services:
    # Weaviate instance for basic tests
    weaviate:
        image: semitechnologies/weaviate:1.32.4
        command:
            - --host
            - 0.0.0.0
            - --port
            - '8080'
            - --scheme
            - http
        environment:
            - CLUSTER_HOSTNAME=weaviate
            - CLUSTER_ADVERTISE_ADDR=172.28.0.12
            - CLUSTER_GOSSIP_BIND_PORT=7946
            - CLUSTER_DATA_BIND_PORT=7947
            - DISABLE_TELEMETRY=true
            - PERSISTENCE_DATA_PATH=/var/lib/weaviate
            - DEFAULT_VECTORIZER_MODULE=none
            - ENABLE_MODULES=
            - AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED=true
            - LOG_LEVEL=info
        ports:
            - "9000:8080"
        volumes:
            - weaviate_data:/var/lib/weaviate
        networks:
            bifrost_network:
                ipv4_address: 172.28.0.12

    # Redis Stack instance for vector store tests
    redis-stack:
        image: redis/redis-stack:7.4.0-v6
        command: redis-stack-server --protected-mode no
        ports:
            - "6379:6379"
            - "8001:8001"  # RedisInsight web UI
        volumes:
            - redis_data:/data
        networks:
            bifrost_network:
                ipv4_address: 172.28.0.13
        healthcheck:
            test: ["CMD", "redis-cli", "ping"]
            interval: 30s
            timeout: 10s
            retries: 3

    # Generates self-signed TLS certs shared with the TLS Redis services.
    # Writes to ./redis-certs on the host so tests can read the CA cert.
    redis-certs-init:
        image: alpine:3.19
        volumes:
            - ./redis-certs:/tls
        command: >
            sh -c "
              set -e;
              if [ ! -f /tls/redis.crt ]; then
                apk add --no-cache openssl >/dev/null;
                cd /tls;
                openssl req -x509 -newkey rsa:2048 -days 365 -nodes -keyout ca.key -out ca.crt -subj '/CN=bifrost-test-ca';
                openssl req -new -newkey rsa:2048 -nodes -keyout redis.key -out redis.csr -subj '/CN=localhost' -addext 'subjectAltName=DNS:localhost,IP:127.0.0.1';
                openssl x509 -req -in redis.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out redis.crt -days 365 -extfile <(printf 'subjectAltName=DNS:localhost,IP:127.0.0.1');
                chmod 644 ca.crt ca.key redis.crt redis.key;
              fi;
              echo 'certs ready';
            "
        networks:
            - bifrost_network

    # TLS-enabled standalone Redis on 6380 for TLS client tests.
    redis-tls:
        image: redis:7.4-alpine
        depends_on:
            redis-certs-init:
                condition: service_completed_successfully
        volumes:
            - ./redis-certs:/tls:ro
        command: >
            redis-server
            --tls-port 6380
            --port 0
            --tls-cert-file /tls/redis.crt
            --tls-key-file /tls/redis.key
            --tls-ca-cert-file /tls/ca.crt
            --tls-auth-clients no
            --protected-mode no
        ports:
            - "6380:6380"
        networks:
            bifrost_network:
                ipv4_address: 172.28.0.17

    # Single-node Redis Cluster on 7000 for cluster client tests.
    redis-cluster:
        image: redis:7.4-alpine
        entrypoint: ["sh", "-c"]
        command:
            - |
                redis-server \
                    --port 7000 \
                    --bind 0.0.0.0 \
                    --cluster-enabled yes \
                    --cluster-config-file /tmp/nodes.conf \
                    --cluster-announce-ip 127.0.0.1 \
                    --cluster-announce-port 7000 \
                    --cluster-announce-bus-port 17000 \
                    --protected-mode no &
                SERVER_PID=$$!
                until redis-cli -p 7000 ping >/dev/null 2>&1; do sleep 0.2; done
                redis-cli -p 7000 cluster addslotsrange 0 16383 || true
                wait $$SERVER_PID
        ports:
            - "7000:7000"
            - "17000:17000"
        healthcheck:
            test: ["CMD-SHELL", "redis-cli -p 7000 cluster info | grep -q cluster_state:ok"]
            interval: 5s
            timeout: 3s
            retries: 10
            start_period: 5s
        networks:
            bifrost_network:
                ipv4_address: 172.28.0.18

    # Single-node TLS Redis Cluster on 7100 for TLS cluster client tests.
    redis-cluster-tls:
        image: redis:7.4-alpine
        depends_on:
            redis-certs-init:
                condition: service_completed_successfully
        volumes:
            - ./redis-certs:/tls:ro
        entrypoint: ["sh", "-c"]
        command:
            - |
                redis-server \
                    --tls-port 7100 \
                    --port 0 \
                    --bind 0.0.0.0 \
                    --tls-cert-file /tls/redis.crt \
                    --tls-key-file /tls/redis.key \
                    --tls-ca-cert-file /tls/ca.crt \
                    --tls-auth-clients no \
                    --tls-cluster yes \
                    --cluster-enabled yes \
                    --cluster-config-file /tmp/nodes.conf \
                    --cluster-announce-ip 127.0.0.1 \
                    --cluster-announce-tls-port 7100 \
                    --cluster-announce-bus-port 17100 \
                    --protected-mode no &
                SERVER_PID=$$!
                until redis-cli --tls --cacert /tls/ca.crt -p 7100 ping >/dev/null 2>&1; do sleep 0.2; done
                redis-cli --tls --cacert /tls/ca.crt -p 7100 cluster addslotsrange 0 16383 || true
                wait $$SERVER_PID
        ports:
            - "7100:7100"
            - "17100:17100"
        healthcheck:
            test: ["CMD-SHELL", "redis-cli --tls --cacert /tls/ca.crt -p 7100 cluster info | grep -q cluster_state:ok"]
            interval: 5s
            timeout: 3s
            retries: 10
            start_period: 5s
        networks:
            bifrost_network:
                ipv4_address: 172.28.0.19

    # Qdrant instance for vector store tests
    qdrant:
        image: qdrant/qdrant:v1.16.0
        ports:
            - "6334:6334"  # gRPC API
        volumes:
            - qdrant_data:/qdrant/storage
        networks:
            bifrost_network:
                ipv4_address: 172.28.0.14

    # Pinecone Local instance for vector store tests
    pinecone-local:
        image: ghcr.io/pinecone-io/pinecone-index:latest
        environment:
            PORT: 5081
            INDEX_TYPE: serverless
            VECTOR_TYPE: dense
            DIMENSION: 1536
            METRIC: cosine
        ports:
            - "5081:5081"
        platform: linux/amd64
        networks:
            bifrost_network:
                ipv4_address: 172.28.0.15
    # Postgres instance for configstore and encryption tests
    postgres:
        image: postgres:16-alpine
        environment:
            POSTGRES_USER: bifrost
            POSTGRES_PASSWORD: bifrost_password
            POSTGRES_DB: bifrost
        ports:
            - "5432:5432"
        networks:
            bifrost_network:
                ipv4_address: 172.28.0.16

networks:
    bifrost_network:
        driver: bridge
        ipam:
            config:
                - subnet: 172.28.0.0/16
                  gateway: 172.28.0.1

volumes:
    weaviate_data:
    redis_data:
    qdrant_data: