docker-compose.yml

volumes:
  postgres_data: {}
  mongo_data: {}
  minio_data: {}
  dserver_venv: {}

networks:
  dserver_net:

services:
  # ==========================================================================
  # PostgreSQL - SQL database for dserver admin metadata
  # ==========================================================================
  postgres:
    image: postgres:16-alpine
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: dserver
      POSTGRES_PASSWORD: dserver_secret
      POSTGRES_DB: dserver
    ports:
      - "5432:5432"
    networks:
      - dserver_net
    healthcheck:
      test: pg_isready -U dserver
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s

  # ==========================================================================
  # MongoDB - Search and retrieval backend for dataset metadata
  # ==========================================================================
  mongo:
    image: mongo:7
    volumes:
      - mongo_data:/data/db
    environment:
      MONGO_INITDB_ROOT_USERNAME: dserver
      MONGO_INITDB_ROOT_PASSWORD: dserver_secret
    ports:
      - "27017:27017"
    networks:
      - dserver_net
    healthcheck:
      test: echo 'db.runCommand("ping").ok' | mongosh localhost:27017/test --quiet
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s

  # ==========================================================================
  # MinIO - S3-compatible object storage
  # ==========================================================================
  minio:
    image: minio/minio
    ports:
      - "9000:9000"
      - "9001:9001"
    networks:
      dserver_net:
        aliases:
          # Add to /etc/hosts: 127.0.0.1 dserver-minio-alias
          # for local access to datasets via the same URL
          - dserver-minio-alias
    volumes:
      - minio_data:/data
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
      # Allow CORS requests from the webapp
      MINIO_API_CORS_ALLOW_ORIGIN: "*"
    command: server /data --console-address ":9001"
    healthcheck:
      test: timeout 5s bash -c ':> /dev/tcp/127.0.0.1/9000' || exit 1
      interval: 5s
      retries: 3
      start_period: 5s
      timeout: 5s

  # ==========================================================================
  # MinIO bucket initialization
  # ==========================================================================
  minio-init:
    image: minio/mc
    depends_on:
      minio:
        condition: service_healthy
    networks:
      - dserver_net
    entrypoint: >
      /bin/sh -c "
      /usr/bin/mc alias set minio http://minio:9000 minioadmin minioadmin;
      /usr/bin/mc mb --ignore-existing minio/dtool-bucket;
      /usr/bin/mc anonymous set public minio/dtool-bucket;
      exit 0;
      "

  # ==========================================================================
  # dserver - Virtual environment builder
  # ==========================================================================
  dserver-build-venv:
    build:
      context: .
      dockerfile: ./compose/dserver/Dockerfile
    image: dserver_image
    volumes:
      - .:/app
      - dserver_venv:/venv
    entrypoint: /bin/bash
    command: /scripts/make-venv.sh
    networks:
      - dserver_net

  # ==========================================================================
  # dserver - Flask REST API for dataset metadata
  # ==========================================================================
  dserver:
    image: dserver_image
    depends_on:
      dserver-build-venv:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      mongo:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully
    volumes:
      - .:/app
      - dserver_venv:/venv
    environment:
      # Flask configuration
      FLASK_APP: dservercore
      FLASK_DEBUG: "1"

      # SQL database for admin metadata
      SQLALCHEMY_DATABASE_URI: postgresql://dserver:dserver_secret@postgres:5432/dserver

      # MongoDB for search plugin (dserver-search-plugin-mongo)
      SEARCH_MONGO_URI: mongodb://dserver:dserver_secret@mongo:27017/?authSource=admin
      SEARCH_MONGO_DB: dserver
      SEARCH_MONGO_COLLECTION: datasets

      # MongoDB for retrieve plugin (dserver-retrieve-plugin-mongo)
      RETRIEVE_MONGO_URI: mongodb://dserver:dserver_secret@mongo:27017/?authSource=admin
      RETRIEVE_MONGO_DB: dserver
      RETRIEVE_MONGO_COLLECTION: datasets

      # MongoDB for dependency graph plugin (uses same DB as search/retrieve)
      MONGO_URI: mongodb://dserver:dserver_secret@mongo:27017/?authSource=admin
      MONGO_DB: dserver
      MONGO_COLLECTION: datasets

      # Dependency graph plugin configuration
      DSERVER_ENABLE_DEPENDENCY_VIEW: "True"
      DSERVER_DYNAMIC_DEPENDENCY_KEYS: "True"

      # JWT configuration (keys will be generated on first run)
      JWT_PRIVATE_KEY_FILE: /app/compose/dserver/jwt/jwt_key
      JWT_PUBLIC_KEY_FILE: /app/compose/dserver/jwt/jwt_key.pub
      JWT_ALGORITHM: RS256

      # CORS - allow requests from webapp
      CORS_ALLOW_ORIGIN: "*"

      # S3 configuration for dtool
      DTOOL_S3_ENDPOINT_dtool-bucket: http://minio:9000
      AWS_ACCESS_KEY_ID: minioadmin
      AWS_SECRET_ACCESS_KEY: minioadmin

      # Also provide credentials in DTOOL format for storage broker signing
      DTOOL_S3_ACCESS_KEY_ID_dtool-bucket: minioadmin
      DTOOL_S3_SECRET_ACCESS_KEY_dtool-bucket: minioadmin

      # Signed URL plugin configuration
      SIGNED_URL_READ_EXPIRY_SECONDS: "3600"
      SIGNED_URL_WRITE_EXPIRY_SECONDS: "14400"
      # NOTE: URL rewriting breaks S3 signatures. Instead, add "127.0.0.1 minio"
      # to /etc/hosts on client machines to resolve the internal hostname.

      # dtool-dserver URI configuration
      # Enable short URI format: dserver://localhost:5000/<uuid>
      DSERVER_DEFAULT_BASE_URI: "s3://dtool-bucket"

      # Flask session secret (required for OAuth2)
      SECRET_KEY: "dev-secret-key-change-in-production"

      # =======================================================================
      # OAuth2 Token Generator Plugin Configuration
      # =======================================================================

      # OAuth2 Provider settings
      OAUTH2_PROVIDER_NAME: "orcid"
      OAUTH2_BASE_URL: "http://127.0.0.1:5000"

      # ORCID OAuth2 endpoints (use sandbox for testing)
      # Production:
      OAUTH2_AUTHORIZATION_URL: "https://orcid.org/oauth/authorize"
      OAUTH2_TOKEN_URL: "https://orcid.org/oauth/token"
      # Sandbox:
      # OAUTH2_AUTHORIZATION_URL: "https://sandbox.orcid.org/oauth/authorize"
      # OAUTH2_TOKEN_URL: "https://sandbox.orcid.org/oauth/token"

      # ORCID credentials (get from https://orcid.org/developer-tools)
      # Set these in .env file (copy from .env.template)
      OAUTH2_CLIENT_ID: "${OAUTH2_CLIENT_ID:-}"
      OAUTH2_CLIENT_SECRET: "${OAUTH2_CLIENT_SECRET:-}"
      OAUTH2_SCOPE: "/authenticate"

      # Attribute mapping for ORCID
      OAUTH2_ATTRIBUTE_MAP: "orcid:user_id,name:display_name"
      OAUTH2_USERNAME_FIELD: "user_id"

      # Frontend redirect URLs
      OAUTH2_FRONTEND_URL: "http://127.0.0.1:8080"
      OAUTH2_LOGIN_SUCCESS_REDIRECT: "http://127.0.0.1:8080"
      OAUTH2_LOGIN_ERROR_REDIRECT: "http://127.0.0.1:8080/login?error=auth_failed"
    ports:
      - "5000:5000"
    networks:
      - dserver_net
    command: /scripts/start-dserver.sh
    healthcheck:
      test: curl -sf http://localhost:5000/config/health || exit 1
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 60s

  # ==========================================================================
  # Webapp - Vue.js frontend (development server with hot-reload)
  # ==========================================================================
  webapp:
    build:
      context: .
      dockerfile: ./compose/webapp/Dockerfile
    depends_on:
      dserver:
        condition: service_healthy
    volumes:
      # Mount source for hot-reload in development
      - ./dtool-lookup-webapp/dtool-lookup-webapp/src:/app/src
      - ./dtool-lookup-webapp/dtool-lookup-webapp/public:/app/public
      # Mount dserver-client-js for development
      - ./dserver-client-js:/dserver-client-js
    environment:
      # Use 127.0.0.1 instead of localhost for OAuth2 compatibility
      # (ORCID doesn't allow localhost as redirect URI)
      VUE_APP_DTOOL_LOOKUP_SERVER_URL: http://127.0.0.1:5000
      VUE_APP_DTOOL_LOOKUP_SERVER_TOKEN_GENERATOR_URL: http://127.0.0.1:5000/auth/token

      # OAuth2 configuration for webapp
      # Set to "true" to enable OAuth2 login button
      VUE_APP_OAUTH2_ENABLED: "true"
      # Display name for the OAuth2 provider (shown on login button)
      VUE_APP_OAUTH2_PROVIDER_NAME: "ORCID"
      # Set to "true" to also show username/password form alongside OAuth2
      VUE_APP_SHOW_USERNAME_PASSWORD_FORM: "false"
    ports:
      - "8080:8080"
    networks:
      - dserver_net
    command: npm run serve -- --host 0.0.0.0

  # ==========================================================================
  # Dataset indexer - Indexes datasets from S3 into dserver (using flask CLI)
  # ==========================================================================
  index-s3:
    image: dserver_image
    depends_on:
      dserver:
        condition: service_healthy
    volumes:
      - .:/app
      - dserver_venv:/venv
    environment:
      # Flask configuration
      FLASK_APP: dservercore

      # SQL database for admin metadata
      SQLALCHEMY_DATABASE_URI: postgresql://dserver:dserver_secret@postgres:5432/dserver

      # MongoDB for search plugin
      SEARCH_MONGO_URI: mongodb://dserver:dserver_secret@mongo:27017/?authSource=admin
      SEARCH_MONGO_DB: dserver
      SEARCH_MONGO_COLLECTION: datasets

      # MongoDB for retrieve plugin
      RETRIEVE_MONGO_URI: mongodb://dserver:dserver_secret@mongo:27017/?authSource=admin
      RETRIEVE_MONGO_DB: dserver
      RETRIEVE_MONGO_COLLECTION: datasets

      # MongoDB for dependency graph plugin
      MONGO_URI: mongodb://dserver:dserver_secret@mongo:27017/?authSource=admin
      MONGO_DB: dserver
      MONGO_COLLECTION: datasets

      # S3 configuration for dtool
      DTOOL_S3_ENDPOINT_dtool-bucket: http://minio:9000
      AWS_ACCESS_KEY_ID: minioadmin
      AWS_SECRET_ACCESS_KEY: minioadmin
      DTOOL_S3_ACCESS_KEY_ID_dtool-bucket: minioadmin
      DTOOL_S3_SECRET_ACCESS_KEY_dtool-bucket: minioadmin
    networks:
      - dserver_net
    entrypoint: /bin/bash
    command: >
      -c "
      source /venv/bin/activate &&
      echo '==> Indexing all datasets in s3://dtool-bucket...' &&
      flask base_uri index s3://dtool-bucket &&
      echo '==> Indexing complete!'
      "
    profiles:
      - index  # Run with: docker compose --profile index up index-s3