docker-compose.yml

services:
  oidc:
    profiles: ["sda-sweden"]
    container_name: oidc
    command:
      - /bin/sh
      - -c
      - |
        pip install -q --upgrade pip
        pip install -q aiohttp Authlib joserfc requests
        sh make_oidc_jwt.sh
        python -u /oidc.py
    healthcheck:
      test: ["CMD", "python3", "-c", 'import requests; print(requests.get(url = "http://localhost:8080/jwk").text)']
      interval: 10s
      timeout: 2s
      retries: 6
    image: python:3.11-slim
    ports:
      - "8085:8080"
    restart: always
    volumes:
      - ./scripts/oidc.py:/oidc.py
      - ./scripts/sign_jwt.py:/sign_jwt.py
      - ./scripts/make_oidc_jwt.sh:/make_oidc_jwt.sh
      - shared:/shared
  postgres:
    profiles: ["sda-sweden"]
    container_name: postgres
    environment:
      - POSTGRES_PASSWORD=rootpasswd
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 2s
      retries: 6
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}-postgres
    ports:
      - "5432:5432"
    volumes:
      - dbdata:/var/lib/postgresql/data

  rabbitmq:
    profiles: ["sda-sweden"]
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}-rabbitmq
    container_name: rabbitmq
    environment:
     - RABBITMQ_DEFAULT_PASS=test
     - RABBITMQ_DEFAULT_USER=test
     - MQ_VHOST=sda
    ports:
      - "15672:15672"
      - "5672:5672"
    healthcheck:
      test: ["CMD", "bash", "-c", "rabbitmq-diagnostics -q check_running && rabbitmq-diagnostics -q check_local_alarms"]
      interval: 5s
      timeout: 120s
      retries: 10

  s3:
    profiles: ["sda-sweden"]
    command: server /data --console-address ":9001"
    container_name: s3
    environment:
      - MINIO_ROOT_USER=access
      - MINIO_ROOT_PASSWORD=secretkey
      - MINIO_SERVER_URL=http://127.0.0.1:9000
    healthcheck:
      test:
        ["CMD", "curl", "-fqI", "http://localhost:9000/minio/health/live"]
      interval: 5s
      timeout: 20s
      retries: 10
    image: minio/minio
    ports:
      - "9000:9000"
      - "9001:9001"

  createbucket:
    profiles: ["sda-sweden"]
    image: minio/mc
    container_name: mc
    depends_on:
      s3:
        condition: service_started
    entrypoint: >
      /bin/sh -c "
      sleep 10;
      /usr/bin/mc -q config host add s3 http://s3:9000 access secretkey;
      /usr/bin/mc -q mb s3/inbox || true;
      /usr/bin/mc -q mb s3/archive || true;
      /usr/bin/mc -q mb s3/backup || true;
      exit 0;
      "

  s3inbox:
    profiles: ["sda-sweden"]
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}
    command: [ sda-s3inbox ]
    container_name: s3inbox
    depends_on:
      oidc:
        condition: service_healthy
      s3:
        condition: service_started
      postgres:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
    restart: always
    environment:
      - LOG_LEVEL=debug
      - BROKER_ROUTINGKEY=inbox
      - SERVER_JWTPUBKEYPATH=/keys/
      - SERVER_JWTPUBKEYURL=http://oidc:8080/jwk
      - LOG_FORMAT=json
    volumes:
      - ./config.yaml:/config.yaml
      - ./keys:/keys
    ports:
      - "8000:8000"
      - "8001:8001"

  ingest:
    profiles: ["sda-sweden"]
    container_name: ingest
    depends_on:
      postgres:
        condition: service_started
      rabbitmq:
        condition: service_healthy
      s3:
        condition: service_started
      bootstrap:
        condition: service_started
    environment:
      - BROKER_QUEUE=ingest
      - BROKER_ROUTINGKEY=archived
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}
    command: [ sda-ingest ]
    volumes:
      - ./config.yaml:/config.yaml
      - keys:/keys
    restart: always

  verify:
    profiles: ["sda-sweden"]
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}
    command: [ sda-verify ]
    container_name: verify
    depends_on:
      postgres:
        condition: service_started
      rabbitmq:
        condition: service_healthy
      s3:
        condition: service_started
    environment:
      - BROKER_QUEUE=archived
      - BROKER_ROUTINGKEY=verified
    volumes:
      - ./config.yaml:/config.yaml
      - keys:/keys
    restart: always

  finalize:
    profiles: ["sda-sweden"]
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}
    command: [ sda-finalize ]
    container_name: finalize
    depends_on:
      postgres:
        condition: service_started
      rabbitmq:
        condition: service_healthy
    environment:
      - BROKER_QUEUE=accession
      - BROKER_ROUTINGKEY=completed
    volumes:
      - ./config.yaml:/config.yaml
      - keys:/keys
    restart: always

  sync:
    profiles: ["sda-sweden"]
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}
    command: [ sda-sync ]
    container_name: sync
    depends_on:
      postgres:
        condition: service_started
      rabbitmq:
        condition: service_healthy
      s3:
        condition: service_started
    environment:
      - BROKER_QUEUE=mapping_stream
    # uncomment for sftp inbox
      # - SYNC_DESTINATION_TYPE=sftp
      # - SYNC_DESTINATION_SFTP_HOST=sftp-serverfin
      # - SYNC_DESTINATION_SFTP_PORT=22
      # - SYNC_DESTINATION_SFTP_USERNAME=user
      # - SYNC_DESTINATION_SFTP_HOSTKEY=
      # - SYNC_DESTINATION_SFTP_PEMKEYPATH=/keys-sftp/sftp-key.pem
      # - SYNC_DESTINATION_SFTP_PEMKEYPASS=test
    volumes:
      - ./config.yaml:/config.yaml
      - keys:/keys
    # uncomment for sftp inbox
      # - ./keys-sftp:/keys-sftp
    restart: always

  sync-api:
    profiles: ["sda-sweden"]
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}
    command: [ sda-syncapi ]
    container_name: sync-api
    depends_on:
      rabbitmq:
        condition: service_healthy
    environment:
      - SYNC_API_INGESTROUTING=ingest
      - SYNC_API_ACCESSIONROUTING=accession
      - SYNC_API_MAPPINGROUTING=mappings
    ports:
      - "18080:8080"
    restart: always
    volumes:
      - ./config.yaml:/config.yaml

  mapper:
    profiles: ["sda-sweden"]
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}
    command: [ sda-mapper ]
    container_name: mapper
    depends_on:
      postgres:
        condition: service_started
      rabbitmq:
        condition: service_healthy
    environment:
      - BROKER_QUEUE=mappings
    volumes:
      - ./config.yaml:/config.yaml
      - keys:/keys
    restart: always

  bootstrap:
    profiles: ["sda-sweden"]
    depends_on:
      createbucket:
        condition: service_completed_successfully
    command: sh -c /bin/bootstrap.sh -p /keys/c4gh.pub
    container_name: bs
    image: neicnordic/sda-helm-tests-support:latest
    user: 0:0
    volumes:
      - $PWD/scripts/bootstrap.sh:/bin/bootstrap.sh
      - keys:/keys

# Finnish implementation
  postgresfin:
    profiles: ["sda-finland"]
    container_name: postgresfin
    environment:
      - POSTGRES_PASSWORD=rootpasswd
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 2s
      retries: 6
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}-postgres
    ports:
      - "5431:5432"
    volumes:
      - dbdatafin:/var/lib/postgresql/data

  rabbitmqfin:
    profiles: ["sda-finland"]
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}-rabbitmq
    container_name: rabbitmqfin
    environment:
     - RABBITMQ_DEFAULT_PASS=test
     - RABBITMQ_DEFAULT_USER=test
     - MQ_VHOST=sda
    ports:
      - "15674:15672"
      - "5674:5672"
    healthcheck:
      test: [ "CMD", "bash", "-c", "rabbitmq-diagnostics -q check_running && rabbitmq-diagnostics -q check_local_alarms"]
      interval: 5s
      timeout: 120s
      retries: 10

# uncomment for sftp inbox
  # sftp-serverfin:
  #   profiles: ["sda-finland"]
  #   build:
  #       context: dev_utils/sftp-server
  #   hostname: sftp-serv
  #   environment:
  #     - SFTP_USER=user
  #     - SFTP_USER_PASS=user
  #     - DELETE_UPLOADED_FILES=false
  #     - FILE_CHECK_INTERVAL=0
  #     - FILE_AGE=0.01 #minutes
  #     - SFTP_USER_PUB_KEY=/keys/sftp-key.pub
  #   container_name: sftp-server
  #   ports:
  #       - "6222:22"
  #   volumes:
  #       - inboxfin:/uploads
  #       - ./keys-sftp:/keys

  s3fin:
    profiles: ["sda-finland"]
    command: server /data --console-address ":9001"
    container_name: s3fin
    environment:
      - MINIO_ROOT_USER=access
      - MINIO_ROOT_PASSWORD=secretkey
      - MINIO_SERVER_URL=http://127.0.0.1:9000
    healthcheck:
      test: ["CMD", "curl", "-fq", "http://localhost:9000/minio/health/live"]
      interval: 5s
      timeout: 20s
      retries: 3
    image: minio/minio
    ports:
      - "9003:9000"
      - "9004:9001"

  createbucketfin:
    profiles: ["sda-finland"]
    image: minio/mc
    container_name: mcfin
    depends_on:
      s3fin:
        condition: service_started
    entrypoint: >
      /bin/sh -c "
      sleep 10;
      /usr/bin/mc -q config host add s3 http://s3fin:9000 access secretkey;
      /usr/bin/mc -q mb s3/inbox || true;
      /usr/bin/mc -q mb s3/archive || true;
      /usr/bin/mc -q mb s3/sync || true;
      exit 0;
      "

  ingestfin:
    profiles: ["sda-finland"]
    container_name: ingestfin
    depends_on:
      postgresfin:
        condition: service_started
      rabbitmqfin:
        condition: service_healthy
      s3fin:
        condition: service_started
    # uncomment for sftp inbox
      # sftp-serverfin:
      #   condition: service_started
      bootstrapfin:
        condition: service_started
    environment:
    # uncomment for sftp inbox
      # - INBOX_TYPE=posix
      # - INBOX_LOCATION=/uploads/user/upload
      - BROKER_QUEUE=ingest
      - BROKER_ROUTINGKEY=archived
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}
    command: [ sda-ingest ]
    volumes:
    # uncomment for sftp inbox
      # - inboxfin:/uploads
      - ./configfin.yaml:/config.yaml
      - keys:/keys
    # uncomment if using POSIX filesystem
      # - archivefin:/tmp
    restart: always

  verifyfin:
    profiles: ["sda-finland"]
    command: sda-verify
    container_name: verifyfin
    depends_on:
      postgresfin:
        condition: service_started
      rabbitmqfin:
        condition: service_healthy
      s3fin:
        condition: service_started
    # uncomment for sftp inbox
      # sftp-serverfin:
      #   condition: service_started
    environment:
      - BROKER_QUEUE=archived
      - BROKER_ROUTINGKEY=verified
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}
    volumes:
      - ./configfin.yaml:/config.yaml
      - keys:/keys
    # uncomment if using POSIX filesystem
      # - archivefin:/tmp
    restart: always

  finalizefin:
    profiles: ["sda-finland"]
    command: sda-finalize
    container_name: finalizefin
    depends_on:
      postgresfin:
        condition: service_started
      rabbitmqfin:
        condition: service_healthy
    environment:
      - BROKER_QUEUE=accession
      - BROKER_ROUTINGKEY=completed
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}
    volumes:
      - ./configfin.yaml:/config.yaml
      - keys:/keys
    # uncomment if using POSIX filesystem
      # - archivefin:/tmp
      # - backupfin:/tmp
    restart: always

  syncfin:
    profiles: ["sda-finland"]
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}
    command: [ sda-sync ]
    container_name: syncfin
    depends_on:
      postgresfin:
        condition: service_started
      rabbitmqfin:
        condition: service_healthy
      s3fin:
        condition: service_started
    environment:
      - BROKER_QUEUE=mapping_stream
    volumes:
      - ./configfin.yaml:/config.yaml
      - keys:/keys
    # uncomment if using POSIX filesystem
      # - archivefin:/tmp
    restart: always

  sync-apifin:
    profiles: ["sda-finland"]
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}
    command: [ sda-syncapi ]
    container_name: sync-apifin
    depends_on:
      rabbitmqfin:
        condition: service_healthy
    environment:
      - SYNC_API_INGESTROUTING=ingest
      - SYNC_API_ACCESSIONROUTING=accession
      - SYNC_API_MAPPINGROUTING=mappings
    ports:
      - "8090:8080"
    restart: always
    volumes:
      - ./configfin.yaml:/config.yaml

  mapperfin:
    profiles: ["sda-finland"]
    command: sda-mapper
    container_name: mapperfin
    depends_on:
      postgresfin:
        condition: service_started
      rabbitmqfin:
        condition: service_healthy
    environment:
      - BROKER_QUEUE=mappings
    image: ghcr.io/neicnordic/sensitive-data-archive:${TAG}
    volumes:
      - ./configfin.yaml:/config.yaml
      - keys:/keys
    restart: always

  bootstrapfin:
    profiles: ["sda-finland"]
    command: sh -c /bin/bootstrap.sh -p /keys/c4gh.pub
    container_name: bsfin
    image: neicnordic/sda-helm-tests-support:latest
    user: 0:0
    volumes:
      - $PWD/scripts/bootstrap.sh:/bin/bootstrap.sh
      - keys:/keys

volumes:
  keys:
  dbdata:
  dbdatafin:
  inboxfin:
  archivefin:
  backupfin:
  shared: