docker-compose.yml

---
services:
  app:
    build: .
    depends_on:
      solr:
        condition: service_healthy
      spatial:
        condition: service_started
      geoserver:
        condition: service_healthy
      geoserver-secure:
        condition: service_healthy
      keycloak-config:
        condition: service_completed_successfully
    command:
      - tail
      - -f
      - /dev/null
    environment:
      CI: "${CI:-false}" # set to 'true' to mimic GitHub Actions
      GEOSERVER_ROOT: data/geoserver/
      GEOSERVER_SECURE_URL: http://admin:geoserver@geoserver-secure:8080/geoserver/rest/
      GEOSERVER_URL: http://admin:geoserver@geoserver:8080/geoserver/rest/
      SOLR_URL: http://solr:8983/solr/geodata-test
      SPATIAL_ROOT: data/spatial/
      SPATIAL_URL: http://spatial
    restart: no
    volumes:
      - ./:/opt/app

  solr:
    command: >
      bash -c 'echo geodata geodata-test | xargs -n1 precreate-core && solr-foreground'
    image: solr:8.11.2
    ports:
      - 8983:8983
    restart: always
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8983/solr/"]
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 60s
    volumes:
      - ./solr:/opt/solr/server/solr/configsets:ro

  spatial:
    image: httpd:2.4
    ports:
      - 80:80
    volumes:
      - ./data/spatial:/usr/local/apache2/htdocs/:ro

  geoserver:
    image: docker.osgeo.org/geoserver:2.28-latest
    ports:
      - 8080:8080
    environment: &geoserver-environment
      ROOT_WEBAPP_REDIRECT: "true"
      SKIP_DEMO_DATA: "true"
      INSTALL_EXTENSIONS: "true"
      COMMUNITY_EXTENSIONS: "sec-oidc"
      PROXY_BASE_URL:
    depends_on:
      keycloak-config:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/geoserver/web/"]
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 30s
    extra_hosts:
      - keycloak.localhost:host-gateway
    volumes:
      # Uncomment and comment out the geoserver-config service to persist geoserver between runs.
      # - ./data/geoserver/geoserver_data:/opt/geoserver_data
      - ./data/geoserver/public:/srv/geofiles

  geoserver-secure:
    image: docker.osgeo.org/geoserver:2.28-latest
    ports:
      - 8081:8080
    environment: *geoserver-environment
    depends_on:
      keycloak-config:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/geoserver/web/"]
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 30s
    extra_hosts:
      - keycloak.localhost:host-gateway
    volumes:
      - ./data/geoserver/UCB:/srv/geofiles

  geoserver-config:
    image: curlimages/curl:latest
    depends_on:
      geoserver:
        condition: service_healthy
      geoserver-secure:
        condition: service_healthy
    entrypoint: ["/bin/sh"]
    command: ["/scripts/geoserver-oidc-config.sh"]
    environment:
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
      OIDC_SECURE_CLIENT_ID: ${OIDC_SECURE_CLIENT_ID}
      OIDC_SECURE_CLIENT_SECRET: ${OIDC_SECURE_CLIENT_SECRET}
    restart: on-failure:3
    volumes:
      - ./bin/geoserver-oidc-config.sh:/scripts/geoserver-oidc-config.sh:ro

  postgres:
    image: postgres:18-alpine
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: keycloak
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U keycloak -d keycloak"]
      interval: 10s
      timeout: 5s
      retries: 5
    volumes:
      - postgres_data:/var/lib/postgresql

  keycloak:
    command: start-dev
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: keycloak
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
      KC_HOSTNAME: "http://keycloak.localhost:8180"
      KC_HOSTNAME_STRICT: "false"
      KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
      KC_HTTP_ENABLED: "true"
      KC_HTTP_PORT: "8180"
      KC_HEALTH_ENABLED: "true"
      KC_LOG_LEVEL: ${KC_LOG_LEVEL:-INFO}
    healthcheck:
      # curl/wget are not present in the UBI9-based Keycloak image; use /dev/tcp.
      # KC_HEALTH_ENABLED=true exposes /health/ready on the management port (9000).
      test:
        [
          "CMD-SHELL",
          "exec 3<>/dev/tcp/localhost/9000 && printf 'GET /health/ready HTTP/1.0\\r\\nHost: localhost\\r\\n\\r\\n' >&3 && grep -q 'status.*UP' <&3",
        ]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 20s
    image: quay.io/keycloak/keycloak:26.1
    ports:
      - 127.0.0.1:8180:8180
    restart: always

  keycloak-config:
    depends_on:
      keycloak:
        condition: service_healthy
    environment:
      KEYCLOAK_URL: http://keycloak:8180
      KEYCLOAK_USER: admin
      KEYCLOAK_PASSWORD: admin
      KEYCLOAK_AVAILABILITYCHECK_ENABLED: "true"
      IMPORT_FILES_LOCATIONS: /config/*
      IMPORT_VAR_SUBSTITUTION_ENABLED: "true"
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
      OIDC_SECURE_CLIENT_ID: ${OIDC_SECURE_CLIENT_ID}
      OIDC_SECURE_CLIENT_SECRET: ${OIDC_SECURE_CLIENT_SECRET}
      OIDC_ADMIN_GROUP: ${OIDC_ADMIN_GROUP}
      OIDC_USER_GROUP: ${OIDC_USER_GROUP}
    image: adorsys/keycloak-config-cli:latest-26.1.0
    restart: on-failure:3
    volumes:
      - ./data/geoserver/keycloak/config:/config

volumes:
  postgres_data: