docker-compose.yml

name: mapaengine

# Base común. Los puertos publicados y el restart de production viven en los
# overrides: docker-compose.dev.yml y docker-compose.prod.yml. No uses este
# archivo solo; siempre combínalo con un override (ver Makefile).

services:
  db:
    image: postgis/postgis:18-3.6
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-mapaengine}
      POSTGRES_USER: ${POSTGRES_USER:-mapaengine}
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
    secrets:
      - postgres_password
    volumes:
      - db_data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-mapaengine} -d ${POSTGRES_DB:-mapaengine}"]
      interval: 10s
      timeout: 5s
      retries: 5

  db-init:
    image: postgis/postgis:18-3.6
    restart: "no"
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-mapaengine}
      POSTGRES_DB: ${POSTGRES_DB:-mapaengine}
      AUTHENTIK_POSTGRES_DB: ${AUTHENTIK_POSTGRES_DB:-authentik}
      AUTHENTIK_POSTGRES_USER: ${AUTHENTIK_POSTGRES_USER:-authentik}
    entrypoint: ["/bin/bash", "/init/init-authentik.sh"]
    secrets:
      - postgres_password
      - authentik_postgres_password
    volumes:
      - ./docker/db/init-authentik.sh:/init/init-authentik.sh:ro
    depends_on:
      db:
        condition: service_healthy

  redis:
    image: redis:8-alpine
    restart: unless-stopped
    command: ["sh", "-c", "exec redis-server --requirepass \"$$(cat /run/secrets/redis_password)\""]
    secrets:
      - redis_password
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD-SHELL", "redis-cli -a \"$$(cat /run/secrets/redis_password)\" ping | grep -q PONG"]
      interval: 10s
      timeout: 5s
      retries: 5

  geoserver:
    image: docker.osgeo.org/geoserver:3.0.0
    restart: unless-stopped
    environment:
      GEOSERVER_ADMIN_USER: ${GEOSERVER_ADMIN_USER:-admin}
      GEOSERVER_ADMIN_PASSWORD_FILE: /run/secrets/geoserver_admin_password
    secrets:
      - geoserver_admin_password
    volumes:
      - geoserver_data:/opt/geoserver_data
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/geoserver/web/ >/dev/null || exit 1"]
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 60s
    depends_on:
      db:
        condition: service_healthy

  geodata-init:
    image: postgis/postgis:18-3.6
    restart: "no"
    environment:
      POSTGRES_HOST: ${POSTGRES_HOST:-db}
      POSTGRES_USER: ${POSTGRES_USER:-mapaengine}
      POSTGRES_DB: ${POSTGRES_DB:-mapaengine}
    entrypoint: ["/bin/bash", "/init/init-sample-layer.sh"]
    secrets:
      - postgres_password
    volumes:
      - ./docker/db/init-sample-layer.sh:/init/init-sample-layer.sh:ro
    depends_on:
      db:
        condition: service_healthy

  geoserver-init:
    image: curlimages/curl:8.11.1
    restart: "no"
    user: "0:0"
    environment:
      GEOSERVER_ADMIN_USER: ${GEOSERVER_ADMIN_USER:-admin}
      GEOSERVER_WORKSPACE: ${GEOSERVER_WORKSPACE:-mapaengine}
      GEOSERVER_DATASTORE: ${GEOSERVER_DATASTORE:-mapaengine_postgis}
      POSTGRES_HOST: ${POSTGRES_HOST:-db}
      POSTGRES_PORT: ${POSTGRES_PORT:-5432}
      POSTGRES_DB: ${POSTGRES_DB:-mapaengine}
      POSTGRES_USER: ${POSTGRES_USER:-mapaengine}
    entrypoint: ["/bin/sh", "/init/init-geoserver.sh"]
    secrets:
      - geoserver_admin_password
      - postgres_password
    volumes:
      - ./docker/geoserver/init-geoserver.sh:/init/init-geoserver.sh:ro
    depends_on:
      geoserver:
        condition: service_healthy
      geodata-init:
        condition: service_completed_successfully

  pycsw-init:
    image: postgis/postgis:18-3.6
    restart: "no"
    environment:
      POSTGRES_HOST: ${POSTGRES_HOST:-db}
      POSTGRES_USER: ${POSTGRES_USER:-mapaengine}
      POSTGRES_DB: ${POSTGRES_DB:-mapaengine}
      PYCSW_DB_USER: ${PYCSW_DB_USER:-pycsw}
    entrypoint: ["/bin/bash", "/init/init-pycsw.sh"]
    secrets:
      - postgres_password
      - pycsw_db_password
    volumes:
      - ./docker/db/init-pycsw.sh:/init/init-pycsw.sh:ro
    depends_on:
      db:
        condition: service_healthy

  pycsw:
    image: geopython/pycsw:3.0.0-beta3
    restart: unless-stopped
    user: "0:0"
    environment:
      POSTGRES_HOST: ${POSTGRES_HOST:-db}
      POSTGRES_PORT: ${POSTGRES_PORT:-5432}
      POSTGRES_DB: ${POSTGRES_DB:-mapaengine}
      PYCSW_DB_USER: ${PYCSW_DB_USER:-pycsw}
    entrypoint: ["/bin/sh", "/usr/local/bin/entrypoint-wrapper.sh"]
    secrets:
      - pycsw_db_password
    volumes:
      - ./docker/pycsw/pycsw.yml.tpl:/etc/pycsw/pycsw.yml.tpl:ro
      - ./docker/pycsw/entrypoint-wrapper.sh:/usr/local/bin/entrypoint-wrapper.sh:ro
    healthcheck:
      test: ["CMD", "/venv/bin/python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/?service=CSW&version=2.0.2&request=GetCapabilities').read()"]
      interval: 15s
      timeout: 10s
      retries: 5
      start_period: 30s
    depends_on:
      db:
        condition: service_healthy
      pycsw-init:
        condition: service_completed_successfully

  authentik-server:
    image: ghcr.io/goauthentik/server:2026.5.2
    restart: unless-stopped
    command: server
    environment:
      AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key
      AUTHENTIK_POSTGRESQL__HOST: ${POSTGRES_HOST:-db}
      AUTHENTIK_POSTGRESQL__NAME: ${AUTHENTIK_POSTGRES_DB:-authentik}
      AUTHENTIK_POSTGRESQL__USER: ${AUTHENTIK_POSTGRES_USER:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/authentik_postgres_password
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_REDIS__PASSWORD: file:///run/secrets/redis_password
    secrets:
      - authentik_secret_key
      - authentik_postgres_password
      - redis_password
    depends_on:
      db-init:
        condition: service_completed_successfully
      redis:
        condition: service_healthy

  authentik-worker:
    image: ghcr.io/goauthentik/server:2026.5.2
    restart: unless-stopped
    command: worker
    environment:
      AUTHENTIK_SECRET_KEY: file:///run/secrets/authentik_secret_key
      AUTHENTIK_POSTGRESQL__HOST: ${POSTGRES_HOST:-db}
      AUTHENTIK_POSTGRESQL__NAME: ${AUTHENTIK_POSTGRES_DB:-authentik}
      AUTHENTIK_POSTGRESQL__USER: ${AUTHENTIK_POSTGRES_USER:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: file:///run/secrets/authentik_postgres_password
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_REDIS__PASSWORD: file:///run/secrets/redis_password
    secrets:
      - authentik_secret_key
      - authentik_postgres_password
      - redis_password
    depends_on:
      db-init:
        condition: service_completed_successfully
      redis:
        condition: service_healthy

  backend:
    profiles: ["portal"]
    build: ./backend
    restart: unless-stopped
    environment:
      POSTGRES_HOST: ${POSTGRES_HOST:-db}
      POSTGRES_DB: ${POSTGRES_DB:-mapaengine}
      POSTGRES_USER: ${POSTGRES_USER:-mapaengine}
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      FASTAPI_SECRET_KEY_FILE: /run/secrets/fastapi_secret_key
      OIDC_CLIENT_SECRET_FILE: /run/secrets/oidc_client_secret
    secrets:
      - postgres_password
      - fastapi_secret_key
      - oidc_client_secret
    depends_on:
      db:
        condition: service_healthy

  frontend:
    profiles: ["portal"]
    build: ./frontend
    restart: unless-stopped
    depends_on:
      - backend

secrets:
  postgres_password:
    file: ./secrets/postgres_password
  authentik_postgres_password:
    file: ./secrets/authentik_postgres_password
  geoserver_admin_password:
    file: ./secrets/geoserver_admin_password
  authentik_secret_key:
    file: ./secrets/authentik_secret_key
  oidc_client_secret:
    file: ./secrets/oidc_client_secret
  fastapi_secret_key:
    file: ./secrets/fastapi_secret_key
  redis_password:
    file: ./secrets/redis_password
  pycsw_db_password:
    file: ./secrets/pycsw_db_password

volumes:
  db_data:
  redis_data:
  geoserver_data: