services:
  db:
    image: kasmweb/postgres:${KASM_VERSION}
    container_name: kasm_db
    restart: unless-stopped
    stop_signal: SIGTERM
    stop_grace_period: 60s
    environment:
      POSTGRES_PASSWORD: ${KASM_DB_PASSWORD}
      POSTGRES_USER: kasmapp
      POSTGRES_DB: kasm
    command: postgres -c ssl=on -c ssl_cert_file=/etc/ssl/certs/db_server.crt -c ssl_key_file=/etc/ssl/certs/db_server.key -c config_file=/var/lib/postgresql/conf/postgresql.conf -c hba_file=/var/lib/postgresql/conf/pg_hba.conf
    healthcheck:
      test: "pg_isready --username=$$POSTGRES_USER --dbname=$$POSTGRES_DB && cat /proc/1/cmdline | grep -q '^postgres'"
      timeout: 5s
      retries: 20
    volumes:
      - ${KASM_DB_INIT_SQL}:/docker-entrypoint-initdb.d/current.sql:ro,Z
      - ${KASM_ROOT_PATH}/conf/database/pg_hba.conf:/var/lib/postgresql/conf/pg_hba.conf:ro,Z
      - ${KASM_ROOT_PATH}/conf/database/postgresql.conf:/var/lib/postgresql/conf/postgresql.conf:ro,Z
      - ${KASM_ROOT_PATH}/certs/db_server.crt:/etc/ssl/certs/db_server.crt:ro,Z
      - ${KASM_ROOT_PATH}/certs/db_server.key:/etc/ssl/certs/db_server.key:ro,Z
      - ${KASM_ROOT_PATH}/log/postgres:/var/log/postgres:Z
      - ${KASM_ROOT_PATH}/tmp/kasm_db:/tmp:Z
      - ${KASM_DB_DATA_PATH}:/var/lib/postgresql/data:Z
    networks:
      - kasm_default_network
    labels:
      prune.protect: "true"

  kasm_api:
    image: kasmweb/api:${KASM_VERSION}
    container_name: kasm_api
    user: "${KASM_UID}:${KASM_GID}"
    read_only: true
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: "/usr/bin/healthcheck.sh http://localhost:8080/api/__healthcheck \"\" 5 60"
      timeout: 30s
      interval: 10s
      retries: 3
      start_period: 60s
    volumes:
      - ${KASM_ROOT_PATH}:/opt/kasm/current:Z
      - ${KASM_ROOT_PATH}/healthcheck/kasm_api:/healthcheck:Z
      - ${KASM_ROOT_PATH}/tmp/api:/tmp:Z
    networks:
      - kasm_default_network
    labels:
      prune.protect: "true"

  kasm_manager:
    image: kasmweb/manager:${KASM_VERSION}
    container_name: kasm_manager
    user: "${KASM_UID}:${KASM_GID}"
    read_only: true
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: "/usr/bin/healthcheck.sh http://localhost:8181/__healthcheck \"\" 5 60"
      timeout: 30s
      interval: 10s
      retries: 3
    volumes:
      - ${KASM_ROOT_PATH}:/opt/kasm/current:Z
      - ${KASM_ROOT_PATH}/healthcheck/kasm_manager:/healthcheck:Z
      - ${KASM_ROOT_PATH}/tmp/manager:/tmp:Z
    networks:
      - kasm_default_network
    labels:
      prune.protect: "true"

  kasm_agent:
    image: kasmweb/agent:${KASM_VERSION}
    container_name: kasm_agent
    user: root
    read_only: true
    restart: unless-stopped
    depends_on:
      - kasm_manager
    healthcheck:
      test: "/usr/bin/healthcheck.sh http://localhost:4444/__healthcheck \"\" 30 90 15"
      timeout: 30s
      interval: 30s
      retries: 3
    volumes:
      - ${KASM_ROOT_PATH}:/opt/kasm/current:Z
      - ${KASM_ROOT_PATH}/healthcheck/kasm_agent:/healthcheck:Z
      - /var/run/docker.sock:/var/run/docker.sock
      - ${KASM_ROOT_PATH}/conf/nginx:/etc/nginx/conf.d:Z
    networks:
      - kasm_default_network
    labels:
      prune.protect: "true"

  kasm_guac:
    image: kasmweb/kasm-guac:${KASM_VERSION}
    container_name: kasm_guac
    user: "${KASM_UID}:${KASM_GID}"
    read_only: true
    init: true
    restart: unless-stopped
    healthcheck:
      test: "/usr/bin/healthcheck.sh http://localhost:3000/__healthcheck \"\" 30 90"
      interval: 60s
      timeout: 30s
      retries: 3
    volumes:
      - ${KASM_ROOT_PATH}/log:/opt/kasm/current/log:Z
      - ${KASM_ROOT_PATH}/tmp/guac:/opt/kasm/current/tmp/guac:Z
      - ${KASM_ROOT_PATH}/conf/app/guac:/opt/kasm/current/conf/app/guac:Z
      - ${KASM_ROOT_PATH}/tmp/guac:/tmp:Z
      - ${KASM_ROOT_PATH}/healthcheck/kasm_guac:/healthcheck:Z
    networks:
      - kasm_default_network
    labels:
      prune.protect: "true"

  rdp_gateway:
    image: kasmweb/rdp-gateway:${KASM_VERSION}
    container_name: kasm_rdp_gateway
    user: "${KASM_UID}:${KASM_GID}"
    read_only: true
    restart: unless-stopped
    depends_on:
      - kasm_api
    healthcheck:
      test: "/usr/bin/healthcheck.sh http://localhost:5555/__healthcheck 3389 1 30"
      interval: 60s
      timeout: 30s
      start_period: 30s
    volumes:
      - ${KASM_ROOT_PATH}/log:/opt/kasm/current/log:Z
      - ${KASM_ROOT_PATH}/conf/app/rdp_gateway:/usr/local/etc/rdpproxy/conf:Z
      - ${KASM_ROOT_PATH}/certs/kasm_nginx.key:/usr/local/etc/rdpproxy/rdpproxy.key:ro,Z
      - ${KASM_ROOT_PATH}/certs/kasm_nginx.crt:/usr/local/etc/rdpproxy/rdpproxy.crt:ro,Z
      - ${KASM_ROOT_PATH}/tmp/rdpgw/var:/usr/local/etc/rdpproxy/var:Z
      - ${KASM_ROOT_PATH}/tmp/rdpgw/tmp:/tmp:Z
      - ${KASM_ROOT_PATH}/healthcheck/rdp_gateway:/healthcheck:Z
    networks:
      - kasm_default_network
    labels:
      prune.protect: "true"

  kasm_rdp_https_gateway:
    image: kasmweb/rdp-https-gateway:${KASM_VERSION}
    container_name: kasm_rdp_https_gateway
    user: "${KASM_UID}:${KASM_GID}"
    read_only: true
    restart: unless-stopped
    depends_on:
      proxy:
        condition: service_started
    healthcheck:
      test: "/usr/bin/healthcheck.sh https://localhost:9443/rdp-https-gateway/__healthcheck \"\" 1 30"
      interval: 60s
      timeout: 30s
      start_period: 30s
    volumes:
      - ${KASM_ROOT_PATH}/log:/opt/kasm/current/log:Z
      - ${KASM_ROOT_PATH}/conf/app/rdp_https_gateway:/opt/rdpgw/conf:Z
      - ${KASM_ROOT_PATH}/certs/kasm_nginx.key:/opt/rdpgw/key.pem:ro,Z
      - ${KASM_ROOT_PATH}/certs/kasm_nginx.crt:/opt/rdpgw/server.pem:ro,Z
      - ${KASM_ROOT_PATH}/healthcheck/rdp_https_gateway:/healthcheck:Z
    networks:
      - kasm_default_network
    labels:
      prune.protect: "true"

  proxy:
    image: kasmweb/proxy:${KASM_VERSION}
    container_name: kasm_proxy
    restart: unless-stopped
    depends_on:
      kasm_manager:
        condition: service_healthy
      kasm_api:
        condition: service_healthy
      kasm_agent:
        condition: service_started
      kasm_guac:
        condition: service_started
    volumes:
      - ${KASM_ROOT_PATH}/conf/nginx:/etc/nginx/conf.d:ro,Z
      - ${KASM_ROOT_PATH}/certs/kasm_nginx.key:/etc/ssl/private/kasm_nginx.key:ro,Z
      - ${KASM_ROOT_PATH}/certs/kasm_nginx.crt:/etc/ssl/certs/kasm_nginx.crt:ro,Z
      - ${KASM_ROOT_PATH}/log/nginx:/var/log/external/nginx:Z
      - ${KASM_ROOT_PATH}/log/logrotate:/var/log/external/logrotate:Z
    networks:
      - kasm_default_network
      - kasm_sidecar_network
      - proxy
    labels:
      prune.protect: "true"
      traefik.enable: "true"
      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
      traefik.http.routers.kasm.rule: "Host(`${KASM_DOMAIN}`)"
      traefik.http.routers.kasm.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
      traefik.http.routers.kasm.tls: "true"
      traefik.http.routers.kasm.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
      traefik.http.routers.kasm.middlewares: "crowdsec-bouncer@file,${TRAEFIK_AUTH_MIDDLEWARE}"
      traefik.http.services.kasm.loadbalancer.server.port: "3000"
      traefik.http.services.kasm.loadbalancer.server.scheme: "https"
      traefik.http.services.kasm.loadbalancer.passhostheader: "true"
      homepage.group: "Infraestructura"
      homepage.name: "Kasm"
      homepage.icon: "https://www.kasmweb.com/favicon.ico"
      homepage.description: "Workspaces en navegador"
      homepage.href: "https://${KASM_DOMAIN}"
      homepage.siteMonitor: "https://kasm_proxy:3000/"
      homepage.weight: "350"

networks:
  kasm_default_network:
    name: kasm_default_network
    driver: bridge
  kasm_sidecar_network:
    name: kasm_sidecar_network
    driver: bridge
  proxy:
    external: true