docker-compose.yml

name: islamu-event-platform

x-keycloak-env: &keycloak-env
  KEYCLOAK_REALM: ${KEYCLOAK_REALM:-ISLAMU}
  KEYCLOAK_ENDPOINT: ${KEYCLOAK_ENDPOINT:-http://keycloak.localhost:8080}
  KEYCLOAK_BLAZOR_CLIENT_ID: ${KEYCLOAK_BLAZOR_CLIENT_ID:-islamu-event-blazor}
  KEYCLOAK_INTERNAL_URL: http://keycloak:8080
  Keycloak__RequireHttpsMetadata: ${KEYCLOAK_REQUIRE_HTTPS_METADATA:-false}

x-authentication-selection-env: &authentication-selection-env
  Authentication__Provider: ${AUTHENTICATION_PROVIDER:-}
  Authentication__AtprotoLoginEnabled: ${ATPROTO_LOGIN_ENABLED:-false}

x-local-identity-runtime-env: &local-identity-runtime-env
  Authentication__Local__JwtKey: ${AUTHENTICATION_LOCAL_JWT_KEY:-}
  Authentication__Local__LockoutThreshold: ${AUTHENTICATION_LOCAL_LOCKOUT_THRESHOLD:-5}
  Authentication__Local__LockoutDurationMinutes: ${AUTHENTICATION_LOCAL_LOCKOUT_DURATION_MINUTES:-15}
  Authentication__Local__PasswordBlocklistPath: ${AUTHENTICATION_LOCAL_PASSWORD_BLOCKLIST_PATH:-}
  Authentication__Local__PasswordBlocklistSha256: ${AUTHENTICATION_LOCAL_PASSWORD_BLOCKLIST_SHA256:-}
  Authentication__Local__PasswordHashIterations: ${AUTHENTICATION_LOCAL_PASSWORD_HASH_ITERATIONS:-210000}
  IdentityDatabase__Topology: ${IDENTITY_DATABASE_TOPOLOGY:-colocated}
  IdentityDatabase__Provider: ${IDENTITY_DATABASE_PROVIDER:-}
  IdentityDatabase__Host: ${IDENTITY_DATABASE_HOST:-}
  IdentityDatabase__Port: ${IDENTITY_DATABASE_PORT:-}
  IdentityDatabase__Name: ${IDENTITY_DATABASE_NAME:-}
  IdentityDatabase__Schema: ${IDENTITY_DATABASE_SCHEMA:-}
  IdentityDatabase__TlsMode: ${IDENTITY_DATABASE_TLS_MODE:-}
  IdentityDatabase__TrustServerCertificate: ${IDENTITY_DATABASE_TRUST_SERVER_CERTIFICATE:-false}
  IdentityDatabase__Runtime__Username: ${IDENTITY_DATABASE_RUNTIME_USERNAME:-}
  IdentityDatabase__Runtime__Password: ${IDENTITY_DATABASE_RUNTIME_PASSWORD:-}
  IdentityDatabase__LocalIdentityWriter__Username: ${IDENTITY_DATABASE_LOCAL_IDENTITY_WRITER_USERNAME:-}
  IdentityDatabase__LocalIdentityWriter__Password: ${IDENTITY_DATABASE_LOCAL_IDENTITY_WRITER_PASSWORD:-}
  IdentityDatabase__ServerVersion: ${IDENTITY_DATABASE_SERVER_VERSION:-}

x-local-identity-migrator-env: &local-identity-migrator-env
  IdentityDatabase__Topology: ${IDENTITY_DATABASE_TOPOLOGY:-colocated}
  IdentityDatabase__Provider: ${IDENTITY_DATABASE_PROVIDER:-}
  IdentityDatabase__Host: ${IDENTITY_DATABASE_HOST:-}
  IdentityDatabase__Port: ${IDENTITY_DATABASE_PORT:-}
  IdentityDatabase__Name: ${IDENTITY_DATABASE_NAME:-}
  IdentityDatabase__Schema: ${IDENTITY_DATABASE_SCHEMA:-}
  IdentityDatabase__TlsMode: ${IDENTITY_DATABASE_TLS_MODE:-}
  IdentityDatabase__TrustServerCertificate: ${IDENTITY_DATABASE_TRUST_SERVER_CERTIFICATE:-false}
  IdentityDatabase__Migrator__Username: ${IDENTITY_DATABASE_MIGRATOR_USERNAME:-}
  IdentityDatabase__Migrator__Password: ${IDENTITY_DATABASE_MIGRATOR_PASSWORD:-}
  IdentityDatabase__Runtime__Username: ${IDENTITY_DATABASE_RUNTIME_USERNAME:-}
  IdentityDatabase__LocalIdentityWriter__Username: ${IDENTITY_DATABASE_LOCAL_IDENTITY_WRITER_USERNAME:-}
  IdentityDatabase__ServerVersion: ${IDENTITY_DATABASE_SERVER_VERSION:-}

# One explicit deployment-owned secret authority. Environment never contacts Infisical;
# Infisical never falls back to the lower environment values below.
x-secrets-env: &secrets-env
  SecretProvider__Provider: ${SECRET_PROVIDER:?Set SECRET_PROVIDER to Environment or Infisical}
  SecretProvider__Infisical__Url: ${INFISICAL_URL:-}
  SecretProvider__Infisical__ProjectId: ${INFISICAL_PROJECT_ID:-}
  SecretProvider__Infisical__Environment: ${INFISICAL_ENV:-}

x-postgres-env: &postgres-env
  POSTGRES_USER: ${DATABASE_MIGRATOR_USERNAME:-}
  POSTGRES_PASSWORD: ${DATABASE_MIGRATOR_PASSWORD:-}
  POSTGRES_DB: ${DATABASE_NAME:-islamu_event_db}

x-formbricks-env: &formbricks-env
  WEBAPP_URL: ${FORMBRICKS_WEBAPP_URL:-http://localhost:3005}
  NEXTAUTH_URL: ${FORMBRICKS_WEBAPP_URL:-http://localhost:3005}
  DATABASE_URL: postgresql://${FORMBRICKS_DATABASE_USER:-postgres}:${FORMBRICKS_DATABASE_PASSWORD:-}@formbricks-postgres:5432/${FORMBRICKS_DATABASE_NAME:-formbricks}?schema=public
  NEXTAUTH_SECRET: ${FORMBRICKS_NEXTAUTH_SECRET:-}
  ENCRYPTION_KEY: ${FORMBRICKS_ENCRYPTION_KEY:-}
  CRON_SECRET: ${FORMBRICKS_CRON_SECRET:-}
  REDIS_URL: redis://formbricks-redis:6379
  HUB_API_KEY: ${FORMBRICKS_HUB_API_KEY:-}
  HUB_API_URL: http://formbricks-hub:8080
  CUBEJS_API_URL: http://formbricks-cube:4000
  CUBEJS_API_SECRET: ${FORMBRICKS_CUBEJS_API_SECRET:-}
  CUBEJS_JWT_ISSUER: formbricks-web
  CUBEJS_JWT_AUDIENCE: formbricks-cube
  EMAIL_VERIFICATION_DISABLED: "1"
  PASSWORD_RESET_DISABLED: "1"
  TELEMETRY_DISABLED: "1"

x-database-env: &database-env
  Database__Provider: ${DATABASE_PROVIDER:-PostgreSql}
  Database__Host: ${DATABASE_HOST-postgres}
  Database__Port: ${DATABASE_PORT-5432}
  Database__Name: ${DATABASE_NAME:-islamu_event_db}
  Database__Database: ${DATABASE_NAME:-islamu_event_db}
  Database__Schema: ${DATABASE_SCHEMA:-islamu_event}
  Database__TlsMode: ${DATABASE_TLS_MODE:-Prefer}
  Database__TrustServerCertificate: ${DATABASE_TRUST_SERVER_CERTIFICATE:-false}
  Database__ServerVersion: ${DATABASE_SERVER_VERSION:-}

x-database-runtime-env: &database-runtime-env
  Database__Runtime__Username: ${DATABASE_RUNTIME_USERNAME:-}
  Database__Runtime__Password: ${DATABASE_RUNTIME_PASSWORD:-}
  Database__Global__Username: ${DATABASE_GLOBAL_USERNAME:-}
  Database__Global__Password: ${DATABASE_GLOBAL_PASSWORD:-}
  Database__LocalIdentityWriter__Username: ${DATABASE_LOCAL_IDENTITY_WRITER_USERNAME:-}
  Database__LocalIdentityWriter__Password: ${DATABASE_LOCAL_IDENTITY_WRITER_PASSWORD:-}
  Database__InstanceKeyRead__Username: ${DATABASE_INSTANCE_KEY_READ_USERNAME:-}
  Database__InstanceKeyRead__Password: ${DATABASE_INSTANCE_KEY_READ_PASSWORD:-}
  Database__InstanceKeyWrite__Username: ${DATABASE_INSTANCE_KEY_WRITE_USERNAME:-}
  Database__InstanceKeyWrite__Password: ${DATABASE_INSTANCE_KEY_WRITE_PASSWORD:-}
  Database__InstanceKeyIssuance__Username: ${DATABASE_INSTANCE_KEY_ISSUANCE_USERNAME:-}
  Database__InstanceKeyIssuance__Password: ${DATABASE_INSTANCE_KEY_ISSUANCE_PASSWORD:-}
  Database__PlatformKeyReport__Username: ${DATABASE_PLATFORM_KEY_REPORT_USERNAME:-}
  Database__PlatformKeyReport__Password: ${DATABASE_PLATFORM_KEY_REPORT_PASSWORD:-}
  Database__EmailPolicyInstanceMutation__Username: ${DATABASE_EMAIL_POLICY_INSTANCE_MUTATION_USERNAME:-}
  Database__EmailPolicyInstanceMutation__Password: ${DATABASE_EMAIL_POLICY_INSTANCE_MUTATION_PASSWORD:-}
  Database__EmailPolicyTenantMutation__Username: ${DATABASE_EMAIL_POLICY_TENANT_MUTATION_USERNAME:-}
  Database__EmailPolicyTenantMutation__Password: ${DATABASE_EMAIL_POLICY_TENANT_MUTATION_PASSWORD:-}

x-database-migrator-env: &database-migrator-env
  Database__Migrator__Username: ${DATABASE_MIGRATOR_USERNAME:-}
  Database__Migrator__Password: ${DATABASE_MIGRATOR_PASSWORD:-}
  Database__Runtime__Username: ${DATABASE_RUNTIME_USERNAME:-}
  Database__Global__Username: ${DATABASE_GLOBAL_USERNAME:-}
  Database__LocalIdentityWriter__Username: ${DATABASE_LOCAL_IDENTITY_WRITER_USERNAME:-}
  Database__EmailPolicyInstanceMutation__Username: ${DATABASE_EMAIL_POLICY_INSTANCE_MUTATION_USERNAME:-}
  Database__EmailPolicyTenantMutation__Username: ${DATABASE_EMAIL_POLICY_TENANT_MUTATION_USERNAME:-}

x-privacy-erasure-authority-env: &privacy-erasure-authority-env
  PrivacyErasure__Authority__Topology: ${ERASURE_DATABASE_TOPOLOGY:-EmbeddedSqlite}
  PrivacyErasureAuthorityEmbedded__Path: ${ERASURE_EMBEDDED_PATH:-${PRIVACY_ERASURE_AUTHORITY_EMBEDDED_PATH:-/app/data/privacy_erasure_authority.db}}
  PrivacyErasureAuthorityEmbedded__WriterReplicaCount: ${ERASURE_WRITER_REPLICA_COUNT:-${PRIVACY_ERASURE_AUTHORITY_WRITER_REPLICA_COUNT:-1}}
  PrivacyErasureAuthorityEmbedded__BusyTimeoutSeconds: ${ERASURE_BUSY_TIMEOUT_SECONDS:-${PRIVACY_ERASURE_AUTHORITY_BUSY_TIMEOUT_SECONDS:-30}}
  PrivacyErasureAuthorityDatabase__Provider: PostgreSql
  PrivacyErasureAuthorityDatabase__Host: ${ERASURE_DATABASE_HOST:-${PRIVACY_ERASURE_AUTHORITY_HOST:-privacy-erasure-db}}
  PrivacyErasureAuthorityDatabase__Port: ${ERASURE_DATABASE_PORT:-${PRIVACY_ERASURE_AUTHORITY_PORT:-5432}}
  PrivacyErasureAuthorityDatabase__Database: ${ERASURE_DATABASE_NAME:-${PRIVACY_ERASURE_AUTHORITY_DATABASE:-islamu_event_privacy_erasure}}
  PrivacyErasureAuthorityDatabase__TlsMode: ${ERASURE_DATABASE_TLS_MODE:-${PRIVACY_ERASURE_AUTHORITY_TLS_MODE:-Prefer}}
  PrivacyErasureAuthorityDatabase__TrustServerCertificate: ${ERASURE_DATABASE_TRUST_SERVER_CERTIFICATE:-${PRIVACY_ERASURE_AUTHORITY_TRUST_SERVER_CERTIFICATE:-false}}
  Database__Erasure__Provider: PostgreSql
  Database__Erasure__Host: ${ERASURE_DATABASE_HOST:-${PRIVACY_ERASURE_AUTHORITY_HOST:-privacy-erasure-db}}
  Database__Erasure__Port: ${ERASURE_DATABASE_PORT:-${PRIVACY_ERASURE_AUTHORITY_PORT:-5432}}
  Database__Erasure__Database: ${ERASURE_DATABASE_NAME:-${PRIVACY_ERASURE_AUTHORITY_DATABASE:-islamu_event_privacy_erasure}}
  Database__Erasure__Name: ${ERASURE_DATABASE_NAME:-${PRIVACY_ERASURE_AUTHORITY_DATABASE:-islamu_event_privacy_erasure}}
  Database__Erasure__TlsMode: ${ERASURE_DATABASE_TLS_MODE:-${PRIVACY_ERASURE_AUTHORITY_TLS_MODE:-Prefer}}
  Database__Erasure__TrustServerCertificate: ${ERASURE_DATABASE_TRUST_SERVER_CERTIFICATE:-${PRIVACY_ERASURE_AUTHORITY_TRUST_SERVER_CERTIFICATE:-false}}

x-privacy-erasure-runtime-env: &privacy-erasure-runtime-env
  <<: *privacy-erasure-authority-env
  PRIVACY_ERASURE_IDENTITY_FENCE_KEY_ID: ${PRIVACY_ERASURE_IDENTITY_FENCE_KEY_ID:-}
  PRIVACY_ERASURE_IDENTITY_FENCE_KEY: ${PRIVACY_ERASURE_IDENTITY_FENCE_KEY:-}
  PrivacyErasureAuthorityDatabase__Runtime__Username: ${ERASURE_DATABASE_RUNTIME_USERNAME:-${PRIVACY_ERASURE_AUTHORITY_RUNTIME_USERNAME:-privacy_erasure_runtime}}
  PrivacyErasureAuthorityDatabase__Runtime__Password: ${ERASURE_DATABASE_RUNTIME_PASSWORD:-${PRIVACY_ERASURE_AUTHORITY_RUNTIME_PASSWORD:-}}
  Database__Erasure__Runtime__Username: ${ERASURE_DATABASE_RUNTIME_USERNAME:-${PRIVACY_ERASURE_AUTHORITY_RUNTIME_USERNAME:-privacy_erasure_runtime}}
  Database__Erasure__Runtime__Password: ${ERASURE_DATABASE_RUNTIME_PASSWORD:-${PRIVACY_ERASURE_AUTHORITY_RUNTIME_PASSWORD:-}}

x-privacy-erasure-migrator-env: &privacy-erasure-migrator-env
  <<: *privacy-erasure-authority-env
  PrivacyErasureAuthorityDatabase__Migrator__Username: ${ERASURE_DATABASE_MIGRATOR_USERNAME:-${PRIVACY_ERASURE_AUTHORITY_MIGRATOR_USERNAME:-privacy_erasure_migrator}}
  PrivacyErasureAuthorityDatabase__Migrator__Password: ${ERASURE_DATABASE_MIGRATOR_PASSWORD:-${PRIVACY_ERASURE_AUTHORITY_MIGRATOR_PASSWORD:-}}
  Database__Erasure__Migrator__Username: ${ERASURE_DATABASE_MIGRATOR_USERNAME:-${PRIVACY_ERASURE_AUTHORITY_MIGRATOR_USERNAME:-privacy_erasure_migrator}}
  Database__Erasure__Migrator__Password: ${ERASURE_DATABASE_MIGRATOR_PASSWORD:-${PRIVACY_ERASURE_AUTHORITY_MIGRATOR_PASSWORD:-}}

x-s3-env: &s3-env
  STORAGE_S3_ENDPOINT: ${STORAGE_S3_ENDPOINT:-http://minio:9000}
  STORAGE_S3_PUBLIC_ENDPOINT: ${STORAGE_S3_PUBLIC_ENDPOINT:-http://minio.localhost:9005}
  STORAGE_S3_REGION: ${STORAGE_S3_REGION:-us-east-1}
  STORAGE_S3_BUCKET_NAME: ${STORAGE_S3_BUCKET_NAME:-explore}
  STORAGE_S3_ACCESS_KEY_ID: ${STORAGE_S3_ACCESS_KEY_ID:-}
  STORAGE_S3_SECRET_ACCESS_KEY: ${STORAGE_S3_SECRET_ACCESS_KEY:-}

x-api-runtime-env: &api-runtime-env
  EffectiveHostAuthority__InstanceHosts__0: ${EFFECTIVEHOSTAUTHORITY__INSTANCEHOSTS__0:-islamu-event-api}
  EffectiveHostAuthority__SubdomainBaseDomains__0: ${EFFECTIVEHOSTAUTHORITY__SUBDOMAINBASEDOMAINS__0:-}
  ForwardedHeadersTrust__ForwardLimit: ${FORWARDEDHEADERSTRUST__FORWARDLIMIT:-1}
  ForwardedHeadersTrust__TrustLoopbackProxy: ${FORWARDEDHEADERSTRUST__TRUSTLOOPBACKPROXY:-false}
  ForwardedHeadersTrust__KnownProxies__0: ${FORWARDEDHEADERSTRUST__KNOWNPROXIES__0:-}
  ForwardedHeadersTrust__KnownNetworks__0: ${FORWARDEDHEADERSTRUST__KNOWNNETWORKS__0:-}
  OperationalEndpoints__Address: ${OPERATIONALENDPOINTS__ADDRESS:-}
  OperationalEndpoints__Port: ${OPERATIONALENDPOINTS__PORT:-0}
  KEYCLOAK_LIFECYCLE_CLIENT_SECRET: ${KEYCLOAK_LIFECYCLE_CLIENT_SECRET:-}
  KEYCLOAKLIFECYCLEEMAIL__ENABLED: ${KEYCLOAKLIFECYCLEEMAIL__ENABLED:-false}
  KEYCLOAKLIFECYCLEEMAIL__BASEURL: ${KEYCLOAKLIFECYCLEEMAIL__BASEURL:-}
  KEYCLOAKLIFECYCLEEMAIL__REALM: ${KEYCLOAKLIFECYCLEEMAIL__REALM:-ISLAMU}
  KEYCLOAKLIFECYCLEEMAIL__CLIENTID: ${KEYCLOAKLIFECYCLEEMAIL__CLIENTID:-event-lifecycle}
  KEYCLOAKLIFECYCLEEMAIL__DEFAULTCLIENTID: ${KEYCLOAKLIFECYCLEEMAIL__DEFAULTCLIENTID:-event-blazor}
  KEYCLOAKLIFECYCLEEMAIL__PROVIDERVERSION: ${KEYCLOAKLIFECYCLEEMAIL__PROVIDERVERSION:-26.1.2}
  KEYCLOAKLIFECYCLEEMAIL__ALLOWLOCALURLS: ${KEYCLOAKLIFECYCLEEMAIL__ALLOWLOCALURLS:-false}
  DEPLOYMENT_MODE: ${DEPLOYMENT_MODE:-}
  INSTANCE_ADMIN_PUBLIC_ORIGIN: ${INSTANCE_ADMIN_PUBLIC_ORIGIN:-http://admin.localhost:7002}
  SETUP_SECRET: ${SETUP_SECRET:-}
  SETUP_SECRET_FILE: ${SETUP_SECRET_FILE:-/app/bootstrap/setup-secret}
  SETUP_SECRET_REQUIRED: ${SETUP_SECRET_REQUIRED:-true}
  INSTANCE_BOOTSTRAP_MODE: ${INSTANCE_BOOTSTRAP_MODE:-Interactive}
  INSTANCE_BOOTSTRAP_ADMIN_PROVIDER: ${INSTANCE_BOOTSTRAP_ADMIN_PROVIDER:-}
  INSTANCE_BOOTSTRAP_ADMIN_SUBJECT: ${INSTANCE_BOOTSTRAP_ADMIN_SUBJECT:-}
  INSTANCE_BOOTSTRAP_BINDING_GENERATION: ${INSTANCE_BOOTSTRAP_BINDING_GENERATION:-}
  INSTANCE_BOOTSTRAP_ADMIN_EMAIL: ${INSTANCE_BOOTSTRAP_ADMIN_EMAIL:-}
  INSTANCE_BOOTSTRAP_ADMIN_FIRST_NAME: ${INSTANCE_BOOTSTRAP_ADMIN_FIRST_NAME:-}
  INSTANCE_BOOTSTRAP_ADMIN_LAST_NAME: ${INSTANCE_BOOTSTRAP_ADMIN_LAST_NAME:-}
  INSTANCE_BOOTSTRAP_LOCAL_PASSWORD: ${INSTANCE_BOOTSTRAP_LOCAL_PASSWORD:-}
  Hosting__ReplicaCount: ${HOSTING_REPLICA_COUNT:-1}
  Promotions__CodeLookup__ActiveKeyVersion: ${PROMOTIONS_CODE_LOOKUP_ACTIVE_KEY_VERSION:-1}
  PROMOTIONS_CODE_LOOKUP_HMAC_KEY: ${PROMOTIONS_CODE_LOOKUP_HMAC_KEY:-}

x-instance-operator-identity-env: &instance-operator-identity-env
  INSTANCE__OPERATORIDENTITY__OPERATORID: ${INSTANCE__OPERATORIDENTITY__OPERATORID:-}
  INSTANCE__OPERATORIDENTITY__PUBLICNAME: ${INSTANCE__OPERATORIDENTITY__PUBLICNAME:-}
  INSTANCE__OPERATORIDENTITY__LEGALNAME: ${INSTANCE__OPERATORIDENTITY__LEGALNAME:-}
  INSTANCE__OPERATORIDENTITY__ISOFFICIALINSTANCE: ${INSTANCE__OPERATORIDENTITY__ISOFFICIALINSTANCE:-false}
  INSTANCE__OPERATORIDENTITY__OFFICIALORIGIN: ${INSTANCE__OPERATORIDENTITY__OFFICIALORIGIN:-}
  INSTANCE__OPERATORIDENTITY__OPERATORKINDCODE: ${INSTANCE__OPERATORIDENTITY__OPERATORKINDCODE:-}
  INSTANCE__OPERATORIDENTITY__JURISDICTIONCOUNTRYCODE: ${INSTANCE__OPERATORIDENTITY__JURISDICTIONCOUNTRYCODE:-}
  INSTANCE__OPERATORIDENTITY__REGISTRATIONIDENTIFIER: ${INSTANCE__OPERATORIDENTITY__REGISTRATIONIDENTIFIER:-}
  INSTANCE__OPERATORIDENTITY__PUBLICCONTACTEMAIL: ${INSTANCE__OPERATORIDENTITY__PUBLICCONTACTEMAIL:-}
  INSTANCE__OPERATORIDENTITY__WEBSITEURL: ${INSTANCE__OPERATORIDENTITY__WEBSITEURL:-}
  INSTANCE__OPERATORIDENTITY__LEGALNOTICEURL: ${INSTANCE__OPERATORIDENTITY__LEGALNOTICEURL:-}
  INSTANCE__OPERATORIDENTITY__TERMSURL: ${INSTANCE__OPERATORIDENTITY__TERMSURL:-}
  INSTANCE__OPERATORIDENTITY__PRIVACYURL: ${INSTANCE__OPERATORIDENTITY__PRIVACYURL:-}

x-payment-operations-env: &payment-operations-env
  PAYMENTS__CHECKOUTGOVERNANCE__COMPLAINTOWNER: ${PAYMENTS__CHECKOUTGOVERNANCE__COMPLAINTOWNER:-}
  PAYMENTS__CHECKOUTGOVERNANCE__REFUNDOWNER: ${PAYMENTS__CHECKOUTGOVERNANCE__REFUNDOWNER:-}
  PAYMENTS__CHECKOUTGOVERNANCE__DISPUTEOWNER: ${PAYMENTS__CHECKOUTGOVERNANCE__DISPUTEOWNER:-}
  PAYMENTS__CHECKOUTGOVERNANCE__RECONCILIATIONOWNER: ${PAYMENTS__CHECKOUTGOVERNANCE__RECONCILIATIONOWNER:-}
  PAYMENTS__CHECKOUTGOVERNANCE__ACTIVATIONSTATUS: ${PAYMENTS__CHECKOUTGOVERNANCE__ACTIVATIONSTATUS:-suspended}
  PAYMENTS__CHECKOUTGOVERNANCE__REFUNDPOLICYLANGUAGETAG: ${PAYMENTS__CHECKOUTGOVERNANCE__REFUNDPOLICYLANGUAGETAG:-}
  PAYMENTS__CHECKOUTGOVERNANCE__STATEMENTDESCRIPTOR: ${PAYMENTS__CHECKOUTGOVERNANCE__STATEMENTDESCRIPTOR:-}
  PAYMENTS__CHECKOUTGOVERNANCE__CHARGETYPE: ${PAYMENTS__CHECKOUTGOVERNANCE__CHARGETYPE:-direct-charge}

x-payment-api-env: &payment-api-env
  PublicBaseUrl: ${PUBLIC_BASE_URL:-}
  Payments__Stripe__Mode: ${PAYMENTS_STRIPE_MODE:-Test}
  Payments__OrganizerDirect__ProviderCode: ${PAYMENTS_ORGANIZER_DIRECT_PROVIDER_CODE:-}
  Payments__OrganizerDirect__ConnectPlatformId: ${PAYMENTS_ORGANIZER_DIRECT_CONNECT_PLATFORM_ID:-}
  STRIPE_PLATFORM_SECRET_KEY: ${STRIPE_PLATFORM_SECRET_KEY:-}
  STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}

x-ai-env: &ai-env
  AI_PROVIDER: ${AI_PROVIDER:-none}
  AI_ENDPOINT: ${AI_ENDPOINT:-}
  AI_MODEL_ID: ${AI_MODEL_ID:-}
  AI_CREDENTIAL_SCOPE: ${AI_CREDENTIAL_SCOPE:-}
  AI_OPENAI_API_KEY: ${AI_OPENAI_API_KEY:-}
  AI_ANTHROPIC_API_KEY: ${AI_ANTHROPIC_API_KEY:-}
  AI_OPENAI_COMPATIBLE_API_KEY: ${AI_OPENAI_COMPATIBLE_API_KEY:-}
  AI_ANTHROPIC_COMPATIBLE_API_KEY: ${AI_ANTHROPIC_COMPATIBLE_API_KEY:-}
  AI_AZURE_API_KEY: ${AI_AZURE_API_KEY:-}
  AI_TOOL_PROPOSALS_ENABLED: ${AI_TOOL_PROPOSALS_ENABLED:-false}

x-geocoding-env: &geocoding-env
  GEOCODING_PROVIDER: ${GEOCODING_PROVIDER:-None}
  GEOCODING_ENDPOINT: ${GEOCODING_ENDPOINT:-}
  GEOCODING_LANGUAGE: ${GEOCODING_LANGUAGE:-en}
  GEOCODING_COUNTRY_CODES: ${GEOCODING_COUNTRY_CODES:-}
  GEOCODING_DATASET_VERSION: ${GEOCODING_DATASET_VERSION:-}
  GEOCODING_MAXIMUM_RESULTS: ${GEOCODING_MAXIMUM_RESULTS:-10}
  GEOCODING_MAXIMUM_RESPONSE_BYTES: ${GEOCODING_MAXIMUM_RESPONSE_BYTES:-65536}
  GEOCODING_TOTAL_TIMEOUT_MILLISECONDS: ${GEOCODING_TOTAL_TIMEOUT_MILLISECONDS:-5000}
  GEOCODING_MAXIMUM_RETRY_COUNT: ${GEOCODING_MAXIMUM_RETRY_COUNT:-2}
  GEOCODING_RETRY_DELAYS_MILLISECONDS: ${GEOCODING_RETRY_DELAYS_MILLISECONDS:-200,500}
  GEOCODING_READINESS_TIMEOUT_MILLISECONDS: ${GEOCODING_READINESS_TIMEOUT_MILLISECONDS:-2000}
  GEOCODING_SELECTION_LIFETIME_SECONDS: ${GEOCODING_SELECTION_LIFETIME_SECONDS:-300}

x-mcp-env: &mcp-env
  MCP_ENABLED: ${MCP_ENABLED:-true}
  MCP_ENDPOINT_PATH: ${MCP_ENDPOINT_PATH:-/mcp}
  MCP_STATELESS: ${MCP_STATELESS:-true}
  MCP_ENABLE_LEGACY_SSE: ${MCP_ENABLE_LEGACY_SSE:-true}

x-smtp-env: &smtp-env
  MAIL_SMTP_HOST: ${MAIL_SMTP_HOST:-}
  MAIL_SMTP_PORT: ${MAIL_SMTP_PORT:-}
  MAIL_SMTP_USERNAME: ${MAIL_SMTP_USERNAME:-}
  MAIL_SMTP_PASSWORD: ${MAIL_SMTP_PASSWORD:-}
  MAIL_SMTP_ENCRYPTION: ${MAIL_SMTP_ENCRYPTION:-}
  MAIL_SMTP_FROM_ADDRESS: ${MAIL_SMTP_FROM_ADDRESS:-}
  MAIL_SMTP_FROM_NAME: ${MAIL_SMTP_FROM_NAME:-}

x-email-dispatch-rabbitmq-env: &email-dispatch-rabbitmq-env
  ConnectionStrings__messaging: ${MESSAGING_URI:-}
  EmailDispatchRabbitMq__Enabled: ${EMAIL_DISPATCH_RABBITMQ_ENABLED:-false}
  EmailDispatchRabbitMq__ConnectionStringName: ${EMAIL_DISPATCH_RABBITMQ_CONNECTION_STRING_NAME:-messaging}
  EmailDispatchRabbitMq__ConnectionString: ${EMAIL_DISPATCH_RABBITMQ_CONNECTION_STRING:-}
  EmailDispatchRabbitMq__ExchangeName: ${EMAIL_DISPATCH_RABBITMQ_EXCHANGE_NAME:-explore.email-dispatch}
  EmailDispatchRabbitMq__DispatchQueueName: ${EMAIL_DISPATCH_RABBITMQ_DISPATCH_QUEUE_NAME:-explore.email-dispatch.dispatch}
  EmailDispatchRabbitMq__DispatchRoutingKey: ${EMAIL_DISPATCH_RABBITMQ_DISPATCH_ROUTING_KEY:-email-dispatch.dispatch}
  EmailDispatchRabbitMq__DeadLetterExchangeName: ${EMAIL_DISPATCH_RABBITMQ_DEAD_LETTER_EXCHANGE_NAME:-explore.email-dispatch.dlx}
  EmailDispatchRabbitMq__DeadLetterQueueName: ${EMAIL_DISPATCH_RABBITMQ_DEAD_LETTER_QUEUE_NAME:-explore.email-dispatch.dead-letter}
  EmailDispatchRabbitMq__DeadLetterRoutingKey: ${EMAIL_DISPATCH_RABBITMQ_DEAD_LETTER_ROUTING_KEY:-email-dispatch.dead-letter}
  EmailDispatchRabbitMq__ParkingQueueName: ${EMAIL_DISPATCH_RABBITMQ_PARKING_QUEUE_NAME:-explore.email-dispatch.parking}
  EmailDispatchRabbitMq__ParkingRoutingKey: ${EMAIL_DISPATCH_RABBITMQ_PARKING_ROUTING_KEY:-email-dispatch.parking}
  EmailDispatchRabbitMq__ClientProvidedName: ${EMAIL_DISPATCH_RABBITMQ_CLIENT_PROVIDED_NAME:-explore-email-dispatch-rabbitmq}
  EmailDispatchRabbitMq__ConsumerId: ${EMAIL_DISPATCH_RABBITMQ_CONSUMER_ID:-explore-email-dispatch-rabbitmq-consumer}
  EmailDispatchRabbitMq__PrefetchCount: ${EMAIL_DISPATCH_RABBITMQ_PREFETCH_COUNT:-10}
  EmailDispatchRabbitMq__DeadLetterReplayEnabled: ${EMAIL_DISPATCH_RABBITMQ_DEAD_LETTER_REPLAY_ENABLED:-false}
  EmailDispatchRabbitMq__DeadLetterReplayConsumerId: ${EMAIL_DISPATCH_RABBITMQ_DEAD_LETTER_REPLAY_CONSUMER_ID:-explore-email-dispatch-dlq-replay}
  EmailDispatchRabbitMq__DeadLetterReplayPrefetchCount: ${EMAIL_DISPATCH_RABBITMQ_DEAD_LETTER_REPLAY_PREFETCH_COUNT:-5}
  EmailDispatchRabbitMq__PublishTimeoutSeconds: ${EMAIL_DISPATCH_RABBITMQ_PUBLISH_TIMEOUT_SECONDS:-15}
  EmailDispatchRabbitMq__PublisherPollingIntervalSeconds: ${EMAIL_DISPATCH_RABBITMQ_PUBLISHER_POLLING_INTERVAL_SECONDS:-5}
  EmailDispatchRabbitMq__PublisherBatchSize: ${EMAIL_DISPATCH_RABBITMQ_PUBLISHER_BATCH_SIZE:-100}
  EmailDispatchRabbitMq__PublisherRetryDelaySeconds: ${EMAIL_DISPATCH_RABBITMQ_PUBLISHER_RETRY_DELAY_SECONDS:-30}

x-web-push-env: &web-push-env
  WebPush__Enabled: ${WEB_PUSH_ENABLED:-false}
  VAPID_SUBJECT: ${VAPID_SUBJECT:-}
  VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:-}
  VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY:-}

x-reporting-env: &reporting-env
  Reporting__Enabled: ${REPORTING_ENABLED:-true}
  Reporting__Mode: ${REPORTING_MODE:-LocalOnly}
  Reporting__SyncReports: ${REPORTING_SYNC_REPORTS:-true}
  Reporting__EvaluateSignals: ${REPORTING_EVALUATE_SIGNALS:-false}
  Reporting__MirrorReviewQueue: ${REPORTING_MIRROR_REVIEW_QUEUE:-true}
  Reporting__ExecuteDecisions: ${REPORTING_EXECUTE_DECISIONS:-true}
  Reporting__Osprey__Enabled: ${REPORTING_OSPREY_ENABLED:-false}
  Reporting__Osprey__EndpointUrl: ${REPORTING_OSPREY_ENDPOINT_URL:-}
  Reporting__Osprey__ApiKey: ${REPORTING_OSPREY_API_KEY:-}
  Reporting__Osprey__AllowLocalProviderEndpoints: ${REPORTING_OSPREY_ALLOW_LOCAL_PROVIDER_ENDPOINTS:-true}
  Reporting__Coop__Enabled: ${REPORTING_COOP_ENABLED:-true}
  Reporting__Coop__EndpointUrl: ${REPORTING_COOP_ENDPOINT_URL:-http://coop:8080}
  Reporting__Coop__ApiKey: ${REPORTING_COOP_API_KEY:-}
  Reporting__Coop__AllowLocalProviderEndpoints: ${REPORTING_COOP_ALLOW_LOCAL_PROVIDER_ENDPOINTS:-true}
  Reporting__Coop__WebhookSecret: ${REPORTING_COOP_WEBHOOK_SECRET:-}

x-webhooks-env: &webhooks-env
  Webhooks__Enabled: ${WEBHOOKS_ENABLED:-true}
  Webhooks__Provider: ${WEBHOOKS_PROVIDER:-Local}
  Webhooks__Svix__BaseUrl: ${WEBHOOKS_SVIX_BASE_URL:-http://svix:8071}
  Webhooks__Svix__Environment: ${WEBHOOKS_SVIX_ENVIRONMENT:-self-hosted}
  Webhooks__Svix__ProviderVersion: ${WEBHOOKS_SVIX_PROVIDER_VERSION:-1.96.1}
  Webhooks__Svix__CapabilityPolicyVersion: ${WEBHOOKS_SVIX_CAPABILITY_POLICY_VERSION:-svix-self-hosted-1.96.1-v1}
  Webhooks__Svix__AuthTokenSecretRef: ${WEBHOOKS_SVIX_AUTH_TOKEN_SECRET_REF:-webhooks.svix.auth_token}
  Webhooks__Svix__OperationalWebhookSecretRef: ${WEBHOOKS_SVIX_OPERATIONAL_WEBHOOK_SECRET_REF:-webhooks.svix.operational_webhook_secret}
  WEBHOOKS_SVIX_AUTH_TOKEN: ${WEBHOOKS_SVIX_AUTH_TOKEN:-}
  WEBHOOKS_SVIX_OPERATIONAL_WEBHOOK_SECRET: ${WEBHOOKS_SVIX_OPERATIONAL_WEBHOOK_SECRET:-}

x-listmonk-env: &listmonk-env
  LISTMONK_ENABLED: ${LISTMONK_ENABLED:-false}
  LISTMONK_INSTANCE_URL: ${LISTMONK_INSTANCE_URL:-}
  LISTMONK_DEFAULT_LIST_ID: ${LISTMONK_DEFAULT_LIST_ID:-0}
  LISTMONK_PRECONFIRM_SUBSCRIPTIONS: ${LISTMONK_PRECONFIRM_SUBSCRIPTIONS:-true}
  LISTMONK_SYNC_ON_REGISTRATION: ${LISTMONK_SYNC_ON_REGISTRATION:-false}
  LISTMONK_API_USERNAME: ${LISTMONK_API_USERNAME:-}
  LISTMONK_API_KEY: ${LISTMONK_API_KEY:-}

x-local-storage-env: &local-storage-env
  Storage__Local__RootPath: ${LOCAL_STORAGE_ROOT_PATH:-/app/storage-data/local}
  Storage__Local__CreateRootIfMissing: ${LOCAL_STORAGE_CREATE_ROOT_IF_MISSING:-true}
  StorageReconciliation__Enabled: ${STORAGE_RECONCILIATION_ENABLED:-true}
  StorageReconciliation__DryRun: ${STORAGE_RECONCILIATION_DRY_RUN:-true}
  StorageReconciliation__QuarantineMissingObjects: ${STORAGE_RECONCILIATION_QUARANTINE_MISSING_OBJECTS:-false}
  StorageReconciliation__QuarantineOrphanLocalFiles: ${STORAGE_RECONCILIATION_QUARANTINE_ORPHAN_LOCAL_FILES:-false}
  StorageReconciliation__DeleteQuarantinedObjects: ${STORAGE_RECONCILIATION_DELETE_QUARANTINED_OBJECTS:-false}

services:
  privacy-erasure-authority-volume-init:
    image: busybox:1.37.0-musl
    restart: "no"
    user: "0:0"
    command: ["sh", "-c", "chown 1654:1654 /app/data && chmod 700 /app/data"]
    volumes:
      - privacy_erasure_authority_data:/app/data

  postgres:
    image: postgres:18-alpine
    restart: unless-stopped
    environment:
      <<: *postgres-env
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s

  privacy-erasure-db:
    profiles: ["privacy-erasure-external"]
    image: postgres:18-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${ERASURE_DATABASE_MIGRATOR_USERNAME:-privacy_erasure_migrator}
      POSTGRES_PASSWORD: ${ERASURE_DATABASE_MIGRATOR_PASSWORD:-}
      POSTGRES_DB: ${ERASURE_DATABASE_NAME:-islamu_event_privacy_erasure}
    volumes:
      - privacy_erasure_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s

  event-migrationservice:
    build:
      context: .
      dockerfile: src/Event.MigrationService/Dockerfile
    environment:
      <<: [*secrets-env, *database-env, *database-migrator-env, *privacy-erasure-migrator-env, *local-identity-migrator-env]
      SecretProvider__Infisical__ClientId: ${INFISICAL_MIGRATION_CLIENT_ID:-}
      SecretProvider__Infisical__ClientSecret: ${INFISICAL_MIGRATION_CLIENT_SECRET:-}
    volumes:
      - privacy_erasure_authority_data:/app/data
    depends_on:
      privacy-erasure-authority-volume-init:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      privacy-erasure-db:
        condition: service_healthy
        required: false

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: ["redis-server", "--appendonly", "yes"]
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5

  # Optional local capture only. Starting this profile never enables delivery.
  mailpit:
    profiles: ["mail"]
    image: axllent/mailpit:v1.30.0@sha256:0059ef81e492a7192af3816281eed6859eb078bd7bdc58b76757c13e10e53a7d
    restart: unless-stopped
    environment:
      MP_MAX_MESSAGES: "500"
      MP_DATABASE: /data/mailpit.db
      MP_DISABLE_VERSION_CHECK: "true"
    volumes:
      - mailpit_data:/data
    ports:
      - "127.0.0.1:${MAILPIT_UI_PORT:-8025}:8025"

  keycloak-db:
    image: postgres:18-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${KEYCLOAK_DB_USERNAME:-keycloak}
      POSTGRES_PASSWORD: ${KEYCLOAK_DB_PASSWORD:-}
      POSTGRES_DB: ${KEYCLOAK_DB_DATABASE:-keycloak}
    volumes:
      - keycloak_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s

  keycloak:
    image: quay.io/keycloak/keycloak:26.1.2
    restart: unless-stopped
    command: ["start-dev", "--http-port=8080"]
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://keycloak-db:5432/${KEYCLOAK_DB_DATABASE:-keycloak}
      KC_DB_USERNAME: ${KEYCLOAK_DB_USERNAME:-keycloak}
      KC_DB_PASSWORD: ${KEYCLOAK_DB_PASSWORD:-}
      KC_HOSTNAME: ${KEYCLOAK_ENDPOINT:-http://keycloak.localhost:8080}
      KC_HOSTNAME_URL: ${KEYCLOAK_ENDPOINT:-http://keycloak.localhost:8080}
      KC_HOSTNAME_STRICT: "false"
      KC_HOSTNAME_STRICT_BACKCHANNEL: "false"
      KC_HTTP_ENABLED: "true"
      KC_HEALTH_ENABLED: "true"
      KC_METRICS_ENABLED: "true"
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-admin}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-}
    ports:
      - "${KEYCLOAK_HTTP_PORT:-8080}:8080"
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'exec 3<>/dev/tcp/localhost/8080'"]
      interval: 10s
      timeout: 10s
      retries: 15
      start_period: 60s
    depends_on:
      keycloak-db:
        condition: service_healthy

  islamu-event-api:
    build:
      context: .
      dockerfile: src/Explore.API/Dockerfile
    environment:
      EVENT_DP_API_RING: ${EVENT_DP_API_RING:-}
      EVENT_DP_API_ADMISSION: ${EVENT_DP_API_ADMISSION:-}
      EVENT_DP_API_ADMISSION_SHA256: ${EVENT_DP_API_ADMISSION_SHA256:-}
      EVENT_DP_API_MINIMUM_GENERATION: ${EVENT_DP_API_MINIMUM_GENERATION:-}
      SecretProvider__Infisical__ClientId: ${INFISICAL_API_CLIENT_ID:-}
      SecretProvider__Infisical__ClientSecret: ${INFISICAL_API_CLIENT_SECRET:-}
      CONFIGURATION_MANIFEST_MODE: ${CONFIGURATION_MANIFEST_MODE:-Off}
      CONFIGURATION_MANIFEST_PATH: ${CONFIGURATION_MANIFEST_PATH:-/etc/islamu-event/bootstrap/configuration-manifest.json}
      KEYCLOAK__AUDIENCE: ${KEYCLOAK__AUDIENCE:-islamu-event-api}
      # No default/empty item: Compose omits an unresolved passthrough variable.
      KEYCLOAK__PERMITTEDCLIENTS__0:
      <<: [*keycloak-env, *authentication-selection-env, *local-identity-runtime-env, *s3-env, *local-storage-env, *secrets-env, *database-env, *database-runtime-env, *privacy-erasure-runtime-env, *api-runtime-env, *instance-operator-identity-env, *payment-operations-env, *payment-api-env, *ai-env, *geocoding-env, *mcp-env, *smtp-env, *email-dispatch-rabbitmq-env, *web-push-env, *reporting-env, *webhooks-env, *listmonk-env]
      ASPNETCORE_URLS: http://+:8080
      ASPNETCORE_ENVIRONMENT: Production
      KEYCLOAK_ENDPOINT: ${KEYCLOAK_ENDPOINT:-http://keycloak:8080}
      Keycloak__MetadataAddress: ${KEYCLOAK_INTERNAL_URL:-http://keycloak:8080}/realms/${KEYCLOAK_REALM:-ISLAMU}/.well-known/openid-configuration
      Keycloak__AllowManagedLocalHttp: "true"
      Keycloak__ManagedLocalHttpOrigin: http://keycloak:8080
      Keycloak__Authority: ${KEYCLOAK_ENDPOINT:-http://keycloak.localhost:8080}/realms/${KEYCLOAK_REALM:-ISLAMU}
      ConnectionStrings__cache: ${REDIS_CONNECTION_STRING:-redis:6379}
      AUTHORIZATION_PROVIDER: ${AUTHORIZATION_PROVIDER:-}
      Cerbos__GrpcEndpoint: ${CERBOS_GRPC_ENDPOINT:-http://cerbos:3593}
      Cerbos__HttpEndpoint: ${CERBOS_HTTP_ENDPOINT:-http://cerbos:3592}
      Cerbos__UseTls: ${CERBOS_USE_TLS:-false}
      Cerbos__PlaintextMode: ${CERBOS_PLAINTEXT_MODE:-true}
      Cerbos__PolicyPackagePath: /app/cerbos/policies
      Cerbos__AdminApi__Endpoints__0: ${CERBOS_HTTP_ENDPOINT:-http://cerbos:3592}
      Cerbos__PolicyPackage__Publication__ReceiptBase64: ${CERBOS_PUBLICATION_RECEIPT_BASE64:-}
      Cerbos__PolicyPackage__Publication__SignatureBase64: ${CERBOS_PUBLICATION_SIGNATURE_BASE64:-}
      Cerbos__PolicyPackage__Publication__PublicKeyPem: ${CERBOS_PUBLICATION_PUBLIC_KEY_PEM:-}
      Cerbos__PolicyPackage__Publication__Revision: ${CERBOS_PUBLICATION_REVISION:-}
      Cerbos__PolicyPackage__Publication__Environment: ${CERBOS_PUBLICATION_ENVIRONMENT:-}
    ports:
      - "127.0.0.1:${API_HTTP_PORT:-7039}:8080"
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'exec 3<>/dev/tcp/localhost/8080'"]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 10s
    extra_hosts:
      - "keycloak.localhost:host-gateway"
      - "minio.localhost:host-gateway"
    volumes:
      - ./cerbos/policies:/app/cerbos/policies:ro
      - setup_data:/app/bootstrap
      - local_storage_data:/app/storage-data/local
      - privacy_erasure_authority_data:/app/data
      - type: bind
        source: ${CONFIGURATION_MANIFEST_HOST_DIRECTORY:-./deploy/bootstrap}
        target: /etc/islamu-event/bootstrap
        read_only: true
        bind:
          create_host_path: false
    deploy:
      replicas: 1
    depends_on:
      privacy-erasure-authority-volume-init:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      event-migrationservice:
        condition: service_completed_successfully
      privacy-erasure-db:
        condition: service_healthy
        required: false
      keycloak:
        condition: service_healthy
      minio:
        condition: service_healthy
        required: false
      svix:
        condition: service_healthy
        required: false
      weblate:
        condition: service_started
        required: false
      coop:
        condition: service_started
        required: false
      osprey:
        condition: service_started
        required: false

  islamu-event-ui:
    build:
      context: .
      dockerfile: src/Explore.Blazor/Dockerfile
    environment:
      EVENT_DP_BFF_RING: ${EVENT_DP_BFF_RING:-}
      EVENT_DP_BFF_ADMISSION: ${EVENT_DP_BFF_ADMISSION:-}
      EVENT_DP_BFF_ADMISSION_SHA256: ${EVENT_DP_BFF_ADMISSION_SHA256:-}
      EVENT_DP_BFF_MINIMUM_GENERATION: ${EVENT_DP_BFF_MINIMUM_GENERATION:-}
      SecretProvider__Infisical__ClientId: ${INFISICAL_BFF_CLIENT_ID:-}
      SecretProvider__Infisical__ClientSecret: ${INFISICAL_BFF_CLIENT_SECRET:-}
      KEYCLOAK_BLAZOR_CLIENT_SECRET: ${KEYCLOAK_BLAZOR_CLIENT_SECRET:-}
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      ATPROTO_OAUTH_CLIENT_PRIVATE_JWKS: ${ATPROTO_OAUTH_CLIENT_PRIVATE_JWKS:-}
      <<: [*keycloak-env, *authentication-selection-env, *secrets-env]
      ASPNETCORE_URLS: http://+:8080
      ASPNETCORE_ENVIRONMENT: Production
      API_ENDPOINT: ${API_ENDPOINT:-http://islamu-event-api:8080/}
      Keycloak__Authority: ${KEYCLOAK_ENDPOINT:-http://keycloak.localhost:8080}/realms/${KEYCLOAK_REALM:-ISLAMU}
      Keycloak__MetadataAddress: ${KEYCLOAK_INTERNAL_URL:-http://keycloak:8080}/realms/${KEYCLOAK_REALM:-ISLAMU}/.well-known/openid-configuration
      Keycloak__Realm: ${KEYCLOAK_REALM:-ISLAMU}
      Keycloak__ClientId: ${KEYCLOAK_BLAZOR_CLIENT_ID:-islamu-event-blazor}
      Keycloak__ClientSecret: ${KEYCLOAK_BLAZOR_CLIENT_SECRET:-}
      Bff__AdminHosts__0: ${INSTANCE_ADMIN_PUBLIC_ORIGIN:-http://admin.localhost:7002}
      ConnectionStrings__cache: ${REDIS_CONNECTION_STRING:-redis:6379}
    ports:
      - "${UI_HTTP_PORT:-7002}:8080"
    extra_hosts:
      - "keycloak.localhost:host-gateway"
      - "minio.localhost:host-gateway"
    depends_on:
      islamu-event-api:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      minio:
        condition: service_healthy
        required: false

  minio:
    image: ghcr.io/coollabsio/minio:latest
    profiles: ["storage"] # Opt-in only
    restart: unless-stopped
    environment:
      MINIO_ROOT_USER: ${STORAGE_S3_ACCESS_KEY_ID:-}
      MINIO_ROOT_PASSWORD: ${STORAGE_S3_SECRET_ACCESS_KEY:-}
      MINIO_SERVER_URL: ${STORAGE_S3_PUBLIC_ENDPOINT:-http://minio.localhost:9005}
    volumes:
      - minio_data:/data
    ports:
      - "${MINIO_API_PORT:-9005}:9000"
      - "${MINIO_CONSOLE_PORT:-9006}:9001"
    command: server /data --console-address ":9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s

  minio-init:
    image: minio/mc:latest
    profiles: ["storage"] # Only runs if storage is enabled
    depends_on:
      minio:
        condition: service_healthy
    entrypoint: >
      /bin/sh -c "
      mc alias set local http://minio:9000 ${STORAGE_S3_ACCESS_KEY_ID:-} ${STORAGE_S3_SECRET_ACCESS_KEY:-};
      mc mb --ignore-existing local/${STORAGE_S3_BUCKET_NAME:-explore};
      mc anonymous set private local/${STORAGE_S3_BUCKET_NAME:-explore};
      "

  cerbos-db:
    image: postgres:18-alpine
    profiles: ["authz"]
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${CERBOS_POSTGRES_USER:-cerbos_user}
      POSTGRES_PASSWORD: ${CERBOS_POSTGRES_PASSWORD:-}
      POSTGRES_DB: ${CERBOS_POSTGRES_DB:-cerbos}
    volumes:
      - cerbos_data:/var/lib/postgresql
      # Repository-owned Cerbos PostgreSQL schema used by local infrastructure.
      - ./cerbos/init/cerbos-schema.sql:/docker-entrypoint-initdb.d/cerbos-schema.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s

  cerbos:
    image: ghcr.io/cerbos/cerbos:0.53.0
    profiles: ["authz"] # Opt-in only (use: docker compose --profile authz up)
    restart: unless-stopped
    command: ["server", "--config=/config/.cerbos.yaml"]
    environment:
      CERBOS_ADMIN_USER: ${CERBOS_ADMIN_USERNAME:-cerbos}
      CERBOS_ADMIN_PASSWORD_HASH: ${CERBOS_ADMIN_PASSWORD_HASH:-}
      CERBOS_PG_URL: ${CERBOS_PG_URL:-}
    volumes:
      # Repository-owned Cerbos runtime config and bundled policies/schemas.
      - ./cerbos/config/.cerbos.yaml:/config/.cerbos.yaml:ro
      - ./cerbos/policies:/policies:ro
    ports:
      - "${CERBOS_HTTP_PORT:-3592}:3592"
      - "${CERBOS_GRPC_PORT:-3593}:3593"
    depends_on:
      cerbos-db:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3592/_cerbos/health"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s

  cerbos-policy-sync:
    image: ghcr.io/cerbos/cerbosctl:0.53.0
    profiles: ["cerbos-publication"]
    depends_on:
      cerbos:
        condition: service_healthy
    environment:
      CERBOS_USERNAME:
      CERBOS_PASSWORD:
    volumes:
      # Sync the same repository policy bundle that local Cerbos reads from disk.
      - ./cerbos/policies:/policies:ro
    entrypoint: ["/bin/sh", "-c"]
    command:
      - >-
        test -n "$$CERBOS_USERNAME" && test -n "$$CERBOS_PASSWORD" &&
        cerbosctl --server=http://cerbos:3592 put schema --recursive /policies/_schemas &&
        cerbosctl --server=http://cerbos:3592 put policy --recursive /policies &&
        cerbosctl --server=http://cerbos:3592 store reload --wait

  svix-db:
    image: postgres:13.4
    profiles: ["webhooks"]
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${SVIX_DB_USERNAME:-postgres}
      POSTGRES_PASSWORD: ${SVIX_DB_PASSWORD:-}
      POSTGRES_DB: ${SVIX_DB_DATABASE:-postgres}
    volumes:
      - svix_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s

  svix:
    image: svix/svix-server:${SVIX_TAG:-v1.96.1}
    profiles: ["webhooks"]
    restart: unless-stopped
    environment:
      WAIT_FOR: "true"
      SVIX_DB_DSN: ${SVIX_DB_DSN:-postgresql://postgres:postgres@svix-db:5432/postgres}
      SVIX_REDIS_DSN: ${SVIX_REDIS_DSN:-redis://redis:6379}
      SVIX_QUEUE_TYPE: ${SVIX_QUEUE_TYPE:-redis}
      SVIX_CACHE_TYPE: ${SVIX_CACHE_TYPE:-redis}
      SVIX_JWT_SECRET: ${SVIX_JWT_SECRET:-}
    ports:
      - "${SVIX_HTTP_PORT:-8071}:8071"
    depends_on:
      svix-db:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "svix-server healthcheck http://localhost:8071"]
      interval: 5s
      timeout: 5s
      retries: 60
      start_period: 30s

  weblate-db:
    image: postgres:18-alpine
    profiles: ["localization"]
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${WEBLATE_POSTGRES_USER:-weblate}
      POSTGRES_PASSWORD: ${WEBLATE_POSTGRES_PASSWORD:-}
      POSTGRES_DB: ${WEBLATE_POSTGRES_DB:-weblate}
    volumes:
      - weblate_postgres_data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 10s

  weblate:
    image: ${WEBLATE_IMAGE:-weblate/weblate:latest}
    profiles: ["localization"]
    restart: unless-stopped
    environment:
      WEBLATE_SITE_DOMAIN: ${WEBLATE_SITE_DOMAIN:-localhost:8083}
      WEBLATE_ADMIN_NAME: ${WEBLATE_ADMIN_NAME:-Admin}
      WEBLATE_ADMIN_EMAIL: ${WEBLATE_ADMIN_EMAIL:-admin@openislamu.org}
      WEBLATE_ADMIN_PASSWORD: ${WEBLATE_ADMIN_PASSWORD:-}
      POSTGRES_HOST: weblate-db
      POSTGRES_PORT: "5432"
      POSTGRES_USER: ${WEBLATE_POSTGRES_USER:-weblate}
      POSTGRES_PASSWORD: ${WEBLATE_POSTGRES_PASSWORD:-}
      POSTGRES_DB: ${WEBLATE_POSTGRES_DB:-weblate}
      VALKEY_HOST: redis
      VALKEY_PORT: "6379"
      REDIS_HOST: redis
      REDIS_PORT: "6379"
    volumes:
      - weblate_data:/app/data
    ports:
      - "${WEBLATE_HTTP_PORT:-8083}:8080"
    depends_on:
      weblate-db:
        condition: service_healthy
      redis:
        condition: service_healthy

  coop:
    image: ${COOP_IMAGE:-ghcr.io/roostorg/coop-server:latest}
    profiles: ["moderation"]
    restart: unless-stopped
    environment:
      NODE_ENV: ${COOP_NODE_ENV:-development}
      OTEL_SERVICE_NAME: ${COOP_OTEL_SERVICE_NAME:-coop}
      PORT: "8080"
      UI_URL: ${COOP_UI_URL:-http://localhost:3001}
      SESSION_SECRET: ${COOP_SESSION_SECRET:-}
      DATABASE_HOST: coop-db
      DATABASE_READ_ONLY_HOST: coop-db
      DATABASE_PORT: "5432"
      DATABASE_USER: ${COOP_DATABASE_USER:-coop}
      DATABASE_PASSWORD: ${COOP_DATABASE_PASSWORD:-}
      DATABASE_NAME: ${COOP_DATABASE_NAME:-coop}
      WAREHOUSE_ADAPTER: ${COOP_WAREHOUSE_ADAPTER:-noop}
      ANALYTICS_ADAPTER: ${COOP_ANALYTICS_ADAPTER:-noop}
      SCYLLA_HOSTS: ${COOP_SCYLLA_HOSTS:-coop-scylla}
      SCYLLA_USERNAME: ${COOP_SCYLLA_USERNAME:-cassandra}
      SCYLLA_PASSWORD: ${COOP_SCYLLA_PASSWORD:-}
      SCYLLA_LOCAL_DATACENTER: ${COOP_SCYLLA_LOCAL_DATACENTER:-datacenter1}
      SCYLLA_SSL: ${COOP_SCYLLA_SSL:-false}
      REDIS_USE_CLUSTER: "false"
      REDIS_HOST: redis
      REDIS_PORT: "6379"
    ports:
      - "${COOP_HTTP_PORT:-8082}:8080"
    depends_on:
      coop-migrations:
        condition: service_completed_successfully
      coop-db:
        condition: service_healthy
      redis:
        condition: service_healthy

  coop-migrations:
    image: ${COOP_MIGRATIONS_IMAGE:-ghcr.io/roostorg/coop-migrations:latest}
    profiles: ["moderation"]
    restart: "no"
    environment:
      DATABASE_HOST: coop-db
      DATABASE_READ_ONLY_HOST: coop-db
      DATABASE_PORT: "5432"
      DATABASE_USER: ${COOP_DATABASE_USER:-coop}
      DATABASE_PASSWORD: ${COOP_DATABASE_PASSWORD:-}
      DATABASE_NAME: ${COOP_DATABASE_NAME:-coop}
      API_SERVER_DATABASE_HOST: coop-db
      API_SERVER_DATABASE_PORT: "5432"
      API_SERVER_DATABASE_USER: ${COOP_DATABASE_USER:-coop}
      API_SERVER_DATABASE_PASSWORD: ${COOP_DATABASE_PASSWORD:-}
      API_SERVER_DATABASE_NAME: ${COOP_DATABASE_NAME:-coop}
      SCYLLA_HOSTS: ${COOP_SCYLLA_HOSTS:-coop-scylla}
      SCYLLA_USERNAME: ${COOP_SCYLLA_USERNAME:-cassandra}
      SCYLLA_PASSWORD: ${COOP_SCYLLA_PASSWORD:-}
      SCYLLA_LOCAL_DATACENTER: ${COOP_SCYLLA_LOCAL_DATACENTER:-datacenter1}
      SCYLLA_SSL: ${COOP_SCYLLA_SSL:-false}
    entrypoint: ["sh", "-c", "npm run db:create -- --db api-server-pg --env staging && npm run db:update -- --db api-server-pg --env staging"]
    depends_on:
      coop-db:
        condition: service_healthy

  coop-client:
    image: ${COOP_CLIENT_IMAGE:-ghcr.io/roostorg/coop-client:latest}
    profiles: ["moderation"]
    restart: unless-stopped
    volumes:
      - ./src/Explore.AppHost/Config/coop/nginx.conf:/etc/nginx/conf.d/default.conf:ro
    ports:
      - "${COOP_CLIENT_HTTP_PORT:-3001}:80"
    depends_on:
      coop:
        condition: service_started

  coop-db:
    image: postgres:18-alpine
    profiles: ["moderation"]
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${COOP_DATABASE_USER:-coop}
      POSTGRES_PASSWORD: ${COOP_DATABASE_PASSWORD:-}
      POSTGRES_DB: ${COOP_DATABASE_NAME:-coop}
    volumes:
      - coop_postgres_data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${COOP_DATABASE_USER:-coop} -d ${COOP_DATABASE_NAME:-coop}"]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 10s

  formbricks-postgres:
    image: pgvector/pgvector:pg18
    profiles: ["formbricks"]
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${FORMBRICKS_DATABASE_USER:-postgres}
      POSTGRES_PASSWORD: ${FORMBRICKS_DATABASE_PASSWORD:-}
      POSTGRES_DB: ${FORMBRICKS_DATABASE_NAME:-formbricks}
    volumes:
      - formbricks_postgres_data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${FORMBRICKS_DATABASE_USER:-postgres} -d ${FORMBRICKS_DATABASE_NAME:-formbricks}"]
      interval: 5s
      timeout: 3s
      retries: 30
      start_period: 30s

  formbricks-redis:
    image: valkey/valkey@sha256:12ba4f45a7c3e1d0f076acd616cb230834e75a77e8516dde382720af32832d6d
    profiles: ["formbricks"]
    restart: unless-stopped
    command: valkey-server --appendonly yes --maxmemory-policy noeviction
    volumes:
      - formbricks_redis_data:/data
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 30
      start_period: 10s

  formbricks-migrate:
    image: ghcr.io/formbricks/formbricks:5.2.2@sha256:d6f635714a9c29620203ba29762f4746f5def86c346d6ad95fefa66adc21fd5e
    profiles: ["formbricks"]
    restart: "no"
    entrypoint: ["sh", "-c"]
    command: ["node /home/nextjs/validate-env.mjs && node packages/database/dist/scripts/apply-migrations.js"]
    environment:
      <<: *formbricks-env
    depends_on:
      formbricks-postgres:
        condition: service_healthy

  formbricks-hub-migrate:
    image: ghcr.io/formbricks/hub:latest@sha256:4dc0c4f26cf999b3bf4a26d7b09634fc65ae23cbb30c9ad82042da019d231458
    profiles: ["formbricks"]
    restart: "no"
    entrypoint: ["sh", "-c"]
    command: ['goose -dir /app/migrations postgres "$$DATABASE_URL" up && river migrate-up --database-url "$$DATABASE_URL"']
    environment:
      DATABASE_URL: postgresql://${FORMBRICKS_DATABASE_USER:-postgres}:${FORMBRICKS_DATABASE_PASSWORD:-}@formbricks-postgres:5432/${FORMBRICKS_DATABASE_NAME:-formbricks}?sslmode=disable
    depends_on:
      formbricks-migrate:
        condition: service_completed_successfully

  formbricks-hub:
    image: ghcr.io/formbricks/hub:latest@sha256:4dc0c4f26cf999b3bf4a26d7b09634fc65ae23cbb30c9ad82042da019d231458
    profiles: ["formbricks"]
    restart: unless-stopped
    environment:
      API_KEY: ${FORMBRICKS_HUB_API_KEY:-}
      DATABASE_URL: postgresql://${FORMBRICKS_DATABASE_USER:-postgres}:${FORMBRICKS_DATABASE_PASSWORD:-}@formbricks-postgres:5432/${FORMBRICKS_DATABASE_NAME:-formbricks}?sslmode=disable
    depends_on:
      formbricks-hub-migrate:
        condition: service_completed_successfully

  formbricks-cube:
    image: cubejs/cube:v1.6.6
    profiles: ["formbricks"]
    restart: unless-stopped
    command: ["sh", "-c", "test -n \"$$CUBEJS_API_SECRET\" && exec cubejs server"]
    environment:
      CUBEJS_DB_TYPE: postgres
      CUBEJS_DB_HOST: formbricks-postgres
      CUBEJS_DB_NAME: ${FORMBRICKS_DATABASE_NAME:-formbricks}
      CUBEJS_DB_USER: ${FORMBRICKS_DATABASE_USER:-postgres}
      CUBEJS_DB_PASS: ${FORMBRICKS_DATABASE_PASSWORD:-}
      CUBEJS_DB_PORT: "5432"
      CUBEJS_API_SECRET: ${FORMBRICKS_CUBEJS_API_SECRET:-}
      CUBEJS_JWT_ISSUER: formbricks-web
      CUBEJS_JWT_AUDIENCE: formbricks-cube
      CUBEJS_DEFAULT_API_SCOPES: meta,data
      CUBEJS_CACHE_AND_QUEUE_DRIVER: memory
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:4000/readyz',r=>{r.resume();process.exit(r.statusCode===200?0:1)}).on('error',()=>process.exit(1))"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 30s
    depends_on:
      formbricks-hub-migrate:
        condition: service_completed_successfully
      formbricks-postgres:
        condition: service_healthy

  formbricks:
    image: ghcr.io/formbricks/formbricks:5.2.2@sha256:d6f635714a9c29620203ba29762f4746f5def86c346d6ad95fefa66adc21fd5e
    profiles: ["formbricks"]
    restart: unless-stopped
    ports:
      - "${FORMBRICKS_HTTP_PORT:-3005}:3000"
    environment:
      <<: *formbricks-env
      SKIP_STARTUP_MIGRATION: "true"
    depends_on:
      formbricks-migrate:
        condition: service_completed_successfully
      formbricks-postgres:
        condition: service_healthy
      formbricks-redis:
        condition: service_healthy
      formbricks-cube:
        condition: service_healthy
      formbricks-hub:
        condition: service_started

  osprey:
    image: ${OSPREY_IMAGE:-ghcr.io/roostorg/osprey/osprey-coordinator:latest}
    profiles: ["osprey"]
    restart: unless-stopped
    environment:
      RUST_LOG: ${OSPREY_RUST_LOG:-info}
      OSPREY_COORDINATOR_BIDI_STREAM_PORT: "19950"
      OSPREY_COORDINATOR_SYNC_ACTION_PORT: "19951"
      POD_IP: ${OSPREY_POD_IP:-osprey}
    ports:
      - "${OSPREY_BIDI_STREAM_PORT:-19950}:19950"
      - "${OSPREY_SYNC_ACTION_PORT:-19951}:19951"

volumes:
  setup_data:
  postgres_data:
  privacy_erasure_authority_data:
  privacy_erasure_postgres_data:
  redis_data:
  keycloak_data:
  mailpit_data:
  local_storage_data:
  minio_data:
  cerbos_data:
  svix_postgres_data:
  weblate_data:
  weblate_postgres_data:
  coop_postgres_data:
  formbricks_postgres_data:
  formbricks_redis_data: