services:
    laravel.test:
        build:
            context: './vendor/laravel/sail/runtimes/8.5'
            dockerfile: Dockerfile
            args:
                WWWGROUP: '${WWWGROUP}'
        image: 'sail-8.5/app'
        extra_hosts:
            - 'host.docker.internal:host-gateway'
        ports:
            - '${APP_PORT:-80}:80'
            - '${VITE_PORT:-5173}:${VITE_PORT:-5173}'
        environment:
            WWWUSER: '${WWWUSER}'
            LARAVEL_SAIL: 1
            XDEBUG_MODE: '${SAIL_XDEBUG_MODE:-off}'
            XDEBUG_CONFIG: '${SAIL_XDEBUG_CONFIG:-client_host=host.docker.internal}'
            IGNITION_LOCAL_SITES_PATH: '${PWD}'
        volumes:
            - '.:/var/www/html'
        networks:
            - sail
        depends_on:
            - mysql
            - redis
    # Runs the schedule in routes/console.php — uptime:check every five minutes
    # and uptime:prune nightly. Without this the schedule is defined but never
    # invoked, so outage alerts can never fire. Shares the app image and code so
    # there is nothing extra to build.
    scheduler:
        image: 'sail-8.5/app'
        command: 'php artisan schedule:work'
        environment:
            WWWUSER: '${WWWUSER}'
            LARAVEL_SAIL: 1
        volumes:
            - '.:/var/www/html'
        networks:
            - sail
        restart: unless-stopped
        depends_on:
            - laravel.test
            - mysql
            - redis
    mysql:
        image: 'mysql:8.4'
        ports:
            - '${FORWARD_DB_PORT:-3306}:3306'
        environment:
            MYSQL_ROOT_PASSWORD: '${DB_PASSWORD}'
            MYSQL_ROOT_HOST: '%'
            MYSQL_DATABASE: '${DB_DATABASE}'
            MYSQL_USER: '${DB_USERNAME}'
            MYSQL_PASSWORD: '${DB_PASSWORD}'
            MYSQL_ALLOW_EMPTY_PASSWORD: 1
            MYSQL_EXTRA_OPTIONS: '${MYSQL_EXTRA_OPTIONS:-}'
        volumes:
            - 'sail-mysql:/var/lib/mysql'
            - './vendor/laravel/sail/database/mysql/create-testing-database.sh:/docker-entrypoint-initdb.d/10-create-testing-database.sh'
        networks:
            - sail
        healthcheck:
            test:
                - CMD
                - mysqladmin
                - ping
                - '-p${DB_PASSWORD}'
            retries: 3
            timeout: 5s
    redis:
        image: 'redis:alpine'
        ports:
            - '${FORWARD_REDIS_PORT:-6379}:6379'
        volumes:
            - 'sail-redis:/data'
        networks:
            - sail
        healthcheck:
            test:
                - CMD
                - redis-cli
                - ping
            retries: 3
            timeout: 5s
    phpmyadmin:
        image: 'phpmyadmin:5'
        # Bound to loopback only — this container auto-logs in as the database
        # user, so it must not be reachable from the local network.
        ports:
            - '127.0.0.1:${FORWARD_PHPMYADMIN_PORT:-8090}:80'
        environment:
            PMA_HOST: mysql
            PMA_PORT: 3306
            PMA_USER: '${DB_USERNAME}'
            PMA_PASSWORD: '${DB_PASSWORD}'
            UPLOAD_LIMIT: 256M
        networks:
            - sail
        depends_on:
            mysql:
                condition: service_healthy
    # Local mail catcher: the app talks real SMTP to it, but nothing leaves the
    # machine. Read the caught mail at http://localhost:8091.
    #
    # The image listens on 2525 for SMTP and 8080 for its web UI — not the 25/80
    # you might expect.
    papercut:
        image: 'changemakerstudiosus/papercut-smtp:latest'
        # Loopback only — an open relay on the LAN would be a bad surprise.
        ports:
            - '127.0.0.1:${FORWARD_PAPERCUT_PORT:-8091}:8080'
        networks:
            - sail
    # Headless Chromium for photographing an audited page. Its own container so
    # the app image stays free of a browser and its libraries.
    #
    # Deliberately not published to the host: anything that can reach port 9222
    # can drive this browser and make it fetch arbitrary URLs, so only the app
    # on the sail network may talk to it.
    chromium:
        image: 'zenika/alpine-chrome:latest'
        command:
            - '--headless'
            - '--no-sandbox'
            - '--disable-gpu'
            - '--disable-dev-shm-usage'
            - '--hide-scrollbars'
            - '--remote-debugging-address=0.0.0.0'
            - '--remote-debugging-port=9222'
            # Chrome 111+ refuses DevTools websockets from a non-null origin
            # without this. Safe here only because the port is unpublished.
            - '--remote-allow-origins=*'
        networks:
            - sail
networks:
    sail:
        driver: bridge
volumes:
    sail-mysql:
        driver: local
    sail-redis:
        driver: local
