docker-compose.yml

services:

  nginx:
    image: nginx:1.27.1-alpine
    restart: always
    container_name: nginx
    ports:
      - "80:80"
      - "443:443"
    # user: 1000:1000
    volumes:
      - ./frontend/reverse-proxy/nginx.conf:/etc/nginx/nginx.conf
      - ./frontend/reverse-proxy/certs:/etc/nginx/certs # self signed certs
    depends_on:
      frontend:
        condition: service_started
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.25'
          memory: 128M
    networks:
      - public-subnet
      - private-subnet

  frontend:
    build: ./frontend/clientapp/
    read_only: true
    restart: always
    container_name: frontend
    # ports:
    #   - "3000:3000"
    user: 1000:1000
    depends_on:
      blog-service:
        condition: service_started
      file-service:
        condition: service_started
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    networks:
      - private-subnet

  file-service:
    build: ./backend/filestorage-service/
    restart: always
    container_name: file-service
    # ports:
    #   - "8000:8000"
    # user: 1000:1000 # already created non-root user on dockerfile (fastapi)
    environment:
      FILE_STORAGE_STATIC_FOLDER: ${FILE_STORAGE_STATIC_FOLDER}
      FRONTEND_URL: ${FRONTEND_URL}
    volumes:
      - ./backend/filestorage-service/images:${FILE_STORAGE_STATIC_FOLDER}
    depends_on:
      keycloak:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    networks:
      - private-subnet

  blog-service:
    build: ./backend/blog-service/
    restart: always
    container_name: blog-service
    # ports:
    #   - "8083:8083"
    # user: 1000:1000 # already on Dockerfile from Spring DOC
    environment:
      MYSQL_HOST: "mysql_svr"
      MYSQL_BLOG_SERVICE_PASSWORD: ${MYSQL_BLOG_SERVICE_PASSWORD}
      MYSQL_BLOG_SERVICE_USER: ${MYSQL_BLOG_SERVICE_USER}
      KEYCLOAK_BLOG_REALM_ID: ${KEYCLOAK_BLOG_REALM_ID}
      KEYCLOAK_BLOG_CLIENT_ID: ${KEYCLOAK_BLOG_CLIENT_ID}
      KEYCLOAK_BLOG_CLIENT_SECRET: ${KEYCLOAK_BLOG_CLIENT_SECRET}
      KEYCLOAK_HOSTNAME: ${KEYCLOAK_HOSTNAME}
      KEYCLOAK_PORT: ${KEYCLOAK_HTTP_PORT}
      KEYCLOAK_PROTOCOL: ${KEYCLOAK_PROTOCOL}
      FRONTEND_URL: ${FRONTEND_URL}
    depends_on:
      keycloak:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    networks:
      - private-subnet
      - data-subnet

  keycloak:
    image: quay.io/keycloak/keycloak:latest
    restart: always
    container_name: ${KEYCLOAK_HOSTNAME}
    command: start --proxy-headers forwarded --import-realm
    # ports:
    # - "${KEYCLOAK_HTTP_PORT}:${KEYCLOAK_HTTP_PORT}"
    user: 1000:1000 # default 1000 user, 0 group
    environment:
      KC_HTTP_PORT: ${KEYCLOAK_HTTP_PORT}
      KC_DB: mysql
      KC_DB_URL_HOST: mysql_svr
      KC_DB_URL_DATABASE: ${KEYCLOAK_DATABASE}
      KC_DB_PASSWORD: ${KEYCLOAK_MYSQL_PASSWORD}
      KC_DB_USERNAME: ${KEYCLOAK_MYSQL_USER}
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
      # Production
      KC_HOSTNAME_STRICT: false
      KC_HOSTNAME_STRICT_HTTPS: false
      KC_HTTP_ENABLED: true
      KC_HTTPS_CERTIFICATE_KEY_FILE: /opt/keycloak/certs/keycloak.key.pem
      KC_HTTPS_CERTIFICATE_FILE: /opt/keycloak/certs/keycloak.crt.pem
    depends_on:
      mysql_svr:
        condition: service_healthy
    volumes:
      - ./backend/auth-service/certs/:/opt/keycloak/certs/
      - ./backend/auth-service/realm-data:/opt/keycloak/data/import
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 2048M
        reservations:
          cpus: '0.5'
          memory: 512M
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000;echo -e 'GET /health/ready HTTP/1.1\r\nhost: http://localhost\r\nConnection: close\r\n\r\n' >&3;if [ $? -eq 0 ]; then echo 'Healthcheck Successful';exit 0;else echo 'Healthcheck Failed';exit 1;fi;"]
      interval: 30s
      timeout: 10s
      retries: 5
    security_opt:
      - no-new-privileges:true
    networks:
      - private-subnet
      - data-subnet

  mysql_svr:
    image: mysql:latest
    restart: always
    container_name: mysql_svr
    #ports:
      #- "3306:3306"
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
    volumes:
      - ./backend/mysql/db:/var/lib/mysql
      - ./backend/mysql/initdb:/docker-entrypoint-initdb.d
    healthcheck:
      test: mysqladmin ping -h 127.0.0.1 -u ${MYSQL_BLOG_DB_NAME} --password=${MYSQL_PASSWORD}
      start_period: 5s
      interval: 5s
      timeout: 5s
      retries: 5
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 2048M
        reservations:
          cpus: '0.5'
          memory: 1024M
    networks:
      - data-subnet

networks:
  public-subnet:
    driver: bridge
  private-subnet:
    driver: bridge
  data-subnet:
    driver: bridge