---
# Layered on compose.yml by the dev tooling when the cache stack is
# active. See docs/contributing/environment/cache.md.

services:
  registry-cache:
    image: rpardini/docker-registry-proxy:0.6.5
    container_name: infinito-registry-cache
    environment:
      ENABLE_MANIFEST_CACHE: "true"
      AUTH_REGISTRIES: ""
      CACHE_MAX_SIZE: "${INFINITO_CACHE_REGISTRY_MAX_SIZE:?Run 'make dotenv' to generate the .env single source of truth}"
      DISABLE_IPV6: "true"
    volumes:
      - type: bind
        source: ${INFINITO_CACHE_REGISTRY_HOST_PATH:?Run 'make dotenv' to generate the .env single source of truth}
        target: /docker_mirror_cache
        bind:
          create_host_path: true
      - type: bind
        source: ${INFINITO_CACHE_REGISTRY_CA_HOST_PATH:?Run 'make dotenv' to generate the .env single source of truth}
        target: /ca
        bind:
          create_host_path: true
    healthcheck:
      test:
        - CMD-SHELL
        - "wget -qO- http://127.0.0.1:3128/ca.crt >/dev/null 2>&1"
      interval: 5s
      timeout: 3s
      retries: 30
      start_period: 30s
    networks:
      default:
        ipv4_address: ${INFINITO_CACHE_REGISTRY_IP:?Run 'make dotenv' to generate the .env single source of truth}
    restart: unless-stopped

  package-cache:
    image: sonatype/nexus3:3.91.1-ubi
    container_name: infinito-package-cache
    # Exception: fresh bind-mount is root:root and Nexus aborts unless run as root.
    user: "0:0"
    environment:
      INSTALL4J_ADD_VM_PARAMS: "-Xms${INFINITO_CACHE_PACKAGE_HEAP:?Run 'make dotenv' to generate the .env single source of truth} -Xmx${INFINITO_CACHE_PACKAGE_HEAP:?Run
        'make dotenv' to generate the .env single source of truth} -XX:MaxDirectMemorySize=${INFINITO_CACHE_PACKAGE_DIRECT_MEM:?Run 'make dotenv' to generate the
        .env single source of truth}"
      # Exception: random-password mode leaves no readable secret for the bootstrap.
      NEXUS_SECURITY_RANDOMPASSWORD: "false"
    volumes:
      - type: bind
        source: ${INFINITO_CACHE_PACKAGE_HOST_PATH:?Run 'make dotenv' to generate the .env single source of truth}
        target: /nexus-data
        bind:
          create_host_path: true
    ports:
      - "${INFINITO_BIND_IP:?Run 'make dotenv' to generate the .env single source of truth}:${INFINITO_CACHE_PACKAGE_PORT:?Run 'make dotenv' to generate the .env
        single source of truth}:8081"
    healthcheck:
      test:
        - CMD-SHELL
        - "curl -fsS http://127.0.0.1:8081/service/rest/v1/status >/dev/null"
      interval: 5s
      timeout: 3s
      retries: 60
      start_period: 120s
    networks:
      default:
        ipv4_address: ${INFINITO_CACHE_PACKAGE_IP:?Run 'make dotenv' to generate the .env single source of truth}
    restart: unless-stopped

  package-cache-frontend:
    image: nginx:1.27-alpine
    container_name: infinito-package-cache-frontend
    depends_on:
      package-cache:
        condition: service_healthy
    volumes:
      - type: bind
        source: ${INFINITO_CACHE_PACKAGE_FRONTEND_CA_DIR:?Run 'make dotenv' to generate the .env single source of truth}
        target: /etc/nginx/ca
        read_only: true
        bind:
          create_host_path: true
      - type: bind
        source: ${INFINITO_CACHE_PACKAGE_FRONTEND_CERTS_DIR:?Run 'make dotenv' to generate the .env single source of truth}
        target: /etc/nginx/certs
        read_only: true
        bind:
          create_host_path: true
      - ./compose/package-cache-frontend/upstreams.conf:/etc/nginx/conf.d/upstreams.conf:ro
    networks:
      default:
        ipv4_address: ${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}
    healthcheck:
      test:
        - CMD-SHELL
        - "wget -qO- --no-check-certificate https://127.0.0.1/ --header 'Host: pypi.org' >/dev/null 2>&1 || exit 0"
      interval: 5s
      timeout: 3s
      retries: 30
      start_period: 10s
    restart: unless-stopped

  infinito:
    depends_on:
      registry-cache:
        condition: service_healthy
        required: false
      package-cache:
        condition: service_healthy
        required: false
      package-cache-frontend:
        condition: service_healthy
        required: false
    environment:
      INFINITO_CACHE_PACKAGE_FRONTEND_IP: ${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}
    extra_hosts:
      # Exception: /etc/hosts is used because coredns can't resolve the container names.
      - "infinito-registry-cache:${INFINITO_CACHE_REGISTRY_IP:?Run 'make dotenv' to generate the .env single source of truth}"
      - "deb.debian.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
      - "archive.ubuntu.com:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
      - "security.ubuntu.com:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
      - "pypi.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
      - "files.pythonhosted.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
      - "registry.npmjs.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
      - "rubygems.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
      - "index.rubygems.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
      - "repo.packagist.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
      - "proxy.golang.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
      - "dl-cdn.alpinelinux.org:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
      - "raw.githubusercontent.com:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
      - "codeload.github.com:${INFINITO_CACHE_PACKAGE_FRONTEND_IP:?Run 'make dotenv' to generate the .env single source of truth}"
    volumes:
      - type: bind
        source: ${INFINITO_CACHE_REGISTRY_CA_HOST_PATH:?Run 'make dotenv' to generate the .env single source of truth}
        target: /opt/registry-cache-ca
        read_only: true
        bind:
          create_host_path: true
      - ${INFINITO_CACHE_REGISTRY_PROXY_CONF:?Set by 'cli deploy development up' / 'make compose-up' (driver-injected, not produced by 'make
        dotenv')}:/etc/systemd/system/docker.service.d/registry-cache-proxy.conf:ro
      - ./scripts/docker/cache/registry-ca.sh:/usr/local/bin/registry-cache-ca.sh:ro
      - ${INFINITO_CACHE_PACKAGE_PIP_CONF:?Set by 'cli deploy development up' / 'make compose-up' (driver-injected, not produced by 'make
        dotenv')}:/etc/pip.conf:ro
      - ${INFINITO_CACHE_PACKAGE_NPMRC:?Set by 'cli deploy development up' / 'make compose-up' (driver-injected, not produced by 'make dotenv')}:/root/.npmrc:ro
      - ./compose/package-cache/apt/${INFINITO_DISTRO:?Run 'make dotenv' to generate the .env single source of
        truth}.list:/etc/apt/sources.list.d/package-cache.list:ro
      - ${INFINITO_CACHE_PACKAGE_FRONTEND_CA_FILE:?Set by 'cli deploy development up' / 'make compose-up' (driver-injected, not produced by 'make
        dotenv')}:/opt/package-frontend-ca.crt:ro
      - ./scripts/docker/cache/package-frontend/ca.sh:/usr/local/bin/package-frontend-ca.sh:ro