name: thothii

x-smoke-labels: &smoke-labels
  io.thothii.smoke-owner: "${THOTH_SMOKE_OWNER:-operator}"

services:
  core:
    image: thothii-core:local
    profiles: [external, local-vector]
    build:
      context: .
      dockerfile: docker/core.Dockerfile
    labels: *smoke-labels
    environment:
      AUTH_MODE: "${AUTH_MODE:-none}"
      THOTH_PUBLIC_EXPOSURE: "${THOTH_PUBLIC_EXPOSURE:-false}"
      THT_DATA_ROOT: /data
      SETTINGS_FILE: /data/settings/settings.json
      THT_VECTOR_DATABASE: "${THT_VECTOR_DATABASE:-thoth}"
      THT_VECTOR_BOOTSTRAP_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
      THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
      THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
      THT_VECTOR_READER_PASSWORD_FILE: /run/secrets/vector_reader_password
      THT_VECTOR_WRITER_PASSWORD_FILE: /run/secrets/vector_writer_password
    secrets:
      - vector_reader_password
      - vector_writer_password
    volumes:
      - thoth_data:/data
      - ./deploy/workspaces:/app/harness/workspaces:ro
    depends_on:
      vector-migrate:
        condition: service_completed_successfully
        required: false
    healthcheck:
      test: [CMD, curl, --fail, --silent, http://127.0.0.1:8787/health]
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 10s
    restart: unless-stopped

  frontend:
    profiles: [external, local-vector]
    build:
      context: .
      dockerfile: docker/frontend.Dockerfile
    labels: *smoke-labels
    environment:
      BACKEND_BASE_URL: /api
    ports:
      - "127.0.0.1:${THOTH_HTTP_PORT:-8080}:8080"
    depends_on:
      core:
        condition: service_healthy
    healthcheck:
      test: [CMD, wget, --quiet, --spider, http://127.0.0.1:8080/health]
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 5s
    restart: unless-stopped

  vector-db:
    image: pgvector/pgvector:0.8.5-pg16@sha256:1d533553fefe4f12e5d80c7b80622ba0c382abb5758856f52983d8789179f0fb
    profiles: [local-vector]
    labels: *smoke-labels
    environment:
      POSTGRES_DB: "${THT_VECTOR_DATABASE:-thoth}"
      POSTGRES_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
      POSTGRES_PASSWORD_FILE: /run/secrets/vector_bootstrap_password
      THT_VECTOR_MIGRATOR_USER: "${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}"
      THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
      THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
    secrets:
      - vector_bootstrap_password
      - vector_migrator_password
      - vector_reader_password
      - vector_writer_password
    volumes:
      - vector_data:/var/lib/postgresql/data
    healthcheck:
      test: [CMD-SHELL, "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 3s
      retries: 20
      start_period: 10s
    restart: unless-stopped

  vector-reconcile:
    image: pgvector/pgvector:0.8.5-pg16@sha256:1d533553fefe4f12e5d80c7b80622ba0c382abb5758856f52983d8789179f0fb
    profiles: [local-vector]
    labels: *smoke-labels
    environment:
      PGHOST: vector-db
      PGPORT: 5432
      PGDATABASE: "${THT_VECTOR_DATABASE:-thoth}"
      PGUSER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
      THT_VECTOR_BOOTSTRAP_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
      THT_VECTOR_MIGRATOR_USER: "${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}"
      THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
      THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
    entrypoint: [/opt/thoth/reconcile-roles.sh]
    secrets:
      - vector_bootstrap_password
      - vector_migrator_password
      - vector_reader_password
      - vector_writer_password
    volumes:
      - ./deploy/vector/reconcile-roles.sh:/opt/thoth/reconcile-roles.sh:ro
      - ./deploy/vector/secret-policy.sh:/opt/thoth/secret-policy.sh:ro
    depends_on:
      vector-db:
        condition: service_healthy
    restart: "no"

  vector-migrate:
    image: thothii-core:local
    profiles: [local-vector]
    build:
      context: .
      dockerfile: docker/core.Dockerfile
    labels: *smoke-labels
    entrypoint: [sh, -ec]
    command:
      - |
        password=$$(cat /run/secrets/vector_migrator_password)
        encoded=$$(python -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$$password")
        exec /opt/venv/bin/tht vector migrate \
          --database-url "postgresql+psycopg2://${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}:$$encoded@vector-db:5432/${THT_VECTOR_DATABASE:-thoth}" \
          --json
    secrets:
      - vector_migrator_password
    depends_on:
      vector-reconcile:
        condition: service_completed_successfully
    restart: "no"

volumes:
  thoth_data:
    labels: *smoke-labels
  vector_data:
    labels: *smoke-labels

networks:
  default:
    labels: *smoke-labels

secrets:
  vector_bootstrap_password:
    file: ${THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE:-deploy/secrets/vector_bootstrap_password}
  vector_migrator_password:
    file: ${THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE:-deploy/secrets/vector_migrator_password}
  vector_reader_password:
    file: ${THT_VECTOR_READER_PASSWORD_SECRET_FILE:-deploy/secrets/vector_reader_password}
  vector_writer_password:
    file: ${THT_VECTOR_WRITER_PASSWORD_SECRET_FILE:-deploy/secrets/vector_writer_password}