docker-compose.yml

# ==============================================================================
# NSW Unified Docker Compose
# ==============================================================================
# Usage:
#   cp .env.docker.example .env.docker
#   ./start-docker.sh --env-file=.env.docker
#
# Or directly:
#   docker compose --env-file .env.docker --profile idp --profile db --profile migration up -d --build
#
# Networks:
#   idp-net       — IDP (Thunder) services
#   core-net      — PostgreSQL, backend, trader portal
#   oga-npqs-net  — OGA NPQS backend + portal
#   oga-fcau-net  — OGA FCAU backend + portal
#   oga-ird-net   — OGA IRD backend + portal
#
# The backend is multi-homed on all 5 networks (needs DB, IDP JWKS, OGA endpoints).
# Portal frontends are browser-rendered SPAs — API calls go through localhost ports.
# ==============================================================================

# ---- Networks ----------------------------------------------------------------

networks:
  idp-net:
    driver: bridge
  core-net:
    driver: bridge
  oga-npqs-net:
    driver: bridge
  oga-fcau-net:
    driver: bridge
  oga-ird-net:
    driver: bridge

# ---- Volumes -----------------------------------------------------------------

volumes:
  thunder-db:
  postgres-data:
  oga-npqs-postgres-data:
  backend-uploads:
  oga-npqs-data:
  oga-fcau-data:
  oga-ird-data:



# ---- Services ----------------------------------------------------------------

services:

  # ============================================================================
  # IDP (Thunder) — idp-net — profile: idp
  # ============================================================================

  thunder-db-init:
    image: ghcr.io/asgardeo/thunder:0.29.0
    command: sh -c "cp -r /opt/thunder/repository/database/* /data/"
    volumes:
      - thunder-db:/data
    networks:
      - idp-net
    restart: "no"
    profiles:
      - idp

  thunder-setup:
    image: ghcr.io/asgardeo/thunder:0.29.0
    command: ./setup.sh
    environment:
      THUNDER_ADMIN_USERNAME: ${THUNDER_ADMIN_USERNAME:-admin}
      THUNDER_ADMIN_PASSWORD: ${THUNDER_ADMIN_PASSWORD:-1234}
      THUNDER_SAMPLE_USER_PASSWORD: ${THUNDER_SAMPLE_USER_PASSWORD:-1234}
      THUNDER_M2M_CLIENT_SECRET: ${THUNDER_M2M_CLIENT_SECRET:-1234}
      THUNDER_M2M_NPQS_SECRET: ${THUNDER_M2M_NPQS_SECRET:-${THUNDER_M2M_CLIENT_SECRET:-1234}}
      THUNDER_M2M_FCAU_SECRET: ${THUNDER_M2M_FCAU_SECRET:-${THUNDER_M2M_CLIENT_SECRET:-1234}}
      THUNDER_M2M_IRD_SECRET: ${THUNDER_M2M_IRD_SECRET:-${THUNDER_M2M_CLIENT_SECRET:-1234}}
      THUNDER_API_BASE: ${THUNDER_API_BASE:-https://thunder:8090}
      THUNDER_PUBLIC_URL: ${IDP_PUBLIC_URL:-https://thunder:8090}
    volumes:
      - thunder-db:/opt/thunder/repository/database
      - ./idp/01-default-resources.sh:/opt/thunder/bootstrap/01-default-resources.sh
      - ./idp/02-sample-resources.sh:/opt/thunder/bootstrap/02-sample-resources.sh
    networks:
      - idp-net
    depends_on:
      thunder-db-init:
        condition: service_completed_successfully
    restart: "no"
    profiles:
      - idp

  thunder:
    image: ghcr.io/asgardeo/thunder:0.29.0
    ports:
      - "${IDP_PORT:-8090}:8090"
    volumes:
      - thunder-db:/opt/thunder/repository/database
      - ./idp/deployment.yaml:/opt/thunder/repository/conf/deployment.yaml
    networks:
      - idp-net
    depends_on:
      thunder-setup:
        condition: service_completed_successfully
    profiles:
      - idp

  # ============================================================================
  # PostgreSQL — core-net — profile: db
  # ============================================================================

  postgres:
    image: postgres:16-alpine
    ports:
      - "${DB_PORT:-55432}:5432"
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD:-changeme}
      POSTGRES_DB: ${DB_NAME:-nsw_db}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - core-net
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USERNAME:-postgres}"]
      interval: 5s
      timeout: 5s
      retries: 10
    profiles:
      - db

  # ============================================================================
  # DB Migrations — core-net — profile: migration
  # ============================================================================

  db-migration:
    image: postgres:16-alpine
    working_dir: /migrations
    volumes:
      - ./backend/internal/database/migrations:/migrations:ro
    environment:
      PGPASSWORD: ${DB_PASSWORD:-changeme}
      DB_HOST: postgres
      DB_PORT: "5432"
      DB_USERNAME: ${DB_USERNAME:-postgres}
      DB_NAME: ${DB_NAME:-nsw_db}
      NPQS_OGA_SUBMISSION_URL: http://oga-npqs:${OGA_NPQS_PORT:-8081}/api/oga/inject
      FCAU_OGA_SUBMISSION_URL: http://oga-fcau:${OGA_FCAU_PORT:-8082}/api/oga/inject
      PRECONSIGNMENT_OGA_SUBMISSION_URL: http://oga-ird:${OGA_IRD_PORT:-8083}/api/oga/inject
    networks:
      - core-net
    depends_on:
      postgres:
        condition: service_healthy
    entrypoint: ["sh", "-c"]
    command:
      - |
        set -e
        echo "Dropping database $${DB_NAME}..."
        psql -h "$${DB_HOST}" -p "$${DB_PORT}" -U "$${DB_USERNAME}" -d postgres \
          -c "DROP DATABASE IF EXISTS $${DB_NAME} WITH (FORCE);"

        echo "Creating database $${DB_NAME}..."
        psql -h "$${DB_HOST}" -p "$${DB_PORT}" -U "$${DB_USERNAME}" -d postgres \
          -c "CREATE DATABASE $${DB_NAME};"

        echo "Starting database migrations..."
        for FILE in \
          001_initial_schema.sql \
          001_insert_seed_hscodes.sql \
          001_insert_seed_form_templates.sql \
          001_insert_seed_workflow_node_templates.sql \
          001_insert_seed_workflow_templates.sql \
          001_insert_seed_workflow_hscode_map.sql \
          001_insert_cha_entity.sql \
          001_insert_seed_pre_consignment_template.sql \
          002_workflow_table.sql; do
          if [ -f "$$FILE" ]; then
            echo "Executing: $$FILE"
            psql \
              -v ON_ERROR_STOP=1 \
              -v NPQS_OGA_SUBMISSION_URL="$${NPQS_OGA_SUBMISSION_URL}" \
              -v FCAU_OGA_SUBMISSION_URL="$${FCAU_OGA_SUBMISSION_URL}" \
              -v PRECONSIGNMENT_OGA_SUBMISSION_URL="$${PRECONSIGNMENT_OGA_SUBMISSION_URL}" \
              -h "$${DB_HOST}" -p "$${DB_PORT}" -U "$${DB_USERNAME}" -d "$${DB_NAME}" \
              -f "$$FILE"
          else
            echo "Warning: $$FILE not found, skipping."
          fi
        done
        echo "Migrations completed successfully."
    restart: "no"
    profiles:
      - db

  # ============================================================================
  # Backend — core-net + idp-net + all oga-*-net
  # ============================================================================

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    image: nsw-backend:local
    ports:
      - "${BACKEND_PORT:-8080}:8080"
    volumes:
      - backend-uploads:/app/bucket
    networks:
      - core-net
      - idp-net
      - oga-npqs-net
      - oga-fcau-net
      - oga-ird-net
    depends_on:
      db-migration:
        condition: service_completed_successfully
        required: false
      postgres:
        condition: service_healthy
        required: false
    environment:
      DB_HOST: postgres
      DB_PORT: "5432"
      DB_USERNAME: ${DB_USERNAME:-postgres}
      DB_PASSWORD: ${DB_PASSWORD:-changeme}
      DB_NAME: ${DB_NAME:-nsw_db}
      DB_SSLMODE: ${DB_SSLMODE:-disable}
      SERVER_PORT: "8080"
      SERVICE_URL: http://backend:8080
      SERVER_DEBUG: ${SERVER_DEBUG:-true}
      SERVER_LOG_LEVEL: ${SERVER_LOG_LEVEL:-info}
      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost:3000,http://localhost:5173,http://localhost:5174,http://localhost:5175,http://localhost:5176}
      AUTH_JWKS_URL: https://thunder:8090/oauth2/jwks
      AUTH_ISSUER: ${AUTH_ISSUER:-https://localhost:8090}
      AUTH_CLIENT_ID: ${AUTH_CLIENT_ID:-TRADER_PORTAL_APP}
      AUTH_AUDIENCE: ${AUTH_AUDIENCE:-TRADER_PORTAL_APP}
      AUTH_JWKS_INSECURE_SKIP_VERIFY: ${AUTH_JWKS_INSECURE_SKIP_VERIFY:-true}
      STORAGE_TYPE: ${STORAGE_TYPE:-local}
      STORAGE_LOCAL_BASE_DIR: ${STORAGE_LOCAL_BASE_DIR:-/app/bucket}

  # ============================================================================
  # Trader Portal — core-net
  # ============================================================================

  trader-portal:
    build:
      context: ./portals
      dockerfile: apps/trader-app/Dockerfile
    image: nsw-trader-portal:local
    ports:
      - "${TRADER_APP_PORT:-5173}:80"
    networks:
      - core-net
    environment:
      VITE_API_BASE_URL: http://localhost:${BACKEND_PORT:-8080}/api/v1
      VITE_IDP_BASE_URL: ${IDP_PUBLIC_URL:-https://localhost:8090}
      VITE_IDP_CLIENT_ID: ${TRADER_IDP_CLIENT_ID:-TRADER_PORTAL_APP}
      VITE_IDP_TRADER_GROUP_NAME: ${TRADER_IDP_TRADER_GROUP_NAME:-Traders}
      VITE_IDP_CHA_GROUP_NAME: ${TRADER_IDP_CHA_GROUP_NAME:-CHA}
      VITE_APP_URL: http://localhost:${TRADER_APP_PORT:-5173}
      VITE_IDP_SCOPES: ${IDP_SCOPES:-openid,profile,email,group,role}
      VITE_IDP_PLATFORM: ${IDP_PLATFORM:-AsgardeoV2}
      VITE_SHOW_AUTOFILL_BUTTON: ${SHOW_AUTOFILL_BUTTON:-true}

  # ============================================================================
  # OGA NPQS — oga-npqs-net
  # ============================================================================

  oga-npqs-db:
    image: postgres:16-alpine
    ports:
      - "${OGA_NPQS_DB_PORT:-55433}:5432"
    environment:
      POSTGRES_PASSWORD: ${OGA_NPQS_DB_PASSWORD:-changeme}
      POSTGRES_DB: ${OGA_NPQS_DB_NAME:-oga_npqs_db}
    volumes:
      - oga-npqs-postgres-data:/var/lib/postgresql/data
    networks:
      - oga-npqs-net
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${OGA_NPQS_DB_USERNAME:-postgres}"]
      interval: 5s
      timeout: 5s
      retries: 10

  oga-npqs:
    build:
      context: ./oga
      dockerfile: Dockerfile
    image: nsw-oga-backend:local
    ports:
      - "${OGA_NPQS_PORT:-8081}:${OGA_NPQS_PORT:-8081}"
    volumes:
      - oga-npqs-data:/data
    networks:
      - oga-npqs-net
    depends_on:
      oga-npqs-db:
        condition: service_healthy
    environment:
      OGA_PORT: ${OGA_NPQS_PORT:-8081}
      OGA_DB_DRIVER: ${OGA_NPQS_DB_DRIVER:-postgres}
      OGA_DB_HOST: ${OGA_NPQS_DB_HOST:-oga-npqs-db}
      OGA_DB_PORT: "5432"
      OGA_DB_USER: ${OGA_NPQS_DB_USERNAME:-postgres}
      OGA_DB_PASSWORD: ${OGA_NPQS_DB_PASSWORD:-changeme}
      OGA_DB_NAME: ${OGA_NPQS_DB_NAME:-oga_npqs_db}
      OGA_DB_SSLMODE: disable
      OGA_DEFAULT_FORM_ID: ${OGA_NPQS_DEFAULT_FORM_ID:-default}
      OGA_ALLOWED_ORIGINS: ${OGA_NPQS_ALLOWED_ORIGINS:-http://localhost:5174}

  oga-portal-npqs:
    build:
      context: ./portals
      dockerfile: apps/oga-app/Dockerfile
    image: nsw-oga-portal:local
    ports:
      - "${OGA_APP_NPQS_PORT:-5174}:80"
    networks:
      - oga-npqs-net
    environment:
      VITE_INSTANCE_CONFIG: ${OGA_APP_NPQS_INSTANCE_CONFIG:-npqs}
      VITE_API_BASE_URL: http://localhost:${OGA_NPQS_PORT:-8081}
      VITE_IDP_BASE_URL: ${IDP_PUBLIC_URL:-https://localhost:8090}
      VITE_IDP_CLIENT_ID: ${NPQS_IDP_CLIENT_ID:-OGA_PORTAL_APP_NPQS}
      VITE_APP_URL: http://localhost:${OGA_APP_NPQS_PORT:-5174}
      VITE_IDP_SCOPES: ${IDP_SCOPES:-openid,profile,email}
      VITE_IDP_PLATFORM: ${IDP_PLATFORM:-AsgardeoV2}

  # ============================================================================
  # OGA FCAU — oga-fcau-net
  # ============================================================================

  oga-fcau:
    image: nsw-oga-backend:local
    ports:
      - "${OGA_FCAU_PORT:-8082}:${OGA_FCAU_PORT:-8082}"
    volumes:
      - oga-fcau-data:/data
    networks:
      - oga-fcau-net
    depends_on:
      - oga-npqs
    environment:
      OGA_PORT: ${OGA_FCAU_PORT:-8082}
      OGA_DB_DRIVER: ${OGA_FCAU_DB_DRIVER:-sqlite}
      OGA_DB_PATH: ${OGA_FCAU_DB_PATH:-/data/oga_applications.db}
      OGA_DEFAULT_FORM_ID: ${OGA_FCAU_DEFAULT_FORM_ID:-default}
      OGA_ALLOWED_ORIGINS: ${OGA_FCAU_ALLOWED_ORIGINS:-http://localhost:5175}

  oga-portal-fcau:
    image: nsw-oga-portal:local
    ports:
      - "${OGA_APP_FCAU_PORT:-5175}:80"
    networks:
      - oga-fcau-net
    depends_on:
      - oga-portal-npqs
    environment:
      VITE_INSTANCE_CONFIG: ${OGA_APP_FCAU_INSTANCE_CONFIG:-fcau}
      VITE_API_BASE_URL: http://localhost:${OGA_FCAU_PORT:-8082}
      VITE_IDP_BASE_URL: ${IDP_PUBLIC_URL:-https://localhost:8090}
      VITE_IDP_CLIENT_ID: ${FCAU_IDP_CLIENT_ID:-OGA_PORTAL_APP_FCAU}
      VITE_APP_URL: http://localhost:${OGA_APP_FCAU_PORT:-5175}
      VITE_IDP_SCOPES: ${IDP_SCOPES:-openid,profile,email}
      VITE_IDP_PLATFORM: ${IDP_PLATFORM:-AsgardeoV2}

  # ============================================================================
  # OGA IRD — oga-ird-net
  # ============================================================================

  oga-ird:
    image: nsw-oga-backend:local
    ports:
      - "${OGA_IRD_PORT:-8083}:${OGA_IRD_PORT:-8083}"
    volumes:
      - oga-ird-data:/data
    networks:
      - oga-ird-net
    depends_on:
      - oga-npqs
    environment:
      OGA_PORT: ${OGA_IRD_PORT:-8083}
      OGA_DB_DRIVER: ${OGA_IRD_DB_DRIVER:-sqlite}
      OGA_DB_PATH: ${OGA_IRD_DB_PATH:-/data/oga_applications.db}
      OGA_DEFAULT_FORM_ID: ${OGA_IRD_DEFAULT_FORM_ID:-default}
      OGA_ALLOWED_ORIGINS: ${OGA_IRD_ALLOWED_ORIGINS:-http://localhost:5176}

  oga-portal-ird:
    image: nsw-oga-portal:local
    ports:
      - "${OGA_APP_IRD_PORT:-5176}:80"
    networks:
      - oga-ird-net
    depends_on:
      - oga-portal-npqs
    environment:
      VITE_INSTANCE_CONFIG: ${OGA_APP_IRD_INSTANCE_CONFIG:-ird}
      VITE_API_BASE_URL: http://localhost:${OGA_IRD_PORT:-8083}
      VITE_IDP_BASE_URL: ${IDP_PUBLIC_URL:-https://localhost:8090}
      VITE_IDP_CLIENT_ID: ${IRD_IDP_CLIENT_ID:-OGA_PORTAL_APP_IRD}
      VITE_APP_URL: http://localhost:${OGA_APP_IRD_PORT:-5176}
      VITE_IDP_SCOPES: ${IDP_SCOPES:-openid,profile,email}
      VITE_IDP_PLATFORM: ${IDP_PLATFORM:-AsgardeoV2}