services:
  mysql:
    image: public.ecr.aws/docker/library/mysql:8.0
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    environment:
      MYSQL_ROOT_PASSWORD: ${SC_MYSQL_ROOT_PASSWORD}
      MYSQL_DATABASE: ${SC_MYSQL_DATABASE}
      MYSQL_USER: ${SC_MYSQL_USER}
      MYSQL_PASSWORD: ${SC_MYSQL_APP_PASSWORD}
    volumes:
      - mysql-data:/var/lib/mysql
      - ./mysql-init.sql:/docker-entrypoint-initdb.d/10-init.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -p\"${SC_MYSQL_ROOT_PASSWORD}\" >/dev/null 2>&1"]
      interval: 10s
      timeout: 5s
      retries: 30

  redis:
    image: public.ecr.aws/docker/library/redis:7.2
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${SC_REDIS_PASSWORD}"]
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD-SHELL", "redis-cli -a \"${SC_REDIS_PASSWORD}\" ping | grep -q PONG"]
      interval: 10s
      timeout: 5s
      retries: 30

  backend:
    image: ${SC_BACKEND_IMAGE}
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    environment:
      SECURITY_CENTER_APP_ENVIRONMENT: ${SC_APP_ENVIRONMENT}
      SECURITY_CENTER_HTTP_HOST: 0.0.0.0
      SECURITY_CENTER_HTTP_PORT: 8080
      SECURITY_CENTER_HTTP_ALLOWED_ORIGINS: ${SC_ALLOWED_ORIGINS}
      SECURITY_CENTER_PUBLIC_BASE_URL: ${SC_ALLOWED_ORIGIN}
      SECURITY_CENTER_AUTH_BYPASS_SSO: ${SC_BYPASS_SSO}
      SECURITY_CENTER_OAUTH_ENABLED: ${SC_OAUTH_ENABLED}
      SECURITY_CENTER_OAUTH_AUTH0_DOMAIN: ${SC_AUTH0_DOMAIN}
      SECURITY_CENTER_OAUTH_AUTH0_CLIENT_ID: ${SC_AUTH0_CLIENT_ID}
      SECURITY_CENTER_OAUTH_AUTH0_CLIENT_SECRET: ${SC_AUTH0_CLIENT_SECRET}
      SECURITY_CENTER_OAUTH_AUTH0_AUDIENCE: ${SC_AUTH0_AUDIENCE}
      SECURITY_CENTER_OAUTH_REDIRECT_URL: ${SC_AUTH0_CALLBACK_URL}
      SECURITY_CENTER_STORAGE_PROVIDER: ${SECURITY_CENTER_STORAGE_PROVIDER}
      SECURITY_CENTER_STORAGE_S3_ENABLED: ${SECURITY_CENTER_STORAGE_S3_ENABLED}
      SECURITY_CENTER_STORAGE_S3_BUCKET: ${SECURITY_CENTER_STORAGE_S3_BUCKET}
      SECURITY_CENTER_STORAGE_S3_REGION: ${SECURITY_CENTER_STORAGE_S3_REGION}
      SECURITY_CENTER_STORAGE_S3_BASE_URL: ${SECURITY_CENTER_STORAGE_S3_BASE_URL}
      SECURITY_CENTER_STORAGE_S3_UPLOAD_PREFIX: ${SECURITY_CENTER_STORAGE_S3_UPLOAD_PREFIX}
      SECURITY_CENTER_STORAGE_S3_PRESIGN_TTL: ${SECURITY_CENTER_STORAGE_S3_PRESIGN_TTL}
      SECURITY_CENTER_STORAGE_S3_ENDPOINT: ${SECURITY_CENTER_STORAGE_S3_ENDPOINT}
      SECURITY_CENTER_STORAGE_S3_PUBLIC_ENDPOINT: ${SECURITY_CENTER_STORAGE_S3_PUBLIC_ENDPOINT}
      SECURITY_CENTER_STORAGE_S3_USE_PATH_STYLE: ${SECURITY_CENTER_STORAGE_S3_USE_PATH_STYLE}
      SECURITY_CENTER_DATABASE_DSN: ${SC_MYSQL_USER}:${SC_MYSQL_APP_PASSWORD}@tcp(mysql:3306)/${SC_MYSQL_DATABASE}?parseTime=true
      SECURITY_CENTER_REDIS_ADDR: redis:6379
      SECURITY_CENTER_REDIS_PASSWORD: ${SC_REDIS_PASSWORD}
      SECURITY_CENTER_JWT_ACCESS_SECRET: ${SC_JWT_ACCESS_SECRET}
      SECURITY_CENTER_JWT_REFRESH_SECRET: ${SC_JWT_REFRESH_SECRET}
      SECURITY_CENTER_SCAN_SCANNER_ENABLED: ${SECURITY_CENTER_SCAN_SCANNER_ENABLED}
      SECURITY_CENTER_SCAN_SCANNER_BASE_URL: ${SECURITY_CENTER_SCAN_SCANNER_BASE_URL}
      SECURITY_CENTER_SCAN_SCANNER_API_TOKEN: ${SECURITY_CENTER_SCAN_SCANNER_API_TOKEN}
      SECURITY_CENTER_SCAN_SCANNER_CALLBACK_TOKEN: ${SECURITY_CENTER_SCAN_SCANNER_CALLBACK_TOKEN}
      SECURITY_CENTER_SCAN_SCANNER_MAX_TARGETS_PER_BATCH: ${SECURITY_CENTER_SCAN_SCANNER_MAX_TARGETS_PER_BATCH}
      SECURITY_CENTER_SCAN_SCANNER_MAX_CAMPAIGN_TARGETS: ${SECURITY_CENTER_SCAN_SCANNER_MAX_CAMPAIGN_TARGETS}
      SECURITY_CENTER_SCAN_SCANNER_TIMEOUT: ${SECURITY_CENTER_SCAN_SCANNER_TIMEOUT}
      SECURITY_CENTER_SCAN_SCANNER_USER_AGENT: ${SECURITY_CENTER_SCAN_SCANNER_USER_AGENT}
      SECURITY_CENTER_AGENT_ENABLED: ${SECURITY_CENTER_AGENT_ENABLED}
      SECURITY_CENTER_AGENT_KEY_PREFIX: ${SECURITY_CENTER_AGENT_KEY_PREFIX}
      SECURITY_CENTER_AGENT_ALLOW_PERMANENT_KEY: ${SECURITY_CENTER_AGENT_ALLOW_PERMANENT_KEY}
      SECURITY_CENTER_AGENT_QUOTA_ENABLED: ${SECURITY_CENTER_AGENT_QUOTA_ENABLED}
      SECURITY_CENTER_AGENT_DEFAULT_QUOTA_RPM: ${SECURITY_CENTER_AGENT_DEFAULT_QUOTA_RPM}
      SECURITY_CENTER_AUDIT_RETENTION_DAYS: ${SECURITY_CENTER_AUDIT_RETENTION_DAYS}
      SSL_CERT_FILE: ${SC_DAST_SSL_CERT_FILE}
    volumes:
      - ${SC_DAST_CA_BUNDLE_HOST_PATH}:${SC_DAST_CA_BUNDLE_MOUNT_PATH}:ro
    depends_on:
      mysql:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:8080${SC_BACKEND_HEALTHCHECK_PATH} > /dev/null 2>&1 || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 60s

  frontend:
    image: ${SC_FRONTEND_IMAGE}
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    environment:
      NEXT_PUBLIC_API_BASE_URL: /api/v1
      NEXT_PUBLIC_SSO_PROVIDER: ${SC_NEXT_PUBLIC_SSO_PROVIDER}
      API_PROXY_TARGET: http://backend:8080
    depends_on:
      backend:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:3000${SC_FRONTEND_HEALTHCHECK_PATH} > /dev/null 2>&1 || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 60s

  nginx:
    image: public.ecr.aws/docker/library/nginx:1.27-alpine
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    depends_on:
      frontend:
        condition: service_healthy
      backend:
        condition: service_healthy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx-security-center.conf:/etc/nginx/conf.d/default.conf:ro
      - ${SC_TLS_CERT_FULLCHAIN}:${SC_TLS_CERT_FULLCHAIN}:ro
      - ${SC_TLS_CERT_PRIVKEY}:${SC_TLS_CERT_PRIVKEY}:ro
      - ${SC_ACME_WEBROOT}:${SC_ACME_WEBROOT}:ro
    healthcheck:
      test: ["CMD-SHELL", "wget --no-check-certificate -q -O - https://localhost/ > /dev/null 2>&1 || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s

volumes:
  mysql-data:
  redis-data: