docker-compose.yml

version: "3.4"

volumes:
  pg_data:
  out:
    driver_opts:
      type: tmpfs
      device: tmpfs

networks:
  grant:
    driver: bridge

services:
  dev:
    container_name: grant-dev
    build:
      context: .
      target: builder
      args:
          VERSION: "${VERSION}"
          COMMIT: "${COMMIT}"
          BUILD_TIME: "${BUILD_TIME}"
    environment:
      - "ALLOWED_ORIGINS=http://localhost:8080"
      - AWS_ACCESS_KEY_ID=dummy
      - AWS_SECRET_ACCESS_KEY=dummy
      - AWS_REGION=us-west-2
      - BAT_SETTLEMENT_ADDRESS
      - BITFLYER_CLIENT_ID
      - BITFLYER_CLIENT_SECRET
      - BITFLYER_EXTRA_CLIENT_SECRET
      - BITFLYER_DRYRUN
      - BITFLYER_SERVER
      - BITFLYER_SOURCE_FROM
      - BITFLYER_TOKEN
      - BRAVE_TRANSFER_PROMOTION_ID
      - CHALLENGE_BYPASS_SERVER=http://challenge-bypass:2416
      - CHALLENGE_BYPASS_TOKEN
      - COINGECKO_APIKEY
      - COINGECKO_SERVICE
      - "DATABASE_MIGRATIONS_URL=file:///src/migrations"
      - "DATABASE_URL=postgres://grants:password@postgres/grants?sslmode=disable"
      - DEBUG=1
      - DONOR_WALLET_CARD_ID
      - DONOR_WALLET_PRIVATE_KEY
      - DONOR_WALLET_PUBLIC_KEY
      - DRAIN_RETRY_JOB_ENABLED=true
      - "DYNAMODB_ENDPOINT=http://dynamodb:8000"
      - ENABLE_LINKING_DRAINING=true
      - ENV=local
      - GEMINI_API_KEY
      - GEMINI_API_SECRET
      - GEMINI_BROWSER_CLIENT_ID
      - GEMINI_CLIENT_ID
      - GEMINI_CLIENT_SECRET
      - GEMINI_SERVER
      - GEMINI_TEST_DESTINATION_ID
      - GOTOOLCHAIN=local
      - GRANT_CBP_SIGN_CONSUMER_TOPIC=sign.consumer # unsigned order creds request
      - GRANT_CBP_SIGN_CONSUMER_TOPIC_DLQ=sign.consumer.dlq # unsigned order creds request dlq
      - GRANT_CBP_SIGN_PRODUCER_TOPIC=sign.producer # signed orders creds result
      - GRANT_SIGNATOR_PUBLIC_KEY
      - GRANT_WALLET_CARD_ID
      - GRANT_WALLET_PRIVATE_KEY
      - GRANT_WALLET_PUBLIC_KEY
      - KAFKA_BROKERS=kafka:19092
      - KAFKA_CONSUMER_GROUP_PROMOTIONS=grant-bat-promotions-local
      - KAFKA_CONSUMER_GROUP_SIGNED_ORDER_CREDENTIALS=grant-bat-skus-local
      - KAFKA_REQUIRED_ACKS=1
      - KAFKA_SSL_CA_LOCATION=/etc/kafka/secrets/snakeoil-ca-1.crt
      - KAFKA_SSL_CERTIFICATE_LOCATION=/etc/kafka/secrets/consumer-ca1-signed.pem
      - KAFKA_SSL_KEY_LOCATION=/etc/kafka/secrets/consumer.client.key
      - PPROF_ENABLED=true
      - "RATIOS_SERVICE=https://ratios.rewards.bravesoftware.com"
      - RATIOS_TOKEN
      - REPUTATION_SERVER
      - REPUTATION_TOKEN
      - SKUS_WHITELIST
      - TEST_PKG
      - TEST_RUN
      - TOKEN_LIST
      - UPHOLD_ACCESS_TOKEN
      - "DAPP_ALLOWED_CORS_ORIGINS=https://my-dapp.com"
    volumes:
      - ./test/secrets:/etc/kafka/secrets
      - ./migrations:/src/migrations
      - "out:/out"
    depends_on:
      redis:
        condition: service_healthy
      postgres:
        condition: service_healthy
      challenge-bypass:
        condition: service_started
      kafka:
        condition: service_healthy
    networks:
      - grant

  web:
    container_name: grant-web
    build:
      context: .
      target: artifact
      args:
          VERSION: "${VERSION}"
          COMMIT: "${COMMIT}"
          BUILD_TIME: "${BUILD_TIME}"
    ports:
      - "3333:3333"
      - "6061:6061"
    security_opt:
      - no-new-privileges:true
    environment:
      - AWS_ACCESS_KEY_ID=dummy
      - AWS_SECRET_ACCESS_KEY=dummy
      - AWS_REGION=us-west-2
      - BAT_SETTLEMENT_ADDRESS
      - BITFLYER_CLIENT_ID
      - BITFLYER_CLIENT_SECRET
      - BITFLYER_EXTRA_CLIENT_SECRET
      - BITFLYER_DRYRUN
      - BITFLYER_SERVER
      - BITFLYER_SOURCE_FROM
      - BITFLYER_TOKEN
      - CHALLENGE_BYPASS_SERVER=http://challenge-bypass:2416
      - CHALLENGE_BYPASS_TOKEN
      - COINGECKO_APIKEY
      - COINGECKO_SERVICE
      - "DATABASE_MIGRATIONS_URL=file:///src/migrations"
      - "DATABASE_URL=postgres://grants:password@postgres/grants?sslmode=disable"
      - DEBUG=1
      - DONOR_WALLET_CARD_ID
      - DONOR_WALLET_PRIVATE_KEY
      - DONOR_WALLET_PUBLIC_KEY
      - DRAIN_RETRY_JOB_ENABLED=true
      - "DYNAMODB_ENDPOINT=http://dynamodb:8000"
      - ENABLE_LINKING_DRAINING=true
      - ENCRYPTION_KEY
      - ENV=local
      - FEATURE_MERCHANT
      - GEMINI_API_KEY
      - GEMINI_API_SECRET
      - GEMINI_BROWSER_CLIENT_ID
      - GEMINI_CLIENT_ID
      - GEMINI_CLIENT_SECRET
      - GEMINI_SERVER
      - GEMINI_TEST_DESTINATION_ID
      - GRANT_CBP_SIGN_CONSUMER_TOPIC=sign.consumer # unsigned order creds request
      - GRANT_CBP_SIGN_CONSUMER_TOPIC_DLQ=sign.consumer.dlq # unsigned order creds request dlq
      - GRANT_CBP_SIGN_PRODUCER_TOPIC=sign.producer # signed orders creds result
      - GRANT_SIGNATOR_PUBLIC_KEY
      - GRANT_WALLET_CARD_ID
      - GRANT_WALLET_PRIVATE_KEY
      - GRANT_WALLET_PUBLIC_KEY
      - KAFKA_BROKERS=kafka:19092
      - KAFKA_CONSUMER_GROUP_PROMOTIONS=grant-bat-promotions-local
      - KAFKA_CONSUMER_GROUP_SIGNED_ORDER_CREDENTIALS=grant-bat-skus-local
      - KAFKA_REQUIRED_ACKS=1
      - KAFKA_SSL_CA_LOCATION=/etc/kafka/secrets/snakeoil-ca-1.crt
      - KAFKA_SSL_CERTIFICATE_LOCATION=/etc/kafka/secrets/consumer-ca1-signed.pem
      - KAFKA_SSL_KEY_LOCATION=/etc/kafka/secrets/consumer.client.key
      - OUTPUT_DIR="/out"
      - PKG
      - PPROF_ENABLED=true
      - RUN
      - TEST_PKG
      - TEST_RUN
      - TOKEN_LIST
      - UPHOLD_ACCESS_TOKEN
      - "DAPP_ALLOWED_CORS_ORIGINS=https://my-dapp.com"
    volumes:
      - ./test/secrets:/etc/kafka/secrets
      - ./migrations:/src/migrations
    depends_on:
      redis:
        condition: service_healthy
      postgres:
        condition: service_healthy
      challenge-bypass:
        condition: service_started
      kafka:
        condition: service_healthy
    networks:
      - grant

  redis:
    container_name: grant-redis
    image: redis
    ports:
      - "6379:6379"
    networks:
      - grant
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 5s

  postgres:
    container_name: grant-postgres
    image: postgres:14
    ports:
      - "3401:5432"
    environment:
      - "POSTGRES_USER=grants"
      - "POSTGRES_PASSWORD=password"
      - "POSTGRES_EXTRA_DATABASES=btokens:btokens:password"
      - "TZ=UTC"
    networks:
      - grant
    command: ["postgres", "-c", "log_statement=all"]
    volumes:
      - pg_data:/var/lib/postgresql/data
      - ./create_dbs.sh:/docker-entrypoint-initdb.d/00_create_dbs.sh
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U grants -d grants"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 5s

  challenge-bypass:
    container_name: challenge-bypass
    image: brave/challenge-bypass:latest
    restart: always
    ports:
      - "2416:2416"
    environment:
      - "ENV=devtest"
      - "SENTRY_DSN"
      - "DATABASE_URL=postgres://btokens:password@grant-postgres/btokens?sslmode=disable"
      - "DATABASE_MIGRATIONS_URL=file:///src/migrations"
      - KAFKA_BROKERS=kafka:19092
      - KAFKA_SSL_CA_LOCATION=/etc/kafka/secrets/snakeoil-ca-1.crt
      - KAFKA_SSL_CERTIFICATE_LOCATION=/etc/kafka/secrets/consumer-ca1-signed.pem
      - KAFKA_SSL_KEY_LOCATION=/etc/kafka/secrets/consumer.client.key
      - KAFKA_REQUIRED_ACKS=1
      - KAFKA_CONSUMERS_PER_NODE=1
      - REDEEM_CONSUMER_TOPIC=redeem.consumer
      - REDEEM_PRODUCER_TOPIC=redeem.producer
      - SIGN_CONSUMER_TOPIC=sign.consumer # unsigned order creds request
      - SIGN_PRODUCER_TOPIC=sign.producer # signed orders creds result
      - CONSUMER_GROUP=consumer.group
      - "DYNAMODB_ENDPOINT=http://dynamodb:8000"
      - AWS_ACCESS_KEY_ID=dummy
      - AWS_SECRET_ACCESS_KEY=dummy
      - AWS_REGION=us-west-2
    depends_on:
      postgres:
        condition: service_healthy
      dynamodb:
        condition: service_healthy
    volumes:
      - ./test/secrets:/etc/kafka/secrets
    networks:
      - grant

  zookeeper:
    container_name: grant-zookeeper
    image: confluentinc/cp-zookeeper:7.3.1
    environment:
      ZOOKEEPER_CLIENT_PORT: 2181
    ports:
      - "2181:2181"
    networks:
      - grant
    healthcheck:
      test: ["CMD-SHELL", "nc -z localhost 2181 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s

  kafka:
    container_name: grant-kafka
    image: confluentinc/cp-kafka:7.3.1
    ports:
      - "29092:29092"
    environment:
      KAFKA_ZOOKEEPER_CONNECT: "zookeeper:2181"
      KAFKA_ADVERTISED_LISTENERS: "SSL://kafka:19092,SSL2://localhost:29092"
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: SSL:SSL,SSL2:SSL
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_SSL_KEYSTORE_FILENAME: kafka.broker1.keystore.jks
      KAFKA_SSL_KEYSTORE_CREDENTIALS: broker1_keystore_creds
      KAFKA_SSL_KEY_CREDENTIALS: broker1_sslkey_creds
      KAFKA_SSL_TRUSTSTORE_FILENAME: kafka.broker1.truststore.jks
      KAFKA_SSL_TRUSTSTORE_CREDENTIALS: broker1_truststore_creds
      KAFKA_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM: " "
      KAFKA_SSL_CLIENT_AUTH: requested
      KAFKA_SECURITY_INTER_BROKER_PROTOCOL: SSL
      KAFKA_RETENTION_MS: 10000
    volumes:
      - ./test/secrets:/etc/kafka/secrets
    depends_on:
      zookeeper:
        condition: service_healthy
    networks:
      - grant
    healthcheck:
      test: ["CMD-SHELL", "nc -z localhost 29092 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s

  dynamodb:
    container_name: dynamodb
    image: amazon/dynamodb-local:1.21.0
    networks:
      - grant
    ports:
      - "8000:8000"
    healthcheck:
      test: ["CMD-SHELL", "curl -Is http://localhost:8000/shell/ | grep HTTP || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 5s