docker-compose.yml

---
# Common environment variables shared across services
x-common-env: &common-env
  AM_I_IN_DOCKER_CONTAINER: ${AM_I_IN_DOCKER_CONTAINER:-1}
  APP_BASE_URL: ${APP_BASE_URL:-http://dev.sbomify.com}
  AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-minioadmin}
  AWS_ENDPOINT_URL_S3: ${AWS_ENDPOINT_URL_S3:-http://sbomify-minio:9000}
  AWS_MEDIA_ACCESS_KEY_ID: ${AWS_MEDIA_ACCESS_KEY_ID:-minioadmin}
  AWS_MEDIA_SECRET_ACCESS_KEY: ${AWS_MEDIA_SECRET_ACCESS_KEY:-minioadmin}
  AWS_MEDIA_STORAGE_BUCKET_NAME: ${AWS_MEDIA_STORAGE_BUCKET_NAME:-sbomify-media}
  AWS_MEDIA_STORAGE_BUCKET_URL: ${AWS_MEDIA_STORAGE_BUCKET_URL:-http://sbomify-minio:9000/sbomify-media}
  AWS_REGION: ${AWS_REGION:-auto}
  AWS_SBOMS_ACCESS_KEY_ID: ${AWS_SBOMS_ACCESS_KEY_ID:-minioadmin}
  AWS_SBOMS_SECRET_ACCESS_KEY: ${AWS_SBOMS_SECRET_ACCESS_KEY:-minioadmin}
  AWS_SBOMS_STORAGE_BUCKET_NAME: ${AWS_SBOMS_STORAGE_BUCKET_NAME:-sbomify-sboms}
  AWS_SBOMS_STORAGE_BUCKET_URL: ${AWS_SBOMS_STORAGE_BUCKET_URL:-http://sbomify-minio:9000/sbomify-sboms}
  AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-minioadmin}
  CLOUDFLARE_DCV_HOSTNAME: ${CLOUDFLARE_DCV_HOSTNAME:-}
  DATABASE_NAME: ${DATABASE_NAME:-sbomify}
  DATABASE_PASSWORD: ${DATABASE_PASSWORD:-sbomify}
  DATABASE_PORT: ${DATABASE_PORT:-5432}
  DATABASE_USER: ${DATABASE_USER:-sbomify}
  DOCKER_DATABASE_HOST: ${DOCKER_DATABASE_HOST:-sbomify-db}
  REDIS_HOST: ${REDIS_HOST:-sbomify-redis:6379}
  SECRET_KEY: ${SECRET_KEY:-"django-insecure-your-development-secret-key-here-CHANGE-ME!"}
  SIGNED_URL_SALT: ${SIGNED_URL_SALT:-django-insecure-signed-url-salt-CHANGE-ME!}

services:
  sbomify-db:
    image: ${POSTGRES_IMAGE:-postgres:17-alpine}
    restart: ${POSTGRES_RESTART_POLICY:-always}
    environment:
      # We can't use anchors here, since anchors are resolved *after* these values are set.
      # You can however override all of them using environment variables.
      POSTGRES_USER: ${DATABASE_USER:-sbomify}
      POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-sbomify}
      POSTGRES_DB: ${DATABASE_NAME:-sbomify}
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    volumes:
      - sbomify_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DATABASE_USER:-sbomify}"]
      interval: 10s
      timeout: 2s
      retries: 10

  sbomify-redis:
    image: ${REDIS_IMAGE:-redis:8-alpine}
    restart: ${REDIS_RESTART_POLICY:-always}
    ports:
      - "${REDIS_PORT:-6379}:6379"
    volumes:
      - sbomify_redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  sbomify-backend:
    image: ${SBOMIFY_IMAGE:-sbomifyhub/sbomify}:${SBOMIFY_TAG:-latest}
    build:
      context: ${BUILD_CONTEXT:-.}
      target: ${BUILD_TARGET:-python-app-prod}
      args:
        BUILD_ENV: ${BUILD_ENV:-production}
    pull_policy: ${SBOMIFY_PULL_POLICY:-always}
    restart: ${SBOMIFY_RESTART_POLICY:-always}
    deploy:
      replicas: ${BACKEND_REPLICAS:-2}
    environment:
      <<: *common-env
      BILLING: ${BILLING:-False}
      DATABASE_HOST: ${DATABASE_HOST:-localhost}
      KC_HOSTNAME_URL: ${KC_HOSTNAME_URL:-http://keycloak:8080/}
      KEYCLOAK_CLIENT_ID: ${KEYCLOAK_CLIENT_ID:-sbomify}
      KEYCLOAK_CLIENT_SECRET: ${KEYCLOAK_CLIENT_SECRET:-dev-client-secret}
      KEYCLOAK_REALM: ${KEYCLOAK_REALM:-sbomify}
      KEYCLOAK_SERVER_URL: ${KEYCLOAK_SERVER_URL:-http://keycloak:8080/}
    # No ports exposed - all traffic goes through Caddy
    expose:
      - 8000
    depends_on:
      sbomify-db:
        condition: service_healthy
      sbomify-redis:
        condition: service_healthy
      sbomify-migrations:
        condition: service_completed_successfully
    stop_grace_period: 30s
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8000/UuPha8mu/"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s

  sbomify-caddy:
    image: ${CADDY_IMAGE:-caddy:2-alpine}
    restart: ${CADDY_RESTART_POLICY:-always}
    ports:
      - "${BIND_IP:-127.0.0.1}:${HTTP_PORT:-8000}:80"
      - "${BIND_IP:-127.0.0.1}:${HTTPS_PORT:-8443}:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
    environment:
      LOG_LEVEL: ${CADDY_LOG_LEVEL:-INFO}
      CADDY_ADMIN: ${CADDY_ADMIN:-off}
      ACME_EMAIL: ${ACME_EMAIL:-admin@example.com}
      ACME_CA: ${ACME_CA:-https://acme-v02.api.letsencrypt.org/directory}
    depends_on:
      - sbomify-backend
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://sbomify-caddy/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    stop_grace_period: 10s

  sbomify-migrations:
    image: ${SBOMIFY_IMAGE:-sbomifyhub/sbomify}:${SBOMIFY_TAG:-latest}
    build:
      context: ${BUILD_CONTEXT:-.}
      target: ${BUILD_TARGET:-python-app-prod}
      args:
        BUILD_ENV: ${BUILD_ENV:-production}
    pull_policy: ${SBOMIFY_PULL_POLICY:-always}
    environment:
      <<: *common-env
      BILLING: ${BILLING:-False}
    command: /code/bin/release.sh
    depends_on:
      sbomify-db:
        condition: service_healthy

  sbomify-worker:
    image: ${SBOMIFY_IMAGE:-sbomifyhub/sbomify}:${SBOMIFY_TAG:-latest}
    build:
      context: ${BUILD_CONTEXT:-.}
      target: ${BUILD_TARGET:-python-app-prod}
      args:
        BUILD_ENV: ${BUILD_ENV:-production}
    restart: ${SBOMIFY_RESTART_POLICY:-always}
    deploy:
      replicas: ${WORKER_REPLICAS:-2}
    environment:
      <<: *common-env
      BILLING: ${BILLING:-False}
    command:
      [
        "uv",
        "run",
        "manage.py",
        "rundramatiq",
        "-p",
        "${DRAMATIQ_PROCESSES:-1}",
        "-t",
        "${DRAMATIQ_THREADS:-4}"
      ]
    depends_on:
      sbomify-redis:
        condition: service_healthy
      sbomify-db:
        condition: service_healthy
    stop_grace_period: 30s

volumes:
  sbomify_postgres_data:
  sbomify_redis_data: