docker-compose.yml

volumes:
  # These names are used for backwards compatibility.
  mongo_storage:
    name: "baseinfrastructure_mongo_storage"
    driver: local
  influxdb_storage:
    name: "baseinfrastructure_influxdb_storage"
    driver: local
  grafana_storage:
    name: "baseinfrastructure_grafana_storage"
    driver: local
  postgres_storage:
    name: "baseinfrastructure_postgres_storage"
    driver: local

networks:
  mapeditor-net:
    driver: bridge
    name: mapeditor-net

services:
  #___  ___  ___  ______ ___________ _____ _____ ___________
  #|  \/  | / _ \ | ___ \  ___|  _  \_   _|_   _|  _  | ___ \
  #| .  . |/ /_\ \| |_/ / |__ | | | | | |   | | | | | | |_/ /
  #| |\/| ||  _  ||  __/|  __|| | | | | |   | | | | | |    /
  #| |  | || | | || |   | |___| |/ / _| |_  | | \ \_/ / |\ \
  #\_|  |_/\_| |_/\_|   \____/|___/  \___/  \_/  \___/\_| \_|

  mapeditor:
    container_name: esdl-toolsuite_mapeditor
    image: esdlmapeditoressim/esdl-mapeditor:25.10.0
    restart: unless-stopped
    networks:
      - mapeditor-net
    ports:
      - "${MAPEDITOR_PORT:-8111}:8111"
    environment:
      - POSTGRES_PASSWORD=${POSTGRES_DATA_MANAGER_PASSWORD:-password}
    env_file:
      - ESDLMapEditor/mapeditor_open_source.env
    volumes:
      - "./ESDLMapEditor/esdl_mapeditor/client_secrets_opensource.json:/usr/src/app/credentials/client_secrets_opensource.json"
    depends_on:
      influxdb:
        condition: service_healthy
      mongo:
        condition: service_healthy
      postgres:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      panel-service:
        condition: service_healthy

  # _____ ___________ _       _____ ___________ _   _ _____ _____  _____ _____
  #|  ___/  ___|  _  \ |     /  ___|  ___| ___ \ | | |_   _/  __ \|  ___/  ___|
  #| |__ \ `--.| | | | |     \ `--.| |__ | |_/ / | | | | | | /  \/| |__ \ `--.
  #|  __| `--. \ | | | |      `--. \  __||    /| | | | | | | |    |  __| `--. \
  #| |___/\__/ / |/ /| |____ /\__/ / |___| |\ \\ \_/ /_| |_| \__/\| |___/\__/ /
  #\____/\____/|___/ \_____/ \____/\____/\_| \_|\___/ \___/ \____/\____/\____/

  boundary-service:
    container_name: esdl-toolsuite_boundary-service
    image: esdlmapeditoressim/boundary-service:latest
    restart: unless-stopped
    networks:
      - mapeditor-net
    ports:
      - "${BOUNDARYSERVICE_PORT:-4002}:4002"
    depends_on:
      postgres:
        condition: service_healthy
    env_file:
      - ESDLMapEditor/boundary_service.env

  # Init script for the panel-service. This script will setup the Grafana API key.
  panel-service-init:
    container_name: esdl-toolsuite_panel-service-init
    image: esdlmapeditoressim/panel-service:latest
    volumes:
      - ./ESDLMapEditor:/app
    environment:
      - ENV_FILE_PATH=/app/panel_service.env
      - INTERNAL_GRAFANA_HOST=grafana
      - INTERNAL_GRAFANA_PORT=3000
      - GRAFANA_USER=admin
      - GRAFANA_PASSWORD=admin
    command: bash -c '[ -f setup_grafana.py ] && python setup_grafana.py || { echo "setup_grafana.py not found, skipping initialization"; exit 0; }'
    depends_on:
      grafana:
        condition: service_healthy
    networks:
      - mapeditor-net

  panel-service:
    container_name: esdl-toolsuite_panel-service
    image: esdlmapeditoressim/panel-service:latest
    restart: unless-stopped
    ports:
      - "${PANELSERVICE_PORT:-3400}:5000"
    environment:
      - INTERNAL_GRAFANA_HOST=grafana
      - INTERNAL_GRAFANA_PORT=3000
      - EXTERNAL_GRAFANA_URL=http://localhost:${GRAFANA_PORT:-3000}
    env_file:
      - ESDLMapEditor/panel_service.env
    depends_on:
      panel-service-init:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/status"]
      interval: 5s
      timeout: 2s
      retries: 10
    networks:
      - mapeditor-net

  # _____ ___________ _      ____________ _____ _   _ _____
  #|  ___/  ___|  _  \ |     |  _  \ ___ \_   _| | | |  ___|
  #| |__ \ `--.| | | | |     | | | | |_/ / | | | | | | |__
  #|  __| `--. \ | | | |     | | | |    /  | | | | | |  __|
  #| |___/\__/ / |/ /| |____ | |/ /| |\ \ _| |_\ \_/ / |___
  #\____/\____/|___/ \_____/ |___/ \_| \_|\___/ \___/\____/

  cdo-server:
    container_name: esdl-toolsuite_cdo-server
    image: esdlmapeditoressim/cdo-server:25.08
    restart: unless-stopped
    ports:
      - "2036:2036"
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      - POSTGRESQL_HOST=postgres
      - POSTGRESQL_PORT=5432
      - POSTGRESQL_USER=drive
      - POSTGRESQL_PASSWORD=password
      - POSTGRESQL_DATABASE=esdlrepo
      # Set AUTO_UPDATE=1 to auto-migrate the database. This could be a destructive operation.
      - AUTO_UPDATE=0
    networks:
      - mapeditor-net

  esdl-drive:
    container_name: esdl-toolsuite_esdl-drive
    image: esdlmapeditoressim/esdl-drive:25.08
    restart: unless-stopped
    ports:
      - 9080:9080
      - 9443:9443
    depends_on:
      - cdo-server
    environment:
      - CDO_SERVER_HOST=cdo-server:2036
      - POSTGRES_HOST=postgres
      - POSTGRES_PORT=5432
      - POSTGRES_USER=drive
      - POSTGRES_PASSWORD=${POSTGRES_DRIVE_PASSWORD:-password}
      - KEYCLOAK_REALM=http://keycloak:8080/auth/realms/esdl-mapeditor
      - KEYCLOAK_REALM_EXTERNAL=http://localhost:8080/auth/realms/esdl-mapeditor
    networks:
      - mapeditor-net

  # _____ _____ _____ ________  ___
  #|  ___/  ___/  ___|_   _|  \/  |
  #| |__ \ `--.\ `--.  | | | .  . |
  #|  __| `--. \`--. \ | | | |\/| |
  #| |___/\__/ /\__/ /_| |_| |  | |
  #\____/\____/\____/ \___/\_|  |_/

  essim-engine:
    container_name: esdl-toolsuite_essim-engine
    image: esdlmapeditoressim/essim:latest
    restart: unless-stopped
    ports:
      - 8112:8112
    environment:
      - HTTP_SERVER_SCHEME=http
      - HTTP_SERVER_HOSTNAME=0.0.0.0
      - HTTP_SERVER_PORT=8112
      - HTTP_SERVER_PATH=essim
      - MONGODB_HOST=mongo
      - MONGODB_PORT=27017
      - GRAFANA_ADMIN_USER=admin
      - GRAFANA_ADMIN_PASSWORD=admin
      - GRAFANA_INTERNAL_URL=http://grafana:3000
      - GRAFANA_EXTERNAL_URL=http://localhost:3000
    networks:
      - mapeditor-net
    depends_on:
      - nats

  nats:
    container_name: esdl-toolsuite_nats
    image: esdlmapeditoressim/nats-server:latest
    restart: unless-stopped
    ports:
      - 4222:4222
      - 8222:8222
      - 6222:6222
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:8222/healthz"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - mapeditor-net

  #______  ___ _____ ___  ______  ___   _____ _____ _____
  #|  _  \/ _ \_   _/ _ \ | ___ \/ _ \ /  ___|  ___/  ___|
  #| | | / /_\ \| |/ /_\ \| |_/ / /_\ \\ `--.| |__ \ `--.
  #| | | |  _  || ||  _  || ___ \  _  | `--. \  __| `--. \
  #| |/ /| | | || || | | || |_/ / | | |/\__/ / |___/\__/ /
  #|___/ \_| |_/\_/\_| |_/\____/\_| |_/\____/\____/\____/

  mongo:
    container_name: esdl-toolsuite_mongo
    image: mongo:4.0.28
    restart: unless-stopped
    volumes:
      - mongo_storage:/data/db
    ports:
      - "${MONGO_PORT:-27017}:27017"
    healthcheck:
      test: ["CMD", "mongo", "--eval", "db.adminCommand('ping')"]
      interval: 10s
      timeout: 10s
      retries: 5
    networks:
      - mapeditor-net

  influxdb:
    container_name: esdl-toolsuite_influxdb
    image: influxdb:1.7
    restart: unless-stopped
    ports:
      - "${INFLUXDB_PORT:-8086}:8086"
      - "${INFLUXDB_RPC_PORT:-8088}:8088"
    environment:
      - INFLUXDB_ADMIN_USER=admin
      - INFLUXDB_ADMIN_PASSWORD=admin
      - INFLUXDB_DB=panelservice
      - INFLUXDB_WRITE_USER=panelservice
      - INFLUXDB_WRITE_USER_PASSWORD=panelservice
    volumes:
      - influxdb_storage:/var/lib/influxdb
    healthcheck:
      test: ["CMD", "curl", "-f", "http://influxdb:8086/ping"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 60s
    networks:
      - mapeditor-net

  postgres:
    container_name: esdl-toolsuite_postgres
    image: postgis/postgis:17-master
    restart: unless-stopped
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    volumes:
      - postgres_storage:/var/lib/postgresql/data
      - ./BaseInfrastructure/postgres/init-database.sh:/docker-entrypoint-initdb.d/init-database.sh
      - ./Data/Boundaries:/data/boundaries
    environment:
      - POSTGRES_DB=${POSTGRES_DB:-postgres}
      - POSTGRES_USER=${POSTGRES_DB_USER:-postgres}
      - POSTGRES_PASSWORD=${POSTGRES_DB_PASSWD:-password}
      - POSTGRES_KEYCLOAK_PASSWORD=${POSTGRES_KEYCLOAK_PASSWORD:-password}
      - POSTGRES_BOUNDARY_SERVICE_PASSWORD=${POSTGRES_BOUNDARY_SERVICE_PASSWORD:-password}
      - POSTGRES_DRIVE_PASSWORD=${POSTGRES_DRIVE_PASSWORD:-password}
      - POSTGRES_DATA_MANAGER_PASSWORD=${POSTGRES_DATA_MANAGER_PASSWORD:-password}
      - POSTGRES_ESSIM_PASSWORD=${POSTGRES_ESSIM_PASSWORD:-pgpassword}
      - DB_INIT_MODE=create_or_update
      - ENABLE_KEYCLOAK_DB=true
      - IMPORT_BOUNDARY_DATA=true
      - IMPORT_BOUNDARY_SHAPEFILES=true
    healthcheck:
      # Check postgres is ready AND either init script completed (.db_init_done) OR database was migrated (keycloak db exists)
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER} && (test -f /var/lib/postgresql/data/.db_init_done || psql -U $${POSTGRES_USER} -d $${POSTGRES_DB} -tAc \"SELECT 1 FROM pg_database WHERE datname='keycloak'\" | grep -q 1)"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 60s
    networks:
      - mapeditor-net

  # _   __ _______   _______  _     _____  ___   _   __
  #| | / /|  ___\ \ / /  __ \| |   |  _  |/ _ \ | | / /
  #| |/ / | |__  \ V /| /  \/| |   | | | / /_\ \| |/ /
  #|    \ |  __|  \ / | |    | |   | | | |  _  ||    \
  #| |\  \| |___  | | | \__/\| |___\ \_/ / | | || |\  \
  #\_| \_/\____/  \_/  \____/\_____/\___/\_| |_/\_| \_/

  keycloak:
    container_name: esdl-toolsuite_keycloak
    # Keycloak can do a data migration from the version we've commonly used (11) to 21.1. Afterwards that is no longer
    # properly supported. So we're moving first to 21.1 and later onwards.
    image: quay.io/keycloak/keycloak:21.1
    restart: unless-stopped
    environment:
      - KC_DB=postgres
      - KC_DB_URL_DATABASE=keycloak
      - KC_DB_URL_HOST=postgres
      - KC_DB_URL_PORT=${POSTGRES_PORT:-5432}
      - KC_DB_SCHEMA=public
      - KC_DB_USERNAME=keycloak
      - KC_DB_PASSWORD=${POSTGRES_KEYCLOAK_PASSWORD:-password}
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN_PASSWORD:-admin}
      - PROXY_ADDRESS_FORWARDING=true
      - KC_OVERRIDE=false
    command:
      - -Dkeycloak.migration.strategy=IGNORE_EXISTING
      - start-dev  # start (production with TLS) or start-dev for development (less strict security)
      - --health-enabled=true  # enable /health, /health/ready and /health/live endpoints
      - --http-relative-path=/auth  # for compatiblity with keycloak <17
      #- --hostname-path=/auth
      - --hostname-strict=false   # for local dev testing between container names and localhost
      - --hostname=localhost  # required for production servers
#      - --hostname-debug=true  # Enable this option on keycloak 25.
      #- --hostname-url=http://localhost:8080/
      #- --features="scripts" # for importing realms with js inside them
      #- --proxy=edge  # for external TLS termination by e.g. nginx
      - --import-realm  # import realm
    ports:
      - "${KEYCLOAK_PORT:-8080}:8080"
      - "${KEYCLOAK_HTTPS_PORT:-8443}:8443"
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "/bin/sh -c '(echo > /dev/tcp/localhost/8080) >/dev/null 2>&1 || exit 1'"]
      interval: 15s
      timeout: 2s
      retries: 15
    networks:
      - mapeditor-net
    volumes:
      - "./BaseInfrastructure/keycloak/:/opt/keycloak/data/import"

  # The below is the config for the old Keycloak version, deprecated but available if you cannot upgrade yet.
  #  keycloak:
  #    container_name: esdl-toolsuite_keycloak-legacy
  #    image: quay.io/keycloak/keycloak:11.0.3
  #    restart: always
  #    profiles: [keycloak-legacy]
  #    environment:
  #      - DB_VENDOR=POSTGRES
  #      - DB_ADDR=postgres
  #      - DB_DATABASE=keycloak
  #      - DB_USER=keycloak
  #      - DB_SCHEMA=public
  #      - DB_PASSWORD=password
  #      - KEYCLOAK_USER=admin
  #      - KEYCLOAK_PASSWORD=password
  #      - PROXY_ADDRESS_FORWARDING=true
  #    ports:
  #      - "${KEYCLOAK_PORT:-8080}:8080"
  #      - "${KEYCLOAK_HTTPS_PORT:-8443}:8443"
  #    depends_on:
  #      postgres:
  #        condition: service_healthy
  #    networks:
  #      - mapeditor-net
  #    volumes:
  #      - "./BaseInfrastructure/keycloak/:/tmp/config/"

  # _____ _____ _   _  ___________
  #|  _  |_   _| | | ||  ___| ___ \
  #| | | | | | | |_| || |__ | |_/ /
  #| | | | | | |  _  ||  __||    /
  #\ \_/ / | | | | | || |___| |\ \
  # \___/  \_/ \_| |_/\____/\_| \_|

  grafana:
    container_name: esdl-toolsuite_grafana
    # From version 11 onwards, dashboards created through ESSIM will complain about Angular support.
    image: grafana/grafana:10.4.17
    restart: unless-stopped
    volumes:
      - grafana_storage:/var/lib/grafana
    depends_on:
      influxdb:
        condition: service_healthy
    ports:
      - "${GRAFANA_PORT:-3000}:3000"
    environment:
      - GF_AUTH_ANONYMOUS_ENABLED=false
      - GF_SERVER_ROOT_URL=http://localhost:${GRAFANA_PORT:-3000}
      - GF_SECURITY_ALLOW_EMBEDDING=True
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_ADMIN_PASSWORD=admin
      - GF_PANELS_DISABLE_SANITIZE_HTML=true
      - GF_ANGULAR_SUPPORT_ENABLED=true
      - GF_AUTH_DISABLE_LOGIN_FORM=True
      - GF_AUTH_BASIC_ENABLED=True
      - GF_AUTH_OAUTH_AUTO_LOGIN=True
      - GF_AUTH_GENERIC_OAUTH_ENABLED=True
      - GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=True
      - GF_AUTH_GENERIC_OAUTH_NAME=Auth0
      - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(grafana_role, 'Admin') && 'Admin' || contains(grafana_role, 'Editor') && 'Editor' || 'Viewer'
      - GF_AUTH_GENERIC_OAUTH_CLIENT_ID=essim-dashboard
      - GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
      - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=174522fe-db1c-4384-a3c5-eaa6dc03329b
      - GF_AUTH_SIGNOUT_REDIRECT_URL=http://localhost:8080/auth/realms/esdl-mapeditor/protocol/openid-connect/logout
      - GF_AUTH_GENERIC_OAUTH_AUTH_URL=http://localhost:8080/auth/realms/esdl-mapeditor/protocol/openid-connect/auth
      - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=http://keycloak:8080/auth/realms/esdl-mapeditor/protocol/openid-connect/token
      - GF_AUTH_GENERIC_OAUTH_API_URL=http://keycloak:8080/auth/realms/esdl-mapeditor/protocol/openid-connect/userinfo
    healthcheck:
      test: [ "CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:3000/api/health || exit 1" ]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - mapeditor-net

  rabbitmq:
    container_name: esdl-toolsuite_rabbitmq
    image: rabbitmq:3-management
    restart: unless-stopped
    ports:
      - 5672:5672
      - 15672:15672
    networks:
      - mapeditor-net
    environment:
      - RABBITMQ_DEFAULT_USER=admin
      - RABBITMQ_DEFAULT_PASS=admin
    healthcheck:
      test: rabbitmq-diagnostics -q ping
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 10s