demis.yml

#
#  Copyright (c) 2023 gematik GmbH
#  
#  Licensed under the EUPL, Version 1.2 or – as soon they will be approved by
#  the European Commission - subsequent versions of the EUPL (the Licence);
#  You may not use this work except in compliance with the Licence.
#  You may obtain a copy of the Licence at:
#  
#      https://joinup.ec.europa.eu/software/page/eupl
#  
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the Licence is distributed on an "AS IS" basis,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the Licence for the specific language governing permissions and
#  limitations under the Licence.
#  
#

###################################################
# General Service Definition
###################################################

version: "3.9"

###################################################
# Definition of common settings across services
###################################################

# Common Service Properties
x-service-setup: &service-setup-ref
  restart: always

# Common Volume Properties
x-volume-config: &volume-setup-ref
  volumes:
    - demis-config-volume:/app/config:rw

# Profile Snapshot Files
x-volume-profile-snapshots: &volume-profiles-ref
  volumes:
    - demis-profiles-volume:/app/data/profiles:ro

# Common Environment Configuration Properties
x-env-config: &environment-config-ref
  CONFIGURATION_PATH: /app/config

# Common Environment Timezone Entry
x-environment-timezone: &environment-timezone-ref
  TZ: Europe/Berlin

# Common Health Check Properties
x-healthcheck-config: &healthcheck-ref
  interval: 15s
  timeout: 10s
  retries: 20
  start_period: 30s

###################################################
# Definition of services
###################################################
services:

  # DEMIS Configuration Files - The image is terminated immediately, it serves as data container
  demis-config-data:
    image: gematik1/demis-configuration-test:1.9.1
    container_name: demis-config-data
    restart: "no"
    <<: *volume-setup-ref

  # DEMIS FHIR Profiles Data - The image is terminated immediately, it serves as data container
  demis-profile-data:
    image: gematik1/demis-fhir-profile-snapshots:2.2.0
    container_name: demis-profile-data
    restart: "no"
    <<: *volume-profiles-ref

  keycloak:
    image: gematik1/demis-keycloak:4.2.0-nginx
    <<: *volume-setup-ref
    ports:
      - "9081:8080"
      - "9082:8443"
    container_name: demis-keycloak
    environment:
      KC_DB_PASSWORD: F9A4nUr4bcyEtjFEdHjW
      KC_DB_URL: jdbc:postgresql://demis-postgres:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_HEALTH_ENABLED: true
      KC_HTTP_ENABLED: true
      KC_HOSTNAME_ADMIN_URL: https://localhost:7443/auth/
      KC_HOSTNAME_URL: https://localhost:7443/auth/
      KC_HOSTNAME_STRICT_BACKCHANNEL: true
      KC_HOSTNAME_STRICT_HTTPS: true
      KC_HOSTNAME_STRICT: true
      KC_HTTPS_CLIENT_AUTH: request
      KC_HTTPS_KEY_STORE_FILE: /app/config/keycloak/truststore/keystore.p12
      KC_HTTPS_KEY_STORE_PASSWORD: password
      KC_SPI_TRUSTSTORE_FILE_FILE: /app/config/keycloak/truststore/truststore.jks
      KC_SPI_TRUSTSTORE_FILE_PASSWORD: password
      KC_SPI_TRUSTSTORE_FILE_HOSTNAME_VERIFICATION_POLICY: ANY
      KC_SPI_X509CERT_LOOKUP_PROVIDER: nginx
      KC_SPI_X509CERT_LOOKUP_NGINX_SSL_CLIENT_CERT: ssl-client-cert
      TZ: Europe/Berlin
      KC_LANG: de_DE.UTF-8
      KC_LOCALE: de
      JAVA_OPTS_APPEND: '-Xms512m -Xmx1024m'
      KC_LOG: console
      KC_LOG_LEVEL: info,org.keycloak.services.x509:debug
      KC_LOG_CONSOLE_COLOR: true
      CERT_HOSTNAME: localhost
      KC_PROXY: edge
      IMPORT_DIR: /app/config/keycloak/initial-import
      IMPORT_ENABLED: "true"
    depends_on:
      demis-postgres:
        condition: service_healthy
    healthcheck:
      <<: *healthcheck-ref
      test: [ "CMD-SHELL", "/usr/bin/wget --no-verbose --tries=1 --spider http://localhost:8080/health" ]
    networks:
      demis-network:

  demis-postgres:
    image: gematik1/demis-postgres:2.0.0
    <<: *volume-setup-ref
    container_name: demis-postgres
    environment:
      - TZ=Europe/Berlin
      - POSTGRES_PASSWORD=demis
    depends_on:
      demis-config-data:
        condition: service_completed_successfully
    healthcheck:
      <<: *healthcheck-ref
      test: [ "CMD-SHELL", "pg_isready" ]
    restart: 'no'
    networks:
      demis-network:

  nginx:
    image: gematik1/demis-nginx:1.9.0
    <<: [*service-setup-ref ,*volume-setup-ref]
    ports:
      - "7443:443"
    container_name: demis-nginx
    environment:
      <<: *environment-timezone-ref
    healthcheck:
      <<: *healthcheck-ref
      test: [ "CMD-SHELL", "curl --fail http://localhost:80 || exit 1" ]
    depends_on:
      keycloak:
        condition: service_healthy
    networks:
      demis-fe-network:
      demis-network:
        aliases:
          - demis.ddtu.de

  storage-service:
    image: gematik1/demis-storage:1.8.6
    <<: *volume-setup-ref
    ports:
      - "9181:7771"
    container_name: demis-storage-service
    environment:
      <<: *environment-timezone-ref
    restart: 'no'
    depends_on:
      demis-config-data:
        condition: service_completed_successfully
    networks:
      demis-network:

  doublette-detection-services:
    image: gematik1/demis-doublette-detection:1.10.0
    <<: *volume-setup-ref
    ports:
      - "9182:7665"
    container_name: demis-doublette-detection-service
    environment:
      <<: *environment-timezone-ref
    depends_on:
      keycloak:
        condition: service_healthy
      demis-config-data:
        condition: service_completed_successfully
    networks:
      demis-network:

  pseudonymization-service:
    image: gematik1/demis-pseudonymization:1.8.7
    <<: *volume-setup-ref
    container_name: demis-pseudonymization-service
    environment:
      <<: *environment-timezone-ref
    depends_on:
      demis-config-data:
        condition: service_completed_successfully
    networks:
      demis-network:

  notification-clearing-api:
    image: gematik1/demis-notification-clearing-api:1.16.4
    <<: *volume-setup-ref
    ports:
      - "9070:8080"
    container_name: demis-notification-clearing-api
    environment:
      <<: *environment-timezone-ref
      HAPI_CORS_ALLOW_ORIGIN: "*"
      HAPI_NOTIFICATION_API_IP: "*"
      HAPI_SERVER_ADDRESS: "https://localhost:7443/notification-clearing-api/fhir/"
      # Deletion / Expunge Job
      HAPI_DELETION_SERVICER_ADDRESS_LOCALHOST: "http://demis-notification-clearing-api:8080/notification-clearing-api/fhir/"
      HAPI_DELETION_FREQUENCY_AS_CRON: "0 0 22 * * ? *"
      HAPI_EXPUNGE_FREQUENCY_AS_CRON: "0 15 * * * ? *"
      # Keycloak
      HAPI_OIDC_AUDIENCE: "notification-clearing-api"
      HAPI_OIDC_ISSUER: "https://localhost:7443/auth/realms/OEGD"
      HAPI_OIDC_KEYSOURCE: "http://demis-keycloak:8080/realms/OEGD/protocol/openid-connect/certs"
      HAPI_OIDC_USERINFOENDPOINT: "http://demis-keycloak:8080/realms/OEGD/protocol/openid-connect/userinfo"
      # Database
      HAPI_DATASOURCE_DRIVER: "org.postgresql.Driver"
      HAPI_HIBERNATE_DIALECT: "org.hibernate.dialect.PostgreSQL94Dialect"
      HAPI_DATASOURCE_URL: "jdbc:postgresql://demis-postgres:5432/notification"
      HAPI_DATASOURCE_USERNAME: "notification"
      HAPI_DATASOURCE_PASSWORD: "HEAbryTazZ6mcu2G5V2d"
      # Log Level
      HAPI_ROOT_LOG_LEVEL: "DEBUG"
    depends_on:
      demis-postgres:
        condition: service_healthy
      demis-config-data:
        condition: service_completed_successfully
    networks:
      demis-network:

  notification-entry-service:
    image: gematik1/demis-notification-entry-service:2.1.1
    ports:
      - "9080:8080"
    container_name: demis-notification-entry-service
    environment:
      <<: *environment-timezone-ref
      HAPI_SERVER_ADDRESS : "https://localhost:7443/notification-entry-service/fhir/"
      HAPI_CORS_ALLOW_ORIGIN: "*"
      # Certificates 
      HAPI_CERTIFICATES_PATH: /app/config/notification-entry-service/certs
      # Profiles Configuration
      HAPI_SCHEMAS_LOCATION_DV2: "/app/data/profiles/Fhir"
      HAPI_SCHEMAS_DISEASE_MAPPING: "/app/data/profiles/CodeMapping/ProfileResources/ConceptMap/NotificationDiseaseCategoryToSurvNetCode.xml"
      HAPI_SCHEMAS_LABORATORY_MAPPING: "/app/data/profiles/CodeMapping/ProfileResources/ConceptMap/NotificationCategoryToSurvNetCode.xml"
      # Keycloak
      HAPI_OIDC_ISSUER: "https://localhost:7443/auth/realms/LAB,https://localhost:7443/auth/realms/HOSPITAL"
      HAPI_OIDC_KEYSOURCE: "http://demis-keycloak:8080/realms/LAB/protocol/openid-connect/certs,http://demis-keycloak:8080/realms/HOSPITAL/protocol/openid-connect/certs"
      HAPI_OIDC_USERINFOENDPOINT: "http://demis-keycloak:8080/realms/LAB/protocol/openid-connect/userinfo"
      # Pseudonymization Service
      HAPI_KMS_ENDPOINT: "https://demis-pseudonymization-service:7663/v1/kms/keyinfo"
      HAPI_PS_ENDPOINT: "http://demis-pseudonymization-service:7663/demis/pseudonymization"
      HAPI_PS_APIKEY: 549407ec5dc6ed71149a5888c173c96003fff40a0acf864d7595faa3ffd8aa3b
      # Pseudonymization Storage Service
      HAPI_PSS_ENDPOINT: "http://demis-storage-service:7771/demis/storage"
      HAPI_PSS_APIKEY: 505f45bf1319fdd83463e6ce246f6e9c5cda34c6799ad2d838c94fe35e8b5abd
      # Notification Clearing Api
      HAPI_NCS_ENDPOINT: "http://demis-notification-clearing-api:8080/notification-clearing-api/fhir/"
      HAPI_NCS_APIKEY: aad3f9f00390689324a7f49c4e908fcf981dfa0563b857196e7ececf5f1eb0ea
      # PDFGen Service
      HAPI_PDF_GEN_SERVICE: "http://demis-pdfgen-service:8080"
      HAPI_APP_FLAG_USE_PDFGEN_SRV: "true"
    depends_on:
      pseudonymization-service:
        condition: service_started
      storage-service:
        condition: service_started
      demis-config-data:
        condition: service_completed_successfully
      demis-profile-data:
        condition: service_completed_successfully
    restart: 'no'
    networks:
      demis-network:
    volumes:
      - demis-config-volume:/app/config:rw
      - demis-profiles-volume:/app/data/profiles:ro

  validation-service:
    image: gematik1/demis-validation-service:2.0.3
    <<: *volume-profiles-ref
    ports:
      - "8092:8080"
    container_name: demis-validation-service
    environment:
      TZ: Europe/Berlin
      SERVER_PORT: 8080
      FHIR_PROFILES_PATH: /app/data/profiles/Fhir
    depends_on:
      demis-profile-data:
        condition: service_completed_successfully
    restart: 'no'
    healthcheck:
      <<: *healthcheck-ref
      test: [ "CMD-SHELL", "curl --fail http://localhost:8080/actuator/health || exit 1" ]
    networks:
      demis-network:

  hospital-location-service:
    image: gematik1/demis-hospital-location-service:1.0.15
    <<: *service-setup-ref
    ports:
      - "8091:8080"
    container_name: demis-hospital-location-service
    environment:
      TZ: Europe/Berlin
      SERVER_PORT: 8080
    restart: 'no'
    healthcheck:
      <<: *healthcheck-ref
      test: [ "CMD-SHELL", "curl --fail http://localhost:8080/actuator/health || exit 1" ]
    networks:
      demis-network:

  report-processing-service:
    image: gematik1/demis-report-processing-service:1.3.6
    ports:
      - "8090:8090"
    container_name: demis-report-processing-service
    environment:
      TZ: Europe/Berlin
      SERVER_PORT: 8090
      DEMIS_IDP_CLIENT_ID: notification-entry-service
      DEMIS_IDP_ALLOWED_ROLES: disease-notification-sender
      DEMIS_IDP_PUBLIC_KEY_LOCATION: http://demis-keycloak:8080/realms/HOSPITAL/protocol/openid-connect/certs
      DEMIS_NETWORK_VALIDATION_SERVICE_ADDRESS: http://demis-validation-service:8080
      DEMIS_NETWORK_NOTIFICATION_CLEARING_API_ADDRESS: http://demis-notification-clearing-api:8080/notification-clearing-api/fhir
      DEMIS_NETWORK_HOSPITAL_LOCATION_SERVICE_ADDRESS: http://demis-hospital-location-service:8080
      DEMIS_NETWORK_PDFGEN_SERVICE_ADDRESS: http://demis-pdfgen-service:8080
      HLS_VALIDATION_GATEWAY_VALUE: demis-gateway
      HLS_VALIDATION_GATEWAY_KEY: azp
      NCS_APIKEY: aad3f9f00390689324a7f49c4e908fcf981dfa0563b857196e7ececf5f1eb0ea
    restart: 'no'
    healthcheck:
      <<: *healthcheck-ref
      test: [ "CMD-SHELL", "curl --fail http://localhost:8090/actuator/health || exit 1" ]
    networks:
      demis-network:

  pdfgen-service:
    image: gematik1/demis-pdfgen-service:2.1.3
    ports:
      - "8093:8080"
    container_name: demis-pdfgen-service
    environment:
      TZ: Europe/Berlin
      SERVER_PORT: 8080
      DEMIS_NETWORK_FHIR_UI_DATA_MODEL_TRANSLATION_SERVICE_ADDRESS: http://demis-fhir-ui-data-model-translation-service:8080
    restart: 'no'
    healthcheck:
      <<: *healthcheck-ref
      test: [ "CMD-SHELL", "curl --fail http://localhost:8080/actuator/health || exit 1" ]
    networks:
      demis-network:

  fhir-ui-data-model-translation-service:
    image: gematik1/demis-fhir-ui-data-model-translation-service:1.1.3
    <<: *volume-profiles-ref
    ports:
      - "8094:8080"
    container_name: demis-fhir-ui-data-model-translation-service
    environment:
      TZ: Europe/Berlin
      SERVER_PORT: 8080
      DATA_PATH_PROFILE_ROOT: /app/data/profiles/Fhir
      DATA_PATH_LOINC_CSV: /app/data/profiles/Loinc.csv
    restart: 'no'
    networks:
      demis-network:
    depends_on:
      demis-profile-data:
        condition: service_completed_successfully


# Network definition
networks:
  demis-network:
    name: demis-network
  demis-fe-network:
    name : demis-fe-network

# Volume definition
volumes:
  demis-config-volume:
  demis-profiles-volume: