version: '3.8'

# Demo stack secrets — override via .env file or environment variables.
# These are NOT production credentials. Generate your own before deploying.
x-dd-secrets: &dd-secrets
  DD_SECRET_KEY: ${DD_SECRET_KEY:-CHANGE_ME_generate_a_random_secret_key}
  DD_CREDENTIAL_AES_256_KEY: ${DD_CREDENTIAL_AES_256_KEY:-CHANGE_ME_generate_a_base64_aes_key}

services:
  # PostgreSQL for Charybdis
  postgres-charybdis:
    image: postgres:15-alpine
    container_name: charybdis-postgres
    environment:
      POSTGRES_DB: charybdis
      POSTGRES_USER: charybdis
      POSTGRES_PASSWORD: ${CHARYBDIS_DB_PASSWORD:-charybdis}
    ports:
      - "5432:5432"
    volumes:
      - charybdis-postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U charybdis"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - charybdis-network

  # PostgreSQL for DefectDojo
  postgres-defectdojo:
    image: postgres:15-alpine
    container_name: defectdojo-postgres
    environment:
      POSTGRES_DB: defectdojo
      POSTGRES_USER: defectdojo
      POSTGRES_PASSWORD: ${DD_DB_PASSWORD:-defectdojo}
    volumes:
      - defectdojo-postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U defectdojo"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - charybdis-network

  # Redis for DefectDojo
  redis-defectdojo:
    image: redis:7-alpine
    container_name: defectdojo-redis
    networks:
      - charybdis-network

  # DefectDojo
  defectdojo-uwsgi:
    image: defectdojo/defectdojo-django:2.38.1
    platform: linux/amd64  # Force x86_64 emulation for ARM64 (Mac Silicon)
    container_name: defectdojo-uwsgi
    depends_on:
      postgres-defectdojo:
        condition: service_healthy
      redis-defectdojo:
        condition: service_started
    environment:
      DD_DEBUG: 'True'
      DD_ALLOWED_HOSTS: '*'
      DD_DATABASE_URL: postgresql://defectdojo:${DD_DB_PASSWORD:-defectdojo}@postgres-defectdojo:5432/defectdojo
      DD_CELERY_BROKER_URL: redis://redis-defectdojo:6379/0
      <<: *dd-secrets
      DD_INITIALIZE: 'true'
      DD_ADMIN_USER: ${DD_ADMIN_USER:-admin}
      DD_ADMIN_PASSWORD: ${DD_ADMIN_PASSWORD:-admin}
      DD_ADMIN_MAIL: 'admin@example.com'
    ports:
      - "8080:8081"  # DefectDojo HTTP endpoint is on 8081 inside container
    volumes:
      - defectdojo-media:/app/media
    networks:
      - charybdis-network
    # Healthcheck disabled - DefectDojo takes time to initialize
    # Access will be available after ~2 minutes
    # healthcheck:
    #   test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8080/').read()"]
    #   interval: 30s
    #   timeout: 10s
    #   retries: 5
    #   start_period: 120s

  # DefectDojo Celery Worker
  defectdojo-celery:
    image: defectdojo/defectdojo-django:2.38.1
    platform: linux/amd64  # Force x86_64 emulation for ARM64 (Mac Silicon)
    container_name: defectdojo-celery
    depends_on:
      - defectdojo-uwsgi
      - redis-defectdojo
    environment:
      DD_DATABASE_URL: postgresql://defectdojo:${DD_DB_PASSWORD:-defectdojo}@postgres-defectdojo:5432/defectdojo
      DD_CELERY_BROKER_URL: redis://redis-defectdojo:6379/0
      <<: *dd-secrets
    entrypoint: ['/entrypoint-celery-worker.sh']
    networks:
      - charybdis-network

  # DefectDojo Celery Beat
  defectdojo-beat:
    image: defectdojo/defectdojo-django:2.38.1
    platform: linux/amd64  # Force x86_64 emulation for ARM64 (Mac Silicon)
    container_name: defectdojo-beat
    depends_on:
      - defectdojo-celery
    environment:
      DD_DATABASE_URL: postgresql://defectdojo:${DD_DB_PASSWORD:-defectdojo}@postgres-defectdojo:5432/defectdojo
      DD_CELERY_BROKER_URL: redis://redis-defectdojo:6379/0
      <<: *dd-secrets
    entrypoint: ['/entrypoint-celery-beat.sh']
    networks:
      - charybdis-network

  # Keycloak (Identity Provider)
  keycloak:
    image: quay.io/keycloak/keycloak:24.0
    container_name: charybdis-keycloak
    command: start-dev --import-realm
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
    ports:
      - "8082:8080"
    volumes:
      - ./scripts/keycloak/charybdis-realm.json:/opt/keycloak/data/import/charybdis-realm.json:ro
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/8080 && echo -e 'GET /health/ready HTTP/1.1\r\nHost: localhost\r\n\r\n' >&3 && cat <&3 | grep -q '200'"]
      interval: 10s
      timeout: 5s
      retries: 15
      start_period: 30s
    networks:
      - charybdis-network

  # Charybdis
  charybdis:
    build:
      context: ..
      dockerfile: Dockerfile
    container_name: charybdis
    depends_on:
      postgres-charybdis:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      defectdojo-uwsgi:
        condition: service_started  # Changed from service_healthy since healthcheck is disabled
    environment:
      DATABASE_URL: postgresql://charybdis:${CHARYBDIS_DB_PASSWORD:-charybdis}@postgres-charybdis:5432/charybdis
      RUST_LOG: info
      DEFECTDOJO_API_URL: http://defectdojo-uwsgi:8081
      DEFECTDOJO_API_TOKEN: ${DEFECTDOJO_API_TOKEN:-changeme}
    ports:
      - "50051:50051"  # gRPC
      - "8081:8080"    # YAML adapter
    volumes:
      - ./config.toml:/app/config.toml:ro
    networks:
      - charybdis-network
    restart: unless-stopped

  # Backstage (commented out - requires custom build)
  # To enable Backstage:
  # 1. Follow https://backstage.io/docs/getting-started/create-an-app
  # 2. Build Docker image: cd backstage-app && yarn install && yarn build
  # 3. Uncomment this section and postgres-backstage below

  # backstage:
  #   build:
  #     context: ./backstage-app
  #     dockerfile: Dockerfile
  #   container_name: backstage
  #   depends_on:
  #     - charybdis
  #     - postgres-backstage
  #   environment:
  #     POSTGRES_HOST: postgres-backstage
  #     POSTGRES_PORT: 5432
  #     POSTGRES_USER: backstage
  #     POSTGRES_PASSWORD: backstage
  #     CHARYBDIS_URL: http://charybdis:8080
  #   ports:
  #     - "3000:3000"
  #     - "7007:7007"
  #   volumes:
  #     - ./backstage/app-config.yaml:/app/app-config.yaml:ro
  #   networks:
  #     - charybdis-network
  #   restart: unless-stopped

  # postgres-backstage:
  #   image: postgres:15-alpine
  #   container_name: backstage-postgres
  #   environment:
  #     POSTGRES_DB: backstage
  #     POSTGRES_USER: backstage
  #     POSTGRES_PASSWORD: backstage
  #   volumes:
  #     - backstage-postgres-data:/var/lib/postgresql/data
  #   healthcheck:
  #     test: ["CMD-SHELL", "pg_isready -U backstage"]
  #     interval: 10s
  #     timeout: 5s
  #     retries: 5
  #   networks:
  #     - charybdis-network

  # Helper: grpcurl for testing
  grpcurl:
    image: fullstorydev/grpcurl:latest
    container_name: charybdis-grpcurl
    network_mode: service:charybdis
    entrypoint: ["/bin/sh"]
    command: ["-c", "sleep infinity"]
    profiles:
      - tools

volumes:
  charybdis-postgres-data:
  defectdojo-postgres-data:
  defectdojo-media:
  # backstage-postgres-data:  # Uncomment if enabling Backstage

networks:
  charybdis-network:
    driver: bridge