alteredcore-website/docker-compose.stack.yml at preprod · FragileClick/alteredcore-website · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
# Full local / CI stack: the site wired to a local Keycloak and a local decks API, with the
# SPA plugins active. Used by the Playwright tests (tests/e2e) and the plugins CI workflow.
#
#   (cd plugins/rebuilder/app && npm ci && npm run build)   # SPA bundles are not committed
#   docker compose -f docker-compose.yml -f docker-compose.stack.yml up -d --build --wait
#
# Site http://localhost:${WEB_PORT:-8080} · Keycloak http://auth.altered.local.gd:18080 (admin/admin,
# users alice / bob, password TestPassword1234) · decks API http://localhost:8001
# Cards and CDN are production (read-only). Digital ownership is a mock (docker/stack/ownership-mock).
services:
  web:
    # Named images: the CI builds them first (docker buildx bake, with a cache), then starts the
    # stack without building.
    image: alteredcore-stack-web
    volumes:
      - .:/var/www/html
      - ./docker/stack/config.stack.php:/var/www/html/config.local.php:ro
    environment:
      AC_ACTIVATE_PLUGINS: "${AC_ACTIVATE_PLUGINS:-core-altered-cards rebuilder ownership}"
      AC_STACK_SEED: "1"
      # 1: copy production's public content once (docker/stack/mirror-prod.php).
      AC_STACK_MIRROR: "${AC_STACK_MIRROR:-}"
    depends_on:
      db:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      decks-api:
        condition: service_healthy
      ownership:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://localhost/pages/index"]
      interval: 5s
      timeout: 5s
      retries: 30

  # Stand-in for AlteredOwnership (alt-art families, preferences, preference mode), reached by the
  # site only (OWNERSHIP_API_URL); built on the production cards API.
  ownership:
    image: php:8.4-cli-alpine
    command: ["php", "-S", "0.0.0.0:8080", "/app/index.php"]
    volumes:
      - ./docker/stack/ownership-mock:/app:ro
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/health"]
      interval: 3s
      timeout: 3s
      retries: 20

  keycloak:
    image: quay.io/keycloak/keycloak:26.0
    command: ["start-dev", "--import-realm", "--http-port=18080", "--health-enabled=true"]
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
      KC_HOSTNAME: http://auth.altered.local.gd:18080
      KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "false"
      KC_HTTP_ENABLED: "true"
      # JDK 21 dies with SIGILL on recent Apple Silicon (SVE/SME): disable SVE, ignored on x86.
      JAVA_OPTS_APPEND: "-XX:+IgnoreUnrecognizedVMOptions -XX:UseSVE=0"
    ports:
      - "127.0.0.1:18080:18080"  # loopback only: start-dev with admin/admin
    volumes:
      - ./docker/stack/players-realm.json:/opt/keycloak/data/import/players-realm.json:ro
    networks:
      default:
        aliases:
          - auth.altered.local.gd
    healthcheck:
      # The image has no curl: talk HTTP to the management port with bash.
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && printf 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && grep -q '\"UP\"' <&3"]
      interval: 5s
      timeout: 5s
      retries: 60

  decks-db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: decks
      POSTGRES_PASSWORD: decks
      POSTGRES_DB: altered_deck
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U decks -d altered_deck"]
      interval: 3s
      timeout: 3s
      retries: 30

  decks-api:
    # Altered-Community/altered-core-decks-api, pinned: bump the commit to follow the API.
    image: alteredcore-stack-decks-api
    build:
      context: https://github.com/Altered-Community/altered-core-decks-api.git#156d6e83e50d14b2ccf4da449b026ccdc38407c3
      target: frankenphp_prod
    environment:
      APP_ENV: prod
      APP_SECRET: stack-dev-app-secret-not-secret
      SERVER_NAME: ":80"
      DEFAULT_URI: http://localhost:8001
      DATABASE_URL: postgresql://decks:decks@decks-db:5432/altered_deck?serverVersion=16&charset=utf8
      CORS_ALLOW_ORIGIN: '^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$'
      KEYCLOAK_BASE_URL: http://auth.altered.local.gd:18080
      KEYCLOAK_REALM: players
      KEYCLOAK_CLIENT_ID: main-site
      KEYCLOAK_CLIENT_SECRET: dev-main-site-secret
      DEV_AUTH_ENABLED: "false"
      ALTERED_CORE_URL: https://cards.alteredcore.org
      CARD_DATA_PROVIDER: altered_core
      MERCURE_PUBLISHER_JWT_KEY: "!ChangeThisMercureHubJWTSecretKey!"
      MERCURE_SUBSCRIBER_JWT_KEY: "!ChangeThisMercureHubJWTSecretKey!"
      MERCURE_PUBLISHER_JWT_ALG: HS256
      MERCURE_SUBSCRIBER_JWT_ALG: HS256
      # The image's Mercure now refuses publisher_jwt / subscriber_jwt outside compatibility mode (the build pulls
      # the latest FrankenPHP base, so the pinned commit no longer pins it).
      MERCURE_EXTRA_DIRECTIVES: "protocol_version_compatibility 8"
    ports:
      - "127.0.0.1:8001:80"
    depends_on:
      decks-db:
        condition: service_healthy