# Standalone candidate: requires the NEW images; not yet published.
# .env is optional. Change the four API settings for your deployment.
name: accesshub-five
x-service: &service
  restart: unless-stopped
  security_opt: [no-new-privileges:true]
  logging: {driver: json-file, options: {max-size: 5m, max-file: '2'}}
services:
  web:
    <<: *service
    image: ${ACCESSHUB_PROXY_IMAGE:-ghcr.io/saiedawad/accesshub-proxy:0.3.0-alpha.1}
    environment:
      ACCESSHUB_WEB_HOST: ${ACCESSHUB_WEB_HOST:-${ACCESSHUB_PRIVATE_ADDRESS:-localhost}}
    ports: ['${ACCESSHUB_WEB_BIND_ADDRESS:-${ACCESSHUB_PRIVATE_ADDRESS:-127.0.0.1}}:${ACCESSHUB_WEB_PORT:-8444}:8443']
    volumes: [console-https-data:/data, console-https-config:/config]
    networks:
      console-session-proxy: {ipv4_address: 10.243.0.2, aliases: [console-https]}
      frontend: {aliases: [console-https]}
    depends_on: {api: {condition: service_healthy}, console-gateway: {condition: service_healthy}}

  api:
    <<: *service
    image: ${ACCESSHUB_API_IMAGE:-ghcr.io/saiedawad/accesshub-api:0.3.0-alpha.1}
    environment:
      ACCESSHUB_PRIVATE_ADDRESS: ${ACCESSHUB_PRIVATE_ADDRESS:-}
      ACCESSHUB_WEB_HOST: ${ACCESSHUB_WEB_HOST:-${ACCESSHUB_PRIVATE_ADDRESS:-localhost}}
      ACCESSHUB_WEB_PORT: ${ACCESSHUB_WEB_PORT:-8444}
      ACCESSHUB_WEB_ORIGIN: ${ACCESSHUB_WEB_ORIGIN:-}
      ACCESSHUB_CLIENT_NETWORKS: ${ACCESSHUB_CLIENT_NETWORKS:-}
      ACCESSHUB_STORAGE_LAYOUT: shared
    ports: ['${ACCESSHUB_PRIVATE_ADDRESS:-127.0.0.1}:8443:8443']
    read_only: true
    tmpfs: [/tmp, /run]
    cap_drop: [ALL]
    cap_add: [CHOWN, DAC_OVERRIDE, FOWNER, SETUID, SETGID, KILL]
    stop_grace_period: 30s
    networks:
      backend: {}
      console-session-proxy: {aliases: [api-console-upstream]}
      directory-network: {}
      enrollment-api: {aliases: [enrollment]}
      frontend: {}
      private-ingress: {}
      console-private-egress: {}
    volumes:
      - accesshub-data:/initialize

  database:
    <<: *service
    image: postgres:18.6-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873
    # API prepares the private native PostgreSQL initialization hook, not a sixth service.
    entrypoint: [/bin/sh, -ec]
    command: ['if test -L /docker-entrypoint-initdb.d; then test "$(readlink /docker-entrypoint-initdb.d)" = /initialize/postgres-init; else rmdir /docker-entrypoint-initdb.d && ln -s /initialize/postgres-init /docker-entrypoint-initdb.d; fi; until test -s /initialize/postgres-init/.accesshub-start; do sleep 1; done; exec sh /initialize/postgres-init/.accesshub-start']
    depends_on: {api: {condition: service_started}}
    volumes:
      - database-data:/var/lib/postgresql
      - accesshub-data:/initialize:ro
    networks: [backend]
    healthcheck: {test: [CMD-SHELL, 'pg_isready -h 127.0.0.1 -U accesshub -d accesshub'], interval: 5s, timeout: 3s, retries: 60}
    stop_grace_period: 30s

  directory:
    <<: *service
    image: ${ACCESSHUB_DIRECTORY_IMAGE:-ghcr.io/saiedawad/accesshub-directory:0.3.0-alpha.1}
    environment: {ACCESSHUB_STORAGE_LAYOUT: shared}
    ports: ['${ACCESSHUB_PRIVATE_ADDRESS:-127.0.0.1}:389:389']
    depends_on: {database: {condition: service_healthy}}
    networks: [directory-network, private-ingress]
    volumes:
      - directory-data:/var/lib/accesshub-directory
      - accesshub-data:/initialize:ro

  console-gateway:
    <<: *service
    image: ${ACCESSHUB_CONSOLE_IMAGE:-ghcr.io/saiedawad/accesshub-console:0.3.0-alpha.1}
    depends_on: {api: {condition: service_healthy}}
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]
    networks: [console-private-egress, console-session-proxy]
    volumes: [accesshub-data:/initialize:ro]
    entrypoint: [python, -m, accesshub_api.console_runtime, gateway, --config, /initialize/console-gateway/config.json]

networks:
  backend: {internal: true}
  directory-network: {internal: true}
  enrollment-api: {internal: true}
  console-session-proxy:
    internal: true
    ipam: {config: [{subnet: 10.243.0.0/24, ip_range: 10.243.0.128/25}]}
  private-ingress: {ipam: {config: [{subnet: 10.244.240.0/24}]}}
  console-private-egress: {}
  frontend: {}
volumes:
  accesshub-data: {}
  console-https-config: {}
  console-https-data: {}
  database-data: {}
  directory-data: {}