# Copyright 2025-2026 Thomas Hintz

# This file is part of Nassella.

# Nassella is free software: you can redistribute it and/or modify it under the
# terms of the GNU Affero General Public License as published by the Free
# Software Foundation, either version 3 of the License, or (at your option) any
# later version.

# Nassella is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

# You should have received a copy of the GNU Affero General Public License
# along with Nassella. If not, see <https://www.gnu.org/licenses/>.

secrets:
  lldap_postgres_db:
    file: ./lldap/postgres_db
  lldap_postgres_password:
    file: ./lldap/postgres_password
  lldap_postgres_user:
    file: ./lldap/postgres_user
  lldap_admin_password:
    file: ./lldap/admin_password
  lldap_jwt_secret:
    file: ./lldap/jwt_secret

services:
  lldap_db:
    image: postgres:18-trixie
    environment:
      - POSTGRES_DB_FILE=/run/secrets/lldap_postgres_db
      - POSTGRES_USER_FILE=/run/secrets/lldap_postgres_user
      - POSTGRES_PASSWORD_FILE=/run/secrets/lldap_postgres_password
    shm_size: 128mb
    restart: always
    volumes:
      - /nassella/lldap/var-lib-postgresql:/var/lib/postgresql
    networks:
      - lldap_db_internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d `cat $$POSTGRES_DB_FILE` -U `cat $$POSTGRES_USER_FILE`"]
      start_period: 15s
      interval: 30s
      retries: 3
      timeout: 5s
    secrets:
      - lldap_postgres_db
      - lldap_postgres_password
      - lldap_postgres_user

  lldap:
    image: lldap/lldap:stable
    environment:
      - LLDAP_JWT_SECRET_FILE=/run/secrets/lldap_jwt_secret
      - LLDAP_LDAP_USER_PASS_FILE=/run/secrets/lldap_admin_password
    volumes:
      - ./lldap/lldap-config/:/data
    networks:
      - lb
      - lldap_internal
      - lldap_db_internal
    depends_on:
      lldap_db:
        condition: service_healthy
    secrets:
      - lldap_postgres_db
      - lldap_postgres_password
      - lldap_postgres_user
      - lldap_jwt_secret
      - lldap_admin_password

networks:
  lb:
  lldap_internal:
    driver: bridge
    internal: true
  lldap_db_internal:
    driver: bridge
    internal: true