docker-compose.yml

# Fixed name so the network is always "rise_default", even when run from a git worktree.
# The managed BuildKit daemon connects to this network via RISE_MANAGED_BUILDKIT_NETWORK_NAME
# (set in .envrc) to reach rise-registry.
name: rise

volumes:
  registry_data:
  postgres_data:
  dex_data:
  vault_plugins:

services:
  postgres:
    image: postgres:18-trixie
    container_name: rise-postgres
    restart: unless-stopped
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-rise}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-rise123}
      - POSTGRES_DB=${POSTGRES_DB:-rise}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U rise"]
      interval: 5s
      timeout: 5s
      retries: 5

  # OIDC provider for authentication in the development environment.
  dex:
    image: dexidp/dex:v2.45.1
    container_name: rise-dex
    restart: unless-stopped
    user: "0:0"
    ports:
      - "5556:5556"
    volumes:
      - ./dev/dex:/dex-config:ro
      - dex_data:/var/dex
    entrypoint: ["/usr/local/bin/dex"]
    command: ["serve", "/dex-config/config.yaml"]
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:5556/dex/healthz"]
      interval: 5s
      timeout: 5s
      retries: 5

  # Docker registry for images pushed by the rise CLI in the development environment.
  registry:
    image: registry:3
    container_name: rise-registry
    restart: unless-stopped
    ports:
      - "5000:5000"
    volumes:
      - registry_data:/var/lib/registry
    environment:
      - REGISTRY_STORAGE_DELETE_ENABLED=true

  # Helper UI to explore images pushed to the registry.
  registry-ui:
    image: quiq/registry-ui
    container_name: rise-registry-ui
    restart: unless-stopped
    ports:
      - "5001:5001"
    environment:
      - REGISTRY_HOSTNAME=rise-registry:5000
      - REGISTRY_INSECURE=true
      - PERFORMANCE_CATALOG_REFRESH_INTERVAL=0.1
      - TAGS_COUNT_REFRESH_INTERVAL=0.1
      - LISTEN_ADDR=0.0.0.0:5001
    depends_on:
      - registry

  # Traefik reverse proxy for the Docker deployment controller (type: docker).
  # Routes *.rise.localhost to app containers via the Docker provider, reading the
  # Traefik labels the Rise controller stamps on each app container. Only used when
  # deployment_controller.type = "docker" (see config/development.yaml).
  traefik:
    image: traefik:v3.7.10
    container_name: rise-traefik
    restart: unless-stopped
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=rise_default"
      # File provider: routes /.rise/* on app hosts to the host-run Rise backend
      # (see dev/traefik/dynamic/rise-dotrise.yml). The backend isn't a container
      # here, so a Docker-provider label can't target it.
      - "--providers.file.directory=/etc/traefik/dynamic"
      - "--providers.file.watch=true"
      - "--entrypoints.web.address=:80"
      - "--api.dashboard=true"
      - "--api.insecure=true"
    ports:
      - "80:80"        # app traffic: http://<project>.rise.localhost
      - "8090:8080"    # Traefik dashboard: http://localhost:8090
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./dev/traefik/dynamic:/etc/traefik/dynamic:ro
    # Make `host.docker.internal` resolve to the host gateway so Traefik's
    # forwardAuth can reach a host-run backend (`mise br docker`, which sets
    # RISE_AUTH_BACKEND_URL=http://host.docker.internal:3000) on Linux too.
    # No-op on Docker Desktop, which resolves host.docker.internal automatically.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    # Join the compose default network ("rise_default") explicitly so Traefik is
    # on the same network as the app containers it routes to. The Docker provider
    # is pinned to this network via --providers.docker.network=rise_default, so
    # Traefik must be a member to reach the backends.
    networks:
      - default

  # HashiCorp Vault with JFrog Artifactory secrets plugin.
  # Automatically configures itself and JFrog on startup.
  # Access: VAULT_ADDR=http://localhost:8200 VAULT_TOKEN=root
  # Start locally with: docker compose --profile jfrog-vault up -d jfrog vault
  vault:
    profiles: ["jfrog-vault"]
    image: hashicorp/vault:1.21
    container_name: rise-vault
    restart: unless-stopped
    ports:
      - "8200:8200"
    volumes:
      - ./dev/vault:/vault-config:ro
      - vault_plugins:/vault/plugins
    environment:
      - VAULT_DEV_ROOT_TOKEN_ID=root
      - VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:8200
    entrypoint: ["/bin/sh", "/vault-config/entrypoint.sh"]
    cap_add:
      - IPC_LOCK
    depends_on:
      - jfrog

  # JFrog Artifactory JCR for testing the JFrog repository controller.
  # Also serves as a Docker registry at localhost:3082 (repo: rise-docker-local).
  # Login: admin / password
  # Start locally with: docker compose --profile jfrog-vault up -d jfrog vault
  jfrog:
    profiles: ["jfrog-vault"]
    image: releases-docker.jfrog.io/jfrog/artifactory-jcr:7.161.16
    container_name: rise-jfrog
    restart: unless-stopped
    ports:
      # - "3080:8080"
      # - "3081:8081"
      - "3082:8082"
    environment:
      - "JF_SHARED_DATABASE_ALLOWNONPOSTGRESQL=true"