compose.yml

# Infrastructure services – started by `bun run dev` (stopped with `bun run dev:down --infra`)

# Persistent single-node JetStream for local development. Cluster failure tests
# belong to the dedicated Sync test cluster, not the everyday app stack.
x-nats: &nats
  image: nats:2.14.3-alpine
  restart: unless-stopped
  configs:
    - source: nats_config
      target: /etc/nats/nats.conf
    - source: nats_system_config
      target: /etc/nats/system.conf
  healthcheck:
    test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8222/healthz?js-enabled-only=true"]
    interval: 2s
    timeout: 2s
    retries: 30

services:
  clickhouse:
    image: clickhouse/clickhouse-server:26.9.19.9
    restart: unless-stopped
    env_file: ./.local/clickhouse/credentials.env
    volumes:
      - pulse_clickhouse_data:/var/lib/clickhouse
    ports:
      - "127.0.0.1:${CLOUD_DEV_CLICKHOUSE_PORT:-8123}:8123"
    ulimits:
      nofile: { soft: 262144, hard: 262144 }
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8123/ping"]
      interval: 5s
      timeout: 5s
      retries: 10

  rsql:
    image: ghcr.io/k2b-dev/rsql:1.0.0
    restart: unless-stopped
    env_file: ./.local/rsql/credentials.env
    volumes:
      # Retain the existing volume name: Assistant databases also live here.
      - kit_rsql_data:/data
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8080/healthz"]
      interval: 2s
      timeout: 2s
      retries: 30

  postgres:
    image: postgres:15-alpine
    container_name: ipa_postgres
    restart: unless-stopped
    # Each running application holds a small pool and parallel agents run integration
    # suites against this server; 300 was exhausted with four agents working at once.
    command: postgres -c max_connections=600
    # Parallel queries use /dev/shm for dynamic shared memory. Docker's 64 MB
    # default filled up with several agents' integration suites on this server.
    shm_size: 1gb
    environment:
      POSTGRES_DB: ipa
      POSTGRES_USER: ipa
      POSTGRES_PASSWORD: ipa
    ports:
      - "127.0.0.1:${CLOUD_DEV_POSTGRES_PORT:-5432}:5432"
    volumes:
      - ipa_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ipa -d ipa"]
      interval: 2s
      timeout: 2s
      retries: 30

  valkey:
    image: docker.io/valkey/valkey:8-alpine
    container_name: ipa_valkey
    restart: unless-stopped
    command: valkey-server --save 30 1 --loglevel warning
    ports:
      - "127.0.0.1:${CLOUD_DEV_VALKEY_PORT:-6379}:6379"
    volumes:
      - ipa_valkey_data:/data
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 2s
      timeout: 2s
      retries: 30

  # Integration tests get their own Valkey. Cache keys such as `settings:<key>`
  # are not namespaced, so a shared instance would hand the running stack's
  # cached values to tests and test values to the stack. Tests leave nothing
  # worth keeping, so this instance keeps no data across restarts.
  valkey-test:
    image: docker.io/valkey/valkey:8-alpine
    container_name: ipa_valkey_test
    restart: unless-stopped
    command: valkey-server --save "" --appendonly no --loglevel warning
    ports:
      - "127.0.0.1:${CLOUD_DEV_TEST_VALKEY_PORT:-6380}:6379"
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 2s
      timeout: 2s
      retries: 30

  nats-1:
    <<: *nats
    container_name: ipa_nats_1
    # Application data lived in the global account until the TEST account made
    # DEV necessary. Once the prepared configuration defines DEV, move an
    # existing store into it before NATS starts.
    entrypoint:
      - /bin/sh
      - -c
      - |
        if grep -q '^  DEV ' /etc/nats/system.conf && [ -d '/data/jetstream/$$G' ] && [ ! -e /data/jetstream/DEV ]; then
          mv '/data/jetstream/$$G' /data/jetstream/DEV
        fi
        exec nats-server "$$@"
      - nats-server
    command: --config /etc/nats/nats.conf --name ipa_nats_1
    ports:
      - "127.0.0.1:${CLOUD_DEV_NATS_PORT:-4222}:4222"
      - "127.0.0.1:8222:8222"
    volumes:
      - ipa_nats_data:/data

  filegate:
    image: ghcr.io/k2b-dev/filegate:7.1.0
    platform: linux/amd64
    container_name: filegate
    restart: unless-stopped
    # Local POSIX tests need arbitrary UID/GID and access to their test files.
    user: "0:0"
    cap_drop: [ALL]
    cap_add: [CHOWN, DAC_OVERRIDE, FOWNER, FSETID, SETUID, SETGID]
    security_opt: [no-new-privileges:true]
    # Filegate reads its configuration only on start, and Compose does not hash config file contents.
    # This digest of the generated configuration makes `up` recreate Filegate after it changes.
    env_file: ./.local/filegate/conf.env
    configs:
      - source: filegate_config
        target: /etc/filegate/conf.yaml
    secrets:
      - source: filegate_token
        target: /etc/filegate/token
    ports:
      - "127.0.0.1:4000:4000"
    volumes:
      - filegate_cloud:/data/cloud
      - filegate_freeipa:/data/freeipa
      - filegate_state:/var/lib/filegate
    healthcheck:
      test: ["CMD", "/app/filegate", "status"]
      interval: 5s
      timeout: 3s
      retries: 12

  gotenberg:
    image: docker.io/gotenberg/gotenberg:8.36.0
    container_name: gotenberg
    restart: unless-stopped
    ports:
      - "127.0.0.1:3001:3000"

  # Collabora Online (CODE) for Filesv2 document editing. The browser loads the
  # editor from localhost:9980; Collabora itself reaches Cloud through the
  # gateway service name, which Filesv2 sends as the WOPI origin.
  collabora:
    image: collabora/code:26.04.4.1.1
    container_name: collabora
    restart: unless-stopped
    cap_add: [MKNOD]
    environment:
      aliasgroup1: http://gateway:3000
      dictionaries: de_DE en_US
      DONT_GEN_SSL_CERT: "1"
      extra_params: --o:ssl.enable=false --o:ssl.termination=false --o:net.frame_ancestors=localhost:3000 --o:admin_console.enable=false --o:ai.enabled=false --o:mount_jail_tree=false
    ports:
      - "127.0.0.1:9980:9980"

configs:
  # Prepared by `bun run dev` from `scripts/dev-filegate.ts`; allows the configured APP_URL as a browser origin.
  filegate_config:
    file: ./.local/filegate/conf.yaml
  # Prepared by `bun run dev`; defines the DEV, TEST, and $SYS accounts with public keys only.
  nats_system_config:
    file: ./.local/nats/system.conf
  nats_config:
    content: |
      include system.conf
      # max_payload must cover the largest @k2b/sync publish (notebooks Yjs
      # full-state resync is ~8 MB); sync's ready() refuses smaller servers.
      max_payload: 16MB
      http: 0.0.0.0:8222
      jetstream {
        store_dir: /data
      }

secrets:
  filegate_token:
    file: ./.local/filegate/token

volumes:
  pulse_clickhouse_data:
  kit_rsql_data:
  ipa_postgres_data:
  ipa_valkey_data:
  ipa_nats_data:
  filegate_cloud:
  filegate_freeipa:
  filegate_state: