docker-compose.yml

services:
  atlas:
    # Pin a given, audited version of the latest-alpine tag.
    image: arigaio/atlas@sha256:591872655a7758a60edcb6a23e60caee2fd3ae3fb08bceb8bc4e095f6d5013b5
    depends_on:
      atlas-dev-database:
        condition: service_healthy
    # The entrypoint is patched to include git in the image.
    #
    # The current official atlas docker image does not include git, which
    # prevents the tool to run command against git paths, namely the lint
    # command, which we want to run against master.
    # Once the corresponding issue <https://github.com/ariga/atlas/issues/3589>
    # is fixed this patch can be removed.
    entrypoint: ["sh", "-c", 'apk add git && exec /atlas "$$@"', "--"]
    working_dir: "/home"
    profiles:
      - donotstart
    volumes:
      - ./.atlas:/root/.atlas
      - ./.git:/home/.git
      - ./controlplane/migrations:/home/controlplane/migrations
      - ./controlplane/schema.hcl:/home/controlplane/schema.hcl

  atlas-dev-database:
    image: postgres:16
    environment:
      POSTGRES_PASSWORD: postgres
    healthcheck:
      test: ["CMD", "pg_isready"]

  worker:
    build:
      args:
        BUILDKIT_INLINE_CACHE: ${BUILDKIT_INLINE_CACHE:-1}
      cache_from:
        - ${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}worker:${CI_COMMIT_REF_SLUG:-latest}-${TARGET:-development}
        - ${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}worker:master-${TARGET:-development}
      context: controlplane
      dockerfile: Dockerfile
      target: ${TARGET:-development}-operation-worker
    depends_on:
      controlplane:
        condition: service_healthy
      postgres:
        condition: service_healthy
      postgres-migrate:
        condition: service_completed_successfully
      spicedb:
        condition: service_healthy
      zed:
        condition: service_completed_successfully
    environment:
      DATABASE_URL: postgres://postgres:postgres@postgres:5432/postgres
      # Must match the controlplane KEK so the worker can decrypt cluster kubeconfigs.
      # DEV ONLY: never use this fallback key outside local development.
      KUBECONFIG_ENCRYPTION_KEY: ${KUBECONFIG_ENCRYPTION_KEY:-ZGV2LWt1YmVjb25maWctZW5jcnlwdGlvbi1rZXkhMzI=}
      MANAGED_DEFAULT_STORAGE_CLASS: ${MANAGED_DEFAULT_STORAGE_CLASS:-}
      RUST_LOG: ${RUST_LOG:-info}
      SPICEDB_GRPC_PRESHARED_KEY: ${SPICEDB_GRPC_PRESHARED_KEY:-PGOmLcWQCjqipv5gM8xzXUo4xqLJdEIifGkH5rR3xL1TLPlaWpcgBrgI62EbCWbO}
      SPICEDB_URL: ${SPICEDB_URL:-http://spicedb:50051}
      WORKER_TOKEN: ${WORKER_TOKEN:-dev-worker-token-secret}
      WORKFLOW_SERVER_URL: ${WORKFLOW_SERVER_URL:-http://controlplane:80}
    image: "${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}worker:${CI_COMMIT_REF_SLUG:-latest}-${TARGET:-development}"
    volumes:
      - ./controlplane:/app
      - /app/target
      - ${HOME}/.kube:/root/.kube:ro

