compose.yaml

volumes:
  pgstac_data:
  rustfs_data:
  pmtiles:
  chiitiler_cache:
  tms_nginx_cache:
  uploader_db_data:

services:
  # Core infrastructure

  nginx:
    image: docker.io/nginx:1.31-alpine
    ports:
      - "8080:80"
    volumes:
      - ./local.conf:/etc/nginx/conf.d/default.conf:ro
    depends_on:
      stac-api:
        condition: service_healthy
      raster:
        condition: service_healthy
      frontend:
        condition: service_started
      stac-map:
        condition: service_healthy
      uploader-api:
        condition: service_healthy
    restart: unless-stopped

  database:
    image: ghcr.io/stac-utils/pgstac:v0.9.6
    environment:
      - POSTGRES_USER=oam
      - POSTGRES_PASSWORD=password
      - POSTGRES_DB=postgis
      - PGUSER=oam
      - PGPASSWORD=password
      - PGDATABASE=postgis
    volumes:
      - pgstac_data:/var/lib/postgresql/data
    command: postgres -N 500
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U oam -d postgis"]
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  # S3-compatible object storage
  rustfs:
    image: rustfs/rustfs:1.0.0-rc.3
    environment:
      - RUSTFS_ACCESS_KEY=oam
      - RUSTFS_SECRET_KEY=oam
    ports:
      - "9000:9000" # presigned PUTs from the browser / uploader test script
      - "9001:9001" # console
    volumes:
      - rustfs_data:/data
    command: server /data --console-address ":9001"
    restart: unless-stopped
    healthcheck:
      test:
        [
          "CMD",
          "sh",
          "-c",
          "curl -f http://localhost:9000/health && curl -f http://localhost:9001/rustfs/console/health",
        ]

  # One-shot bucket bootstrap: create it, make objects public-read, allow the
  # browser's cross-origin presigned PUTs. Same script the chart's bucket-init
  # job runs, so local and cluster agree on what "ready" means.
  rustfs-init:
    image: ghcr.io/hotosm/openaerialmap/uploader-api:debug
    build: ./backend/uploader-api
    depends_on:
      rustfs:
        condition: service_healthy
    restart: "no"
    environment:
      S3_ENDPOINT: http://rustfs:9000
      S3_BUCKET: oam
      S3_REGION: us-east-1
      AWS_ACCESS_KEY_ID: oam
      AWS_SECRET_ACCESS_KEY: oam
      INIT_CORS_ORIGINS: http://imagery.localhost:8080,http://upload.imagery.localhost:8080
    command: ["python", "/app/scripts/init_bucket.py"]

  # STAC API

  stac-api:
    build: ./backend/stac-api
    environment:
      - APP_HOST=0.0.0.0
      - APP_PORT=8082
      - RELOAD=true
      - ENVIRONMENT=local
      - POSTGRES_USER=oam
      - POSTGRES_PASS=password
      - POSTGRES_DBNAME=postgis
      - POSTGRES_HOST_READER=database
      - POSTGRES_HOST_WRITER=database
      - POSTGRES_PORT=5432
      - WEB_CONCURRENCY=10
      - VSI_CACHE=TRUE
      - GDAL_HTTP_MERGE_CONSECUTIVE_RANGES=YES
      - GDAL_DISABLE_READDIR_ON_OPEN=EMPTY_DIR
      - DB_MIN_CONN_SIZE=1
      - DB_MAX_CONN_SIZE=1
      - USE_API_HYDRATE=${USE_API_HYDRATE:-false}
      # - ENABLE_TRANSACTIONS_EXTENSIONS=false
      - UVICORN_ROOT_PATH=/stac
    volumes:
      - ./backend/stac-api/app:/app/app
      - ./backend/stac-api/scripts:/app/scripts
    depends_on:
      database:
        condition: service_healthy
    command: bash -c "./scripts/wait-for-it.sh database:5432 && python -m app.main"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          'python -c "import urllib.request; urllib.request.urlopen(''http://localhost:8082/'')"',
        ]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 15s
    restart: unless-stopped

  # Raster tiler (titiler-pgstac)

  raster:
    image: ghcr.io/stac-utils/titiler-pgstac:1.7.2
    environment:
      - POSTGRES_USER=oam
      - POSTGRES_PASS=password
      - POSTGRES_DBNAME=postgis
      - POSTGRES_HOST=database
      - POSTGRES_PORT=5432
      - TITILER_PGSTAC_API_ROOT_PATH=/raster
    depends_on:
      database:
        condition: service_healthy
    healthcheck:
      test:
        [
          "CMD-SHELL",
          'python -c "import urllib.request; urllib.request.urlopen(''http://localhost:80/api.html'')"',
        ]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 15s
    restart: unless-stopped

  # The uploader reuses shared storage and catalog services without processing.
  uploader-api:
    extends:
      file: backend/uploader-api/compose.yaml
      service: uploader-api
    environment:
      S3_ENDPOINT: http://rustfs:9000
      STAC_URL: http://stac-api:8082
      OAM_UPLOAD_DOMAIN: upload.imagery.localhost
      OAM_UPLOAD_DEV_PORT: "8080"
      OAM_FRONTEND_URL: http://imagery.localhost:8080
      OAM_API_URL: http://imagery.localhost:8080
      # Remote-source ingest fetches a caller-supplied URL. Locally that means
      # in-network hosts (RustFS, a partner service on the compose network),
      # which the production SSRF guard rejects. Never set this in production.
      FETCH_ALLOW_PRIVATE_HOSTS: "true"
    depends_on:
      uploader-db:
        condition: service_healthy
      uploader-migrations:
        condition: service_completed_successfully
      rustfs:
        condition: service_healthy
      rustfs-init:
        condition: service_completed_successfully
      stac-api:
        condition: service_healthy

  uploader-migrations:
    extends:
      file: backend/uploader-api/compose.yaml
      service: uploader-migrations
    depends_on:
      uploader-db:
        condition: service_healthy

  uploader-db:
    extends:
      file: backend/uploader-api/compose.yaml
      service: uploader-db

  # Frontend

  frontend:
    build:
      context: ./frontend
      target: build
    environment:
      # Seed the local catalog with `just test populate-prod`. Services without
      # local versions continue to use production.
      - VITE_PMTILES_URL=${VITE_PMTILES_URL:-https://s3.amazonaws.com/oin-hotosm-temp/global-data.pmtiles}
      - VITE_DENSITY_PMTILES_URL=${VITE_DENSITY_PMTILES_URL:-https://s3.amazonaws.com/oin-hotosm-temp/global-coverage.pmtiles}
      - VITE_API_URL=${VITE_API_URL:-http://imagery.localhost:8080}
      - VITE_STAC_TITILER_URL=${VITE_STAC_TITILER_URL:-http://imagery.localhost:8080/raster}
      - VITE_STAC_URL=${VITE_STAC_URL:-http://imagery.localhost:8080/stac}
      - VITE_STAC_BROWSER_URL=${VITE_STAC_BROWSER_URL:-https://api.imagery.hotosm.org/browser}
      - VITE_UPLOADER_URL=${VITE_UPLOADER_URL:-http://upload.imagery.localhost:8080}
      - VITE_PACKAGER_URL=${VITE_PACKAGER_URL:-https://packager.imagery.hotosm.org}
      - VITE_ANNOUNCEMENT_URL=${VITE_ANNOUNCEMENT_URL:-https://d33erh71igmru9.cloudfront.net/oam.json}
    volumes:
      - ./frontend/src:/app/src
      - ./frontend/index.html:/app/index.html
      - ./frontend/vite.config.ts:/app/vite.config.ts
      - ./frontend/uno.config.ts:/app/uno.config.ts
    command: pnpm dev --host 0.0.0.0
    ports:
      - "3000:3000"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3000/ || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 20s
    restart: unless-stopped

  # stac-map
  # Wrapper around https://github.com/developmentseed/stac-map, built
  # into a tiny nginx image and served at /map/. Mirrors how the
  # eoapi chart deploys stac-browser (ghcr.io/developmentseed/eoapi-k8s-stac-browser).

  stac-map:
    build:
      context: ./stac-map
      args:
        # Override VITE_STAC_MAP_DEFAULT_HREF to browse another catalog.
        VITE_BASE_PATH: /map/
        VITE_DEFAULT_HREF: ${VITE_STAC_MAP_DEFAULT_HREF:-http://imagery.localhost:8080/stac}
        VITE_STAC_BROWSER_URL: ${VITE_STAC_MAP_BROWSER_URL:-https://api.imagery.hotosm.org/browser/external/}
    healthcheck:
      # BusyBox wget on nginx:alpine sometimes fails to resolve
      # `localhost` cleanly; using 127.0.0.1 avoids the DNS path.
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1/map/"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 15s
    restart: unless-stopped

  # Tilepack worker (profile: tilepack)
  # One-shot: generates mbtiles/pmtiles from a COG. Triggered via
  # `just test tilepack <item_id>`. Uploads to LOCAL S3 only.

  tilepack-worker:
    build: ./backend/tilepack-api/worker
    profiles: [tilepack]
    environment:
      # S3 - always points at local RustFS, never prod
      - AWS_ENDPOINT_URL=http://rustfs:9000
      - AWS_ACCESS_KEY_ID=oam
      - AWS_SECRET_ACCESS_KEY=oam
      - AWS_REGION=us-east-1
      - S3_BUCKET=oam
      - S3_PUBLIC_BASE_URL=http://s3.imagery.localhost:8080
      # Worker inputs - overridden at runtime by `just test tilepack`
      - STAC_ITEM_ID=placeholder
      - FORMAT=mbtiles
      - COG_URL=placeholder
      - OUTPUT_KEY=placeholder
      - LOCK_KEY=placeholder
      - MIN_ZOOM=0
      - MAX_ZOOM=0
      - GSD=0
      - CANONICAL=false
      - INTERNAL_BASE_URL=http://localhost:0
      - INTERNAL_TOKEN=unused
    depends_on:
      rustfs:
        condition: service_healthy

  # Optional: Global TMS tiles (profile: tms)

  get-tiles:
    extends:
      file: backend/global-tms/compose.yaml
      service: get-tiles
    profiles: [tms]

  martin:
    extends:
      file: backend/global-tms/compose.yaml
      service: martin
    profiles: [tms]
    ports: !override []
    depends_on:
      get-tiles:
        condition: service_completed_successfully

  chiitiler:
    extends:
      file: backend/global-tms/compose.yaml
      service: chiitiler
    profiles: [tms]

  tms-nginx:
    extends:
      file: backend/global-tms/compose.yaml
      service: tms-nginx
    profiles: [tms]
    ports: !override []
    depends_on:
      martin:
        condition: service_healthy
      get-tiles:
        condition: service_completed_successfully