scouthub/docker-compose.yml

services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    ports:
      - "${POSTGRES_PORT}:5432"
    volumes:
      - scouthub_db_data:/var/lib/postgresql/data
      # Crea anche i DB scouthub_home / scouthub_magazzino / scouthub_eventi
      # usati dagli altri backend, sulla stessa istanza (solo al primo init).
      - ./db-init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 10

  attivita-backend:
    build:
      context: ./scouthub-attivita-be
    restart: unless-stopped
    environment:
      PORT: ${ATTIVITA_BACKEND_PORT}
      CORS_ORIGIN: http://localhost:${ATTIVITA_FRONTEND_PORT}
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public
      KEYCLOAK_BASE_URL: http://keycloak:8080
      KEYCLOAK_REALM: scouthub
    ports:
      - "${ATTIVITA_BACKEND_PORT}:${ATTIVITA_BACKEND_PORT}"
    depends_on:
      db:
        condition: service_healthy
      keycloak:
        condition: service_started

  attivita-frontend:
    build:
      context: ./scouthub-attivita-fe
      args:
        API_URL: http://localhost:${ATTIVITA_BACKEND_PORT}
        KEYCLOAK_BASE_URL: http://localhost:${KEYCLOAK_PORT}
    restart: unless-stopped
    ports:
      - "${ATTIVITA_FRONTEND_PORT}:80"
    depends_on:
      - attivita-backend

  home-backend:
    build:
      context: ./scouthub-home-be
    restart: unless-stopped
    environment:
      PORT: ${HOME_BACKEND_PORT}
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/scouthub_home?schema=public
      FRONTEND_BASE_URL: http://localhost:${HOME_FRONTEND_PORT}
      # Rete interna Docker: la validazione del JWT (JWKS) non controlla l'issuer,
      # quindi non serve che coincida con l'hostname visto dal browser (localhost:8081).
      KEYCLOAK_BASE_URL: http://keycloak:8080
      KEYCLOAK_REALM: scouthub
      KEYCLOAK_ORG_SERVICE_CLIENT_ID: scouthub-home-be
      KEYCLOAK_ORG_SERVICE_CLIENT_SECRET: ${KEYCLOAK_ORG_SERVICE_CLIENT_SECRET}
    ports:
      - "${HOME_BACKEND_PORT}:${HOME_BACKEND_PORT}"
    depends_on:
      db:
        condition: service_healthy
      keycloak:
        condition: service_started

  home-frontend:
    build:
      context: ./scouthub-home-fe
      args:
        KEYCLOAK_BASE_URL: http://localhost:${KEYCLOAK_PORT}
        ORG_SERVICE_API_BASE_URL: http://localhost:${HOME_BACKEND_PORT}
        ATTIVITA_FE_BASE_URL: http://localhost:${ATTIVITA_FRONTEND_PORT}
    restart: unless-stopped
    ports:
      - "${HOME_FRONTEND_PORT}:80"
    depends_on:
      - home-backend

  magazzino-backend:
    build:
      context: ./scouthub-magazzino-be
    restart: unless-stopped
    environment:
      PORT: ${MAGAZZINO_BACKEND_PORT}
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/scouthub_magazzino?schema=public
      KEYCLOAK_BASE_URL: http://keycloak:8080
      KEYCLOAK_REALM: scouthub
      KEYCLOAK_MAGAZZINO_CLIENT_ID: scouthub-magazzino-be
      KEYCLOAK_MAGAZZINO_CLIENT_SECRET: ${KEYCLOAK_MAGAZZINO_CLIENT_SECRET}
    ports:
      - "${MAGAZZINO_BACKEND_PORT}:${MAGAZZINO_BACKEND_PORT}"
    depends_on:
      db:
        condition: service_healthy
      keycloak:
        condition: service_started

  magazzino-frontend:
    build:
      context: ./scouthub-magazzino-fe
      args:
        KEYCLOAK_BASE_URL: http://localhost:${KEYCLOAK_PORT}
        MAGAZZINO_API_BASE_URL: http://localhost:${MAGAZZINO_BACKEND_PORT}
    restart: unless-stopped
    ports:
      - "${MAGAZZINO_FRONTEND_PORT}:80"
    depends_on:
      - magazzino-backend

  eventi-backend:
    build:
      context: ./scouthub-eventi-be
    restart: unless-stopped
    environment:
      PORT: ${EVENTI_BACKEND_PORT}
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/scouthub_eventi?schema=public
      KEYCLOAK_BASE_URL: http://keycloak:8080
      KEYCLOAK_REALM: scouthub
      KEYCLOAK_EVENTI_CLIENT_ID: scouthub-eventi-be
      KEYCLOAK_EVENTI_CLIENT_SECRET: ${KEYCLOAK_EVENTI_CLIENT_SECRET}
      KEYCLOAK_AUTHORIZED_SERVICE_CLIENTS: scouthub-eventi-be
    ports:
      - "${EVENTI_BACKEND_PORT}:${EVENTI_BACKEND_PORT}"
    depends_on:
      db:
        condition: service_healthy
      keycloak:
        condition: service_started

  eventi-frontend:
    build:
      context: ./scouthub-eventi-fe
      args:
        KEYCLOAK_BASE_URL: http://localhost:${KEYCLOAK_PORT}
        EVENTI_API_BASE_URL: http://localhost:${EVENTI_BACKEND_PORT}
    restart: unless-stopped
    ports:
      - "${EVENTI_FRONTEND_PORT}:80"
    depends_on:
      - eventi-backend

  keycloak-db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
    volumes:
      - scouthub_keycloak_db_data:/var/lib/postgresql/data

  keycloak:
    image: quay.io/keycloak/keycloak:26.7
    restart: unless-stopped
    # --import-realm importa keycloak/realm-export.json solo se il realm non esiste già
    # NOTA: dopo l'import, assegnare al service account di scouthub-home-be i client role
    # del client 'realm-management': manage-organizations, manage-users, manage-groups,
    # view-users (permessi minimi, non manage-realm). Con Fine-Grained Admin Permissions
    # (26.7+, feature admin-fine-grained-authz:v1) si puo' poi restringere ulteriormente
    # per singola Organization.
    command: start-dev --import-realm
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://keycloak-db:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
      # admin-fine-grained-authz:v1 serve per i permessi granulari sulle Organization (26.7+).
      # Verificare con `kc.sh show-config` che i flag richiesti siano invariati nella versione
      # effettivamente usata: i nomi dei feature flag cambiano tra minor version di Keycloak.
      KC_FEATURES: organization,admin-fine-grained-authz:v1
      KC_HOSTNAME: localhost
      KC_HOSTNAME_PORT: "${KEYCLOAK_PORT}"
      KC_HTTP_ENABLED: "true"
    ports:
      - "${KEYCLOAK_PORT}:8080"
    volumes:
      - ./keycloak/realm-export.json:/opt/keycloak/data/import/realm-export.json:ro
    depends_on:
      - keycloak-db

volumes:
  scouthub_db_data:
  scouthub_keycloak_db_data: