docker-compose.yml

services:
  # Blockchain Services - Authentication and wallet operations
  blockchain-services:
    build:
      context: ./blockchain-services
      dockerfile: Dockerfile
    user: "${HOST_UID:-1000}:${HOST_GID:-1000}"
    env_file:
      - .env  # Main gateway configuration
      - ./blockchain-services/.env  # Blockchain-specific configuration (optional overrides)
    environment:
      # Server name for URL resolution (WebAuthn rpId, issuer URLs, etc.)
      - SERVER_NAME=${SERVER_NAME}
      - HTTPS_PORT=${HTTPS_PORT:-443}
      # MySQL datasource for persistence (lab_reservations, auth_users)
      - SPRING_DATASOURCE_URL=jdbc:mysql://mysql:3306/${BLOCKCHAIN_MYSQL_DATABASE:-blockchain_services}?serverTimezone=UTC&characterEncoding=UTF-8&useSSL=false&allowPublicKeyRetrieval=true
      - SPRING_DATASOURCE_USERNAME=${MYSQL_USER}
      - SPRING_DATASOURCE_PASSWORD=${MYSQL_PASSWORD}
      - PROVIDER_CONFIG_PATH=/app/data/provider.properties
      - ADMIN_ACCESS_TOKEN=${ADMIN_ACCESS_TOKEN}
      - ADMIN_ACCESS_TOKEN_HEADER=${ADMIN_ACCESS_TOKEN_HEADER:-X-Access-Token}
      - ADMIN_ACCESS_TOKEN_COOKIE=${ADMIN_ACCESS_TOKEN_COOKIE:-access_token}
      - ADMIN_ACCESS_TOKEN_REQUIRED=${ADMIN_ACCESS_TOKEN_REQUIRED:-true}
      - ADMIN_DASHBOARD_LOCAL_ONLY=${ADMIN_DASHBOARD_LOCAL_ONLY:-true}
      - ADMIN_DASHBOARD_ALLOW_PRIVATE=${ADMIN_DASHBOARD_ALLOW_PRIVATE:-true}
      - SECURITY_ALLOW_PRIVATE_NETWORKS=${SECURITY_ALLOW_PRIVATE_NETWORKS:-true}
      - ADMIN_ALLOWED_CIDRS=${ADMIN_ALLOWED_CIDRS:-}
    volumes:
      - ./certs:/app/config/keys
      - ./blockchain-data:/app/data
    depends_on:
      mysql:
        condition: service_healthy
    healthcheck:
      # Accepts 200 (UP) or 503 (DEGRADED when wallet not yet configured)
      test: ["CMD", "sh", "-c", "code=$$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8080/health) && ([ $$code -eq 200 ] || [ $$code -eq 503 ])"]
      timeout: 10s
      retries: 5
      interval: 30s
      start_period: 120s
    deploy:
      resources:
        limits:
          memory: 768M
          cpus: '1.0'
        reservations:
          memory: 384M
          cpus: '0.5'
    logging:
      driver: "json-file"
      options:
        max-size: "20m"
        max-file: "5"
        labels: "service=blockchain-services"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: always
    networks:
      - guacnet

  openresty:
    build:
      context: ./openresty
      dockerfile: Dockerfile
    ports:
      - "${OPENRESTY_BIND_ADDRESS:-127.0.0.1}:${OPENRESTY_BIND_HTTPS_PORT:-443}:443"
      - "${OPENRESTY_BIND_ADDRESS:-127.0.0.1}:${OPENRESTY_BIND_HTTP_PORT:-80}:80"
    volumes:
      - ./certs:/etc/ssl/private
      - ./certbot/www:/var/www/certbot
      - ./openresty/nginx.conf:/usr/local/openresty/nginx/conf/nginx.conf:ro
      - ./openresty/lab_access.conf:/etc/openresty/lab_access.conf:ro
      - ./openresty/lua:/etc/openresty/lua:ro
      - ./web:/var/www/html:ro
      # Full mode: expose blockchain-services JWT public key to OpenResty so
      # /.well-known/public-key.pem and init.lua always use the correct key.
      # In Lite mode this directory is empty/absent; init.lua falls back to
      # the key downloaded by init-ssl.sh into /etc/ssl/private/.
      - ./blockchain-data/keys:/etc/openresty/jwt-keys:ro
    tmpfs:
      - /tmp:size=64M,mode=1777
      - /var/run:size=16M,mode=755
    environment:
      - GUAC_ADMIN_USER=${GUAC_ADMIN_USER}
      - GUAC_ADMIN_PASS=${GUAC_ADMIN_PASS}
      - SERVER_NAME=${SERVER_NAME}
      - HTTPS_PORT=${HTTPS_PORT}
      - HTTP_PORT=${HTTP_PORT}
      - ISSUER=${ISSUER}
      - MYSQL_DATABASE=${MYSQL_DATABASE}
      - MYSQL_USER=${MYSQL_USER}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS}
      - MARKETPLACE_URL=${MARKETPLACE_URL:-https://marketplace-decentralabs.vercel.app}
      - ADMIN_ACCESS_TOKEN=${ADMIN_ACCESS_TOKEN}
      - ADMIN_ACCESS_TOKEN_HEADER=${ADMIN_ACCESS_TOKEN_HEADER:-X-Access-Token}
      - ADMIN_ACCESS_TOKEN_COOKIE=${ADMIN_ACCESS_TOKEN_COOKIE:-access_token}
      - LAB_MANAGER_TOKEN=${LAB_MANAGER_TOKEN}
      - LAB_MANAGER_TOKEN_HEADER=${LAB_MANAGER_TOKEN_HEADER}
      - LAB_MANAGER_TOKEN_COOKIE=${LAB_MANAGER_TOKEN_COOKIE}
      - FMU_RUNNER_ENABLED=${FMU_RUNNER_ENABLED:-}
      - AAS_ENABLED=${AAS_ENABLED:-}
      - BASYX_AAS_URL=${BASYX_AAS_URL:-}
    depends_on:
      guacamole:
        condition: service_healthy
      blockchain-services:
        condition: service_healthy  # Wait for keys to be generated
      ops-worker:
        condition: service_started
    healthcheck:
      test: ["CMD", "sh", "-c", "curl -f -k https://localhost:443/ -H 'Host: ${SERVER_NAME}' --connect-timeout 5"]
      timeout: 10s
      retries: 3
      interval: 30s
      start_period: 30s
    deploy:
      resources:
        limits:
          memory: 128M
          cpus: '0.3'
        reservations:
          memory: 64M
          cpus: '0.2'
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "5"
        labels: "service=openresty"
    # OpenResty needs to chown temporary files during startup, so do not drop all capabilities.
    #security_opt:
    #  - no-new-privileges:true
    #cap_drop:
    #  - ALL
    cap_add:
      - NET_BIND_SERVICE
    restart: always
    networks:
      - guacnet

  cloudflared:
    image: cloudflare/cloudflared:2024.11.0
    profiles: ["cloudflare"]
    depends_on:
      openresty:
        condition: service_healthy
    command:
      - sh
      - -c
      - |
        set -e
        target="${CLOUDFLARE_TUNNEL_SERVICE:-https://openresty:443}"

        # If we have real certs and a non-localhost hostname, trust TLS; otherwise allow self-signed.
        have_real_cert=false
        if [ -s /certs/fullchain.pem ] && [ -s /certs/privkey.pem ] && [ "${SERVER_NAME:-localhost}" != "localhost" ]; then
          have_real_cert=true
        fi

        args="tunnel --no-autoupdate --protocol http2 --url $${target}"
        if [ "$$have_real_cert" != "true" ]; then
          args="$$args --no-tls-verify"
        fi

        exec cloudflared $$args
    environment:
      - CLOUDFLARE_TUNNEL_SERVICE=${CLOUDFLARE_TUNNEL_SERVICE:-https://openresty:443}
      - SERVER_NAME=${SERVER_NAME}
    volumes:
      - ./certs:/certs:ro
    deploy:
      resources:
        limits:
          memory: 128M
          cpus: '0.25'
        reservations:
          memory: 64M
          cpus: '0.1'
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: unless-stopped
    networks:
      - guacnet

  cloudflared-token:
    image: cloudflare/cloudflared:2024.11.0
    profiles: ["cloudflare-token"]
    depends_on:
      openresty:
        condition: service_healthy
    command:
      - tunnel
      - --no-autoupdate
      - run
      - --token
      - ${CLOUDFLARE_TUNNEL_TOKEN}
    environment:
      - CLOUDFLARE_TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN:-}
    deploy:
      resources:
        limits:
          memory: 128M
          cpus: '0.25'
        reservations:
          memory: 64M
          cpus: '0.1'
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: unless-stopped
    networks:
      - guacnet

  certbot:
    image: certbot/certbot
    profiles: ["certbot"]
    entrypoint: ["sh", "-c", "certbot --version"]
    volumes:
      - ./certs:/etc/letsencrypt
      - ./certbot/www:/var/www/certbot
    # Usage example:
    # docker compose run --rm --profile certbot certbot certonly --webroot -w /var/www/certbot -d your.domain --email you@example.com --agree-tos --no-eff-email

  certbot-renew:
    image: certbot/certbot
    profiles: ["certbot"]
    restart: unless-stopped
    entrypoint: ["sh", "-c", "while true; do certbot renew --webroot -w /var/www/certbot --quiet || true; sleep 12h; done"]
    volumes:
      - ./certs:/etc/letsencrypt
      - ./certbot/www:/var/www/certbot

  certbot-init:
    image: certbot/certbot
    profiles: ["certbot"]
    restart: "no"
    entrypoint: >
      sh -c '
      if [ -z "$$CERTBOT_DOMAINS" ] || [ -z "$$CERTBOT_EMAIL" ]; then
        echo "CERTBOT_DOMAINS or CERTBOT_EMAIL not set; skipping initial cert issuance";
        exit 0;
      fi;
      primary_domain=$${CERTBOT_DOMAINS%%,*};
      if [ -f "/etc/letsencrypt/live/$$primary_domain/fullchain.pem" ]; then
        echo "Certificate already present for $$primary_domain; skipping issuance";
        exit 0;
      fi;
      domains="";
      for d in $${CERTBOT_DOMAINS//,/ }; do domains="$$domains -d $$d"; done;
      staging="";
      if [ "$$CERTBOT_STAGING" = "1" ]; then staging="--staging"; fi;
      certbot certonly --non-interactive --agree-tos $$staging --webroot -w /var/www/certbot $$domains -m "$$CERTBOT_EMAIL"
      '
    environment:
      - CERTBOT_DOMAINS=${CERTBOT_DOMAINS}
      - CERTBOT_EMAIL=${CERTBOT_EMAIL}
      - CERTBOT_STAGING=${CERTBOT_STAGING:-0}
    volumes:
      - ./certs:/etc/letsencrypt
      - ./certbot/www:/var/www/certbot

  mysql:
    image: mysql:8.0.41
    entrypoint: ["/bin/bash", "/usr/local/bin/ensure-user-entrypoint.sh"]
    command: ["mysqld"]
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      MYSQL_USER: ${MYSQL_USER}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
      BLOCKCHAIN_MYSQL_DATABASE: ${BLOCKCHAIN_MYSQL_DATABASE:-blockchain_services}
      GUAC_ADMIN_USER: ${GUAC_ADMIN_USER}
      GUAC_ADMIN_PASS: ${GUAC_ADMIN_PASS}
    volumes:
      - mysql_data:/var/lib/mysql
      - ./mysql/ensure-user-entrypoint.sh:/usr/local/bin/ensure-user-entrypoint.sh:ro
      - ./mysql/000-ensure-user.sh:/docker-entrypoint-initdb.d/000-ensure-user.sh:ro
      - ./mysql/001-create-schema.sql:/docker-entrypoint-initdb.d/001-create-schema.sql:ro
      - ./mysql/002-labstation-ops.sql:/docker-entrypoint-initdb.d/002-labstation-ops.sql:ro
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p$${MYSQL_ROOT_PASSWORD}"]
      timeout: 20s
      retries: 10
      interval: 30s
      start_period: 60s  # MySQL needs time to initialize
    deploy:
      resources:
        limits:
          memory: 768M
          cpus: '0.75'
        reservations:
          memory: 384M
          cpus: '0.25'
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
        labels: "service=mysql"
    security_opt:
      - no-new-privileges:true
    #ports:
    # - "3306:3306"
    restart: always
    networks:
      - guacnet

  guacamole:
    build:
      context: ./guacamole
      dockerfile: Dockerfile
    depends_on:
      mysql:
        condition: service_healthy
      guacd:
        condition: service_healthy
    environment:
      GUACD_HOSTNAME: guacd
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      MYSQL_USER: ${MYSQL_USER}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
      MYSQL_HOSTNAME: mysql
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/guacamole/"]
      timeout: 10s
      retries: 5
      interval: 30s
      start_period: 120s  # Guacamole needs time to fully start
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '1.0'
        reservations:
          memory: 512M
          cpus: '0.5'
    logging:
      driver: "json-file"
      options:
        max-size: "20m"
        max-file: "5"
        labels: "service=guacamole"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    #ports:
    # - "8080:8080"
    networks:
      - guacnet
  guacd:
    image: guacamole/guacd:1.5.5
    healthcheck:
      test: ["CMD", "nc", "-z", "localhost", "4822"]
      timeout: 10s
      retries: 3
      interval: 30s
      start_period: 30s
    tmpfs:
      - /tmp:size=128M,mode=1777
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.5'
        reservations:
          memory: 128M
          cpus: '0.2'
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "3"
        labels: "service=guacd"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: always
    #ports:
    # - "4822:4822"
    networks:
      - guacnet

  ops-worker:
    build:
      context: ./ops-worker
      dockerfile: Dockerfile
    environment:
      - OPS_BIND=0.0.0.0
      - OPS_PORT=8081
      - OPS_CONFIG=/app/hosts.json
      - OPS_POLL_ENABLED=true
      - OPS_POLL_INTERVAL=60
      - OPS_RESERVATION_AUTOMATION=true
      - OPS_RESERVATION_SCAN_INTERVAL=30
      - OPS_RESERVATION_START_LEAD=120
      - OPS_RESERVATION_END_DELAY=60
      - MYSQL_DSN=mysql+pymysql://${MYSQL_USER}:${MYSQL_PASSWORD}@mysql:3306/${BLOCKCHAIN_MYSQL_DATABASE:-blockchain_services}
      - BASYX_AAS_URL=${BASYX_AAS_URL:-http://basyx-aas-server:8081}
    volumes:
      - ${OPS_CONFIG_PATH:-./ops-worker/hosts.empty.json}:/app/hosts.json:ro
    tmpfs:
      - /tmp:size=32M,mode=1777
    read_only: true
    depends_on:
      mysql:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8081/health').read()"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.4'
        reservations:
          memory: 128M
          cpus: '0.2'
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
        labels: "service=ops-worker"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: always
    networks:
      - guacnet

  # FMU Runner - FMI Co-Simulation execution service
  fmu-runner:
    profiles: ["fmu-runner"]
    build:
      context: ./fmu-runner
      dockerfile: Dockerfile
    environment:
      - FMU_BACKEND_MODE=${FMU_BACKEND_MODE:-local}
      - FMU_DATA_PATH=/app/fmu-data
      - FMU_PROXY_RUNTIME_PATH=/app/fmu-proxy-runtime
      - FMU_STATION_BASE_URL=${FMU_STATION_BASE_URL:-}
      - FMU_STATION_INTERNAL_TOKEN=${FMU_STATION_INTERNAL_TOKEN:-}
      - FMU_STATION_REQUEST_TIMEOUT=${FMU_STATION_REQUEST_TIMEOUT:-10}
      - HISTORY_DB_PATH=/app/data/history.db
      - ISSUER=${ISSUER:-}
      - AUTH_JWKS_URL=${AUTH_JWKS_URL:-}
      - AUTH_SESSION_TICKET_ISSUE_URL=${AUTH_SESSION_TICKET_ISSUE_URL:-http://blockchain-services:8080/auth/fmu/session-ticket/issue}
      - AUTH_SESSION_TICKET_REDEEM_URL=${AUTH_SESSION_TICKET_REDEEM_URL:-http://blockchain-services:8080/auth/fmu/session-ticket/redeem}
      - AUTH_SESSION_TICKET_INTERNAL_TOKEN=${AUTH_SESSION_TICKET_INTERNAL_TOKEN:-}
      - MAX_SIMULATION_TIMEOUT=${FMU_MAX_SIMULATION_TIMEOUT:-300}
      - MAX_CONCURRENT_PER_MODEL=${FMU_MAX_CONCURRENT_PER_MODEL:-10}
      - PROXY_DOWNLOAD_RATE_LIMIT_PER_MINUTE=${FMU_PROXY_DOWNLOAD_RATE_LIMIT_PER_MINUTE:-20}
      - WS_CREATE_RATE_LIMIT_PER_MINUTE=${FMU_WS_CREATE_RATE_LIMIT_PER_MINUTE:-30}
      - FMU_PROXY_GATEWAY_WS_URL=${FMU_PROXY_GATEWAY_WS_URL:-}
      - FMU_PROXY_SIGNING_KEY=${FMU_PROXY_SIGNING_KEY:-}
      - BASYX_AAS_URL=${BASYX_AAS_URL:-http://basyx-aas-server:8081}
    volumes:
      - ./fmu-data:/app/fmu-data:ro
      - ./fmu-proxy-runtime:/app/fmu-proxy-runtime:ro
      - fmu-history:/app/data
      - ./certs:/app/config/keys:ro
    depends_on:
      blockchain-services:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8090/health').read()"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '2.0'
        reservations:
          memory: 512M
          cpus: '0.5'
    logging:
      driver: "json-file"
      options:
        max-size: "20m"
        max-file: "5"
        labels: "service=fmu-runner"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: always
    networks:
      - guacnet

  # BaSyx AAS Server - Asset Administration Shell registry & repository
  # Public read via /aas/ (OpenResty), admin write via /aas-admin/ (lab_manager_admin_access.lua)
  # Only available in Full Gateway instances (one per institution).
  # Start with: docker compose --profile aas up  (or COMPOSE_PROFILES=aas)
  basyx-aas-server:
    image: eclipsebasyx/aas-environment:2.0.0-milestone-04
    profiles: ["aas"]
    environment:
      - BASYX_AASREPOSITORY_FEATURE_MQTT_ENABLED=false
      - BASYX_BACKEND=MongoDB
      - SPRING_DATA_MONGODB_URI=mongodb://basyx-mongo:27017/basyx
      - SERVER_PORT=8081
    depends_on:
      basyx-mongo:
        condition: service_healthy
    volumes:
      - basyx_aas_data:/data
    healthcheck:
      test: ["CMD", "sh", "-c", "code=$$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8081/shells) && [ $$code -eq 200 ]"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '1.0'
        reservations:
          memory: 256M
          cpus: '0.25'
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
        labels: "service=basyx-aas-server"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: always
    networks:
      - guacnet

  # MongoDB backend for BaSyx AAS Server — persists shells/submodels across restarts.
  # Only used when the 'aas' profile is active.
  basyx-mongo:
    image: mongo:7
    profiles: ["aas"]
    command: mongod --quiet --logpath /dev/null
    volumes:
      - basyx_mongo_data:/data/db
    healthcheck:
      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.5'
        reservations:
          memory: 64M
    #security_opt:
    #  - no-new-privileges:true
    #cap_drop:
    #  - ALL
    restart: always
    networks:
      - guacnet

networks:
  guacnet:
    driver: bridge

volumes:
  mysql_data:
  fmu-history:
  basyx_mongo_data:
  basyx_aas_data: