docker-compose.yml

version: "3.9"

services:
  # =============================================================================
  # Traefik - Reverse Proxy
  # =============================================================================
  traefik:
    image: traefik:v3
    environment:
      - DOCKER_API_VERSION=1.45
      # ACME email for Let's Encrypt (only used in HTTPS mode)
      - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL=${ACME_EMAIL:-}
    ports:
      - "${TRAEFIK_PORTS_WEB:-3000:3000}"
      - "${TRAEFIK_PORTS_ALT:-8080:8080}"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - letsencrypt_data:/letsencrypt
      - ./${TRAEFIK_CONFIG:-traefik/traefik-http.yml}:/etc/traefik/traefik.yml:ro
    networks:
      - opencasenet
    labels:
      # Traefik does not route to itself — disable auto-router
      - "traefik.enable=false"

  # =============================================================================
  # Keycloak - OIDC Identity Provider
  # =============================================================================
  keycloak:
    image: quay.io/keycloak/keycloak:26.0.7
    environment:
      - KEYCLOAK_ADMIN=${KEYCLOAK_ADMIN:-admin}
      - KEYCLOAK_ADMIN_PASSWORD=${ADMIN_PASSWORD:-admin}
      - KC_HTTP_ENABLED=true
      - KC_HEALTH_ENABLED=true
      - KC_METRICS_ENABLED=true
      # Hostname configuration - tell Keycloak its external URL
      - KC_HOSTNAME=${OPENCASE_HOSTNAME:-localhost}
      - KC_HOSTNAME_STRICT=false
      - KC_HOSTNAME_STRICT_HTTPS=${KC_HOSTNAME_STRICT_HTTPS:-false}
      # Proxy settings for running behind Traefik
      - KC_PROXY_HEADERS=xforwarded
      - KC_HTTP_RELATIVE_PATH=/
    command: ["start-dev", "--http-port=8080"]
    volumes:
      # Persist Keycloak data (H2 database, realm config)
      - keycloak_data:/opt/keycloak/data
      # Mount custom OpenCASE login theme
      - ./keycloak/themes/opencase:/opt/keycloak/themes/opencase
    networks:
      - opencasenet
    labels:
      - "traefik.enable=true"
      - "traefik.constraint-label=opencase_opencasenet"
      # Route /realms/* to Keycloak (OIDC endpoints)
      - "traefik.http.routers.keycloak-realms.rule=Host(`${OPENCASE_HOSTNAME:-localhost}`) && PathPrefix(`/realms`)"
      - "traefik.http.routers.keycloak-realms.entrypoints=web"
      - "traefik.http.routers.keycloak-realms.priority=100"
      - "traefik.http.routers.keycloak-realms.service=keycloak"
      # Route /admin/* to Keycloak (Admin console)
      - "traefik.http.routers.keycloak-admin.rule=Host(`${OPENCASE_HOSTNAME:-localhost}`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.keycloak-admin.entrypoints=web"
      - "traefik.http.routers.keycloak-admin.priority=100"
      - "traefik.http.routers.keycloak-admin.service=keycloak"
      # Route /resources/* to Keycloak (static assets)
      - "traefik.http.routers.keycloak-resources.rule=Host(`${OPENCASE_HOSTNAME:-localhost}`) && PathPrefix(`/resources`)"
      - "traefik.http.routers.keycloak-resources.entrypoints=web"
      - "traefik.http.routers.keycloak-resources.priority=100"
      - "traefik.http.routers.keycloak-resources.service=keycloak"
      # Route /js/* to Keycloak (JavaScript assets)
      - "traefik.http.routers.keycloak-js.rule=Host(`${OPENCASE_HOSTNAME:-localhost}`) && PathPrefix(`/js`)"
      - "traefik.http.routers.keycloak-js.entrypoints=web"
      - "traefik.http.routers.keycloak-js.priority=100"
      - "traefik.http.routers.keycloak-js.service=keycloak"
      # Route /robots.txt to Keycloak
      - "traefik.http.routers.keycloak-robots.rule=Host(`${OPENCASE_HOSTNAME:-localhost}`) && Path(`/robots.txt`)"
      - "traefik.http.routers.keycloak-robots.entrypoints=web"
      - "traefik.http.routers.keycloak-robots.priority=100"
      - "traefik.http.routers.keycloak-robots.service=keycloak"
      # Service definition
      - "traefik.http.services.keycloak.loadbalancer.server.port=8080"

  # =============================================================================
  # Mailpit - Local SMTP for dev (catches all emails)
  # Web UI: http://localhost:8025
  # =============================================================================
  mailpit:
    image: axllent/mailpit
    ports:
      - "8025:8025"   # Web UI for viewing captured emails
      - "1025:1025"   # SMTP server
    networks:
      - opencasenet

  # =============================================================================
  # OpenCASE - CASE API Backend
  # =============================================================================
  opencase:
    build: ./apps/opencase
    environment:
      - CASE_DATA_DIR=${CASE_DATA_DIR:-/app/data}
      - PORT=8080
      # Keycloak / OIDC configuration
      # External issuer URL — constructed from base variables (scheme://host:port/realms/realm)
      - OIDC_ISSUER_URL=${OPENCASE_SCHEME:-http}://${OPENCASE_HOSTNAME:-localhost}${OPENCASE_PORT_SUFFIX-:3000}/realms/${KEYCLOAK_REALM:-opencase}
      # Internal URL for fetching JWKS (Docker network access to Keycloak)
      - OIDC_JWKS_FETCH_URL=http://keycloak:8080/realms/${KEYCLOAK_REALM:-opencase}
      - OIDC_CLIENT_ID_PREFIX=${OIDC_CLIENT_ID_PREFIX:-tenant-}
      # Keycloak Admin API (internal Docker network)
      - KEYCLOAK_BASE_URL=http://keycloak:8080
      - KEYCLOAK_REALM=${KEYCLOAK_REALM:-opencase}
      - KEYCLOAK_ADMIN_REALM=${KEYCLOAK_ADMIN_REALM:-master}
      - KEYCLOAK_ADMIN_CLIENT_ID=${KEYCLOAK_ADMIN_CLIENT_ID:-admin-cli}
      - KEYCLOAK_ADMIN_USERNAME=${KEYCLOAK_ADMIN_USERNAME:-admin}
      - KEYCLOAK_ADMIN_PASSWORD=${ADMIN_PASSWORD:-admin}
      # SPA redirect URIs — constructed from base variables
      - KEYCLOAK_SPA_REDIRECT_URIS=${OPENCASE_SCHEME:-http}://${OPENCASE_HOSTNAME:-localhost}${OPENCASE_PORT_SUFFIX-:3000}/*
      - KEYCLOAK_SPA_WEB_ORIGINS=${OPENCASE_SCHEME:-http}://${OPENCASE_HOSTNAME:-localhost}${OPENCASE_PORT_SUFFIX-:3000}
      # Bootstrap system admin
      - KEYCLOAK_BOOTSTRAP_SYSTEM_ADMIN=${KEYCLOAK_BOOTSTRAP_SYSTEM_ADMIN:-true}
      - KEYCLOAK_SYSTEM_ADMIN_EMAIL=${KEYCLOAK_SYSTEM_ADMIN_EMAIL:-system-admin@local}
      - KEYCLOAK_SYSTEM_ADMIN_PASSWORD=${ADMIN_PASSWORD:-admin}
      # SMTP for Keycloak email delivery (forgot password, etc.)
      - SMTP_HOST=${SMTP_HOST:-mailpit}
      - SMTP_PORT=${SMTP_PORT:-1025}
      - SMTP_FROM=noreply@${OPENCASE_HOSTNAME:-opencase.local}
    restart: on-failure
    volumes:
      - ./apps/opencase/data:/app/data
    networks:
      - opencasenet
    depends_on:
      - keycloak
      - mailpit
    labels:
      - "traefik.enable=true"
      - "traefik.constraint-label=opencase_opencasenet"
      # Route /ims/* to OpenCASE (CASE API)
      - "traefik.http.routers.opencase-ims.rule=Host(`${OPENCASE_HOSTNAME:-localhost}`) && PathPrefix(`/ims`)"
      - "traefik.http.routers.opencase-ims.entrypoints=web"
      - "traefik.http.routers.opencase-ims.priority=100"
      - "traefik.http.routers.opencase-ims.service=opencase"
      # Route /management/* to OpenCASE
      - "traefik.http.routers.opencase-management.rule=Host(`${OPENCASE_HOSTNAME:-localhost}`) && PathPrefix(`/management`)"
      - "traefik.http.routers.opencase-management.entrypoints=web"
      - "traefik.http.routers.opencase-management.priority=100"
      - "traefik.http.routers.opencase-management.service=opencase"
      # Route /oauth/* to OpenCASE
      - "traefik.http.routers.opencase-oauth.rule=Host(`${OPENCASE_HOSTNAME:-localhost}`) && PathPrefix(`/oauth`)"
      - "traefik.http.routers.opencase-oauth.entrypoints=web"
      - "traefik.http.routers.opencase-oauth.priority=100"
      - "traefik.http.routers.opencase-oauth.service=opencase"
      # Route /public/* to OpenCASE (tenant lookup, etc.)
      - "traefik.http.routers.opencase-public.rule=Host(`${OPENCASE_HOSTNAME:-localhost}`) && PathPrefix(`/public`)"
      - "traefik.http.routers.opencase-public.entrypoints=web"
      - "traefik.http.routers.opencase-public.priority=100"
      - "traefik.http.routers.opencase-public.service=opencase"
      # Route /health to OpenCASE
      - "traefik.http.routers.opencase-health.rule=Host(`${OPENCASE_HOSTNAME:-localhost}`) && Path(`/health`)"
      - "traefik.http.routers.opencase-health.entrypoints=web"
      - "traefik.http.routers.opencase-health.priority=100"
      - "traefik.http.routers.opencase-health.service=opencase"
      # Route /.well-known/* to OpenCASE (OAuth discovery)
      - "traefik.http.routers.opencase-wellknown.rule=Host(`${OPENCASE_HOSTNAME:-localhost}`) && PathPrefix(`/.well-known`)"
      - "traefik.http.routers.opencase-wellknown.entrypoints=web"
      - "traefik.http.routers.opencase-wellknown.priority=100"
      - "traefik.http.routers.opencase-wellknown.service=opencase"
      # Service definition
      - "traefik.http.services.opencase.loadbalancer.server.port=8080"

  # =============================================================================
  # Editor - React Frontend (Vite Dev Server)
  # =============================================================================
  editor:
    build:
      context: ./apps/editor
      dockerfile: Dockerfile
    environment:
      # All URLs constructed from base variables (scheme://host:port)
      - VITE_OPENCASE_BASE_URL=${OPENCASE_SCHEME:-http}://${OPENCASE_HOSTNAME:-localhost}${OPENCASE_PORT_SUFFIX-:3000}
      - VITE_OIDC_AUTHORITY=${OPENCASE_SCHEME:-http}://${OPENCASE_HOSTNAME:-localhost}${OPENCASE_PORT_SUFFIX-:3000}/realms/${KEYCLOAK_REALM:-opencase}
      - VITE_OIDC_CLIENT_ID_PREFIX=${OIDC_CLIENT_ID_PREFIX:-tenant-}
      # Single-tenant mode: skip tenant lookup, sign in directly (leave empty to disable)
      - VITE_DEFAULT_TENANT_ID=${DEFAULT_TENANT_ID:-}
    volumes:
      # Mount source for hot-reload
      - ./apps/editor/src:/app/src
      - ./apps/editor/public:/app/public
      - ./apps/editor/index.html:/app/index.html
      # Exclude node_modules from mount
      - editor_node_modules:/app/node_modules
    networks:
      - opencasenet
    depends_on:
      - opencase
    labels:
      - "traefik.enable=true"
      - "traefik.constraint-label=opencase_opencasenet"
      # Catch-all route for editor (lowest priority)
      - "traefik.http.routers.editor.rule=Host(`${OPENCASE_HOSTNAME:-localhost}`) && PathPrefix(`/`)"
      - "traefik.http.routers.editor.entrypoints=web"
      - "traefik.http.routers.editor.priority=1"
      - "traefik.http.routers.editor.service=editor"
      # Service definition
      - "traefik.http.services.editor.loadbalancer.server.port=5173"

networks:
  opencasenet:
    driver: bridge

volumes:
  editor_node_modules:
  keycloak_data:
  letsencrypt_data:
  # OpenCASE data uses bind mount: ./apps/opencase/data:/app/data
  # This keeps framework files visible on host for easy inspection/backup