", "test", "/home/policies", "/home/tests" ]
    profiles: [ "itest" ]

  office-converter:
    image: ghcr.io/eugenmayer/kontextwork-converter:1.6.1@sha256:92ec2ee4390a7663bc9f5476d6d400bcbbbbc55630bf531d062919b6579295c5
    platform: linux/amd64
    ports:
      - "8083:8080"

  # Open Telemetry Collector which can receive OTLP observability data sent by ZAC
  otel-collector:
    image: docker.io/otel/opentelemetry-collector:0.116.1@sha256:6260c3c942f6abcb45f255ac67835600cfd2fc6ce8be65e0ee3af6da2dfb98fb
    command: [ --config=/etc/otel-collector.yaml ]
    volumes:
      - ./scripts/docker-compose/imports/otel-collector/otel-collector.yaml:/etc/otel-collector.yaml:Z
    ports:
      - "1888:1888" # pprof extension
      - "13133:13133" # health_check extension
      - "4317:4317" # OTLP gRPC receiver
      - "4318:4318" # OTLP http receiver
      - "55679:55679" # zpages extension
    profiles: [ "metrics" ]

  # Observability traces data store
  tempo:
    image: docker.io/grafana/tempo:2.6.1@sha256:ef4384fce6e8ad22b95b243d8fc165628cda655376fd50e7850536ad89d71d50
    command: [ "-config.file=/etc/tempo.yaml" ]
    volumes:
      - ./scripts/docker-compose/imports/tempo/tempo.yaml:/etc/tempo.yaml
    ports:
      - "14268"  # jaeger ingest
      - "3200"   # tempo
      - "4317"  # otlp grpc
      - "4318"  # otlp http
      - "9411"   # zipkin
    profiles: [ "metrics" ]

  # Observability metrics data store
  prometheus:
    image: docker.io/prom/prometheus:v3.0.1@sha256:565ee86501224ebbb98fc10b332fa54440b100469924003359edf49cbce374bd
    command:
      - --config.file=/etc/prometheus.yaml
      - --web.enable-remote-write-receiver
      - --enable-feature=exemplar-storage
    volumes:
      - ./scripts/docker-compose/imports/prometheus/prometheus.yaml:/etc/prometheus.yaml
    ports:
      - "9090:9090"
    profiles: [ "metrics" ]

  # Visualizes metrics and traces data
  grafana:
    image: docker.io/grafana/grafana:11.4.0@sha256:d8ea37798ccc41061a62ab080f2676dda6bf7815558499f901bdb0f533a456fb
    volumes:
      - ./scripts/docker-compose/imports/grafana/grafana-datasources.yaml:/etc/grafana/provisioning/datasources/datasources.yaml
      - ./scripts/docker-compose/volume-data/grafana-data:/var/lib/grafana
    environment:
      - GF_AUTH_ANONYMOUS_ENABLED=true
      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
      - GF_AUTH_DISABLE_LOGIN_FORM=true
      - GF_FEATURE_TOGGLES_ENABLE=traceqlEditor
    ports:
      - "3000:3000"
    healthcheck:
      test: "bash -c 'printf \"GET /api/health HTTP/1.1\n\n\" > /dev/tcp/127.0.0.1/3000; exit $?;'"
      interval: 10s
      timeout: 10s
      retries: 10
      start_period: 30s
    depends_on:
      - tempo
      - prometheus
    profiles: [ "metrics" ]

  greenmail:
    image: docker.io/greenmail/standalone:2.1.2@sha256:572d22796908375678119a13fabfcdc5416c9003404ab975fe824692fe02ba03
    environment:
      GREENMAIL_OPTS: >-
        -Dgreenmail.smtp.hostname=0.0.0.0
        -Dgreenmail.smtp.port=25
        -Dgreenmail.hostname=0.0.0.0
        -Dgreenmail.auth.disabled
        -Dgreenmail.verbose
    ports:
      - "25:25"
      - "143:143"
      - "18083:8080"
    profiles: [ "itest" ]

  rabbitmq:
    image: rabbitmq:4.0.5-alpine@sha256:f8b3601fba0bbda709a0ae23e5df9fc0155f301a0f515894fdbfd5bc229abb64
    healthcheck:
      test: rabbitmq-diagnostics -q ping
      interval: 30s
      timeout: 30s
      retries: 3
    profiles: [ "opennotificaties" ]

  opennotificaties-database:
    image: docker.io/postgis/postgis:17-3.4@sha256:d0b5a6ecab18997637f55a83cb4a9467391de5645916cfa1b6f2a8d19eee7be5
    ports:
      - "54327:5432"
    platform: linux/amd64
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}" ]
      interval: 10s
      timeout: 10s
      retries: 10
      start_period: 30s
    environment:
      - POSTGRES_USER=opennotificaties
      - POSTGRES_PASSWORD=opennotificaties
      - POSTGRES_DB=opennotificaties
    volumes:
      - ./scripts/docker-compose/imports/opennotificaties-database:/docker-entrypoint-initdb.d
      - ./scripts/docker-compose/volume-data/opennotificaties-database-data:/var/lib/postgresql/data
    profiles: [ "opennotificaties" ]

  opennotificaties:
    image: docker.io/openzaak/open-notificaties:1.7.1@sha256:feaf6f1da046bd4a8beb727563deda171fc66bc68371fd6f9192cbb1ceee9e6f
    platform: linux/amd64
    environment: &opennotificaties-env
      - ALLOWED_HOSTS=localhost,host.docker.internal,openzaak.local,zac
      - CACHE_DEFAULT=redis:6379/0
      - CACHE_AXES=redis:6379/0
      - CELERY_BROKER_URL=amqp://guest:guest@rabbitmq:5672//
      - CELERY_RESULT_BACKEND=redis://redis:6379/1
      - CELERY_LOGLEVEL=DEBUG
      - DB_HOST=opennotificaties-database
      - DB_NAME=opennotificaties
      - DB_PASSWORD=opennotificaties
      - DB_USER=opennotificaties
      - DEBUG=true
      - DISABLE_2FA=true
      - DJANGO_SETTINGS_MODULE=nrc.conf.docker
      - DJANGO_SUPERUSER_PASSWORD=admin
      - LOG_LEVEL=DEBUG
      - LOG_NOTIFICATIONS_IN_DB=true
      - PUBLISH_BROKER_URL=amqp://guest:guest@rabbitmq:5672/%2F
      - RABBITMQ_HOST=rabbitmq
      - SECRET_KEY=opennotificatiesApiSecretKey
    healthcheck:
      test: [ "CMD", "python", "-c", "import requests; exit(requests.head('http://localhost:8000/admin/').status_code not in [200, 302])" ]
      interval: 30s
      timeout: 5s
      retries: 3
      # This should allow for enough time for migrations to run before the max
      # retries have passed. This healthcheck in turn allows other containers
      # to wait for the database migrations.
      start_period: 30s
    ports:
      - "8003:8000"
    depends_on:
      opennotificaties-database:
        condition: service_healthy
      redis:
        condition: service_started
      rabbitmq:
        condition: service_started
    profiles: [ "opennotificaties" ]

  opennotificaties-celery:
    image: docker.io/openzaak/open-notificaties:1.7.1@sha256:feaf6f1da046bd4a8beb727563deda171fc66bc68371fd6f9192cbb1ceee9e6f
    platform: linux/amd64
    environment: *opennotificaties-env
    command: /celery_worker.sh
    healthcheck:
      test: [ "CMD", "python", "/app/bin/check_celery_worker_liveness.py" ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    depends_on:
        opennotificaties:
            condition: service_healthy
    profiles: [ "opennotificaties" ]

  zac:
    # By default, we use the most recent ZAC Docker Image. Change this if you wish to use a specific version.
    image: ${ZAC_DOCKER_IMAGE:-ghcr.io/infonl/zaakafhandelcomponent:latest}
    environment:
      - AUTH_REALM=zaakafhandelcomponent
      - AUTH_RESOURCE=zaakafhandelcomponent
      - AUTH_SECRET=keycloakZaakafhandelcomponentClientSecret
      - AUTH_SERVER=http://keycloak:8080
      - BAG_API_CLIENT_MP_REST_URL=https://api.bag.kadaster.nl/lvbag/individuelebevragingen/v2/
      - BAG_API_KEY=${BAG_API_KEY:-dummyBagApiKey}
      - BRP_API_CLIENT_MP_REST_URL=http://brp-personen-mock:5010/haalcentraal/api/brp
      - BRP_API_KEY=dummyKey # not used when using the BRP proxy
      - CONTEXT_URL=http://localhost:8080
      - DB_HOST=zac-database
      - DB_NAME=zac
      - DB_PASSWORD=password
      - DB_USER=zac
      - FEATURE_FLAG_BPMN_SUPPORT=${FEATURE_FLAG_BPMN_SUPPORT:-false}
      - GEMEENTE_CODE=${GEMEENTE_CODE:-9999}
      - GEMEENTE_MAIL=${GEMEENTE_MAIL:-gemeente-zac-test@example.com}
      - GEMEENTE_NAAM=${GEMEENTE_NAAM:-DummyZacGemeente}
      - KLANTINTERACTIES_API_CLIENT_MP_REST_URL=http://openklant.local:8000
      - KLANTINTERACTIES_API_TOKEN=dummyToken
      - KVK_API_CLIENT_MP_REST_URL=${KVK_API_CLIENT_MP_REST_URL:-dummyKvkApiUrl}
      - KVK_API_KEY=${KVK_API_KEY:-dummyKvkApiKey}
      - LDAP_DN="ou=people,dc=example,dc=org"
      - LDAP_PASSWORD=admin
      - LDAP_URL=ldap://openldap:1389
      - LDAP_USER=cn=admin,dc=example,dc=org
      - MAILJET_API_KEY=${MAILJET_API_KEY:-dummyMailjetApiKey}
      - MAILJET_API_SECRET_KEY=${MAILJET_API_SECRET_KEY:-dummyMailjetApiSecretKey}
      - OFFICE_CONVERTER_CLIENT_MP_REST_URL=http://office-converter:8080
      - OBJECTS_API_CLIENT_MP_REST_URL=http://objecten-api.local:8000
      - OBJECTS_API_TOKEN=dummyZacObjectsToken
      - OBJECTTYPES_API_CLIENT_MP_REST_URL=http://objecttypen-api:8000
      - OBJECTTYPES_API_TOKEN=123456
      - OPA_API_CLIENT_MP_REST_URL=http://opa:8181
      - OPEN_FORMS_URL=http://localhost:9999 # dummy for now
      - OPEN_NOTIFICATIONS_API_SECRET_KEY=openNotificatiesApiSecretKey
      - SMARTDOCUMENTS_ENABLED=${SMARTDOCUMENTS_ENABLED:-false}
      - SMARTDOCUMENTS_AUTHENTICATION=${SMARTDOCUMENTS_AUTHENTICATION:-dummySmartDocumentsAuthentication}
      - SMARTDOCUMENTS_CLIENT_MP_REST_URL=${SMARTDOCUMENTS_CLIENT_MP_REST_URL:-http://smartdocuments-wiremock:8080}
      - SMARTDOCUMENTS_FIXED_USER_NAME=${SMARTDOCUMENTS_FIXED_USER_NAME:-}
      - SIGNALERINGEN_DELETE_OLDER_THAN_DAYS=${SIGNALERINGEN_DELETE_OLDER_THAN_DAYS:-14}
      - SOLR_URL=http://solr:8983
      # Turn off the Open Telemetry sampler by default because it is not always needed
      # Typically when using the Docker Compose profile 'metrics' you want to turn this on
      - SUBSYSTEM_OPENTELEMETRY__SAMPLER_TYPE=${SUBSYSTEM_OPENTELEMETRY__SAMPLER_TYPE:-off}
      - SUBSYSTEM_OPENTELEMETRY__ENDPOINT=http://otel-collector:4317
      - ZGW_API_CLIENT_MP_REST_URL=http://openzaak.local:8000/
      - ZGW_API_CLIENTID=zac_client
      - ZGW_API_SECRET=openzaakZaakafhandelcomponentClientSecret
      - ZGW_API_URL_EXTERN=http://localhost:8001/
      - SMTP_SERVER=${SMTP_SERVER:-in-v3.mailjet.com}
      - SMTP_PORT=${SMTP_PORT:-587}
      - SMTP_USERNAME=${SMTP_USERNAME:-dummyMailjetApiKey}
      - SMTP_PASSWORD=${SMTP_PASSWORD:-dummyMailjetApiSecretKey}
    ports:
      - "8080:8080"
      - "9990:9990"
    volumes:
      # mount volumes for (optional) JaCoCo test coverage for our integration tests
      # see: https://blog.akquinet.de/2018/09/06/test-coverage-for-containerized-java-apps/
      - ./build/jacoco/itest/jacoco-agent:/jacoco-agent
      - ./build/jacoco/itest/jacoco-report:/jacoco-report
    entrypoint: [
      "sh",
      "-c",
      # entrypoint may be overridden by environment variable to pass on extra arguments
      "${ZAC_DOCKER_ENTRYPOINT:-java -Djboss.bind.address.management=0.0.0.0 -Xms1024m -Xmx1024m -Xlog:gc::time,uptime -jar zaakafhandelcomponent.jar}"
    ]
    deploy:
      resources:
        limits:
          # Set a maximum memory limit for the ZAC container for a more realistic
          # scenario when testing ZAC locally or when running our integration tests.
          memory: 4G
    depends_on:
      zac-database:
        condition: service_healthy
      openzaak.local:
        condition: service_healthy
    profiles: ["zac"]