build.docker-compose.yml

services:
  certs:
    container_name: oe-certs
    image: certgen
    build:
      context: ./frontend
      dockerfile: ./Dockerfile.certs
    restart: always
    environment:
        - KEYSTORE_PW="kspass"
        - TRUSTSTORE_PW="tspass"
    networks:
        - default  
    volumes:
        - key_trust-store-volume:/etc/openelis-global
        - keys-vol:/etc/ssl/private/
        - certs-vol:/etc/ssl/certs/

  db.openelis.org:
      build:
        context: .
        dockerfile: ./db/Dockerfile
      container_name: openelisglobal-database 
      image: openelisglobal-databse.build
      ports:
          - "15432:5432"
      restart: always
      env_file:
          - ./volume/database/database.env
      environment:
          - DB_PASSWORD=${OE_DB_PASSWORD:-clinlims}
          - DB_SUPERUSER_PASSWORD=${ADMIN_PASSWORD:-superuser}
      volumes:
              # preserves the database between containers
          - db-data:/var/lib/postgresql/data                
      networks:
          - default
      healthcheck:
            test: [ "CMD", "pg_isready", "-q", "-d", "clinlims", "-U", "clinlims" ]
            timeout: 45s
            interval: 10s
            retries: 10      

  oe.openelis.org:
    build:
      context: .
      dockerfile: ./Dockerfile
    container_name: openelisglobal-webapp
    image: openelisglobal-webapp.build
    depends_on:
        - db.openelis.org
        - certs
    ports:
        - "8080:8080"
        - "8443:8443"
    restart: always
    networks:
      default:
        ipv4_address: 172.20.1.121
    environment:
        - DEFAULT_PW=adminADMIN!
        - TZ=${TZ:-UTC}
        - SPRING_LIQUIBASE_CONTEXTS=test
        # context.xml doesn't seem to be able to pick up environment variables directly, so we are passing them in as CATALINA_OPTS
        - CATALINA_OPTS=-Ddatasource.url=jdbc:postgresql://db.openelis.org:5432/clinlims -Ddatasource.username=clinlims -Ddatasource.password=${OE_DB_PASSWORD:-clinlims} -Doe.ssl.truststorepath=${SSL_TRUSTSTORE_PATH:-/etc/openelis-global/truststore} -Doe.ssl.truststorepassword=${SSL_TRUSTSTORE_PASSWORD:-tspass} -Doe.ssl.keystorepath=${SSL_KEYSTORE_PATH:-/etc/openelis-global/keystore} -Doe.ssl.keystorepassword=${SSL_KEYSTORE_PASSWORD:-kspass}
    volumes:
        -  key_trust-store-volume:/etc/openelis-global
        - ./volume/lucene:/var/lib/lucene_index
        - ./volume/plugins/:/var/lib/openelis-global/plugins
        - ./volume/programs/:/var/lib/openelis-global/programs
        - ./volume/logs/oeLogs:/var/lib/openelis-global/logs
        - ./volume/logs/tomcatLogs/:/usr/local/tomcat/logs
        - ./volume/tomcat/oe_server.xml:/usr/local/tomcat/conf/server.xml
        - ./volume/properties/SystemConfiguration.properties:/var/lib/openelis-global/properties/SystemConfiguration.properties
        - ./volume/odoo/odoo-test-product-mapping.csv:/var/lib/openelis-global/odoo/odoo-test-product-mapping.csv
        - ./volume/analyzer/analyzer-test-map.csv:/var/lib/openelis-global/analyzer/analyzer-test-map.csv
        # NOTE: Do NOT bind-mount ./volume/configuration here — it overrides the
        # container's built-in config templates and causes permission errors on
        # checksum files. The container manages its own /var/lib/.../configuration.
        - ./volume/branding:/var/lib/openelis-global/branding
        - ./volume/menu/menu_config.json:/var/lib/openelis-global/menu/menu_config.json
        - ./volume/analyzer-imports:/data/analyzer-imports
    secrets:
        - source: common.properties
    healthcheck:
      test: ["CMD", "/healthcheck.sh"]
      timeout: 10s
      interval: 30s
      retries: 3
      start_period: 2m

  fhir.openelis.org:
    container_name: external-fhir-api
    image: external-fhir-api.build
    build:
      context: .
      dockerfile: ./fhir/Dockerfile
    depends_on:
        - db.openelis.org
        - certs
    ports:
        - "8081:8080"
        - "8444:8443"
    networks:
        - default
    restart: always
    environment:
        TZ: ${TZ:-UTC}
        JAVA_OPTS: "-Djavax.net.ssl.trustStore=${SSL_TRUSTSTORE_PATH:-/etc/openelis-global/truststore}
                        -Djavax.net.ssl.trustStorePassword=${SSL_TRUSTSTORE_PASSWORD:-tspass}
                        -Djavax.net.ssl.trustStoreType=pkcs12
                        -Djavax.net.ssl.keyStore=${SSL_KEYSTORE_PATH:-/etc/openelis-global/keystore}
                        -Djavax.net.ssl.keyStorePassword=${SSL_KEYSTORE_PASSWORD:-kspass}
                        -Djavax.net.ssl.keyStoreType=pkcs12"
        CATALINA_OPTS: "-Dhapi.ssl.truststorepath=${SSL_TRUSTSTORE_PATH:-/etc/openelis-global/truststore} -Dhapi.ssl.truststorepassword=${SSL_TRUSTSTORE_PASSWORD:-tspass} -Dhapi.ssl.keystorepath=${SSL_KEYSTORE_PATH:-/etc/openelis-global/keystore} -Dhapi.ssl.keystorepassword=${SSL_KEYSTORE_PASSWORD:-kspass}"  
        FHIR_DATASOURCE_URL : "jdbc:postgresql://db.openelis.org:5432/clinlims?currentSchema=clinlims"
        FHIR_DATASOURCE_USERNAME: "clinlims"
        FHIR_DATASOURCE_PASSWORD: ${OE_DB_PASSWORD:-clinlims}
        FHIR_SERVER_ADRESS: "http://fhir.openelis.org:8080/fhir/"
    volumes:
      -  key_trust-store-volume:/etc/openelis-global
      
  frontend.openelis.org:
    image: frontend
    # No `target:` → defaults to the final stage of the multi-stage
    # frontend/Dockerfile, which is `runtime` (nginx serving dist/).
    build:
      context: ./frontend
      dockerfile: ./Dockerfile
    container_name: openelisglobal-front-end
    networks:
        - default
    environment:
        - CHOKIDAR_USEPOLLING=true
    tty: true


  proxy:
    image: openelisglobal-proxy.build
    build:
      context: ./nginx-proxy
      dockerfile: ./Dockerfile
    container_name: openelisglobal-proxy
    ports:
        - 80:80
        - 443:443
    volumes:
        - certs-vol:/etc/nginx/certs/
        - keys-vol:/etc/nginx/keys/
        - ./volume/nginx/nginx-prod.conf:/etc/nginx/nginx.conf:ro
    networks:
        - default  
    restart: unless-stopped
    depends_on:
       - certs

secrets:
  common.properties:
    file:  ./volume/properties/common.properties

networks:
  default:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.1.0/24

volumes:
  db-data:
  key_trust-store-volume:
  certs-vol:
  keys-vol:
  lucene_index-vol: