docker-compose.yml

name: ${PROJECT_NAME:-d2e}
networks:
  alp:
  data:
  enterprise-gateway:
  enterprise-gateway-viewer:

volumes:
  caddy:
  cachedb-data-1:
  cdw-config-cachedb-data-1:
  minio-data-1:
  pg-minerva-data-1:
  r-libs:
  trex:
  demodb-data:
  dicom-sqlite-storage:
  hana-data:
  supabase-storage-data:

x-envs:
  env_converter: &x-converter
    URL__DATABASE_LIST__GET: http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/gateway/api/db/database-creds/
    DB_CREDENTIALS__PRIVATE_KEY: ${DB_CREDENTIALS__INTERNAL__DECRYPT_PRIVATE_KEY}
    IDP__ALP_SVC__CLIENT_ID: ${LOGTO__D2E_SVC__CLIENT_ID:-${LOGTO__ALP_SVC__CLIENT_ID}}
    IDP__ALP_SVC__CLIENT_SECRET: ${LOGTO__D2E_SVC__CLIENT_SECRET:-${LOGTO__ALP_SVC__CLIENT_SECRET}}
    IDP__SCOPE: https://alp-default
    IDP_SUBJECT_PROP: sub
  pg: &x-pg
    PG__DB_NAME: alp
    ## Flag to display executed Knex queries in log
    PG__DEBUG: ${PG_DEBUG:-1}
    PG__HOST: ${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}
    PG__MAX_POOL: 10
    PG__MIN_POOL: 0
    PG__PORT: ${PG_PORT:-5432}
    PG__IDLE_TIMEOUT_IN_MS: 1000
    PG__DIALECT: postgresql
    PG__SSL: ${PG__SSL:-false}
    PG__FHIR_DB_NAME: alp
  fhir: &x-fhir
    FHIR__CLIENT_ID: ${FHIR__CLIENT_ID:-db6b2304-f236-45ec-b10c-a852681e7129}
    FHIR__CLIENT_SECRET: ${FHIR__CLIENT_SECRET}
  redis: &x-redis
    REDIS_HOST: ${REDIS_HOST:-${PROJECT_NAME:-d2e}-minerva-redis-1}
    REDIS_PORT: ${REDIS_PORT:-6379}
  trex_sql: &x-trex-sql
    TREX__SQL__HOST: ${PROJECT_NAME:-d2e}-trex
    TREX__SQL__PORT: 5433
    TREX__SQL__USER: postgres
    TREX__SQL__PASSWORD: ${TREX__SQL__PASSWORD:-pencil} # Password for the trex sql interface
    TREX__SQL__DBNAME: postgres
  # "https://${PROJECT_NAME:-d2e}-minerva-portal-server-1.${TLS__INTERNAL__DOMAIN:-alp.local}:41105",
  tls: &x-tls
    TLS__INTERNAL__CA_CRT: ${TLS__INTERNAL__CA_CRT}
    TLS__INTERNAL__CRT: ${TLS__INTERNAL__CRT}
    TLS__INTERNAL__DOMAIN: ${TLS__INTERNAL__DOMAIN:-alp.local}
    TLS__INTERNAL__KEY: ${TLS__INTERNAL__KEY}
  enterprise-gateway: &x-enterprise-gateway
    EG_KERNEL_LAUNCH_TIMEOUT: ${EG_KERNEL_LAUNCH_TIMEOUT:-60}
    EG_KERNEL_INFO_TIMEOUT: ${EG_KERNEL_INFO_TIMEOUT:-60}
    EG_CULL_IDLE_TIMEOUT: ${EG_CULL_IDLE_TIMEOUT:-3600}
    # Use double-defaulting for B/C.  Support for EG_KERNEL_WHITELIST will be removed in a future release
    EG_ALLOWED_KERNELS: ${EG_ALLOWED_KERNELS:-${EG_KERNEL_WHITELIST:-'r_ohdsi_docker'}} # /jupyter/api/kernelspecs
    EG_MIRROR_WORKING_DIRS: ${EG_MIRROR_WORKING_DIRS:-False}
    EG_RESPONSE_PORT: ${EG_RESPONSE_PORT:-8877}
    KG_PORT: ${KG_PORT:-8888}
    EG_BASE_URL: /jupyter
    EG_DEFAULT_KERNEL_NAME: "r_ohdsi_docker"
    EG_DOCKER_MODE: docker
    EG_ALLOW_ORIGIN: "https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}"
    TREX__ENDPOINT_URL: "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001"
    EG_ENV_WHITELIST: "KERNEL_USERNAME"
    EG_MAX_KERNELS_PER_USER: 1

services:
  trex:
    container_name: &c84 ${PROJECT_NAME:-d2e}-trex
    init: true
    command: npm run start
    depends_on:
      alp-minerva-pg-mgmt-init:
        condition: service_completed_successfully
      alp-logto-post-init:
        condition: service_completed_successfully
    hostname: ${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}
    image: ${DOCKER_IMAGE_PREFIX:-ghcr.io/ohdsi/}d2e-trex:${DOCKER_TAG_NAME:-develop}
    platform: linux/amd64
    logging:
      options:
        tag: *c84
    networks:
      alp:
        priority: 20
      data:
        priority: 10
      enterprise-gateway:
        priority: 20
      enterprise-gateway-viewer:
        priority: 20
    volumes:
      - trex:/usr/src/data
      - cdw-config-cachedb-data-1:/usr/src/cdw_data/dynamically_generated # Volume for dynamically generated cdw-config duckdb file
    healthcheck:
      interval: 10s
      retries: 8
      start_period: 300s
      test:
        - CMD
        - npm
        - run
        - health
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}
    environment:
      <<:
        - *x-converter
        - *x-tls
        - *x-fhir
        - *x-pg
        - *x-trex-sql
      REP_PG: postgres://postgres:${DEMO__DB_PASSWORD:-mypass}@demodb:5432/postgres
      TPM_USE_NODE_MODULES: "false"
      SERVICE_ROUTES: |-
        {
        "analytics": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001",
        "bookmark": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/analytics-svc/api/services/bookmark",
        "cdw": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001",
        "d2e-webapi": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/d2e-webapi",
        "paConfig": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/pa-config-svc",
        "trex": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001",
        "queryGen": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001",
        "jobplugins": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001",
        "portalServer": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/system-portal",
        "dataset": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/gateway/api/dataset",
        "usermgmt": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/usermgmt/api",
        "strategus-analysis": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001",
        "terminology": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/terminology",
        "prefect": "http://${PROJECT_NAME:-d2e}-dataflow-gen-1:41120/api",
        "idIssuerUrl": "http://${PROJECT_NAME:-d2e}-logto-1:3001/oidc",
        "minio": "",
        "fhirServer": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/fhir-server/fhir/R4",
        "fhirTokenUrl": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/fhir-server/oauth2/token",
        "fhirGateway": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/fhir-gateway",
        "filesManager": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/files-manager/api",
        "whiteRabbit": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/white-rabbit/api",
        "alpdb": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/gateway/api/db",
        "dicomServer": "http://${PROJECT_NAME:-d2e}-dicom-server-1:8042",
        "logto": "http://${PROJECT_NAME:-d2e}-logto-1:3001",
        "jupyter-gateway": "http://${PROJECT_NAME:-d2e}-enterprise-gateway:8888/jupyter",
        "jupyter-gateway-viewer": "http://${PROJECT_NAME:-d2e}-enterprise-gateway-viewer:8888/jupyter",
        "kpi-dashboard": "${EXTERNAL__KPI_DASHBOARD_URL:-http://docker-dash:8050}",
        "docker-logs": "http://${PROJECT_NAME:-d2e}-logging-1:8080",
        "supabaseStorage": "http://${PROJECT_NAME:-d2e}-supabase-storage-1:9000",
        "mlflow": "http://${PROJECT_NAME:-d2e}-mlflow:5000",
        "mcp-server": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-alp.local}:33001/mcp/chat"
        }
      PG_SUPER_PASSWORD: ${PG_SUPER_PASSWORD}
      PG_SUPER_USER: ${PG_SUPER_USER:-postgres}
      PG_MANAGE_PASSWORD: ${PG_ADMIN_PASSWORD}
      PG_MANAGE_USER: ${PG_ADMIN_USER:-alp_pg_admin_user}
      PG_PASSWORD: ${PG_WRITE_PASSWORD}
      PG_USER: ${PG_WRITE_USER:-alp_pg_write_user}
      PORTAL__LOG_DISCLAIMER: ${PORTAL__LOG_DISCLAIMER:-false}
      PREFECT_API_URL: ${PREFECT_API_URL:-http://${PROJECT_NAME:-d2e}-dataflow-gen-1:41120/api}
      DB_CREDENTIALS__PUBLIC_KEYS: |-
        {
         "DataPlatform": "",
         "Internal": "${DB_CREDENTIALS__INTERNAL__PUBLIC_KEY}"
        }
      DB_CREDENTIALS__PRIVATE_KEY: ${DB_CREDENTIALS__INTERNAL__DECRYPT_PRIVATE_KEY}
      GATEWAY__IDP_AUTH_TYPE: logto
      GATEWAY__IDP_SUBJECT_PROP: sub
      GATEWAY__WO_PROTOCOL_FQDN: ${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}
      HANA__DRIVER_CLASS_PATH: ${HANA__DRIVER_CLASS_PATH:-/app/inst/drivers/ngdbc-latest.jar}
      CADDY__D2E__PUBLIC_FQDN: ${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}
      IDP__ALP_DATA_CLIENT_ID: ${LOGTO__D2E_DATA__CLIENT_ID:-${LOGTO__ALP_DATA__CLIENT_ID}}
      IDP__ALP_SVC_CLIENT_ID: ${LOGTO__D2E_SVC__CLIENT_ID:-${LOGTO__ALP_SVC__CLIENT_ID}}
      IDP__RELYING_PARTY: ${IDP__RELYING_PARTY}
      LOGTO__AUDIENCES: https://alp-default
      LOGTO__CLIENT_ID: ${LOGTO__D2E_APP__CLIENT_ID:-${LOGTO__ALP_APP__CLIENT_ID}}
      LOGTO__D2E_SVC__CLIENT_ID: ${LOGTO__D2E_SVC__CLIENT_ID:-${LOGTO__ALP_SVC__CLIENT_ID}}
      LOGTO__D2E_SVC__CLIENT_SECRET: ${LOGTO__D2E_SVC__CLIENT_SECRET:-${LOGTO__ALP_SVC__CLIENT_SECRET}}
      LOGTO__D2E_DATA__CLIENT_ID: ${LOGTO__D2E_DATA__CLIENT_ID:-${LOGTO__ALP_DATA__CLIENT_ID}}
      LOGTO__D2E_DATA__CLIENT_SECRET: ${LOGTO__D2E_DATA__CLIENT_SECRET:-${LOGTO__ALP_DATA__CLIENT_SECRET}}
      LOGTO__CLIENT_SECRET: ${LOGTO__D2E_APP__CLIENT_SECRET:-${LOGTO__ALP_APP__CLIENT_SECRET}}
      LOGTO__ISSUER: http://${PROJECT_NAME:-d2e}-logto-1:3001/oidc
      LOGTO__RESOURCE_API: https://alp-default
      LOGTO__SCOPE: ${LOGTO__SCOPE:-openid offline_access profile email}
      LOGTO__SVC_CLIENT_ID: ${LOGTO__D2E_SVC__CLIENT_ID:-${LOGTO__ALP_SVC__CLIENT_ID}}
      LOGTO__SVC_CLIENT_SECRET: ${LOGTO__D2E_SVC__CLIENT_SECRET:-${LOGTO__ALP_SVC__CLIENT_SECRET}}
      LOGTO__TOKEN_URL: http://${PROJECT_NAME:-d2e}-logto-1:3001/oidc/token
      LOGTO__ADMIN_SERVER__FQDN_URL: http://${PROJECT_NAME:-d2e}-logto-1:3002
      LOGTO__DEFAULT_TENANT__FQDN_URL: ${LOGTO__DEFAULT_TENANT__FQDN_URL:-https://default.logto.app/api}
      LOGTO__CLIENTID_PASSWORD__BASIC_AUTH: ${LOGTO__CLIENTID_PASSWORD__BASIC_AUTH}
      LOGTO_API_M2M_CLIENT_ID: ${LOGTO_API_M2M_CLIENT_ID}
      LOGTO_API_M2M_CLIENT_SECRET: ${LOGTO_API_M2M_CLIENT_SECRET}
      NODE_ENV: development
      POSTGRES__DRIVER_CLASS_PATH: ${POSTGRES__DRIVER_CLASS_PATH:-/app/inst/drivers/postgresql-42.3.1.jar}
      PREFECT_DOCKER_NETWORK: "${PROJECT_NAME:-d2e}_data"
      PREFECT_DOCKER_VOLUMES: '${PREFECT_DOCKER_VOLUMES_CUSTOM:-["${PROJECT_NAME:-d2e}_trex:/app/duckdb_data"]}'
      GH_TOKEN: ${GH_TOKEN}
      PLUGINS_SEED: '${PLUGINS_SEED:-["d2e-functions", "d2e-ui", "d2e-flows", "d2e-atlas", "data-transformation-flow", "hades-flow", "d2e-fhir-server", "fhir"]}'
      PLUGINS_API_VERSION: ${PLUGINS_API_VERSION:-latest}
      PLUGINS_SEED_UPDATE: ${PLUGINS_SEED_UPDATE:-false}
      PLUGINS_REGISTRY: ${PLUGINS_REGISTRY:-https://pkgs.dev.azure.com/data2evidence/d2e/_packaging/d2e/npm/registry/}
      TPM_REGISTRY_URL: ${PLUGINS_REGISTRY:-https://pkgs.dev.azure.com/data2evidence/d2e/_packaging/d2e/npm/registry/}
      PLUGINS_IMAGE_TAG: ${PLUGINS_IMAGE_TAG:-develop}
      PLUGINS_FLOW_CUSTOM_REPO_IMAGE_CONFIG: "${PLUGINS_FLOW_CUSTOM_REPO_IMAGE_CONFIG:-{}}" #{"current": "ghcr.io/ohdsi/d2e", "new": ""}
      PLUGINS_INFORMATION_URL: ${PLUGINS_INFORMATION_URL:-https://feeds.dev.azure.com/data2evidence/d2e/_apis/packaging/Feeds/d2e/packages?api-version=7.1&includeDescription=true}
      PROJECT_NAME: ${PROJECT_NAME:-d2e}
      DATAFLOW_TEMPLATE_REPO_URL: ${DATAFLOW_TEMPLATE_REPO_URL:-https://github.com/data2evidence/templates.git}
      DATAFLOW_TEMPLATE_BRANCH: ${DATAFLOW_TEMPLATE_BRANCH:-main}
      NOTEBOOK_TEMPLATE_REPO_URL: ${NOTEBOOK_TEMPLATE_REPO_URL:-https://github.com/data2evidence/templates.git}
      NOTEBOOK_TEMPLATE_REPO_BRANCH: ${NOTEBOOK_TEMPLATE_REPO_BRANCH:-main}
      FHIR_STRUCTURE_MAP_TEMPLATE_REPO_URL: ${FHIR_STRUCTURE_MAP_TEMPLATE_REPO_URL:-https://github.com/data2evidence/templates.git}
      FHIR_STRUCTURE_MAP_TEMPLATE_REPO_BRANCH: ${FHIR_STRUCTURE_MAP_TEMPLATE_REPO_BRANCH:-main}
      TREX_SQL_PASSWORD: ${TREX__SQL__PASSWORD}
      GOOGLE_APPLICATION_CREDENTIALS: /usr/src/data/google-credentials.json
      PG_ADMIN_PASSWORD: ${PG_ADMIN_PASSWORD}
      PG_WRITE_PASSWORD: ${PG_WRITE_PASSWORD}
      PG_STUDY_RESULTS_READ_PASSWORD: ${PG_STUDY_RESULTS_READ_PASSWORD}
      PG_STUDY_RESULTS_ADMIN_PASSWORD: ${PG_STUDY_RESULTS_ADMIN_PASSWORD}
      SUPABASE_STORAGE_JWT_TOKEN: ${SUPABASE_STORAGE_JWT_TOKEN}
      SUPABASE_STORAGE_JWT_SECRET: ${SUPABASE_STORAGE_JWT_SECRET}
      PERSEUS__FILES_MANAGER_HOST: trex
      isHttpTestRun: ${isHttpTestRun:-false}
      isTestEnv: ${isTestEnv:-false}
      local: ${local}
      TESTSCHEMA: ${TESTSCHEMA}
      REFRESH_TOKEN__ENDPOINT: ${REFRESH_TOKEN__ENDPOINT}
      REFRESH_TOKEN__CLIENT_ID: ${REFRESH_TOKEN__CLIENT_ID}
      REFRESH_TOKEN__CLIENT_SECRET: ${REFRESH_TOKEN__CLIENT_SECRET}
      EXCLUDE_ANALYSIS_IDS: ${EXCLUDE_ANALYSIS_IDS}
      DC_HANA_READ_ROLE: ${DC_HANA_READ_ROLE}
      MINIO__SECRET_KEY: ${MINIO__SECRET_KEY}
      DEMO__DB_PASSWORD: ${DEMO__DB_PASSWORD:-mypass}
      USE_PUBLIC_WEBAPI_PROXY: ${USE_PUBLIC_WEBAPI_PROXY:-false}
      PUBLIC_WEBAPI_PROXY_URL: ${PUBLIC_WEBAPI_PROXY_URL:-http://localhost:3001}
      PUBLIC_WEBAPI_DATASOURCE: ${PUBLIC_WEBAPI_DATASOURCE:-SYNPUF1K}
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      SQL_RETURN_ON: ${SQL_RETURN_ON:-false}
      AZURE_OPENAI_API_KEY: ${AZURE_OPENAI_API_KEY:-}
      AZURE_OPENAI_API_ENDPOINT: ${AZURE_OPENAI_API_ENDPOINT:-}
      AZURE_OPENAI_API_DEPLOYMENT_NAME: ${AZURE_OPENAI_API_DEPLOYMENT_NAME:-}
      AZURE_OPENAI_API_VERSION: ${AZURE_OPENAI_API_VERSION:-}
      AZURE_OPENAI_API_INSTANCE_NAME: ${AZURE_OPENAI_API_INSTANCE_NAME:-}
      AI_MODEL: ${AI_MODEL:-azure:gpt-4o}
      D2E_MEMORY_LIMIT: ${D2E_MEMORY_LIMIT:-}
      D2E_SWAP_LIMIT: ${D2E_SWAP_LIMIT:-}
      INSTALL_SQLALCHEMY: ${INSTALL_SQLALCHEMY:-}
      IS_SELF_MANAGED_ROLES: ${IS_SELF_MANAGED_ROLES:-false}
      AZ_AUTO_GRANT_RESEARCHER_BY_DATASET_CODES: ${AZ_AUTO_GRANT_RESEARCHER_BY_DATASET_CODES:-}
      CACHE_TABLE_LEVEL_CONCURRENCY: ${CACHE_TABLE_LEVEL_CONCURRENCY:-1}

  alp-minerva-pg-mgmt-init:
    container_name: &c15 ${PROJECT_NAME:-d2e}-minerva-pg-mgmt-init-1
    depends_on:
      alp-minerva-postgres:
        condition: service_healthy
    hostname: ${PROJECT_NAME:-d2e}-minerva-pg-mgmt-init-1.${TLS__INTERNAL__DOMAIN:-alp.local}
    image: ${DOCKER_IMAGE_PREFIX:-ghcr.io/ohdsi/}d2e-pg-mgmt-init:${DOCKER_TAG_NAME:-develop}
    logging:
      options:
        tag: *c15
    networks:
      alp:
        priority: 20
    platform: linux/amd64
    environment:
      <<:
        - *x-tls
      NODE_ENV: development
      ALP_DB_LOGLEVEL: ${ALP_DB_LOGLEVEL:-info}
      POSTGRES_CONNECTION_CONFIG: |-
        {
         "connectionTimeoutMillis": 60000,
         "database": "${PG_DB_NAME:-alp}",
         "host": "${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}",
         "idle_in_transaction_session_timeout": 60000,
         "password": "${PG_SUPER_PASSWORD}",
         "port": "${PG_PORT:-5432}",
         "query_timeout": 60000,
         "statement_timeout": 60000,
         "user": "${PG_SUPER_USER:-postgres}",
         "ssl": false
        }
      POSTGRES_MANAGE_CONFIG: |-
        {
         "databases": {
          "+${PG_DB_NAME:-alp}": {
           "schemas": {
            "+cdw_config": {},
            "+jobplugins": {},
            "+logto": {},
            "+portal": {},
            "+public": {},
            "+qe_config": {},
            "+terminology": {},
            "+usermgmt": {},
            "+files_manager": {},
            "+perseus": {},
            "+white_rabbit": {},
            "+trex": {},
            "+storage": {},
            "+strategus": {},
            "+fhir": {}
           }
          }
         }
        }
      POSTGRES_ALTER_EXTENSION_CONFIG: |-
        {
         "databases": {
          "${PG__FHIR_DB_NAME:-alp}": {
             "schema": "pg_catalog",
             "extension": "pg_trgm"
          }
         }
        }
      POSTGRES_MANAGE_USERS: |-
        {
         "${PG_DB_NAME:-alp}": {
          "manager": "${PG_ADMIN_USER:-alp_pg_admin_user}",
          "managerPassword": "${PG_ADMIN_PASSWORD}",
          "reader": "${PG_WRITE_USER:-alp_pg_write_user}",
          "readerPassword": "${PG_WRITE_PASSWORD}",
          "writer": "${PG_WRITE_USER:-alp_pg_write_user}",
          "writerPassword": "${PG_WRITE_PASSWORD}",
          "logtoManager": "${PG_LOGTO_MANAGER:-${PG__LOGTO_MANAGER_USER:-logto_postgres}}",
          "logtoManagerPassword": "${PG__LOGTO_MANAGER_PASSWORD}"
         }
        }
      POSTGRES_MANAGE_ROLES_USERS: ${POSTGRES_MANAGE_ROLES_USERS:-{}}
      POSTGRES_SUPERUSER: ${PG_SUPER_USER:-postgres}
      POSTGRES_SUPERUSER_PASSWORD: ${PG_SUPER_PASSWORD}
      POSTGRES_CONFIG_DB_NAME: ${PG_DB_NAME:-alp}
      PORT: 41110
      sqlOnly: false

  alp-caddy:
    container_name: &c1 ${PROJECT_NAME:-d2e}-caddy
    hostname: ${PROJECT_NAME:-d2e}-caddy.${TLS__INTERNAL__DOMAIN:-alp.local}
    platform: linux/amd64
    image: caddy:2.8-alpine
    logging:
      options:
        tag: *c1
    networks:
      alp:
        priority: 20
      enterprise-gateway:
        priority: 20
      enterprise-gateway-viewer:
        priority: 20
    command: >
      sh -c "
        mkdir -p /srv/caddy-config &&
        cat <<EOT > /srv/caddy-config/Caddyfile
        {
          debug
          pki {
            ca local {
              name \"D2E Local CA\"
              root_cn \"D2E Local CA - 2024 ECC Root\"
              intermediate_cn \"D2E Local CA - ECC Intermediate\"
            }
          }
        }

        (publicurlredirect) {
          ${CADDY__D2E__ALIAS_PUBLIC_FQDN:-${CADDY__ALP__ALIAS_PUBLIC_FQDN:-}} {
            $TLS__CADDY_DIRECTIVE
            redir https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}{uri} permanent
          }
        }

        (proxy_headers_codespaces) {
          header_up Host {upstream_hostport}
          header_up X-Forwarded-Host ${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}
          header_up X-Forwarded-Proto {scheme}
          header_up X-Forwarded-For {remote}
        }

        (proxy_headers_default) {
          header_up Host {upstream_hostport}
        }

        (portal) {
          log {
            format console {
              level_format color
            }
          }

          # Logto api server
          @logto {
            path /api/*
            path /oidc/*
            path /sign-in
            path /consent
            path /callback/* # For azure connector

            path /d2e/logto/index.*
            path /d2e/logto/assets/* # logto assets are moved to this path
          }

          handle @logto {
            uri strip_prefix /d2e/logto
            reverse_proxy http://${PROJECT_NAME:-d2e}-logto-1:3001 {
              import ${PROXY_HEADERS_MODE:-proxy_headers_default}
              transport http {
                read_buffer 8192
              }
            }
          }

          @jupyter_websocket {
            path /jupyter/*
            header Connection *Upgrade*
            header Upgrade websocket
          }

          @strategus_websocket {
            path /strategus-results/*
            header Connection *Upgrade*
            header Upgrade websocket
          }
          
          handle @jupyter_websocket {
            reverse_proxy https://${PROJECT_NAME:-d2e}-trex:33000 {
              transport http {
                tls
                tls_insecure_skip_verify
                read_buffer 8192
              }
              method GET
              rewrite /usermgmt/api/me/is_token_valid_internal
              header_up X-Forwarded-Method {method}
              header_up X-Forwarded-Uri {uri}
              header_up authorization {http.request.uri.query.token}
              @good status 2xx
              handle_response @good {
                request_header Remote-User {rp.header.Remote-User}
                request_header Remote-Email {rp.header.Remote-Email}
              }
            }
            reverse_proxy @jupyter_websocket http://${PROJECT_NAME:-d2e}-enterprise-gateway:8888
          }

          handle @strategus_websocket {
            @study_id path_regexp ^/strategus-results/([^/]+)/(.*)$
            handle @study_id {
              uri strip_prefix /strategus-results/{re.1}
              reverse_proxy {re.1}:3838
            }
          }

          ## call gateway if there are no matched files
          handle {
            reverse_proxy https://${PROJECT_NAME:-d2e}-trex:33000 {
              transport http {
                tls
                tls_insecure_skip_verify
                read_buffer 8192
              }
            }
          }
        }

        $INSTANCE_SPECIFIC_CONFIG

        # Enable if need to access admin console
        # http://localhost:3002 {
        #   uri strip_prefix /d2e/logto
        #   reverse_proxy http://${PROJECT_NAME:-d2e}-logto-1:3002 {
        #     import ${PROXY_HEADERS_MODE:-proxy_headers_default}
        #     transport http {
        #       read_buffer 8192
        #     }
        #   }
        # }

        https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${CADDY__ADDITIONAL_HOSTS:+, ${CADDY__ADDITIONAL_HOSTS}} {
          $TLS__CADDY_DIRECTIVE

          @aliasbasepaths {
              path_regexp portal_basepath ^/(d2e|portal)(/)?$
          }
          redir @aliasbasepaths /d2e/portal
          import portal
        }
      EOT
        caddy run --environ --config /srv/caddy-config/Caddyfile --adapter caddyfile
      "
    ports:
      - ${CADDY_PORT:-${PORT:-443}}:443
      # - 3002:3002 # Enable if need to access admin console
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}
    volumes:
      - caddy:/data
    environment:
      CADDY__D2E__PUBLIC_FQDN: ${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}
      TLS__CADDY_DIRECTIVE: ${TLS__CADDY_DIRECTIVE:-tls internal}
      INSTANCE_SPECIFIC_CONFIG: ${INSTANCE_SPECIFIC_CONFIG:-}
      CADDY__D2E__ALIAS_PUBLIC_FQDN: ${CADDY__D2E__ALIAS_PUBLIC_FQDN:-${CADDY__ALP__ALIAS_PUBLIC_FQDN:-}}
      PROJECT_NAME: ${PROJECT_NAME:-d2e}

  alp-dataflow-gen:
    command:
      - sh
      - -c
      - "prefect server start"
    container_name: &c2 ${PROJECT_NAME:-d2e}-dataflow-gen-1
    depends_on:
      alp-logto-post-init:
        condition: service_completed_successfully
      alp-minerva-pg-mgmt-init:
        condition: service_completed_successfully
    healthcheck:
      interval: 30s
      retries: 30
      start_period: 30s
      test:
        [
          "CMD",
          "python",
          "-c",
          "import urllib.request, sys; sys.exit(0 if 200 <= urllib.request.urlopen('http://localhost:41120/api/health', timeout=5).getcode() < 300 else 1)",
        ]
      timeout: 30s
    hostname: dataflow-gen-1
    image: prefecthq/prefect:3.0.3-python3.11
    platform: linux/amd64
    logging:
      options:
        tag: *c2
    networks:
      alp:
        priority: 20
      data:
        priority: 10
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}
    environment:
      <<:
        - *x-converter
        - *x-pg
        - *x-tls
      LOCAL_DEBUG: "false"
      PREFECT_API_DATABASE_CONNECTION_URL: postgresql+asyncpg://${PG_SUPER_USER:-postgres}:${PG_SUPER_PASSWORD}@${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}:${PG_PORT:-5432}/${PG_DB_NAME:-alp}
      PREFECT_API_DEFAULT_LIMIT: 5000
      PREFECT_API_URL: http://0.0.0.0:41120/api
      PREFECT_LOGGING_LEVEL: DEBUG
      PREFECT_LOGGING_SERVER_LEVEL: WARNING
      PREFECT_SERVER_ANALYTICS_ENABLED: "false"
      PREFECT_SERVER_API_HOST: 0.0.0.0
      PREFECT_UI_STATIC_DIRECTORY: /app/ui-files
      PREFECT_SERVER_API_PORT: 41120
      PREFECT_API_ENABLE_HTTP2: False

  alp-dataflow-gen-worker:
    command:
      - sh
      - -c
      - "rm -rf /root/.prefect/storage/run_cache.db /root/.prefect/storage/events.db; prefect work-pool create 'docker-pool' --type docker; prefect worker start --pool 'docker-pool' --type docker --name prefect-docker-worker --with-healthcheck"
    container_name: &c83 ${PROJECT_NAME:-d2e}-dataflow-gen-worker
    platform: linux/amd64
    depends_on:
      alp-logto-post-init:
        condition: service_completed_successfully
      alp-dataflow-gen:
        condition: service_healthy
    healthcheck:
      interval: 30s
      retries: 30
      start_period: 30s
      test:
        [
          "CMD",
          "python",
          "-c",
          "import urllib.request, sys; sys.exit(0 if 200 <= urllib.request.urlopen('http://localhost:8080/health', timeout=5).getcode() < 300 else 1)",
        ]
      timeout: 30s
    hostname: ${PROJECT_NAME:-d2e}-dataflow-gen-worker.${TLS__INTERNAL__DOMAIN:-alp.local}
    image: ${DOCKER_IMAGE_PREFIX:-ghcr.io/ohdsi/}d2e-dataflow-gen-worker:${DOCKER_TAG_NAME:-develop}
    logging:
      options:
        tag: *c83
    networks:
      data:
        priority: 20
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      PREFECT_API_URL: http://${PROJECT_NAME:-d2e}-dataflow-gen-1:41120/api
      PREFECT_API_ENABLE_HTTP2: False
      D2E_MEMORY_LIMIT: ${D2E_MEMORY_LIMIT:-16G}
      D2E_SWAP_LIMIT: ${D2E_SWAP_LIMIT:-64G}
      INSTALL_SQLALCHEMY: ${INSTALL_SQLALCHEMY:-}
      DOCKER_REGISTRY_URL: ${DOCKER_REGISTRY_URL:-ghcr.io}
      PREFECT_WORKER_WEBSERVER_HOST: 0.0.0.0
      PREFECT_TASKS_CACHE_ENABLED: false
      PREFECT_FLOW_RUN_CACHE_ENABLED: false
      PREFECT_RESULTS_PERSIST_BY_DEFAULT: false
      PREFECT_EVENTS_ENABLED: false


  # Needed only for future alterations of schema when version upgrades
  # alp-logto-db-post-alterations-init:
  #   depends_on:
  #       alp-minerva-postgres:
  #         condition: service_healthy
  #   image: ghcr.io/logto-io/logto:1.12
  #   entrypoint: ["sh", "-c", "npm run alteration deploy latest"]
  #   environment:
  #     CI: true
  #     DB_URL: postgres://${PG_SUPER_USER:-postgres}:${PG_SUPER_PASSWORD}@alp-minerva-postgres-1:${PG_PORT:-5432}/${PG_DB_NAME:-postgres}
  #   networks:
  #     - alp

  alp-logto-post-init:
    container_name: ${PROJECT_NAME:-d2e}-logto-post-init-1
    depends_on:
      alp-logto:
        condition: service_healthy
    image: ${DOCKER_IMAGE_PREFIX:-ghcr.io/ohdsi/}d2e-logto-post-init:${DOCKER_TAG_NAME:-develop}
    networks:
      alp:
        priority: 20
    platform: linux/amd64
    environment:
      ENV_TYPE: ${ENV_TYPE:-local}
      PG__DB_NAME: alp
      PG__HOST: ${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}
      PG__PASSWORD: ${PG__LOGTO_MANAGER_PASSWORD}
      PG__PORT: ${PG_PORT:-5432}
      PG__USER: ${PG__LOGTO_MANAGER_USER:-logto_postgres}
      PG__SSL: ${PG__SSL:-false}
      PG__SCHEMA: logto
      # LOGTO__CONNECTOR_CONFIG: '{ "id": "y9nq6f91yeg19kwt1x6xz","connectorId": "azuread-alp", "config": { "clientId": "${ENTRA__CLIENT_ID}", "tenantId": "${ENTRA__TENANT_ID}", "clientSecret": "${ENTRA__CLIENT_SECRET}", "cloudInstance": "https://login.microsoftonline.com"}, "syncProfile": true}'
      # LOGTO__DISABLE_BASIC_AUTH: ${LOGTO__DISABLE_BASIC_AUTH:-true}
      # LOGTO__CUSTOM_JWT: '{"environmentVariables": {"clientId": "${ENTRA__CLIENT_ID}", "tenantId": "${ENTRA__TENANT_ID}", "clientSecret": "${ENTRA__CLIENT_SECRET}"}, "script": "/**\n* This function is called during the access token generation process to get custom claims for the JWT token.\n* Limit custom claims to under 50KB.\n*\n* @param {Object} payload - The input payload of the function.\n* @param {AccessTokenPayload} payload.token -The JWT token.\n* @param {Context} payload.context - Logto internal data that can be used to pass additional information\n* @param {EnvironmentVariables} [payload.environmentVariables] - The environment variables.\n*\n* @returns The custom claims.\n*/\n\n// @ts-ignore\nconst getCustomJwtClaims = async ({ token, context, environmentVariables, extra }) => {\n  const clientId = environmentVariables?.clientId || \"\";\n  const clientSecret = environmentVariables?.clientSecret || \"\";\n  const tenantId = environmentVariables?.tenantId || \"\";\n  const refreshToken = extra.thirdPartyRefreshToken || \"\";\n\n  const tokenEndpoint = `https://login.microsoftonline.com/$${tenantId}/oauth2/v2.0/token`;\n\n  const params =\n    `client_id=$${encodeURIComponent(clientId)}` +\n    `&client_secret=$${encodeURIComponent(clientSecret)}` +\n    `&refresh_token=$${encodeURIComponent(refreshToken)}` +\n    `&grant_type=refresh_token` +\n    `&scope=openid`;\n\n  let thirdPartyToken = extra.thirdPartyToken;\n  let thirdPartyRefreshToken = refreshToken;\n  try {\n    const response = await fetch(tokenEndpoint, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: params,\n    });\n\n    if (!response.ok) {\n      const responseBody = await response.text();\n      throw new Error(`Error refreshing token: $${response.statusText}: $${responseBody}: $${params}`);\n    }\n\n    const data = await response.json();\n    thirdPartyToken = data.id_token;\n    thirdPartyRefreshToken = data.refresh_token;\n  } catch (error) {\n    throw error;\n  }\n\n  return { thirdPartyToken, thirdPartyRefreshToken };\n};\n", "tokenSample": {"aud": "http://localhost:3000/api/test", "gty": "authorization_code", "jti": "f1d3d2d1-1f2d-3d4e-5d6f-7d8a9d0e1d2", "kind": "AccessToken", "scope": "read write", "grantId": "grant_123", "clientId": "my_app", "accountId": "uid_123"}, "contextSample": {"user": {"id": "123", "name": "Foo Bar", "roles": [], "avatar": "https://example.com/avatar.png", "profile": {}, "username": "foo", "customData": {}, "identities": {}, "hasPassword": false, "primaryEmail": "foo@logto.io", "primaryPhone": "+1234567890", "applicationId": "my-app", "organizations": [], "ssoIdentities": [], "organizationRoles": [], "mfaVerificationFactors": []}}}'
      LOGTO__CLIENT_APPS: '[{"name":"alp-svc","description":"alp-svc","type":"MachineToMachine", "id": "${LOGTO__D2E_SVC__CLIENT_ID:-${LOGTO__ALP_SVC__CLIENT_ID}}", "secret": "${LOGTO__D2E_SVC__CLIENT_SECRET:-${LOGTO__ALP_SVC__CLIENT_SECRET}}"},{"name":"alp-data","description":"alp-data","type":"MachineToMachine", "id": "${LOGTO__D2E_DATA__CLIENT_ID:-${LOGTO__ALP_DATA__CLIENT_ID}}", "secret": "${LOGTO__D2E_DATA__CLIENT_SECRET:-${LOGTO__ALP_DATA__CLIENT_SECRET}}"},{"name":"alp-app","description":"alp-app","type":"Traditional", "id": "${LOGTO__D2E_APP__CLIENT_ID:-${LOGTO__ALP_APP__CLIENT_ID}}", "secret": "${LOGTO__D2E_APP__CLIENT_SECRET:-${LOGTO__ALP_APP__CLIENT_SECRET}}", "oidcClientMetadata":{"redirectUris":["https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}/d2e/portal/login-callback","https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}/d2e/ui/gateway/dashboard","https://localhost:4000/d2e/portal/login-callback","https://localhost:8081"],"postLogoutRedirectUris":["https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}/d2e/portal","https://localhost:4000/d2e/portal","https://localhost:8081"]},"customClientMetadata":{"corsAllowedOrigins":[],"refreshTokenTtlInDays":14,"alwaysIssueRefreshToken":true,"rotateRefreshToken":true}}]'
      LOGTO__RESOURCE: '{"name":"alp-default","indicator":"https://alp-default","accessTokenTtl":3600}'
      LOGTO__USER: '{"username":"admin","initialPassword":"Updatepassword12345"}'
      LOGTO__ROLES: '[{"name":"role.systemadmin","description":"ALP System admin","type":"User"},{"name":"role.useradmin","description":"ALP User admin","type":"User"},{"name":"role.dashboardviewer","description":"ALP Dashboard viewer","type":"User"}]'
      LOGTO__SCOPES: '[{"name":"role.systemadmin","description":"ALP System admin"},{"name":"role.useradmin","description":"ALP User admin"},{"name":"role.dashboardviewer","description":"ALP Dashboard viewer"}]'
      LOGTO__ADMIN_SERVER__FQDN_URL: "http://${PROJECT_NAME:-d2e}-logto-1:3002"
      LOGTO__CLIENTID_PASSWORD__BASIC_AUTH: ${LOGTO__CLIENTID_PASSWORD__BASIC_AUTH}
      LOGTO__ALP_ADMIN_APP: '{"application": {"id": "${LOGTO_API_M2M_CLIENT_ID}", "name":"alp-admin","description":"alp-admin", "secret": "${LOGTO_API_M2M_CLIENT_SECRET}"}, "role": { "name":"api-access","description":"Logto API access"}}'
      LOGTO__TERM_OF_USE_URL: ${LOGTO__TERM_OF_USE_URL:-}
      LOGTO__PRIVACY_POLICY_URL: ${LOGTO__PRIVACY_POLICY_URL:-}
      LOGTO__CUSTOM_CSS: ${LOGTO__CUSTOM_CSS:-}
      CADDY__D2E__PUBLIC_FQDN: ${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}

  alp-logto:
    container_name: &c8 ${PROJECT_NAME:-d2e}-logto-1
    depends_on:
      alp-minerva-pg-mgmt-init:
        condition: service_completed_successfully
    healthcheck:
      interval: 20s
      retries: 30
      start_period: 120s
      test:
        - CMD
        - wget
        - --proxy
        - off
        - -O
        - logto.status
        - http://localhost:3001/api/status
    hostname: ${PROJECT_NAME:-d2e}-logto-1.${TLS__INTERNAL__DOMAIN:-alp.local}
    platform: linux/amd64
    image: ${DOCKER_IMAGE_PREFIX:-ghcr.io/ohdsi/}d2e-logto:${DOCKER_TAG_NAME:-develop}
    logging:
      options:
        tag: *c8
    networks:
      alp:
        priority: 20
      data:
        priority: 10
    entrypoint:
      - sh
      - -c
      - npm run cli db seed -- --swe && npx @logto/cli db alteration rollback 1.23.0 && npx @logto/cli db alteration deploy 1.23.1 && npm start
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}
    environment:
      <<:
        - *x-tls
      ADMIN_DISABLE_LOCALHOST: ${LOGTO__DISABLE_ADMIN_CONSOLE:-false}
      # ADMIN_ENDPOINT: http://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:3002 # Enable if need to access admin console
      # ENDPOINT: http://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:3001 # Enable if need to access admin console
      DB_URL: postgres://${PG__LOGTO_MANAGER_USER:-logto_postgres}:${PG__LOGTO_MANAGER_PASSWORD}@${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}:${PG_PORT:-5432}/${PG_DB_NAME:-alp}?options=-c%20search_path%3Dlogto
      ENDPOINT: https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}
      LOGTO_API_M2M_CLIENT_ID: ${LOGTO_API_M2M_CLIENT_ID}
      LOGTO_API_M2M_CLIENT_SECRET: ${LOGTO_API_M2M_CLIENT_SECRET}
      LOGTO_ROLES_AZ_GROUPS_MAPPING: ${LOGTO_ROLES_AZ_GROUPS_MAPPING:-{"role.systemadmin":"37b5364a-348c-494f-b67f-a59a40e52ab7","role.useradmin":"90597adc-92af-4649-8151-68c3b7feb66c","role.dashboardviewer":"50a3b140-21eb-46dd-9d81-61a77cbc81f5"}}
      NODE_ENV: test
      PROJECT_NAME: ${PROJECT_NAME:-d2e}
      PORT: 3001
      TRUST_PROXY_HEADER: true
      DATABASE_CONNECTION_TIMEOUT: 30000

  alp-minerva-postgres:
    container_name: &c17 ${PROJECT_NAME:-d2e}-minerva-postgres-1
    healthcheck:
      interval: 20s
      retries: 30
      start_period: 60s
      test:
        - CMD-SHELL
        - pg_isready
        - -d
        - ${POSTGRES_DB}
      timeout: 30s
    hostname: ${PROJECT_NAME:-d2e}-minerva-postgres-1.${TLS__INTERNAL__DOMAIN:-alp.local}
    image: postgres:15-alpine
    logging:
      options:
        tag: *c17
    networks:
      alp:
        priority: 20
      data:
        priority: 10
      enterprise-gateway:
        priority: 10
      enterprise-gateway-viewer:
        priority: 10
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}
    command:
      - "postgres"
      - "-c"
      - "wal_level=logical"
      - "-c"
      - "max_connections=1000"
    shm_size: 1gb
    volumes:
      - pg-minerva-data-1:/var/lib/postgresql/data
      - ./cache/pgbackup:/backup
    environment:
      <<:
        - *x-tls
      POSTGRES_DB: ${PG_DB_NAME:-alp}
      POSTGRES_PASSWORD: ${PG_SUPER_PASSWORD}

  demodb:
    image: ohdsi/broadsea-atlasdb:2.2.0
    container_name: ${PROJECT_NAME:-d2e}-demodb
    mem_limit: "2G"
    command: >
      sh -c '
      set -e;
      echo "Starting PostgreSQL in background via original docker-entrypoint.sh...";
      /usr/local/bin/docker-entrypoint.sh postgres -c wal_level=logical &
      PG_PID=$!;
      echo "Waiting for PostgreSQL to become ready...";
        until pg_isready -q -U postgres -h localhost -p 5432; do
          echo "PostgreSQL is unavailable - sleeping for 1 second...";
          sleep 1;
        done;
      echo "PostgreSQL is ready on localhost:5432.";
      echo "Attempting to change password for user postgres...";
      psql -v ON_ERROR_STOP=1 -h localhost -U postgres -d postgres -c "ALTER USER postgres WITH PASSWORD '\''${DEMO__DB_PASSWORD:-mypass}'\'';";
      echo "PostgreSQL setup complete. Bringing PostgreSQL process (PID $PG_PID) to foreground...";
      wait $PG_PID;
      echo "PostgreSQL process (PID $PG_PID) has exited.";
      exit $?;'
    environment:
      POSTGRES_PASSWORD: ${DEMO__DB_PASSWORD:-mypass}
    networks:
      alp:
        priority: 20
      data:
        priority: 10
    platform: linux/amd64
    volumes:
      - demodb-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 10
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}
    profiles: [demodb]

  redis:
    command: redis-server --requirepass ${REDIS_PASSWORD}
    container_name: &c26 ${PROJECT_NAME:-d2e}-minerva-redis-1
    healthcheck:
      interval: 20s
      retries: 10
      start_period: 60s
      timeout: 30s
      test: redis-cli --no-auth-warning -a ${REDIS_PASSWORD} ping | grep PONG
    hostname: ${PROJECT_NAME:-d2e}-minerva-redis-1.${TLS__INTERNAL__DOMAIN:-alp.local}
    image: redis:7
    logging:
      options:
        tag: *c26
    networks:
      alp:
        priority: 20
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}

  supabase-storage:
    container_name: &c19 ${PROJECT_NAME:-d2e}-supabase-storage-${BASE_PORT:-1}
    depends_on:
      trex:
        condition: service_healthy
      alp-minerva-postgres:
        condition: service_healthy
      alp-minerva-pg-mgmt-init:
        condition: service_completed_successfully
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--proxy=off",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://${PROJECT_NAME:-d2e}-supabase-storage-1:9000/status",
        ]
      timeout: 30s
      interval: 10s
      retries: 20
      start_period: 40s
    image: supabase/storage-api:v1.14.5
    logging:
      options:
        tag: *c19
    networks:
      alp:
        priority: 20
      data:
        priority: 10
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}
    volumes:
      - supabase-storage-data:/var/lib/storage
    entrypoint: ["/bin/sh", "-c"]
    command: >
      "set -e;
      echo 'Waiting 30 seconds for trex migrations...';
      sleep 30;
      echo 'Installing postgresql-client...';
      apk add --no-cache postgresql-client > /dev/null 2>&1;
      echo 'Starting storage server in background (will run migrations)...';
      node dist/start/server.js &
      SERVER_PID=\$!;
      echo 'Waiting 20 seconds for storage migrations to complete...';
      sleep 20;
      echo 'Updating public.objects view to include user_metadata...';
      export PGPASSWORD='${PG_SUPER_PASSWORD}';
      psql -h '${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}' -p '${PG_PORT:-5432}' -U '${PG_SUPER_USER:-postgres}' -d '${PG_DB_NAME:-alp}' -c 'ALTER TABLE IF EXISTS storage.objects DISABLE ROW LEVEL SECURITY;';
      psql -h '${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}' -p '${PG_PORT:-5432}' -U '${PG_SUPER_USER:-postgres}' -d '${PG_DB_NAME:-alp}' -c 'DROP VIEW IF EXISTS public.objects CASCADE;';
      psql -h '${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}' -p '${PG_PORT:-5432}' -U '${PG_SUPER_USER:-postgres}' -d '${PG_DB_NAME:-alp}' -c 'CREATE VIEW public.objects AS SELECT * FROM storage.objects;';
      psql -h '${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}' -p '${PG_PORT:-5432}' -U '${PG_SUPER_USER:-postgres}' -d '${PG_DB_NAME:-alp}' -c 'GRANT SELECT, INSERT, UPDATE, DELETE ON public.objects TO service_role;';
      psql -h '${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}' -p '${PG_PORT:-5432}' -U '${PG_SUPER_USER:-postgres}' -d '${PG_DB_NAME:-alp}' -c 'GRANT SELECT, INSERT, UPDATE, DELETE ON public.objects TO authenticated;';
      psql -h '${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}' -p '${PG_PORT:-5432}' -U '${PG_SUPER_USER:-postgres}' -d '${PG_DB_NAME:-alp}' -c 'GRANT SELECT ON public.objects TO anon;';
      echo 'View setup complete. Storage server continuing...';
      wait \$SERVER_PID;"
    environment:
      <<:
        - *x-tls
      PROJECT_REF: ${PROJECT_REF:-default}
      PORT: 9000
      FILE_SIZE_LIMIT: 52428800
      DATABASE_URL: postgres://${PG_SUPER_USER:-postgres}:${PG_SUPER_PASSWORD}@${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}:${PG_PORT:-5432}/${PG_DB_NAME:-alp}
      PGRST_JWT_SECRET: ${SUPABASE_STORAGE_JWT_SECRET:-mysecret}
      SERVICE_KEY: ${SUPABASE_STORAGE_JWT_TOKEN:-mytoken}
      MIGRATIONS_SCHEMA: storage
      MIGRATIONS_TABLE: migrations
      SKIP_MIGRATIONS: "false"
      STORAGE_BACKEND: file
      GLOBAL_S3_BUCKET: stub
      GLOBAL_S3_ENDPOINT: http://supabase-storage:9000/s3
      GLOBAL_S3_PROTOCOL: "http"
      GLOBAL_S3_FORCE_PATH_STYLE: true
      FILE_STORAGE_BACKEND_PATH: /var/lib/storage
      TENANT_ID: stub
      REGION: stub

  dicom-server:
    # uses 8042 port on the container
    image: orthancteam/orthanc:24.6.1
    container_name: &c27 ${PROJECT_NAME:-d2e}-dicom-server-${BASE_PORT:-1}
    logging:
      options:
        tag: *c27
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}
    networks:
      alp:
      data:
    hostname: ${PROJECT_NAME:-d2e}-dicom-server-1.${TLS__INTERNAL__DOMAIN:-alp.local}
    environment:
      VERBOSE_ENABLED: true
      VERBOSE_STARTUP: true
      ORTHANC__NAME: D2E Dicom Service
      ORTHANC__AWS_S3_STORAGE__BUCKET_NAME: dicom-images
      ORTHANC__AWS_S3_STORAGE__ENDPOINT: http://${MINIO__ENDPOINT:-alp-minerva-s3}:${MINIO__PORT:-9000}
      ORTHANC__AWS_S3_STORAGE__ACCESS_KEY: ${MINIO__ACCESS_KEY:-root}
      ORTHANC__AWS_S3_STORAGE__SECRET_KEY: ${MINIO__SECRET_KEY}
      ORTHANC__AWS_S3_STORAGE__VIRTUAL_ADDRESSING: false
      ORTHANC__AWS_S3_STORAGE__REGION: ${MINIO__REGION:-ap-southeast-1}
      ORTHANC__AUTHENTICATION_ENABLED: false
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "/probes/test-aliveness.py --user=healthcheck --pwd=${DICOM__HEALTH_CHECK_PASSWORD}",
        ]
      start_period: 10s
      interval: 20s
      retries: 20
      timeout: 60s
    volumes:
      - dicom-sqlite-storage:/var/lib/orthanc/db
    profiles: [dicom]

  enterprise-gateway:
    image: ${DOCKER_IMAGE_PREFIX:-ghcr.io/ohdsi/}d2e-enterprise-gateway:${DOCKER_TAG_NAME:-develop}
    container_name: &c28 ${PROJECT_NAME:-d2e}-enterprise-gateway
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8888/jupyter/api || exit 1"]
      interval: 30s
      timeout: 30s
      retries: 5
      start_period: 30s
    platform: linux/amd64
    logging:
      options:
        tag: *c28
    networks:
      enterprise-gateway:
    user: root # Run as root
    environment:
      <<:
        - *x-enterprise-gateway
      EG_DOCKER_NETWORK: ${EG_DOCKER_NETWORK:-${PROJECT_NAME:-d2e}_enterprise-gateway}
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    labels:
      app: "enterprise-gateway"
      component: "enterprise-gateway"
    deploy:
      replicas: 1
      endpoint_mode: dnsrr
      labels:
        app: "enterprise-gateway"
        component: "enterprise-gateway"

  enterprise-gateway-viewer:
    image: ${DOCKER_IMAGE_PREFIX:-ghcr.io/ohdsi/}d2e-enterprise-gateway:${DOCKER_TAG_NAME:-develop}
    container_name: &c29 ${PROJECT_NAME:-d2e}-enterprise-gateway-viewer
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8888/jupyter/api || exit 1"]
      interval: 30s
      timeout: 30s
      retries: 5
      start_period: 30s
    platform: linux/amd64
    logging:
      options:
        tag: *c29
    networks:
      enterprise-gateway-viewer:
    user: root # Run as root
    environment:
      <<:
        - *x-enterprise-gateway
      EG_DOCKER_NETWORK: ${EG_DOCKER_NETWORK:-${PROJECT_NAME:-d2e}_enterprise-gateway-viewer}
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    labels:
      app: "enterprise-gateway-viewer"
      component: "enterprise-gateway-viewer"
    deploy:
      replicas: 1
      endpoint_mode: dnsrr
      labels:
        app: "enterprise-gateway-viewer"
        component: "enterprise-gateway-viewer"

  mlflow:
    image: ghcr.io/mlflow/mlflow:v3.0.0
    container_name: &c31 ${PROJECT_NAME:-d2e}-mlflow
    platform: linux/amd64
    logging:
      options:
        tag: *c31
    networks:
      alp:
      data:
      enterprise-gateway:
    command: mlflow server --host 0.0.0.0 --port 5000
    profiles: [mlflow]

  hana:
    container_name: hana
    hostname: hana
    image: saplabs/hanaexpress:2.00.082.00.20250528.1
    platform: linux/amd64
    ports:
      - 1128-1129:1128-1129
      - 39013:39013
      - 39017:39017
      - 39041-39045:39041-39045
      - 59013-59014:59013-59014
    volumes:
      - hana-data:/hana/mounts
    networks:
      alp:
      data:
    profiles: [hana]

  logging:
    image: amir20/dozzle:v8.13.9
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    read_only: true
    networks:
      alp:
    environment:
      - DOZZLE_FILTER=name=${PROJECT_NAME:-d2e}
      - DOZZLE_BASE=/dockerlogs
      - DOZZLE_NO_ANALYTICS=true