docker-compose.yaml

services:
  auth-db:
    image: postgres:16
    container_name: auth-db
    environment:
      POSTGRES_USER: ${KC_DB_USER}
      POSTGRES_PASSWORD: ${KC_DB_PASS}
      POSTGRES_DB: keycloak
      # POSTGRES_PORT is NOT used, I think
      POSTGRES_PORT: ${KC_DB_PORT}
      
    # volumes:
    #   - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped
    network_mode: host
    command: postgres -p ${KC_DB_PORT}


  pubsub-emulator:
    image: google/cloud-sdk:latest
    container_name: pubsub-emulator
    command: "/pubsub-setup.sh ${PUBSUB_EMULATOR_PORT} ${PUBSUB_PROJECT} ${GCP_EVENT_TOPIC_ID} ${KC_TAPIR_BRIDGE_SUBSCRIPTION}"
    ports:
      - "${PUBSUB_EMULATOR_PORT}:${PUBSUB_EMULATOR_PORT}"
    environment:
      PUBSUB_EMULATOR_HOST: "0.0.0.0:${PUBSUB_EMULATOR_PORT}"
    network_mode: host
    volumes:
      - ./tests/config/pubsub-setup.sh:/pubsub-setup.sh:ro

  keycloak:
    image: ${KC_DOCKER_TAG}:latest
    container_name: keycloak
    environment:
      DB_ADDR: 127.0.0.1:${KC_DB_PORT}
      DB_DATABASE: keycloak
      DB_VENDOR: postgres
      KC_DB_PASS: ${KC_DB_PASS}
      KC_DB_USER: ${KC_DB_USER}
      GCP_CREDENTIALS: ${GCP_CRED}
      GCP_PROJECT_ID: ${PUBSUB_PROJECT}
      KC_JDBC_CONNECTION: ${KC_JDBC_CONNECTION}
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: ${KC_ADMIN_PASSWORD}
      LOG_LEVEL: "INFO,freemarker:DEBUG"
      LOG_OUTPUT_FORMAT: "--log-console-output=default"
      PUBSUB_EMULATOR_HOST: 127.0.0.1:${PUBSUB_EMULATOR_PORT}
      KC_HTTP_PORT: ${KC_PORT}
      #
      # These are used for troubleshooting of audit event not going into pubsub.
      # (not sure this works with te pubsub emulator)
      GRPC_LOG_LEVEL: DEBUG
      GRPC_TRACE: tcp,http,api
    command:
      - start-dev --verbose --http-port ${KC_PORT}
    # This is needed when you connect to DB on GCP
    # volumes:
    #   - ${PWD}/keycloak_bend/cert:/secrets/authdb-certs:ro

    ports:
      - "${KC_PORT}:${KC_PORT}"
    depends_on:
      - auth-db
      - pubsub-emulator
      - legacy-auth-provider
    network_mode: host

  arxiv-db:
    image: mysql:5.7.20
    container_name: arxiv-test-db
    ports:
      - "${ARXIV_DB_PORT}:${ARXIV_DB_PORT}"  # Host port:Container port
    environment:
      MYSQL_ROOT_PASSWORD: root_password
      MYSQL_DATABASE: arXiv
      MYSQL_USER: arxiv
      MYSQL_PASSWORD: arxiv_password
      MYSQL_TCP_PORT: ${ARXIV_DB_PORT}
    # volumes:
    #  - mysql_data:/var/lib/mysql  # Persist data locally (optional)
    network_mode: host

  oauth2-authenticator:
    image: ${ARXIV_OAUTH2_CLIENT_TAG}
    container_name: oauth2-authenticator
    environment:
      PORT: ${ARXIV_OAUTH2_APP_PORT}
      # hostname keycloak for non-host network
      KEYCLOAK_SERVER_URL: http://localhost:${KC_PORT}
      OAUTH2_CALLBACK_URL: ${AAA_CALLBACK_URL}
      ARXIV_USER_SECRET: ${KEYCLOAK_TEST_CLIENT_SECRET}
      CLASSIC_DB_URI: ${CLASSIC_DB_URI}
      SESSION_DURATION: 36000
      CLASSIC_COOKIE_NAME: tapir_session
      CLASSIC_SESSION_HASH: ${CLASSIC_SESSION_HASH}
      JWT_SECRET: ${JWT_SECRET}
      # Do not set DOMAIN - this is to designate the cookie domain and for
      # local run, having this is harmful.
      # In production, this is probably set to .arxiv.org
      # DOMAIN: localhost
    ports:
      - "${ARXIV_OAUTH2_APP_PORT}:${ARXIV_OAUTH2_APP_PORT}"  # Host port:Container port

    network_mode: host
    depends_on:
      - arxiv-db
      - keycloak
      - keycloak-setup

  legacy-auth-provider:
    image: ${LEGACY_AUTH_DOCKER_TAG}
    container_name: legacy-auth-provider
    ports:
      - "${LEGACY_AUTH_PORT}:${LEGACY_AUTH_PORT}"  # Host port:Container port
    network_mode: host
    environment:
      API_SECRET_KEY: "${LEGACY_AUTH_API_TOKEN}"
      PORT: ${LEGACY_AUTH_PORT}
      # CLASSIC_DB_URI: "mysql://arxiv:arxiv_password@arxiv-test-db:3306/arXiv"
      CLASSIC_DB_URI: ${CLASSIC_DB_URI}
      # legacy-auth-provider
      URI: "http://localhost:${LEGACY_AUTH_PORT}/auth"
    depends_on:
      - arxiv-db

  keycloak-tapir-bridge:
    image: "${KC_TAPIR_BRIDGE_DOCKER_TAG}"
    container_name: keycloak-tapir-bridge
    environment:
      PUBSUB_EMULATOR_HOST: 127.0.0.1:${PUBSUB_EMULATOR_PORT}
      # IRL, you set this so the app can read the events from pubsub
      # GOOGLE_APPLICATION_CREDENTIALS: sync-test.json
      SUBSCRIPTION: ${KC_TAPIR_BRIDGE_SUBSCRIPTION}
      # CLASSIC_DB_URI: "mysql://arxiv:arxiv_password@arxiv-test-db:3306/arXiv"
      CLASSIC_DB_URI: ${CLASSIC_DB_URI}
    network_mode: host
    depends_on:
      - arxiv-db
      - pubsub-emulator
    command: python main.py --project "${PUBSUB_PROJECT}" --subscription "${KC_TAPIR_BRIDGE_SUBSCRIPTION}" --debug 


  testsite:
    image: ${TESTSITE_TAG}:latest
    container_name: testsite
    ports:
      - "${TESTSITE_PORT}:${TESTSITE_PORT}"  # Host port:Container port
    environment:
      PORT: ${TESTSITE_PORT}
      JWT_SECRET: ${JWT_SECRET}
      KC_URL_PUBLIC: ${KC_URL_PUBLIC}
      KEYCLOAK_TEST_CLIENT_SECRET: ${KEYCLOAK_TEST_CLIENT_SECRET}
      NGINX_PORT: ${NGINX_PORT} 
    network_mode: host

  nginx:
    image: nginx:latest
    container_name: nginx-proxy
    volumes:
      - ./tests/config/nginx-docker.conf:/etc/nginx/nginx.conf:ro  # Mount custom NGINX config
      - ./tests/nginx/:/nginx/:ro
      - ./tests/log.d/:/log.d/
    ports:
      - "${NGINX_PORT}:${NGINX_PORT}"
    depends_on:
      - oauth2-authenticator
      - testsite
    network_mode: host
    
  mta:
    image: "${TEST_MTA_TAG}"
    container_name: test-mta
    ports:
      - "${SMTP_PORT}:${SMTP_PORT}"
      - "${MAILSTORE_PORT}:${MAILSTORE_PORT}"
    network_mode: host
    environment:
      SMTP_PORT: "${SMTP_PORT}"
      MAILSTORE_PORT: "${MAILSTORE_PORT}"
      
    
  keycloak-setup:
    image: python:3.11
    container_name: keycloak-setup
    depends_on:
      - keycloak
    network_mode: host
    volumes:
      - ./keycloak_bend:/keycloak_bend:ro
    environment:
      # This is running in the docker network - so use private address
      KC_URL: "${KC_URL_PRIVATE}"
      KC_ADMIN_PASSWORD: "${KC_ADMIN_PASSWORD}"
      ARXIV_USER_SECRET: "${KEYCLOAK_TEST_CLIENT_SECRET}"
      LEGACY_AUTH_API_TOKEN: "${LEGACY_AUTH_API_TOKEN}"
      SOURCE: /keycloak_bend/realms/arxiv-realm-localhost.json

    entrypoint: sh /keycloak_bend/tools/setup-arxiv-realm.sh

  arxiv-db-setup:
    image: python:3.11
    container_name: arxiv-db-setup
    depends_on:
      - arxiv-db
    network_mode: host
    environment:
      ARXIV_DB_HOST: 127.0.0.1
      ARXIV_DB_PORT: ${ARXIV_DB_PORT}
    volumes:
      - ./:/arxiv-keycloak/:ro
    entrypoint: bash /arxiv-keycloak/tools/load_test_data.sh
    
# volumes:
#   postgres_data:

networks:
  arxiv-network:
    driver: bridge