  console:
    image: "${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}console:${CI_COMMIT_REF_SLUG:-latest}-${TARGET:-development}"
    build:
      args:
        BUILDKIT_INLINE_CACHE: ${BUILDKIT_INLINE_CACHE:-1}
        VITE_OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-francenuage}
        VITE_OIDC_PROVIDER_NAME: ${OIDC_PROVIDER_NAME:-keycloak}
        VITE_OIDC_PROVIDER_URL: ${OIDC_PROVIDER_URL:-https://keycloak.test/realms/francenuage}
        VITE_APPLICATION_DEFAULT_MODE: ${VITE_APPLICATION_DEFAULT_MODE:-rpc}
        VITE_CONTROLPLANE_URL: ${CONTROLPLANE_URL:-https://controlplane.test}
      cache_from:
        - ${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}console:${CI_COMMIT_REF_SLUG:-latest}-${TARGET:-development}
        - ${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}console:master-${TARGET:-development}
      context: .
      dockerfile: console/Dockerfile
      target: ${TARGET:-development}
    depends_on:
      controlplane:
        condition: service_healthy
      node-sdk:
        condition: service_completed_successfully
      keycloak:
        condition: service_healthy
      traefik:
        condition: service_started
    environment:
      NODE_EXTRA_CA_CERTS: /usr/local/share/ca-certificates/docker-compose-dev-ca.crt
      VITE_OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-francenuage}
      VITE_OIDC_PROVIDER_NAME: ${OIDC_PROVIDER_NAME:-keycloak}
      VITE_OIDC_PROVIDER_URL: ${OIDC_PROVIDER_URL:-https://keycloak.test/realms/francenuage}
      VITE_APPLICATION_DEFAULT_MODE: ${VITE_APPLICATION_DEFAULT_MODE:-rpc}
      VITE_CONTROLPLANE_URL: ${CONTROLPLANE_URL:-https://controlplane.test}
      PORT: 80
    expose:
      - "80"
    extra_hosts:
      - "keycloak.test:host-gateway"
      - "console.test:host-gateway"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost"]
      interval: 5s
      timeout: 5s
      retries: 24
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.console.rule=Host(`console.test`)"
      - "traefik.http.routers.console.entrypoints=websecure"
      - "traefik.http.routers.console.tls=true"
      - "traefik.http.services.console.loadbalancer.server.port=80"
    volumes:
      - ./console:/app
      - /app/node_modules
      - ./certs/ca.pem:/usr/local/share/ca-certificates/docker-compose-dev-ca.crt:ro

  controlplane:
    image: "${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}controlplane:${CI_COMMIT_REF_SLUG:-latest}-${TARGET:-development}"
    build:
      args:
        BUILDKIT_INLINE_CACHE: ${BUILDKIT_INLINE_CACHE:-1}
      cache_from:
        - ${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}controlplane:${CI_COMMIT_REF_SLUG:-latest}-${TARGET:-development}
        - ${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}controlplane:master-${TARGET:-development}
      context: controlplane
      target: ${TARGET:-development}
    depends_on:
      keycloak:
        condition: service_healthy
      postgres:
        condition: service_healthy
      postgres-migrate:
        condition: service_completed_successfully
      postgres-seed:
        condition: service_completed_successfully
      spicedb:
        condition: service_healthy
      traefik:
        condition: service_started
      zed:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "/bin/grpc_health_probe", "-addr=localhost:80"]
      interval: 5s
      timeout: 5s
      retries: 24
    environment:
      CARGO_INCREMENTAL: ${CARGO_INCREMENTAL:-}
      CARGO_BUILD_JOBS: ${CARGO_BUILD_JOBS:-4}
      CI_SERVICE_TOKEN: ${CI_SERVICE_TOKEN:-dev-ci-token-secret}
      CONSOLE_URL: ${CONSOLE_URL:-https://console.test}
      CONTROLPLANE_ADDR: 0.0.0.0:80
      CURL_CA_BUNDLE: /usr/local/share/ca-certificates/docker-compose-dev-ca.crt
      DATABASE_URL: postgres://postgres:postgres@postgres:5432/postgres
      # DEV ONLY: never use this fallback key outside local development.
      KUBECONFIG_ENCRYPTION_KEY: ${KUBECONFIG_ENCRYPTION_KEY:-ZGV2LWt1YmVjb25maWctZW5jcnlwdGlvbi1rZXkhMzI=}
      LLVM_PROFILE_FILE: ${LLVM_PROFILE_FILE:-}
      MANAGED_DEFAULT_STORAGE_CLASS: ${MANAGED_DEFAULT_STORAGE_CLASS:-}
      OIDC_URL: ${OIDC_URL:-https://keycloak.test/realms/francenuage/.well-known/openid-configuration}
      ROOT_ORGANIZATION_NAME: ${ROOT_ORGANIZATION_NAME:-acme}
      ROOT_SERVICE_ACCOUNT_KEY: ${ROOT_SERVICE_ACCOUNT_KEY:-qDOiI0B686hr0wN479q7jmOQ6nYtSUsq}
      RUST_BACKTRACE: ${RUST_BACKTRACE:-1}
      RUST_LOG: ${RUST_LOG:-info}
      RUSTFLAGS: ${RUSTFLAGS:-}
      SPICEDB_URL: ${SPICEDB_URL:-http://spicedb:50051}
      SPICEDB_GRPC_PRESHARED_KEY: ${SPICEDB_GRPC_PRESHARED_KEY:-PGOmLcWQCjqipv5gM8xzXUo4xqLJdEIifGkH5rR3xL1TLPlaWpcgBrgI62EbCWbO}
      SQLX_OFFLINE: ${SQLX_OFFLINE:-true}
      SSL_CERT_FILE: /usr/local/share/ca-certificates/docker-compose-dev-ca.crt
      # Secrets Stripe: jamais de valeur par defaut ici (le fichier est suivi par git).
      # Renseigner STRIPE_SECRET_KEY et STRIPE_WEBHOOK_SECRET dans le .env racine
      # (gitignore). Optionnels au demarrage: sans eux, la facturation est desactivee.
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
      STRIPE_CHECKOUT_SUCCESS_URL: ${STRIPE_CHECKOUT_SUCCESS_URL:-https://console.test/managed-services/instances?checkout=success}
      STRIPE_CHECKOUT_CANCEL_URL: ${STRIPE_CHECKOUT_CANCEL_URL:-https://console.test/managed-services?checkout=cancel}
      WORKER_TOKEN: ${WORKER_TOKEN:-dev-worker-token-secret}
    expose:
      - 80
      - 8081
    ports:
      - "50052:80"
      - "50053:8081"
    extra_hosts:
      - "keycloak.test:host-gateway"
      - "console.test:host-gateway"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.controlplane.rule=Host(`controlplane.test`)"
      - "traefik.http.routers.controlplane.entrypoints=websecure"
      - "traefik.http.routers.controlplane.tls=true"
      - "traefik.http.services.controlplane.loadbalancer.server.port=80"
    volumes:
      - ./controlplane:/app
      - ./certs/ca.pem:/usr/local/share/ca-certificates/docker-compose-dev-ca.crt:ro
      - type: volume
        source: nfs-snippets
        target: /mnt/pve/nfs-snippets
        volume:
          nocopy: true

  keycloak-db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: ${POSTGRES_KEYCLOAK_PASSWORD:-keycloak}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U keycloak -d keycloak"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s
    volumes:
      - postgres_keycloak_data:/var/lib/postgresql/data

  keycloak:
    image: quay.io/keycloak/keycloak:26.0
    command: start-dev --import-realm
    depends_on:
      keycloak-db:
        condition: service_healthy
      traefik:
        condition: service_started
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://keycloak-db:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: ${POSTGRES_KEYCLOAK_PASSWORD:-keycloak}
      KC_HOSTNAME: keycloak.test
      KC_HOSTNAME_STRICT: false
      KC_HTTP_ENABLED: true
      KC_PROXY_HEADERS: xforwarded
      KC_HEALTH_ENABLED: true
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-admin}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
    expose:
      - 8080
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "exec 3<>/dev/tcp/127.0.0.1/9000;echo -e \"GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n\" >&3;grep \"HTTP/1.1 200 OK\" <&3",
        ]
      interval: 10s
      timeout: 5s
      retries: 24
      start_period: 60s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.keycloak.rule=Host(`keycloak.test`)"
      - "traefik.http.routers.keycloak.entrypoints=websecure"
      - "traefik.http.routers.keycloak.tls=true"
      - "traefik.http.services.keycloak.loadbalancer.server.port=8080"
    volumes:
      - ./keycloak-realm.json:/opt/keycloak/data/import/francenuage-realm.json:ro

  markdown-lint:
    command: ["**/*.md"]
    entrypoint: ["markdownlint-cli2"]
    image: davidanson/markdownlint-cli2:v0.13.0
    profiles:
      - donotstart
    volumes:
      - .:/app
    working_dir: /app

  node-sdk:
    build:
      args:
        BUILDKIT_INLINE_CACHE: ${BUILDKIT_INLINE_CACHE:-1}
      context: node-sdk
    volumes:
      - ./node-sdk:/app
      - /app/node_modules

  playwright:
    image: mcr.microsoft.com/playwright:v1.51.1-noble
    command: /bin/sh -c "npx -y playwright@1.51.1 run-server --port 4444 --host 0.0.0.0"
    environment:
      - NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/docker-compose-dev-ca.crt
    extra_hosts:
      - "console.test:host-gateway"
      - "keycloak.test:host-gateway"
      - "controlplane.test:host-gateway"
    ports:
      - "4444:4444"
    profiles:
      - donotstart
    volumes:
      - ./certs/ca.pem:/usr/local/share/ca-certificates/docker-compose-dev-ca.crt:ro

  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: postgres
      PROXMOX_DEV_AUTHORIZATION_TOKEN: ${PROXMOX_DEV_AUTHORIZATION_TOKEN}
      PROXMOX_DEV_STORAGE_NAME: ${PROXMOX_DEV_STORAGE_NAME:-local-lvm}
      PROXMOX_DEV_URL: ${PROXMOX_DEV_URL:-https://pvedev00-dc03.france-nuage.fr}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 24
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./seed.sql:/home/seed.sql:ro

  postgres-migrate:
    # Pin a given, audited version of the latest-alpine tag.
    image: arigaio/atlas@sha256:591872655a7758a60edcb6a23e60caee2fd3ae3fb08bceb8bc4e095f6d5013b5
    entrypoint: ["sh", "-c"]
    command:
      - |
        atlas migrate apply \
          --url="$${DATABASE_URL}?sslmode=disable" \
          --dir=file://controlplane/migrations
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      DATABASE_URL: postgres://postgres:postgres@postgres:5432/postgres
    volumes:
      - ./controlplane/migrations:/controlplane/migrations:ro

  protocol:
    image: "${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}protocol:${CI_COMMIT_REF_SLUG:-latest}-${TARGET:-development}"
    build:
      args:
        BUILDKIT_INLINE_CACHE: ${BUILDKIT_INLINE_CACHE:-1}
      cache_from:
        - ${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}protocol:${CI_COMMIT_REF_SLUG:-latest}
        - ${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}protocol:master
      context: protocol
    profiles:
      - donotstart

  spicedb:
    # TODO: pin to a specific version (was latest)
    image: "authzed/spicedb:latest"
    command: serve
    depends_on:
      spicedb-datastore:
        condition: service_healthy
      spicedb-migrate:
        condition: service_completed_successfully
    environment:
      SPICEDB_GRPC_PRESHARED_KEY: ${SPICEDB_GRPC_PRESHARED_KEY:-PGOmLcWQCjqipv5gM8xzXUo4xqLJdEIifGkH5rR3xL1TLPlaWpcgBrgI62EbCWbO}
      SPICEDB_DATASTORE_ENGINE: postgres
      SPICEDB_DATASTORE_CONN_URI: postgres://spicedb:${POSTGRES_SPICEDB_PASSWORD:-spicedb}@spicedb-datastore:5432/spicedb?sslmode=disable
    healthcheck:
      test: ["CMD", "grpc_health_probe", "-addr=localhost:50051"]
      interval: 5s
      timeout: 5s
      retries: 24
    ports:
      - "50051:50051"
      - "8443:8443"

  spicedb-datastore:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: spicedb
      POSTGRES_USER: spicedb
      POSTGRES_PASSWORD: ${POSTGRES_SPICEDB_PASSWORD:-spicedb}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U spicedb -d spicedb"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s
    ports:
      - "5433:5432"
    volumes:
      - postgres_spicedb_data:/var/lib/postgresql/data

  spicedb-migrate:
    # TODO: pin to a specific version (was latest) - keep in sync with spicedb image above
    image: "authzed/spicedb:latest"
    command: migrate head
    depends_on:
      spicedb-datastore:
        condition: service_healthy
    environment:
      SPICEDB_GRPC_PRESHARED_KEY: ${SPICEDB_GRPC_PRESHARED_KEY:-PGOmLcWQCjqipv5gM8xzXUo4xqLJdEIifGkH5rR3xL1TLPlaWpcgBrgI62EbCWbO}
      SPICEDB_DATASTORE_ENGINE: postgres
      SPICEDB_DATASTORE_CONN_URI: postgres://spicedb:${POSTGRES_SPICEDB_PASSWORD:-spicedb}@spicedb-datastore:5432/spicedb?sslmode=disable

  spicedb-playground:
    # TODO: pin to a specific version (was latest)
    image: "ghcr.io/authzed/spicedb-playground:latest"
    ports:
      - "3000:3000"
    depends_on:
      spicedb:
        condition: service_healthy

  synchronizer:
    image: "${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}synchronizer:${CI_COMMIT_REF_SLUG:-latest}-${TARGET:-development}"
    build:
      args:
        BUILDKIT_INLINE_CACHE: ${BUILDKIT_INLINE_CACHE:-1}
      cache_from:
        - ${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}synchronizer:${CI_COMMIT_REF_SLUG:-latest}-${TARGET:-development}
        - ${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}synchronizer:master-${TARGET:-development}
      context: controlplane
      dockerfile: Dockerfile
      target: ${TARGET:-development}-synchronizer
    depends_on:
      keycloak:
        condition: service_healthy
      postgres:
        condition: service_healthy
      postgres-migrate:
        condition: service_completed_successfully
      spicedb:
        condition: service_healthy
      zed:
        condition: service_completed_successfully
    environment:
      CURL_CA_BUNDLE: /usr/local/share/ca-certificates/docker-compose-dev-ca.crt
      DATABASE_URL: postgres://postgres:postgres@postgres:5432/postgres
      OIDC_URL: ${OIDC_URL:-https://keycloak.test/realms/francenuage/.well-known/openid-configuration}
      RUST_BACKTRACE: ${RUST_BACKTRACE:-1}
      SPICEDB_URL: ${SPICEDB_URL:-http://spicedb:50051}
      SPICEDB_GRPC_PRESHARED_KEY: ${SPICEDB_GRPC_PRESHARED_KEY:-PGOmLcWQCjqipv5gM8xzXUo4xqLJdEIifGkH5rR3xL1TLPlaWpcgBrgI62EbCWbO}
      SSL_CERT_FILE: /usr/local/share/ca-certificates/docker-compose-dev-ca.crt
    extra_hosts:
      - "keycloak.test:host-gateway"
    volumes:
      - ./controlplane:/app
      - /app/target
      - ./certs/ca.pem:/usr/local/share/ca-certificates/docker-compose-dev-ca.crt:ro

  system-tests:
    image: "${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}system-tests:${CI_COMMIT_REF_SLUG:-latest}"
    build:
      args:
        BUILDKIT_INLINE_CACHE: ${BUILDKIT_INLINE_CACHE:-1}
      cache_from:
        - ${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}system-tests:${CI_COMMIT_REF_SLUG:-latest}
        - ${CI_REGISTRY_IMAGE:+$CI_REGISTRY_IMAGE/}system-tests:master
      context: .
      dockerfile: system-tests/Dockerfile
    depends_on:
      worker:
        condition: service_started
      console:
        condition: service_healthy
      controlplane:
        condition: service_healthy
      node-sdk:
        condition: service_completed_successfully
      playwright:
        condition: service_started
      traefik:
        condition: service_started
      synchronizer:
        condition: service_started
    environment:
      CONSOLE_URL: ${CONSOLE_URL:-https://console.test}
      CONTROLPLANE_URL: ${CONTROLPLANE_URL:-https://controlplane.test}
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-admin}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
      KEYCLOAK_URL: ${KEYCLOAK_URL:-https://keycloak.test}
      NODE_EXTRA_CA_CERTS: /usr/local/share/ca-certificates/docker-compose-dev-ca.crt
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-francenuage}
      OIDC_PROVIDER_URL: ${OIDC_PROVIDER_URL:-https://keycloak.test/realms/francenuage}
      PRODUCTION_CONTROLPLANE_URL: ${PRODUCTION_CONTROLPLANE_URL:-https://controlplane.france-nuage.fr}
      PRODUCTION_CONTROLPLANE_TOKEN: ${PRODUCTION_CONTROLPLANE_TOKEN}
      PRODUCTION_DATACENTER_ID: ${PRODUCTION_DATACENTER_ID:-}
      PRODUCTION_ORGANIZATION_ID: ${PRODUCTION_ORGANIZATION_ID:-7e90812b-608f-4dc2-81d2-a2ebb25834e0}
      PROXMOX_DEV_AUTHORIZATION_TOKEN: ${PROXMOX_DEV_AUTHORIZATION_TOKEN}
      PROXMOX_DEV_STORAGE_NAME: ${PROXMOX_DEV_STORAGE_NAME:-local-lvm}
      PROXMOX_DEV_URL: ${PROXMOX_DEV_URL:-https://pvedev00-dc03.france-nuage.fr}
      PROXMOX_DIRTY_ID: ${PROXMOX_DIRTY_ID}
      PROXMOX_TEST_AUTHORIZATION_TOKEN: ${PROXMOX_TEST_AUTHORIZATION_TOKEN}
      PROXMOX_TEST_STORAGE_NAME: ${PROXMOX_TEST_STORAGE_NAME:-local-lvm}
      PROXMOX_TEST_URL: ${PROXMOX_TEST_URL:-https://pve01-test01.france-nuage.fr}
      PW_TEST_CONNECT_WS_ENDPOINT: ws://playwright:4444
      PW_TEST_HTML_REPORT_OPEN: never
      ROOT_ORGANIZATION_NAME: ${ROOT_ORGANIZATION_NAME:-acme}
      ROOT_SERVICE_ACCOUNT_KEY: ${ROOT_SERVICE_ACCOUNT_KEY:-qDOiI0B686hr0wN479q7jmOQ6nYtSUsq}
      SPICEDB_GRPC_PRESHARED_KEY: ${SPICEDB_GRPC_PRESHARED_KEY:-PGOmLcWQCjqipv5gM8xzXUo4xqLJdEIifGkH5rR3xL1TLPlaWpcgBrgI62EbCWbO}
      SPICEDB_URL: ${SPICEDB_URL:-http://spicedb:50051}
      SSL_CERT_FILE: /usr/local/share/ca-certificates/docker-compose-dev-ca.crt
    extra_hosts:
      - "console.test:host-gateway"
      - "controlplane.test:host-gateway"
      - "keycloak.test:host-gateway"
    ports:
      - "9000:9000"
    profiles:
      - donotstart
    volumes:
      - ./certs/ca.pem:/usr/local/share/ca-certificates/docker-compose-dev-ca.crt:ro
      - ./system-tests:/app
      - /app/node_modules

  traefik:
    image: traefik:v2.11
    networks:
      default:
        aliases:
          - console.test
          - keycloak.test
          - controlplane.test
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--providers.file.directory=/etc/traefik/dynamic"
      - "--providers.file.watch=true"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./certs:/etc/traefik/certs:ro
      - ./traefik:/etc/traefik/dynamic:ro

  postgres-seed:
    image: postgres:16-alpine
    entrypoint: ["sh", "-c"]
    command:
      - psql "$${DATABASE_URL}" -f /home/seed.sql
    depends_on:
      postgres:
        condition: service_healthy
      postgres-migrate:
        condition: service_completed_successfully
    environment:
      DATABASE_URL: postgres://postgres:postgres@postgres:5432/postgres
    restart: no
    volumes:
      - ./seed.sql:/home/seed.sql:ro

  zed:
    # TODO: pin to a specific version (was latest)
    image: authzed/zed:latest
    command: import /authz/seed.yaml
    depends_on:
      spicedb:
        condition: service_healthy
      spicedb-migrate:
        condition: service_completed_successfully
    environment:
      ZED_ENDPOINT: spicedb:50051
      ZED_INSECURE: true
      ZED_TOKEN: ${SPICEDB_GRPC_PRESHARED_KEY:-PGOmLcWQCjqipv5gM8xzXUo4xqLJdEIifGkH5rR3xL1TLPlaWpcgBrgI62EbCWbO}
    restart: no
    volumes:
      - ./authz:/authz

volumes:
  nfs-snippets:
    driver: local
    driver_opts:
      type: nfs
      o: addr=nfs-snippets-dev.france-nuage.fr,rw,nfsvers=4
      device: ":/mnt/Apps/France-Nuage/nfs-snippets-proxmox-dev"
  postgres_data:
  postgres_keycloak_data:
  postgres_spicedb_data:
  target: