name: who_need_help_external_boundaries

x-boundary-app-environment: &boundary-app-environment
  DATABASE_URL: ${EXTERNAL_DATABASE_URL:?Set EXTERNAL_DATABASE_URL}
  SECRET_KEY_BASE: ${EXTERNAL_SECRET_KEY_BASE:?Set EXTERNAL_SECRET_KEY_BASE}
  HANDOVER_SECRET: ${EXTERNAL_HANDOVER_SECRET:?Set EXTERNAL_HANDOVER_SECRET}
  PHX_HOST: boundary.local
  PHX_SCHEME: http
  PHX_URL_PORT: "80"
  GITHUB_OAUTH_CLIENT_ID: ${EXTERNAL_OAUTH_CLIENT_ID:?Set EXTERNAL_OAUTH_CLIENT_ID}
  GITHUB_OAUTH_CLIENT_SECRET: ${EXTERNAL_OAUTH_CLIENT_SECRET:?Set EXTERNAL_OAUTH_CLIENT_SECRET}
  GITHUB_OAUTH_BASE_URL: http://external-mock:8080
  GITHUB_OAUTH_AUTHORIZE_URL: http://external-mock:8080/oauth/authorize
  GITHUB_OAUTH_TOKEN_URL: http://external-mock:8080/oauth/token
  GITHUB_OAUTH_USER_URL: http://external-mock:8080/oauth/user
  ALLOW_INSECURE_EXTERNAL_HTTP: "true"
  GITHUB_OAUTH_HTTP_CONNECT_TIMEOUT_MS: "100"
  GITHUB_OAUTH_HTTP_RECEIVE_TIMEOUT_MS: "100"
  SMTP_RELAY: external-mock
  SMTP_PORT: "2525"
  SMTP_USERNAME: ""
  SMTP_PASSWORD: ""
  SMTP_AUTH: never
  SMTP_TLS: never
  SMTP_SSL: "false"
  EMAIL_FROM_NAME: Who Need Help boundary
  EMAIL_FROM_ADDRESS: boundary@example.invalid
  PUSH_HTTP_ENDPOINT: http://external-mock:8080/push
  PUSH_HTTP_BEARER_TOKEN: ${EXTERNAL_PUSH_BEARER_TOKEN:?Set EXTERNAL_PUSH_BEARER_TOKEN}
  PUSH_HTTP_MAX_ATTEMPTS: "1"
  PUSH_HTTP_RECEIVE_TIMEOUT_MS: "1000"
  PUSH_HTTP_CONNECT_TIMEOUT_MS: "1000"
  PUSH_HTTP_RETRY_DELAY_MS: "0"

services:
  boundary-db:
    image: postgis/postgis:18-3.6-alpine@sha256:05d68c7f0f19b9aa0bf7c4a2049b2e8b38b44a63116392b95726a4c913766cf6
    environment:
      POSTGRES_DB: boundary
      POSTGRES_USER: boundary
      POSTGRES_PASSWORD: ${EXTERNAL_POSTGRES_PASSWORD:?Set EXTERNAL_POSTGRES_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 1s
      timeout: 2s
      retries: 60
    volumes:
      - boundary_postgres_data:/var/lib/postgresql
    networks: [boundary]
    restart: "no"

  external-mock:
    image: ${EXTERNAL_BOUNDARY_MOCK_IMAGE:?Set EXTERNAL_BOUNDARY_MOCK_IMAGE}
    build:
      context: ops/external-boundaries
    environment:
      MOCK_OAUTH_CLIENT_ID: ${EXTERNAL_OAUTH_CLIENT_ID:?Set EXTERNAL_OAUTH_CLIENT_ID}
      MOCK_OAUTH_CLIENT_SECRET: ${EXTERNAL_OAUTH_CLIENT_SECRET:?Set EXTERNAL_OAUTH_CLIENT_SECRET}
      MOCK_PUSH_BEARER_TOKEN: ${EXTERNAL_PUSH_BEARER_TOKEN:?Set EXTERNAL_PUSH_BEARER_TOKEN}
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - >-
          import urllib.request;
          urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=1).read()
      interval: 1s
      timeout: 2s
      retries: 30
    user: "10001:10001"
    read_only: true
    tmpfs:
      - /tmp
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    networks: [boundary]
    restart: "no"

  boundary-migrate:
    image: ${EXTERNAL_BOUNDARY_APP_IMAGE:?Set EXTERNAL_BOUNDARY_APP_IMAGE}
    build:
      context: .
      target: release
    command: ["/app/bin/migrate"]
    environment:
      <<: *boundary-app-environment
      APP_ROLE: migrate
    depends_on:
      boundary-db:
        condition: service_healthy
    read_only: true
    tmpfs:
      - /tmp
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    networks: [boundary]
    restart: "no"

  boundary-worker:
    image: ${EXTERNAL_BOUNDARY_APP_IMAGE:?Set EXTERNAL_BOUNDARY_APP_IMAGE}
    build:
      context: .
      target: release
    command: ["/app/bin/who_need_help", "start"]
    environment:
      <<: *boundary-app-environment
      APP_ROLE: worker
    depends_on:
      boundary-migrate:
        condition: service_completed_successfully
      external-mock:
        condition: service_healthy
    read_only: true
    tmpfs:
      - /tmp
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    networks: [boundary]
    restart: "no"

  boundary-check:
    image: ${EXTERNAL_BOUNDARY_APP_IMAGE:?Set EXTERNAL_BOUNDARY_APP_IMAGE}
    build:
      context: .
      target: release
    command:
      - /app/bin/who_need_help
      - eval
      - WhoNeedHelp.ExternalBoundaryDrill.run!()
    environment:
      <<: *boundary-app-environment
      APP_ROLE: migrate
      EXTERNAL_MOCK_BASE_URL: http://external-mock:8080
      EXTERNAL_SMTP_RELAY: external-mock
      EXTERNAL_PUSH_BEARER_TOKEN: ${EXTERNAL_PUSH_BEARER_TOKEN:?Set EXTERNAL_PUSH_BEARER_TOKEN}
      EXTERNAL_EXPECTED_WORKER_REPLICAS: "2"
    depends_on:
      boundary-migrate:
        condition: service_completed_successfully
      boundary-worker:
        condition: service_started
      external-mock:
        condition: service_healthy
    volumes:
      - ${EXTERNAL_BOUNDARY_OUTPUT_DIR:?Set EXTERNAL_BOUNDARY_OUTPUT_DIR}:/output
    user: "${EXTERNAL_BOUNDARY_HOST_UID:?Set EXTERNAL_BOUNDARY_HOST_UID}:${EXTERNAL_BOUNDARY_HOST_GID:?Set EXTERNAL_BOUNDARY_HOST_GID}"
    read_only: true
    tmpfs:
      - /tmp
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    networks: [boundary]
    restart: "no"

networks:
  boundary:
    internal: true

volumes:
  boundary_postgres_data: