# Compose v2 - BFF (api/edge/bff)

x-common-env: &common-env
  env_file:
    - ../env/.env.runtime
    - ../env/.env.version

volumes:
  bff-vault-run:
    driver: local
    driver_opts:
      type: tmpfs
      device: tmpfs
      o: size=8m,uid=0,gid=0,mode=0700

networks:
  sendico-net:
    external: true
    name: sendico-net

services:
  sendico_bff:
    <<: *common-env
    container_name: sendico-bff
    restart: unless-stopped
    image: ${REGISTRY_URL}/bff/service:${APP_V}
    pull_policy: always
    environment:
      AMPLI_ENVIRONMENT: ${AMPLI_ENVIRONMENT}
      API_PROTOCOL: ${API_PROTOCOL}
      SERVICE_HOST: ${SERVICE_HOST}
      API_ENDPOINT: ${API_ENDPOINT}
      API_ENDPOINT_SECRET: ${API_ENDPOINT_SECRET}
      WS_ENDPOINT: ${WS_ENDPOINT}
      NATS_URL: ${NATS_URL}
      NATS_HOST: ${NATS_HOST}
      NATS_PORT: ${NATS_PORT}
      NATS_USER: ${NATS_USER}
      NATS_PASSWORD: ${NATS_PASSWORD}
      CHAIN_GATEWAY_ADDRESS: ${CHAIN_GATEWAY_SERVICE_NAME}:${CHAIN_GATEWAY_GRPC_PORT}
      LEDGER_ADDRESS: ${LEDGER_SERVICE_NAME}:${LEDGER_GRPC_PORT}
      PAYMENTS_ADDRESS: ${PAYMENTS_SERVICE_NAME}:${PAYMENTS_GRPC_PORT}
      PAYMENTS_QUOTE_ADDRESS: ${PAYMENTS_QUOTATION_SERVICE_NAME}:${PAYMENTS_QUOTATION_GRPC_PORT}
      PAYMENTS_METHODS_ADDRESS: ${PAYMENTS_METHODS_SERVICE_NAME}:${PAYMENTS_METHODS_GRPC_PORT}
      MONGO_HOST: ${MONGO_HOST}
      MONGO_PORT: ${MONGO_PORT}
      MONGO_DATABASE: ${MONGO_DATABASE}
      MONGO_USER: ${MONGO_USER}
      MONGO_PASSWORD: ${MONGO_PASSWORD}
      MONGO_AUTH_SOURCE: ${MONGO_AUTH_SOURCE}
      MONGO_REPLICA_SET: ${MONGO_REPLICA_SET}
      MONGO_HOSTS_0: ${MONGO_HOSTS_0}
      MONGO_PORTS_0: ${MONGO_PORTS_0}
      MONGO_HOSTS_1: ${MONGO_HOSTS_1}
      MONGO_PORTS_1: ${MONGO_PORTS_1}
      MONGO_HOSTS_2: ${MONGO_HOSTS_2}
      MONGO_PORTS_2: ${MONGO_PORTS_2}
      PERMISSION_MODEL: ${PERMISSION_MODEL}
      PERMISSION_COLLECTION: ${PERMISSION_COLLECTION}
      PERMISSION_TIMEOUT: ${PERMISSION_TIMEOUT}
      PERMISSION_IS_FILTERED: ${PERMISSION_IS_FILTERED}
      VAULT_ADDR: ${VAULT_ADDR}
      VAULT_TOKEN_FILE: /run/vault/token
    ports:
      - "0.0.0.0:${BFF_HTTP_PORT}:8081"
    volumes:
      - bff-vault-run:/run/vault:ro
    depends_on:
      sendico_bff_vault_agent:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL","wget -qO- http://localhost:8081/api/v1/health | grep -q '\"status\":\"ok\"'"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    networks:
      - sendico-net

  sendico_bff_vault_agent:
    <<: *common-env
    container_name: sendico-bff-vault-agent
    restart: unless-stopped
    image: hashicorp/vault:latest
    pull_policy: always
    cap_add: ["IPC_LOCK"]
    environment:
      VAULT_ADDR: ${VAULT_ADDR}
      BFF_VAULT_ROLE_ID: ${BFF_VAULT_ROLE_ID}
      BFF_VAULT_SECRET_ID: ${BFF_VAULT_SECRET_ID}
    command: >
      sh -lc 'set -euo pipefail; umask 077;
              : "${BFF_VAULT_ROLE_ID:?}"; : "${BFF_VAULT_SECRET_ID:?}";
              printf "%s" "$BFF_VAULT_ROLE_ID"   > /run/vault/role_id;
              printf "%s" "$BFF_VAULT_SECRET_ID" > /run/vault/secret_id;
              unset BFF_VAULT_ROLE_ID BFF_VAULT_SECRET_ID;
              exec vault agent -config=/etc/vault/agent/bff.hcl'
    volumes:
      - ./vault-agent/bff.hcl:/etc/vault/agent/bff.hcl:ro
      - bff-vault-run:/run/vault
    healthcheck:
      test: ["CMD","test","-s","/run/vault/token"]
      interval: 10s
      timeout: 5s
      retries: 6
    networks:
      - sendico-net