docker-compose.yml

---
# Only used for local development and testing.
# Port isolation: set KMS_TEST_SLOT=N to shift all host ports by N×1000.
# Source .mise/lib/test_slots.sh to compute KMS_SLOT_* variables automatically.
services:
  postgres:
    image: postgres:16
    ports:
      - ${KMS_SLOT_POSTGRES_PORT:-5432}:5432
    environment:
      - POSTGRES_USER=kms
      - POSTGRES_DB=kms
      - POSTGRES_PASSWORD=kms
      - PGDATA=/tmp/postgres2
  mysql:
    image: mysql:8.0
    ports:
      - ${KMS_SLOT_MYSQL_PORT:-3306}:3306
    environment:
      - MYSQL_USER=kms
      - MYSQL_PASSWORD=kms
      - MYSQL_DATABASE=kms
      - MYSQL_ROOT_PASSWORD=kms
  percona:
    image: percona/percona-xtradb-cluster:8.0
    ports:
      - ${KMS_SLOT_PERCONA_PORT:-3307}:3306
    environment:
      - MYSQL_ROOT_PASSWORD=kms
      - MYSQL_DATABASE=kms
      - MYSQL_USER=kms
      - MYSQL_PASSWORD=kms
      - CLUSTER_NAME=test-cluster
      - PXC_STRICT_MODE=ENFORCING
  mariadb:
    image: mariadb:11.4
    ports:
      - ${KMS_SLOT_MARIADB_PORT:-3308}:3306
    environment:
      - MYSQL_ROOT_PASSWORD=kms
      - MYSQL_DATABASE=kms
      - MYSQL_USER=kms
      - MYSQL_PASSWORD=kms
  postgres-mtls:
    image: postgres:16
    ports:
      - ${KMS_SLOT_POSTGRES_MTLS_PORT:-5433}:5432
    environment:
      - POSTGRES_USER=kms
      - POSTGRES_DB=kms
      - POSTGRES_PASSWORD=kms
      - PGDATA=/var/lib/postgresql/data
    volumes:
      - ./test_data/certificates/client_server/db/postgres-server.crt:/var/lib/postgresql/certs-ro/server.crt:ro
      - ./test_data/certificates/client_server/db/postgres-server.key:/var/lib/postgresql/certs-ro/server.key:ro
      - ./test_data/certificates/client_server/ca/ca.crt:/var/lib/postgresql/certs-ro/ca.crt:ro
    entrypoint:
      - bash
      - -lc
      - |
        set -euo pipefail
        BIN_DIR=$$(ls -1d /usr/lib/postgresql/*/bin 2>/dev/null | head -n1)
        if [ -n "$$BIN_DIR" ]; then
          export PATH="$$BIN_DIR:$$PATH"
        fi
        # Copy TLS materials from read-only mounts to a writable location
        cp /var/lib/postgresql/certs-ro/server.crt /var/lib/postgresql/server.crt
        cp /var/lib/postgresql/certs-ro/server.key /var/lib/postgresql/server.key
        cp /var/lib/postgresql/certs-ro/ca.crt /var/lib/postgresql/ca.crt
        chown postgres:postgres /var/lib/postgresql/server.key /var/lib/postgresql/server.crt /var/lib/postgresql/ca.crt || true
        chmod 600 /var/lib/postgresql/server.key || true
        exec docker-entrypoint.sh postgres \
          -c ssl=on \
          -c ssl_cert_file=/var/lib/postgresql/server.crt \
          -c ssl_key_file=/var/lib/postgresql/server.key \
          -c ssl_ca_file=/var/lib/postgresql/ca.crt \
          -c ssl_min_protocol_version=TLSv1.2 \
          -c listen_addresses='*'
  mysql-mtls:
    image: mysql:8.0
    ports:
      - ${KMS_SLOT_MYSQL_MTLS_PORT:-3309}:3306
    environment:
      - MYSQL_USER=kms
      - MYSQL_PASSWORD=kms
      - MYSQL_DATABASE=kms
      - MYSQL_ROOT_PASSWORD=kms
    volumes:
      - ./test_data/certificates/client_server/db/mysql-server.crt:/etc/mysql/certs/server-cert.pem:ro
      - ./test_data/certificates/client_server/db/mysql-server.key:/etc/mysql/certs/server-key.pem:ro
      - ./test_data/certificates/client_server/ca/ca.crt:/etc/mysql/certs/ca.pem:ro
    command: >
      --require-secure-transport=ON
      --ssl-cert=/etc/mysql/certs/server-cert.pem
      --ssl-key=/etc/mysql/certs/server-key.pem
      --ssl-ca=/etc/mysql/certs/ca.pem
  redis:
    image: redis:7.2
    ports:
      - ${KMS_SLOT_REDIS_PORT:-6379}:6379

  jaeger:
    image: jaegertracing/all-in-one:1.55
    ports:
      - ${KMS_SLOT_JAEGER_PORT:-16686}:16686
    environment:
      - COLLECTOR_OTLP_ENABLED=true

  # Minimal OTEL stack for integration tests:
  # KMS -> otel-collector -> scrape collector Prometheus endpoint

  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.144.0
    command: [--config=/etc/otel-collector-config.yaml]
    volumes:
      - ./monitoring/ci-otel-collector-config.yaml:/etc/otel-collector-config.yaml:ro
    environment:
      # Kept for local setups that also export somewhere else; not used by test assertions.
      - OTLP_ENDPOINT=jaeger:4317
      - ENVIRONMENT=test
      - KMS_VERSION=dev
    ports:
      - ${KMS_SLOT_OTEL_GRPC_PORT:-4317}:4317   # OTLP gRPC receiver (host)
      - ${KMS_SLOT_OTEL_HTTP_PORT:-4318}:4318   # OTLP HTTP receiver (host)
      - ${KMS_SLOT_OTEL_METRICS_PORT:-8889}:8889   # Prometheus metrics endpoint (host)

  # ── EDB Postgres Advanced Server 17 with Transparent Data Encryption ──────
  #
  # Requires:
  #   - EDB subscription token (free): https://www.enterprisedb.com/accounts/register
  #   - Login before use:
  #       echo "$EDB_SUBSCRIPTION_TOKEN" | docker login --username k8s --password-stdin docker.enterprisedb.com
  #   - Cosmian KMS running with KMIP port 15696
  #   - EDB_MASTER_KEY_UID exported (UID of an Active AES-256 key in the KMS)
  #
  # Used automatically by:  mise run test:edb-tde --variant non-fips
  # (when EDB_SUBSCRIPTION_TOKEN is set; the test script handles login and lifecycle)
  edb-tde:
    profiles:
      - edb-tde
    # Build locally to install PyKMIP (not shipped in the base image).
    build:
      context: .mise/scripts/edb_tde
      dockerfile: Dockerfile.edb
    # Base image is x86_64-only.
    platform: linux/amd64
    ports:
      - ${KMS_SLOT_EDB_PORT:-5444}:5444
    environment:
      PGPASSWORD: ${EDB_PGPASSWORD:-kms_test}

      # Called by initdb --data-encryption to seal the cluster DEK.
      # Wire format: [16-byte IV][ciphertext]  (AES-256-CBC + PKCS5)
      PGDATAKEYWRAPCMD: >-
        python3 /usr/edb/kmip/client/edb_tde_kmip_client.py encrypt
        --pykmip-config-file=/kmip-certs/pykmip.conf
        --key-uid=${EDB_MASTER_KEY_UID:-}
        --variant=pykmip
        --out-file=%p

      # Called by pg_ctl start to unseal the DEK on every restart.
      PGDATAKEYUNWRAPCMD: >-
        python3 /usr/edb/kmip/client/edb_tde_kmip_client.py decrypt
        --pykmip-config-file=/kmip-certs/pykmip.conf
        --key-uid=${EDB_MASTER_KEY_UID:-}
        --variant=pykmip
        --in-file=%p

    # Startup script: runs initdb with TDE (calls the real edb_tde_kmip_client.py
    # to wrap the cluster DEK) then starts postgres in the foreground.
    command: [/bin/bash, /startup/edb_startup.sh]

    volumes:
      - ./test_data/certificates/client_server/ca/ca.crt:/kmip-certs/ca.crt:ro
      - ./test_data/certificates/client_server/owner/owner.client.acme.com.crt:/kmip-certs/client.crt:ro
      - ./test_data/certificates/client_server/owner/owner.client.acme.com.key:/kmip-certs/client.key:ro
      - ./.mise/scripts/edb_tde/pykmip_docker.conf:/kmip-certs/pykmip.conf:ro
      - ./.mise/scripts/edb_tde/edb_startup.sh:/startup/edb_startup.sh:ro

    extra_hosts:
      # Resolves to the Docker host (host.docker.internal is natively available
      # on macOS/Windows Docker Desktop; on Linux Docker the special value
      # "host-gateway" maps to the host IP).
      - host.docker.internal:host-gateway

  # InterSystems IRIS — mTLS integration test
  # Started on demand with: docker compose up -d iris
  # The profile keeps it out of the default `docker compose up -d` that runs
  iris:
    image: ${IRIS_DOCKER_IMAGE:-intersystemsdc/iris-community:latest}
    container_name: ${IRIS_CONTAINER_NAME:-iris-kmip-test}
    # The Community image is amd64-only; Rosetta handles this on Apple Silicon.
    platform: linux/amd64
    pull_policy: always
    profiles:
      - iris
    ports:
      - ${KMS_SLOT_IRIS_WEB_PORT:-52773}:52773     # IRIS Management Portal
      - ${KMS_SLOT_IRIS_SUPER_PORT:-1972}:1972      # IRIS SuperServer
    volumes:
      - ./test_data/certificates/client_server/ca/ca.crt:/iris-kmip-certs/ca.crt:ro
      - ./test_data/certificates/client_server/owner/owner.client.acme.com.crt:/iris-kmip-certs/client.crt:ro
      - ./test_data/certificates/client_server/owner/owner.client.acme.com.key:/iris-kmip-certs/client.key:ro
    environment:
      # Inject an ISC license key when provided (optional; Community image has a built-in key).
      - ISC_PACKAGE_LICENSEKEY=${IRIS_LICENSE_KEY:-}
    extra_hosts:
      # Allow IRIS to reach the KMS running on the Docker host.
      # The KMS server certificate CN is kmserver.acme.com, so IRIS TLS
      # hostname verification requires this alias to resolve to the host.
      - host.docker.internal:host-gateway
      - kmserver.acme.com:host-gateway