docker-compose.yml

services:
  reverse-proxy:
    container_name: freegle-traefik
    networks:
      - default
    image: traefik:latest
    command:
      - "--api.insecure=true"
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.api.address=:8192"
      - "--entrypoints.traefik.address=:8080"
      - "--accesslog=true"
      - "--entrypoints.web.forwardedHeaders.insecure=true"
    ports:
      - "80:80"
      - "8192:8192"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:8080/dashboard/ || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s

  percona:
    container_name: freegle-percona
    networks:
      - default
    image: percona:8.0.33-25-centos
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: iznik
      MYSQL_DATABASE: iznik
    healthcheck:
      test: ["CMD-SHELL", "mysql -h localhost -u root -piznik -e 'SELECT 1' || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 30s

  postgres:
    container_name: freegle-postgres
    networks:
      - default
    image: postgis/postgis:13-3.1
    restart: "no"
    environment:
      POSTGRES_DB: iznik
      POSTGRES_PASSWORD: iznik
      POSTGRES_USER: root
    healthcheck:
      test: ["CMD-SHELL", "psql -h localhost -U root -d iznik -c 'SELECT 1' || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 30s

  phpmyadmin:
    container_name: freegle-phpmyadmin
    networks:
      - default
    image: phpmyadmin
    depends_on:
      percona:
        condition: service_started
      reverse-proxy:
        condition: service_started
    restart: "no"
    environment:
      - PMA_HOST=percona
      - PMA_USER=root
      - PMA_PASSWORD=iznik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.phpmyadmin.rule=Host(`phpmyadmin.localhost`)"
      - "traefik.http.routers.phpmyadmin.entrypoints=web"
      - "traefik.http.services.phpmyadmin.loadbalancer.server.port=80"

  mailhog:
    image: mailhog/mailhog
    container_name: freegle-mailhog
    networks:
      - default
    depends_on:
      percona:
        condition: service_healthy
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      beanstalkd:
        condition: service_healthy
      spamassassin-app:
        condition: service_healthy
      reverse-proxy:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.mailhog.rule=Host(`mailhog.localhost`)"
      - "traefik.http.routers.mailhog.entrypoints=web"
      - "traefik.http.services.mailhog.loadbalancer.server.port=8025"

  beanstalkd:
    image: schickling/beanstalkd
    container_name: freegle-beanstalkd
    networks:
      - default
    healthcheck:
      test: ["CMD-SHELL", "nc -z localhost 11300 || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s

  spamassassin-app:
    image: tiredofit/spamassassin
    container_name: freegle-spamassassin
    networks:
      - default
    ports:
      - 783:783
    volumes:
      - ./logs/spamassassin:/logs
      - ./conf:/config
      - ./data:/data
    environment:
      - CONTAINER_NAME=spamassassin-app
    restart: "no"
    healthcheck:
      test: ["CMD-SHELL", "nc -z 127.0.0.1 783"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 60s

  redis:
    container_name: freegle-redis
    networks:
      - default
    image: redis:6.2-alpine
    restart: "no"
    command: redis-server --save 20 1 --loglevel warning
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s

  delivery:
    container_name: freegle-delivery
    networks:
      - default
    image: ghcr.io/weserv/images:5.x
    restart: "no"
    shm_size: 1gb
    depends_on:
      - tusd
      - freegle-dev
      - freegle-prod
      - modtools
    extra_hosts:
      - "tusd.localhost:host-gateway"
    volumes:
      - ./delivery-nginx.conf:/etc/nginx/nginx.conf:ro
      - ./delivery-imagesweserv.conf:/etc/nginx/imagesweserv.conf:ro
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:80/ || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 15s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.delivery.rule=Host(`delivery.localhost`)"
      - "traefik.http.routers.delivery.entrypoints=web"
      - "traefik.http.services.delivery.loadbalancer.server.port=80"

  tusd:
    image: tusproject/tusd:latest
    container_name: freegle-tusd
    networks:
      default:
        aliases:
          - tusd.localhost
    ports:
      - "1080:8080"
    command: -hooks-http=http://freegle-apiv1:80/api/image -hooks-enabled-events=pre-create,post-finish -base-path=/tus/ -cors-allow-headers=baggage,sentry-trace
    depends_on:
      reverse-proxy:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:8080/tus/ 2>&1 | grep -E '(200|405)' || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 15s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.tusd.rule=Host(`tusd.localhost`)"
      - "traefik.http.routers.tusd.entrypoints=web"
      - "traefik.http.routers.tusd.middlewares=tusd-cors-headers"
      - "traefik.http.services.tusd.loadbalancer.server.port=8080"
      - "traefik.http.middlewares.tusd-cors-headers.headers.customresponseheaders.Access-Control-Allow-Headers=Authorization, Origin, X-Requested-With, X-Request-ID, X-HTTP-Method-Override, Content-Type, Upload-Length, Upload-Offset, Tus-Resumable, Upload-Metadata, Upload-Defer-Length, Upload-Concat, Upload-Complete, Upload-Draft-Interop-Version, x-token, baggage, sentry-trace"

  status:
    build: ./status
    container_name: freegle-status
    networks:
      - default
    ports:
      - "8081:80"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./status/index.html:/app/index.html:ro
      - ./status/logs.html:/app/logs.html:ro
      - ./status/server.js:/app/server.js:ro
      - ./ssl/certs:/app/ssl:ro
      - .:/project:ro
      - rebuild-requests:/rebuild-requests
    environment:
      - DOCKER_HOST=unix:///var/run/docker.sock

  host-scripts:
    image: alpine:latest
    container_name: freegle-host-scripts
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - .:/workspace
      - rebuild-requests:/rebuild-requests
    working_dir: /workspace
    command:
      - sh
      - -c
      - |
        apk add --no-cache docker-cli docker-compose jq bash inotify-tools
        echo 'Starting rebuild monitor and file sync...'
        (
          echo 'Starting rebuild monitor...'
          while true; do
            for request_file in /rebuild-requests/rebuild-*.json; do
              [ ! -f "$$request_file" ] && continue
              echo "Processing rebuild request: $$request_file"
              service=$$(jq -r '.service' "$$request_file" 2>/dev/null)
              container=$$(jq -r '.container' "$$request_file" 2>/dev/null)
              if [ "$$service" != "null" ] && [ "$$container" != "null" ]; then
                echo "Rebuilding service: $$service ($$container)"
                if docker-compose -p freegledockerwsl stop "$$service" && 
                   docker-compose -p freegledockerwsl rm -f "$$service" && 
                   docker-compose -p freegledockerwsl build "$$service" && 
                   docker-compose -p freegledockerwsl up --no-deps -d "$$service"; then
                  echo "Rebuild completed successfully for $$service"
                else
                  echo "Rebuild failed for $$service"
                fi
              fi
              rm -f "$$request_file"
            done
            sleep 2
          done
        ) &
        echo 'Starting file sync in background...'
        bash ./file-sync.sh &
        SYNC_PID=$$!

        # Keep container running
        while true; do
          if ! kill -0 $$SYNC_PID 2>/dev/null; then
            echo "File sync stopped, restarting..."
            bash ./file-sync.sh &
            SYNC_PID=$$!
          fi
          sleep 10
        done
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.status.rule=Host(`status.localhost`)"
      - "traefik.http.routers.status.entrypoints=web"
      - "traefik.http.services.status.loadbalancer.server.port=80"

  # Freegle images.
  apiv1:
    container_name: freegle-apiv1
    networks:
      - default
    build: 
      context: ./iznik-server
      args:
        IZNIK_SERVER_BRANCH: ${IZNIK_SERVER_BRANCH:-master}
    depends_on:
      percona:
        condition: service_started
      beanstalkd:
        condition: service_started
      mailhog:
        condition: service_started
      redis:
        condition: service_started
      spamassassin-app:
        condition: service_started
    restart: "no"
    environment:
      - MYSQL_HOST=percona
      - MYSQL_PORT=3306
      - MYSQL_PASSWORD=iznik
      - PHEANSTALK_SERVER=beanstalkd
      - REDIS_CONNECT=redis
      - IMAGE_DOMAIN=apiv1
      - SPAMD_HOST=spamassassin-app
      - SPAMD_PORT=783
      - SMTP_HOST=mailhog
      - TUS_UPLOADER=http://freegle-tusd:8080/tus
      - SMTP_PORT=1025
      - IMAGE_DELIVERY=http://freegle-delivery
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
      - GOOGLE_PUSH_KEY=${GOOGLE_PUSH_KEY}
      - GOOGLE_VISION_KEY=${GOOGLE_VISION_KEY}
      - GOOGLE_PERSPECTIVE_KEY=${GOOGLE_PERSPECTIVE_KEY}
      - GOOGLE_GEMINI_API_KEY=${GOOGLE_GEMINI_API_KEY}
      - GOOGLE_PROJECT=${GOOGLE_PROJECT}
      - GOOGLE_APP_NAME=${GOOGLE_APP_NAME}
      - MAPBOX_KEY=${MAPBOX_KEY}
      - MAXMIND_ACCOUNT=${MAXMIND_ACCOUNT}
      - MAXMIND_KEY=${MAXMIND_KEY}
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:80/api/config || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.apiv1.rule=Host(`apiv1.localhost`)"
      - "traefik.http.routers.apiv1.entrypoints=web"
      - "traefik.http.routers.apiv1.middlewares=apiv1-cors"
      - "traefik.http.services.apiv1-localhost-freegledocker.loadbalancer.server.port=80"
      - "traefik.http.middlewares.limit.buffering.maxRequestBodyBytes=8000000"
      - "traefik.http.middlewares.apiv1-cors.headers.customresponseheaders.Access-Control-Allow-Origin=*"
      - "traefik.http.middlewares.apiv1-cors.headers.customresponseheaders.Access-Control-Allow-Methods=GET,POST,PUT,DELETE,OPTIONS"
      - "traefik.http.middlewares.apiv1-cors.headers.customresponseheaders.Access-Control-Allow-Headers=*"
      - "traefik.http.middlewares.apiv1-cors.headers.customresponseheaders.Access-Control-Max-Age=86400"
    secrets:
      - LOVE_JUNK_API
      - LOVE_JUNK_SECRET
      - PARTNER_KEY
      - PARTNER_NAME
      - IMAGE_DOMAIN
    ports:
      - "1023:22"
      - "83:80"
      - "8181:80"

  apiv2:
    container_name: freegle-apiv2
    networks:
      default:
        aliases:
          - apiv2.localhost
    build: 
      context: ./iznik-server-go
      args:
        IZNIK_SERVER_GO_BRANCH: ${IZNIK_SERVER_GO_BRANCH:-master}
    depends_on:
      percona:
        condition: service_healthy
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      beanstalkd:
        condition: service_healthy
      reverse-proxy:
        condition: service_healthy
    restart: "no"
    environment:
      - MYSQL_HOST=percona
      - MYSQL_PORT=3306
      - IMAGE_DELIVERY=http://delivery.localhost
      - TUS_UPLOADER=http://freegle-tusd:8080/tus
      - PARTNER_KEY_FILE=/run/secrets/PARTNER_KEY
    ports:
      - "8193:8192"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.apiv2.rule=Host(`apiv2.localhost`)"
      - "traefik.http.routers.apiv2.entrypoints=web"
      - "traefik.http.routers.apiv2.middlewares=apiv2-cors"
      - "traefik.http.services.apiv2.loadbalancer.server.port=8192"
      - "traefik.http.middlewares.apiv2-cors.headers.customresponseheaders.Access-Control-Allow-Origin=*"
      - "traefik.http.middlewares.apiv2-cors.headers.customresponseheaders.Access-Control-Allow-Methods=GET,POST,PUT,DELETE,OPTIONS"
      - "traefik.http.middlewares.apiv2-cors.headers.customresponseheaders.Access-Control-Allow-Headers=*"
      - "traefik.http.middlewares.apiv2-cors.headers.customresponseheaders.Access-Control-Max-Age=86400"

  freegle-dev:
    container_name: freegle-freegle-dev
    networks:
      default:
        aliases:
          - freegle-dev.localhost
    extra_hosts:
      - "apiv1.localhost:host-gateway"
      - "apiv2.localhost:host-gateway"
    build: 
      context: ./iznik-nuxt3
      args:
        IZNIK_NUXT3_BRANCH: ${IZNIK_NUXT3_BRANCH:-master}
    tmpfs:
      - /tmp
    depends_on:
      phpmyadmin:
        condition: service_started
      mailhog:
        condition: service_started
      apiv1:
        condition: service_started
      apiv2:
        condition: service_started
    restart: "no"
    environment:
      - IZNIK_API_V1=http://apiv1.localhost/api
      - IZNIK_API_V2=http://apiv2.localhost/api
      - IMAGE_DELIVERY=http://delivery.localhost
      - TUS_UPLOADER=http://tusd.localhost/tus/
      - USER_SITE=http://freegle-dev.localhost:3002
      - IMAGE_BASE_URL=http://freegle-tusd:8080/tus
      - TUSD_URL=http://freegle-tusd:8080
      - NITRO_PRESET=node-server
      - NUXT_NITRO_PRERENDER_ROUTES=false
      - NUXT_DEV_MODE=true
      - NUXT_SSR_LOG=false
      - NODE_ENV=development
      - NUXT_BUILD_MODE=development
      - TEST_BASE_URL=http://127.0.0.1:3002
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.freegle-dev.rule=Host(`freegle-dev.localhost`)"
      - "traefik.http.routers.freegle-dev.entrypoints=web"
      - "traefik.http.services.freegle-dev.loadbalancer.server.port=3002"

  freegle-prod:
    container_name: freegle-freegle-prod
    networks:
      default:
        aliases:
          - freegle-prod.localhost
    extra_hosts:
      - "apiv1.localhost:host-gateway"
      - "apiv2.localhost:host-gateway"
    build: 
      context: ./iznik-nuxt3
      dockerfile: Dockerfile.prod
      args:
        IZNIK_NUXT3_BRANCH: ${IZNIK_NUXT3_BRANCH:-master}
    tmpfs:
      - /tmp
    depends_on:
      phpmyadmin:
        condition: service_started
      mailhog:
        condition: service_started
      apiv1:
        condition: service_started
      apiv2:
        condition: service_started
    restart: "no"
    environment:
      - IZNIK_API_V1=http://apiv1.localhost/api
      - IZNIK_API_V2=http://apiv2.localhost/api
      - IMAGE_DELIVERY=http://delivery.localhost
      - TUS_UPLOADER=http://tusd.localhost/tus/
      - USER_SITE=http://freegle-prod.localhost:3003
      - IMAGE_BASE_URL=http://freegle-tusd:8080/tus
      - TUSD_URL=http://freegle-tusd:8080
      - NITRO_PRESET=node-server
      - NUXT_NITRO_PRERENDER_ROUTES=false
      - NUXT_DEV_MODE=false
      - NUXT_SSR_LOG=false
      - NODE_ENV=production
      - NUXT_BUILD_MODE=production
      - TEST_BASE_URL=http://127.0.0.1:3003
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.freegle-prod.rule=Host(`freegle-prod.localhost`)"
      - "traefik.http.routers.freegle-prod.entrypoints=web"
      - "traefik.http.services.freegle-prod.loadbalancer.server.port=3003"

  modtools:
    container_name: freegle-modtools
    networks:
      default:
        aliases:
          - modtools.localhost
    extra_hosts:
      - "apiv1.localhost:host-gateway"
      - "apiv2.localhost:host-gateway"
    build: 
      context: .
      dockerfile: ./iznik-nuxt3-modtools/modtools/Dockerfile
      args:
        IZNIK_NUXT3_MODTOOLS_BRANCH: ${IZNIK_NUXT3_MODTOOLS_BRANCH:-master}
    tmpfs:
      - /tmp
    depends_on:
      phpmyadmin:
        condition: service_started
      mailhog:
        condition: service_started
      apiv1:
        condition: service_started
      apiv2:
        condition: service_started
    restart: "no"
    environment:
      - IZNIK_API_V1=http://apiv1.localhost/api
      - IZNIK_API_V2=http://apiv2.localhost/api
      - IMAGE_DELIVERY=http://delivery.localhost
      - TUS_UPLOADER=http://tusd.localhost/tus/
      - USER_SITE=http://modtools.localhost:3000
      - IMAGE_BASE_URL=http://freegle-tusd:8080/tus
      - TUSD_URL=http://freegle-tusd:8080
      - NITRO_PRESET=node-server
      - NUXT_DEV_MODE=true
      - NUXT_SSR_LOG=false
      - NODE_ENV=development
      - NUXT_BUILD_MODE=development
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.modtools.rule=Host(`modtools.localhost`)"
      - "traefik.http.routers.modtools.entrypoints=web"
      - "traefik.http.services.modtools.loadbalancer.server.port=3000"

  playwright:
    container_name: freegle-playwright
    network_mode: "host"
    build: 
      context: ./iznik-nuxt3
      dockerfile: Dockerfile.playwright
    working_dir: /app
    extra_hosts:
      - "freegle-dev.localhost:127.0.0.1"
      - "freegle-prod.localhost:127.0.0.1"
      - "apiv1.localhost:127.0.0.1"
      - "apiv2.localhost:127.0.0.1"
      - "delivery.localhost:127.0.0.1"
      - "modtools.localhost:127.0.0.1"
    volumes:
      - ./iznik-nuxt3/tests:/host-tests:ro
      - ./iznik-nuxt3:/app/src:ro
      - ./iznik-nuxt3:/host-playwright-config:ro
    environment:
      - TEST_BASE_URL=http://freegle-prod.localhost
      - NODE_ENV=test
      - CI=false
      - ENABLE_MONOCART_REPORTER=true
      - COVERALLS_REPO_TOKEN=${COVERALLS_REPO_TOKEN}
    depends_on:
      freegle-dev:
        condition: service_started
      freegle-prod:
        condition: service_started
      apiv1:
        condition: service_healthy
      apiv2:
        condition: service_started
      reverse-proxy:
        condition: service_healthy
      percona:
        condition: service_healthy
      redis:
        condition: service_healthy
      beanstalkd:
        condition: service_healthy

volumes:
  rebuild-requests:
    driver: local

networks:
  default:
    driver: bridge
  cont:
    driver: bridge
    enable_ipv6: false

secrets:
  LOVE_JUNK_API:
    file: ./secrets/lovejunk-api.txt
  LOVE_JUNK_SECRET:
    file: ./secrets/lovejunk-secret.txt
  PARTNER_KEY:
    file: ./secrets/partner-key.txt
  PARTNER_NAME:
    file: ./secrets/partner-name.txt
  IMAGE_DOMAIN:
    file: ./secrets/image-domain.txt