sda-s3-integration.yml

services:
  credentials:
    container_name: credentials
    command:
      - "/bin/sh"
      - "/scripts/make_sda_credentials.sh"
    depends_on:
      postgres:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
    environment:
      - PGPASSWORD=rootpasswd
    image: python:3.11-slim
    volumes:
      - ./scripts:/scripts
      - shared:/shared

  postgres:
    build:
      context: ../../postgresql
    container_name: postgres
    environment:
      - POSTGRES_PASSWORD=rootpasswd
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 2s
      retries: 6
    image: ghcr.io/neicnordic/sensitive-data-archive:PR${PR_NUMBER}-postgres
    ports:
      - "15432:5432"
    restart: always
    volumes:
      - postgres_data:/var/lib/postgresql/data

  rabbitmq:
    build:
      context: ../../rabbitmq
    container_name: rabbitmq
    healthcheck:
      test:
        [
          "CMD",
          "bash",
          "-c",
          "rabbitmq-diagnostics -q check_running && rabbitmq-diagnostics -q check_local_alarms",
        ]
      interval: 10s
      timeout: 5s
      retries: 6
    image: ghcr.io/neicnordic/sensitive-data-archive:PR${PR_NUMBER}-rabbitmq
    ports:
      - "15672:15672"
      - "5672:5672"
    restart: always
    volumes:
      - rabbitmq_data:/var/lib/rabbitmq

  minio:
    image: minio/minio:RELEASE.2023-05-18T00-05-36Z
    command: server /data  --console-address ":9001"
    container_name: s3
    environment:
      - MINIO_ROOT_USER=access
      - MINIO_ROOT_PASSWORD=secretKey
      - MINIO_SERVER_URL=http://127.0.0.1:9000
    healthcheck:
      test: ["CMD", "curl", "-fkq", "http://localhost:9000/minio/health/live"]
      interval: 10s
      timeout: 2s
      retries: 6
    ports:
      - "19000:9000"
      - "19001:9001"
    volumes:
      - minio_data:/data

  s3inbox:
    build:
      args:
        GOLANG_VERSION: ${GOLANG_VERSION:-1.20}
      context: ../../sda
      target: debug
    image: ghcr.io/neicnordic/sensitive-data-archive:PR${PR_NUMBER}
    command: [ sda-s3inbox ]
    container_name: s3inbox
    depends_on:
      credentials:
        condition: service_completed_successfully
      minio:
        condition: service_healthy
      oidc:
        condition: service_healthy
      postgres:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
    environment:
      - BROKER_PASSWORD=inbox
      - BROKER_USER=inbox
      - BROKER_ROUTINGKEY=inbox
      - DB_PASSWORD=inbox
      - DB_USER=inbox
    restart: always
    volumes:
      - ./sda/config.yaml:/config.yaml
      - shared:/shared
    ports:
      - "18000:8000"
      - "18001:8001"

  ingest:
    image: ghcr.io/neicnordic/sensitive-data-archive:PR${PR_NUMBER}
    command: [ sda-ingest ]
    container_name: ingest
    depends_on:
      credentials:
        condition: service_completed_successfully
      minio:
        condition: service_healthy
      postgres:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
    environment:
      - BROKER_PASSWORD=ingest
      - BROKER_USER=ingest
      - BROKER_QUEUE=ingest
      - BROKER_ROUTINGKEY=archived
      - DB_PASSWORD=ingest
      - DB_USER=ingest
    restart: always
    volumes:
      - ./sda/config.yaml:/config.yaml
      - shared:/shared

  verify:
    image: ghcr.io/neicnordic/sensitive-data-archive:PR${PR_NUMBER}
    command: [ sda-verify ]
    container_name: verify
    depends_on:
      credentials:
        condition: service_completed_successfully
      minio:
        condition: service_healthy
      postgres:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
    environment:
      - BROKER_PASSWORD=verify
      - BROKER_USER=verify
      - BROKER_QUEUE=archived
      - BROKER_ROUTINGKEY=verified
      - DB_PASSWORD=verify
      - DB_USER=verify
    restart: always
    volumes:
      - ./sda/config.yaml:/config.yaml
      - shared:/shared

  finalize:
    image: ghcr.io/neicnordic/sensitive-data-archive:PR${PR_NUMBER}
    command: [ sda-finalize ]
    container_name: finalize
    depends_on:
      credentials:
        condition: service_completed_successfully
      minio:
        condition: service_healthy
      postgres:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
    environment:
      - BROKER_PASSWORD=finalize
      - BROKER_USER=finalize
      - BROKER_QUEUE=accession
      - BROKER_ROUTINGKEY=completed
      - DB_PASSWORD=finalize
      - DB_USER=finalize
    restart: always
    volumes:
      - ./sda/config.yaml:/config.yaml
      - shared:/shared

  mapper:
    image: ghcr.io/neicnordic/sensitive-data-archive:PR${PR_NUMBER}
    command: [ sda-mapper ]
    container_name: mapper
    depends_on:
      credentials:
        condition: service_completed_successfully
      minio:
        condition: service_healthy
      postgres:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
    environment:
      - BROKER_PASSWORD=mapper
      - BROKER_USER=mapper
      - BROKER_QUEUE=mappings
      - DB_PASSWORD=mapper
      - DB_USER=mapper
    restart: always
    volumes:
      - ./sda/config.yaml:/config.yaml
      - shared:/shared

  oidc:
    container_name: oidc
    command:
      - /bin/sh
      - -c
      - |
        pip install --upgrade pip
        pip install aiohttp Authlib joserfc requests
        python -u /oidc.py
    depends_on:
      credentials:
        condition: service_completed_successfully
    extra_hosts:
      - "localhost:host-gateway"
    healthcheck:
      test: ["CMD", "python3", "-c", 'import requests; print(requests.get(url = "http://localhost:8080/jwk").text)']
      interval: 10s
      timeout: 2s
      retries: 6
    image: python:3.11-slim
    ports:
      - "8080:8080"
    restart: always
    volumes:
      - ./sda/oidc.py:/oidc.py
      - shared:/shared

  api:
    command: [ sda-api ]
    container_name: api
    depends_on:
      credentials:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      oidc:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
    environment:
      - BROKER_PASSWORD=api
      - BROKER_USER=api
      - DB_PASSWORD=api
      - DB_USER=api
    image: ghcr.io/neicnordic/sensitive-data-archive:PR${PR_NUMBER}
    ports:
      - "8090:8080"
    restart: always
    volumes:
      - ./sda/config.yaml:/config.yaml
      - ./sda/rbac.json:/rbac.json
      - shared:/shared

  reencrypt:
    image: ghcr.io/neicnordic/sensitive-data-archive:PR${PR_NUMBER}
    command: [ sda-reencrypt ]
    container_name: reencrypt
    depends_on:
      credentials:
        condition: service_completed_successfully
    ports:
      - "50051:50051"
    restart: always
    volumes:
      - ./sda/config.yaml:/config.yaml
      - shared:/shared

  cega-nss:
    container_name: cega-nss
    depends_on:
      credentials:
        condition: service_completed_successfully
    command:
      [
        "python",
        "/cega/users.py",
        "0.0.0.0",
        "8443",
        "/shared/users.json"
      ]
    environment:
      - CEGA_USERS_PASSWORD=test
      - CEGA_USERS_USER=test
    image: "egarchive/lega-base:release.v0.2.0"
    ports:
      - "8443:8443"
    volumes:
      - ./sda/users.py:/cega/users.py
      - shared:/shared

  auth-cega:
    command: [ sda-auth ]
    container_name: auth-cega
    depends_on:
      cega-nss:
        condition: service_started
      postgres:
        condition: service_healthy
    environment:
      - AUTH_RESIGNJWT=true
      - AUTH_CEGA_ID=test
      - AUTH_CEGA_SECRET=test
      - DB_PASSWORD=auth
      - DB_USER=auth
    image: ghcr.io/neicnordic/sensitive-data-archive:PR${PR_NUMBER}
    ports:
      - "8888:8080"
    restart: always
    volumes:
      - ./sda/config.yaml:/config.yaml
      - shared:/shared

  auth-oidc:
    command: [ sda-auth ]
    container_name: auth-oidc
    depends_on:
      postgres:
        condition: service_healthy
      oidc:
        condition: service_healthy
    environment:
      - AUTH_RESIGNJWT=false
      - OIDC_ID=XC56EL11xx
      - OIDC_SECRET=wHPVQaYXmdDHg
      - OIDC_PROVIDER=http://localhost:8080
      - OIDC_REDIRECTURL=http://localhost:8889/oidc/login
      - DB_PASSWORD=auth
      - DB_USER=auth
    extra_hosts:
      - "localhost:host-gateway"
    image: ghcr.io/neicnordic/sensitive-data-archive:PR${PR_NUMBER}
    ports:
      - "8889:8080"
    restart: always
    volumes:
      - ./sda/config.yaml:/config.yaml
      - shared:/shared

  integration_test:
    container_name: tester
    command:
      - "/bin/sh"
      - "/tests/run_scripts.sh"
      - "/tests/sda"
    depends_on:
      auth-cega:
        condition: service_started
      auth-oidc:
        condition: service_started
      cega-nss:
        condition: service_started
      credentials:
        condition: service_completed_successfully
      finalize:
        condition: service_started
      ingest:
        condition: service_started
      mapper:
        condition: service_started
      s3inbox:
        condition: service_started
      verify:
         condition: service_started
      api:
         condition: service_started
      reencrypt:
         condition: service_started
    extra_hosts:
      - "localhost:host-gateway"
    environment:
      - PGPASSWORD=rootpasswd
      - STORAGETYPE=s3
    image: python:3.11-slim-bullseye
    profiles:
      - tests
    volumes:
      - shared:/shared
      - ./tests:/tests

volumes:
  minio_data:
  postgres_data:
  rabbitmq_data:
  shared: