docker-compose.yml

services:
  reverse_proxy_docker:
    build:
      context: ./util/traefik
      dockerfile: Dockerfile
    command:
      # Rules
      - --providers.file=true
      - --providers.file.filename=/etc/traefik/rules.yaml
      - --providers.file.watch=true

      # API and dashboard
      - '--api.insecure=true'
      - '--api.dashboard=true'

      # Entry points configuration
      - '--entrypoints.web.address=:80'
      - '--entrypoints.websecure.address=:443'

      # HTTP/2 configuration (critical for subscriptions)
      - '--entrypoints.websecure.http.tls=true'
      - '--entrypoints.websecure.http2.maxConcurrentStreams=250'

      # HTTP to HTTPS redirect
      # - '--entrypoints.web.http.redirections.entrypoint.to=websecure'
      # - '--entrypoints.web.http.redirections.entrypoint.scheme=https'
    ports:
      - 80:80
      - 443:443
      - 8090:8080
    volumes:
      - './util/traefik/rules_docker.yaml:/etc/traefik/rules.yaml'
      - './util/traefik/ssl:/etc/certs:ro'
    networks:
      - klicker
    extra_hosts:
      - 'host.docker.internal:host-gateway'

  reverse_proxy_macos:
    build:
      context: ./util/traefik
      dockerfile: Dockerfile
    command:
      # Rules
      - --providers.file=true
      - --providers.file.filename=/etc/traefik/rules.yaml
      - --providers.file.watch=true

      # API and dashboard
      - '--api.insecure=true'
      - '--api.dashboard=true'

      # Entry points configuration
      - '--entrypoints.web.address=:80'
      - '--entrypoints.websecure.address=:443'

      # HTTP/2 configuration (critical for subscriptions)
      - '--entrypoints.websecure.http.tls=true'
      - '--entrypoints.websecure.http2.maxConcurrentStreams=250'

      # HTTP to HTTPS redirect
      # - '--entrypoints.web.http.redirections.entrypoint.to=websecure'
      # - '--entrypoints.web.http.redirections.entrypoint.scheme=https'
    ports:
      - 80:80
      - 443:443
      - 8090:8080
    volumes:
      - './util/traefik/rules_docker.yaml:/etc/traefik/rules.yaml'
      - './util/traefik/ssl:/etc/certs:ro'
    networks:
      - klicker

  reverse_proxy_wsl:
    build:
      context: ./util/traefik
      dockerfile: Dockerfile.wsl
    command:
      # Rules
      - --providers.file=true
      - --providers.file.filename=/etc/traefik/rules.yaml
      - --providers.file.watch=true

      # API and dashboard
      - '--api.insecure=true'
      - '--api.dashboard=true'

      # Entry points configuration
      - '--entrypoints.web.address=:80'
      - '--entrypoints.websecure.address=:443'

      # HTTP/2 configuration (critical for subscriptions)
      - '--entrypoints.websecure.http.tls=true'
      - '--entrypoints.websecure.http2.maxConcurrentStreams=250'

      # HTTP to HTTPS redirect
      # - '--entrypoints.web.http.redirections.entrypoint.to=websecure'
      # - '--entrypoints.web.http.redirections.entrypoint.scheme=https'
    ports:
      - 80:80
      - 443:443
      - 8090:8080
    volumes:
      - './util/traefik/rules_wsl.yaml:/etc/traefik/rules.yaml'
      - './util/traefik/ssl:/etc/certs:ro'
    networks:
      - klicker

  auth:
    profiles:
      - full
    image: ghcr.io/uzh-bf/klicker-uzh/auth:v3
    environment:
      APP_SECRET: abcd
      DATABASE_URL: 'postgres://klicker-prod:klicker@postgres:5432/klicker-prod'
      # EDUID_CLIENT_SECRET: ''
      # TEAMS_WEBHOOK_URL: ''
    ports:
      - 3010:3000
    networks:
      - klicker

  frontend_pwa:
    profiles:
      - full
    image: ghcr.io/uzh-bf/klicker-uzh/frontend-pwa:v3
    environment:
      APP_SECRET: abcd
      ALLOWED_FRAME_ANCESTORS: 'https://*.klicker.com'
    ports:
      - 3001:3000
    networks:
      - klicker

  frontend_manage:
    profiles:
      - full
    image: ghcr.io/uzh-bf/klicker-uzh/frontend-manage:v3
    ports:
      - 3002:3000
    networks:
      - klicker

  frontend_control:
    profiles:
      - full
    image: ghcr.io/uzh-bf/klicker-uzh/frontend-control:v3
    ports:
      - 3003:3000
    networks:
      - klicker

  backend:
    profiles:
      - full
    image: ghcr.io/uzh-bf/klicker-uzh/backend-docker:v3
    environment:
      APP_SECRET: 'abcd'
      COOKIE_DOMAIN: .klicker.com
      CRON_TOKEN: 'abcd'
      DATABASE_URL: 'postgres://klicker-prod:klicker@postgres:5432/klicker-prod'
      NOTIFICATION_SUPPORT_MAIL: 'noone@klicker.com'
      NOTIFICATION_URL: 'noone@klicker.com'
      REDIS_CACHE_HOST: 'redis_cache'
      REDIS_CACHE_PASS: ''
      REDIS_CACHE_PORT: 6379
      REDIS_HOST: 'redis_exec'
      REDIS_PASS: ''
      REDIS_PORT: 6379
      # BLOB_STORAGE_ACCESS_KEY: ''
      # BLOB_STORAGE_ACCOUNT_NAME: ''
      # NOTIFICATION_SECRET: ''
      # REDIS_CACHE_TLS: 'true'
      # REDIS_TLS: 'true'
      # TEAMS_WEBHOOK_URL: ''
      # VAPID_PRIVATE_KEY: ''
      # VAPID_PUBLIC_KEY: ''
    ports:
      - 3000:3000
    networks:
      - klicker

  # main database
  postgres:
    image: docker.io/library/postgres:15
    environment:
      POSTGRES_USER: klicker-prod
      POSTGRES_PASSWORD: klicker
      POSTGRES_DB: klicker-prod
    command:
      - 'postgres'
      # Auto-kill sessions stuck "idle in transaction" after 5 minutes.
      # Prevents cascading cypress failures when a run is interrupted mid-seed
      # and leaves a BEGIN transaction holding locks on klicker-prod.
      - '-c'
      - 'idle_in_transaction_session_timeout=300000'
    ports:
      - 5432:5432
    networks:
      - klicker
    volumes:
      - klicker_data:/var/lib/postgresql/data
      - ./util/init.sql:/docker-entrypoint-initdb.d/init.sql:ro

  # redis instance to support live quiz execution (normal)
  redis_exec:
    image: docker.io/library/redis:7
    ports:
      - 6379:6379
    networks:
      - klicker
    volumes:
      - redis_data:/data

  # redis instance to support live quiz execution (assessment)
  redis_assessment:
    image: docker.io/library/redis:7
    ports:
      - 6381:6379
    networks:
      - klicker
    volumes:
      - redis_data_assessment:/data

  # redis instance for page caching and rate limiting
  redis_cache:
    image: docker.io/library/redis:7
    ports:
      - 6380:6379
    networks:
      - klicker

  # fake smtp server for catching email during development
  mailhog:
    image: docker.io/mailhog/mailhog:latest
    ports:
      - 1025:1025
      - 8025:8025
    networks:
      - klicker

  hatchet:
    image: ghcr.io/hatchet-dev/hatchet/hatchet-lite:v0.73.1
    ports:
      - '8888:8888'
      - '7077:7077'
    environment:
      DATABASE_URL: 'postgresql://hatchet:hatchet@postgres:5432/hatchet?sslmode=disable'
      SERVER_AUTH_COOKIE_DOMAIN: localhost
      SERVER_AUTH_COOKIE_INSECURE: 't'
      SERVER_GRPC_BIND_ADDRESS: '0.0.0.0'
      SERVER_GRPC_INSECURE: 't'
      SERVER_GRPC_BROADCAST_ADDRESS: localhost:7077
      SERVER_GRPC_PORT: '7077'
      SERVER_URL: http://localhost:8888
      SERVER_AUTH_SET_EMAIL_VERIFIED: 't'
      SERVER_DEFAULT_ENGINE_VERSION: 'V1'
    volumes:
      - 'hatchet_lite_config:/config'
    networks:
      - klicker

  litellm:
    image: ghcr.io/berriai/litellm-database:main-1.80.15-stable.1
    ports:
      - '4000:4000'
    environment:
      - UPSTREAM_OPENAI_API_KEY
      - UPSTREAM_OPENAI_BASE_URL
    volumes:
      - './util/litellm/config.yaml:/app/config.yaml'
    command: ['--config', '/app/config.yaml', '--port', '4000']
    healthcheck:
      test:
        - 'CMD'
        - 'python'
        - '-c'
        - "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:4000/health/liveliness').status == 200 else 1)"
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - klicker

networks:
  klicker:
    driver: bridge

volumes:
  klicker_data:
  klicker_data_diff:
  klicker_data_lti:
  redis_data:
  redis_data_assessment:
  hatchet_lite_config: