services:
  backend:
    # The backend container needs some variables to be configured properly
    environment:
      OPENPROJECT_CLI_PROXY: "${OPENPROJECT_DEV_URL}"
      OPENPROJECT_DEV_EXTRA_HOSTS: "${OPENPROJECT_DEV_HOST}"
      OPENPROJECT_HTTPS: true
      SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
      # uncomment and set all the envs below to integrate keycloak with OpenProject
      # OPENPROJECT_OPENID__CONNECT_KEYCLOAK_DISPLAY__NAME: Keycloak
      # OPENPROJECT_OPENID__CONNECT_KEYCLOAK_HOST: keycloak.local
      # OPENPROJECT_OPENID__CONNECT_KEYCLOAK_IDENTIFIER: https://openproject.local
      # OPENPROJECT_OPENID__CONNECT_KEYCLOAK_SECRET: <The client secret you copied from keycloak>
      # OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ISSUER: https://keycloak.local/realms/<REALM>
      # OPENPROJECT_OPENID__CONNECT_KEYCLOAK_AUTHORIZATION__ENDPOINT: /realms/<REALM>/protocol/openid-connect/auth
      # OPENPROJECT_OPENID__CONNECT_KEYCLOAK_TOKEN__ENDPOINT: /realms/<REALM>/protocol/openid-connect/token
      # OPENPROJECT_OPENID__CONNECT_KEYCLOAK_USERINFO__ENDPOINT: /realms/<REALM>/protocol/openid-connect/userinfo
      # OPENPROJECT_OPENID__CONNECT_KEYCLOAK_END__SESSION__ENDPOINT: https://keycloak.local/realms/<REALM>/protocol/openid-connect/logout
    networks:
      - external
    volumes:
      # This volume mount is the usual volume mount for a linux environment.
      # It must be amended accordingly to OS.
      - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro

  backend-test:
    # Connect the backend-test container to the same network as the backend for nextcloud HTTP interactions
    networks:
      - external
    volumes:
      # Linux
      - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
      # Mac OS
      # - ~/.step/certs:/etc/ssl/certs
      # - ~/.step/certs:/usr/local/share/ca-certificates

  frontend:
    networks:
      - external
    # Those label interpreted by traefik to create the correct HTTP router
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.openproject.rule=Host(`${OPENPROJECT_DEV_HOST}`)"
      - "traefik.http.routers.openproject.entrypoints=websecure"

# You need to define the same external network
# that is defined in the TLS proxy compose file
networks:
  external:
    name: gateway
    external: true
