compose.yaml

# Copyright (c) Humanitarian OpenStreetMap Team
# This file is part of Field-TM.
#
#     Field-TM is free software: you can redistribute it and/or modify
#     it under the terms of the GNU General Public License as published by
#     the Free Software Foundation, either version 3 of the License, or
#     (at your option) any later version.
#
#     Field-TM is distributed in the hope that it will be useful,
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#     GNU General Public License for more details.
#
#     You should have received a copy of the GNU General Public License
#     along with Field-TM.  If not, see <https:#www.gnu.org/licenses/>.
#

name: field-tm

volumes:
  ftm_db_data:
  ftm_logs:
  central_db_data:
  central_frontend:
  qfield_db_data:
  qfield_static:
  qfield_transformation_grids:
  garage_data:

networks:
  ftm-net:
    name: field-tm-local
    ipam:
      driver: default
      config:
        - subnet: 10.20.30.0/24

x-qfield-common-env: &qfield-common-env
  DJANGO_SETTINGS_MODULE: qfieldcloud.settings
  DEBUG: 1
  ENVIRONMENT: development
  QFIELDCLOUD_HOST: qfield.field.localhost
  DJANGO_ALLOWED_HOSTS: "qfield.field.localhost localhost 127.0.0.1 0.0.0.0 qfield-app proxy"
  DJANGO_SUPERUSER_USERNAME: admin
  DJANGO_SUPERUSER_EMAIL: sysadmin@hotosm.org
  DJANGO_SUPERUSER_PASSWORD: ${QFIELDCLOUD_ADMIN_PASSWORD}
  SECRET_KEY: YKuuTCb256dMmcg4DxpxrCafrcVvk8s3ZJrtDr9JaVAkeLiULGiemyzUTQESrzPQhiYUfn
  SALT_KEY: 0123456789abcdefghijklmnopqrstuvwxyz
  ACCOUNT_EMAIL_VERIFICATION: none
  QFIELDCLOUD_PASSWORD_LOGIN_IS_ENABLED: 1
  QFIELDCLOUD_ADMIN_URI: admin/
  CORS_ALLOWED_ORIGINS: "http://qfield.field.localhost,http://qfield.field.localhost:7050"
  CORS_ALLOW_CREDENTIALS: 1
  # TODO fix injecting S3 vars into STORAGES
  # STORAGE_ACCESS_KEY_ID: ${S3_ACCESS_KEY:-GK3515373e4c851ebaad366558}
  # STORAGE_SECRET_ACCESS_KEY: ${S3_SECRET_KEY:-7d37d093435a41f2aab8f13c19ba067d9776c90215f56614adad6ece597dbb34}
  # STORAGE_BUCKET_NAME: ${S3_QFIELD_BUCKET_NAME:-"qfield-cloud"}
  # STORAGE_ENDPOINT_URL: http://s3:3900
  STORAGES: '{
    "default": {
    "BACKEND": "qfieldcloud.filestorage.backend.QfcS3Boto3Storage",
    "OPTIONS": {
    "access_key": "GK3515373e4c851ebaad366558",
    "secret_key": "7d37d093435a41f2aab8f13c19ba067d9776c90215f56614adad6ece597dbb34",
    "bucket_name": "qfield-cloud",
    "region_name": "garage",
    "endpoint_url": "http://s3:3900"
    },
    "QFC_IS_LEGACY": false
    }
    }'
  POSTGRES_USER: ${FTM_DB_USER:-fieldtm}
  POSTGRES_PASSWORD: ${FTM_DB_PASSWORD:-fieldtm}
  POSTGRES_DB: ${FTM_DB_NAME:-fieldtm}
  POSTGRES_HOST: qfield-db
  POSTGRES_PORT: 5432
  POSTGRES_SSLMODE: prefer
  EMAIL_HOST: mail
  EMAIL_USE_TLS: "False"
  EMAIL_USE_SSL: "False"
  EMAIL_PORT: 1025
  EMAIL_HOST_USER: ""
  EMAIL_HOST_PASSWORD: ""
  DEFAULT_FROM_EMAIL: noreply@field.localhost
  QFIELDCLOUD_QGIS_IMAGE_NAME: ghcr.io/opengisch/qfieldcloud-qgis:${QFIELDCLOUD_TAG:-26.3}
  # NOTE this must have a trailing slash
  QFIELDCLOUD_WORKER_QFIELDCLOUD_URL: ${QFIELDCLOUD_URL}
  QFIELDCLOUD_AUTH_TOKEN_EXPIRATION_HOURS: 720
  SENTRY_RELEASE: dev
  QFIELDCLOUD_USE_I18N: 0
  QFIELDCLOUD_DEFAULT_LANGUAGE: "en"
  QFIELDCLOUD_DEFAULT_TIME_ZONE: "Europe/London"
  QFIELDCLOUD_DEFAULT_NETWORK: field-tm-local
  QFIELDCLOUD_TRANSFORMATION_GRIDS_VOLUME_NAME: ${COMPOSE_PROJECT_NAME}_qfield_transformation_grids
  QFIELDCLOUD_SUBSCRIPTION_MODEL: subscription.Subscription
  QFIELDCLOUD_ACCOUNT_ADAPTER: qfieldcloud.core.adapters.AccountAdapterSignUpOpen
  # Required for spawned QGIS job containers
  TMP_DIRECTORY: /tmp

x-qfield-common: &qfield-common
  # This override contains the user creation API from PR:
  # https://github.com/opengisch/QFieldCloud/pull/1506
  # Once merged, we can use the official image
  image: "ghcr.io/hotosm/field-tm/qfieldcloud-app:${QFIELDCLOUD_TAG:-26.3}"
  volumes:
    - qfield_static:/usr/src/app/staticfiles
  networks:
    - ftm-net
  restart: "unless-stopped"
  environment: *qfield-common-env
  healthcheck:
    test: ["CMD", "curl", "-f", "http://localhost:8000/api/v1/status"]
    start_period: 30s
    interval: 10s
    timeout: 5s
    retries: 10

services:
  proxy:
    image: "bunkerity/bunkerweb-all-in-one:1.6.8"
    depends_on:
      central-ui:
        condition: service_completed_successfully
        required: false
    volumes:
      - central_frontend:/var/www/html/odk.field.localhost:ro
      - qfield_static:/var/www/html/qfield.field.localhost/staticfiles:ro
    ports:
      - ${FTM_DEV_PORT:-7050}:8080
    environment:
      # General
      BUNKERWEB_INSTANCES: proxy
      LOG_LEVEL: notice
      USE_UI: no
      USE_BUNKERNET: no
      DISABLE_DEFAULT_SERVER: yes
      USE_REDIS: no
      API_WHITELIST_IP: 127.0.0.0/8 10.20.30.0/24
      # Avoid running ModSec rules on internal service calls
      WHITELIST_IP: 10.20.30.0/24
      WHITELIST_URI: http://field.localhost:7050
      MULTISITE: yes
      USE_REVERSE_PROXY: yes
      ALLOWED_METHODS: OPTIONS|HEAD|GET|POST|PATCH|PUT|DELETE
      USE_REAL_IP: yes
      SERVE_FILES: yes
      USE_BACKUP: no
      USE_METRICS: no
      # USE_ANTIBOT: yes
      USE_LIMIT_CONN: no
      USE_BAD_BEHAVIOR: no
      USE_LIMIT_REQ: no
      USE_MODSECURITY: no
      USE_GZIP: yes
      # On client, brotli is preferred over gzip if both are enabled
      USE_BROTLI: yes
      # Reverse proxy configs
      SERVER_NAME: field.localhost odk.field.localhost qfield.field.localhost mail.field.localhost
      field.localhost_REVERSE_PROXY_HOST: http://backend:8000
      field.localhost_MAX_CLIENT_SIZE: 1G
      field.localhost_REVERSE_PROXY_INTERCEPT_ERRORS: "no"
      # Increase timeout slightly for long project creation requests
      field.localhost_REVERSE_PROXY_READ_TIMEOUT: 90s
      # Prevent bunkerweb page handling login errors (handle via Vue router)
      odk.field.localhost_REVERSE_PROXY_INTERCEPT_ERRORS: "no"
      odk.field.localhost_ERRORS: "404=/index.html"
      # Disable BunkerWeb's default location / block so we can provide our own below.
      # The default uses try_files ... =404 which doesn't support SPA routing.
      odk.field.localhost_SERVE_FILES: "no"
      # SPA fallback: serve index.html for any path that doesn't match a static file,
      # so the Vue router can handle client-side routes (e.g. /login?next=/).
      # NOTE: we need double $$ to avoid compose env var substitution
      odk.field.localhost_CUSTOM_CONF_SERVER_HTTP_spa_routing: |
        location / {
          root /var/www/html/odk.field.localhost;
          try_files $$uri $$uri/ /index.html;
        }
      # ODK API routing to central backend.
      odk.field.localhost_CUSTOM_CONF_SERVER_HTTP_api_routing: |
        location ^~ /v1/ {
          proxy_set_header Host $$http_host;
          proxy_set_header X-Forwarded-Host $$http_host;
          # Trick server into thinking it's https - required...
          proxy_set_header X-Forwarded-Proto https;
          proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
          proxy_pass http://central:8383;
          proxy_redirect off;

          # Buffer requests, but not responses, so streaming out works.
          proxy_request_buffering on;
          proxy_buffering off;
          proxy_read_timeout 2m;
        }
      qfield.field.localhost_REVERSE_PROXY_HOST: http://qfield-app:8000
      # Required to allow loading staticfiles (else route to reverse proxy)
      qfield.field.localhost_REVERSE_PROXY_URL: ~ ^/(?!staticfiles)
      # Sometimes we have large base imagery mbtile layers...
      qfield.field.localhost_MAX_CLIENT_SIZE: 2G
      # Override X-Forwarded-Proto during local dev to allow auth over http
      # https://docs.djangoproject.com/en/4.2/ref/settings/#secure-proxy-ssl-header
      # NOTE we also override the origin to remove the port & prefer CSRF issues
      qfield.field.localhost_REVERSE_PROXY_HEADERS: "X-Forwarded-Proto http; Origin http://qfield.field.localhost"
      mail.field.localhost_REVERSE_PROXY_HOST: http://mail:8025
    networks:
      ftm-net:
        ipv4_address: 10.20.30.50
    restart: "unless-stopped"

  backend:
    image: "ghcr.io/hotosm/field-tm:${TAG_OVERRIDE:-debug}"
    build:
      context: src
      target: "${TARGET_OVERRIDE:-debug}"
      args:
        APP_VERSION: "${TAG_OVERRIDE:-debug}"
    # Uncomment these to debug with a terminal debugger like pdb
    # Then `docker attach field_tm_backend` to debug
    # stdin_open: true
    # tty: true
    volumes:
      - ftm_logs:/opt/logs
      - ./src/backend/pyproject.toml:/opt/pyproject.toml:ro
      - ./src/backend/app:/opt/app:ro
      - ./src/backend/tests:/opt/tests:ro
      # Workspace packages config
      - ./src/backend/packages/osm-fieldwork/osm_fieldwork:/opt/python/lib/python3.13/site-packages/osm_fieldwork:ro
      - ./src/backend/packages/osm-fieldwork/tests:/opt/package_tests/test_osm_fieldwork:ro
      - ./src/backend/packages/area-splitter/area_splitter:/opt/python/lib/python3.13/site-packages/area_splitter:ro
      - ./src/backend/packages/area-splitter/tests:/opt/package_tests/test_area_splitter:ro
    environment:
      DEBUG: ${DEBUG:-True}
      AUTH_PROVIDER: ${AUTH_PROVIDER:-bundled}
      ODK_CENTRAL_PUBLIC_URL: http://${FTM_ODK_DOMAIN:-odk.field.localhost}:${FTM_DEV_PORT:-7050}
    depends_on:
      fieldtm-db:
        condition: service_healthy
      migrations:
        condition: service_completed_successfully
      central:
        condition: service_healthy
        required: false
      qfield-init:
        condition: service_completed_successfully
      qfield-qgis:
        condition: service_healthy
    env_file:
      - .env
    ports:
      - "7052-7055:8000"
      - "5678-5679:5678"
    networks:
      - ftm-net
    restart: "unless-stopped"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/__lbheartbeat__"]
      start_period: 30s
      interval: 10s
      timeout: 5s
      retries: 10
    deploy:
      replicas: ${API_REPLICAS:-1}
      resources:
        limits:
          cpus: "0.9"
          memory: 1500M
        reservations:
          cpus: "0.1"
          memory: 100M

  central:
    profiles: ["", "central"]
    image: "ghcr.io/hotosm/field-tm/odkcentral:v2025.4.4"
    build:
      context: src/odkcentral/api
      args:
        ODK_CENTRAL_TAG: v2025.4.4
    depends_on:
      central-db:
        condition: service_healthy
      pyxform:
        condition: service_started
    environment:
      - DOMAIN=${FTM_CENTRAL_DOMAIN:-odk.field.localhost:7050}
      - SSL_TYPE=upstream
      - SYSADMIN_EMAIL=${ODK_CENTRAL_USER}
      - SYSADMIN_PASSWD=${ODK_CENTRAL_PASSWD}
      - HTTPS_PORT=${HTTPS_PORT:-443}
      - DB_HOST=${CENTRAL_DB_HOST:-central-db}
      - DB_USER=${CENTRAL_DB_USER:-odk}
      - DB_PASSWORD=${CENTRAL_DB_PASSWORD:-odk}
      - DB_NAME=${CENTRAL_DB_NAME:-odk}
      - DB_SSL=${DB_SSL:-null}
      - DB_POOL_SIZE=${DB_POOL_SIZE:-10}
      - EMAIL_FROM=${ODK_CENTRAL_USER}
      - EMAIL_HOST=${EMAIL_HOST:-mail}
      - EMAIL_PORT=${EMAIL_PORT:-1025}
      - EMAIL_SECURE=${EMAIL_SECURE:-false}
      - EMAIL_IGNORE_TLS=${EMAIL_IGNORE_TLS:-true}
      - EMAIL_USER=${EMAIL_USER:-''}
      - EMAIL_PASSWORD=${EMAIL_PASSWORD:-''}
      - OIDC_ENABLED=${OIDC_ENABLED:-false}
      - OIDC_ISSUER_URL=${OIDC_ISSUER_URL:-https://getodk.org}
      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-xxx}
      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-xxx}
      - PGAPPNAME=${PGAPPNAME:-odkcentral}
      - SENTRY_ORG_SUBDOMAIN=${SENTRY_ORG_SUBDOMAIN:-o130137}
      - SENTRY_KEY=${SENTRY_KEY:-3cf75f54983e473da6bd07daddf0d2ee}
      - SENTRY_PROJECT=${SENTRY_PROJECT:-1298632}
      - SENTRY_TRACE_RATE=${SENTRY_TRACE_RATE:-0.1}
      - S3_SERVER=http://dummyvalue.com
      - S3_BUCKET_NAME=dummyvalue
      - S3_ACCESS_KEY=dummyvalue
      - S3_SECRET_KEY=dummyvalue
      - SESSION_LIFETIME=${SESSION_LIFETIME:-86400}
    # ports:
    #   - "8383:8383"
    networks:
      - ftm-net
    restart: "unless-stopped"
    healthcheck:
      test: nc -z localhost 8383 || exit 1
      start_period: 15s
      interval: 10s
      timeout: 5s
      retries: 10

  pyxform:
    image: "ghcr.io/getodk/pyxform-http:v4.2.0"
    networks:
      - ftm-net
    restart: "unless-stopped"

  # Local mail catcher for development: captures emails sent by ODK Central
  # (e.g. welcome emails on user creation) without actually delivering them.
  # Web UI available via proxy at http://mail.field.localhost:${FTM_DEV_PORT:-7050}
  # to view captured emails.
  # In production, set EMAIL_HOST / EMAIL_PORT to a real SMTP server instead.
  # NOTE: this is required, else Central gives 500 response on user creation
  mail:
    image: "axllent/mailpit:v1.29.2"
    networks:
      - ftm-net
    restart: "unless-stopped"

  central-ui:
    # This service simply builds the frontend to a volume
    # accessible to the proxy, then shuts down
    profiles: ["", "central"]
    image: "ghcr.io/hotosm/field-tm/odkcentral-ui:v2025.4.4"
    build:
      context: src/odkcentral/ui
      args:
        ODK_CENTRAL_TAG: v2025.4.4
    volumes:
      - central_frontend:/frontend
    network_mode: none
    restart: "on-failure:2"

  migrations:
    image: "ghcr.io/hotosm/field-tm:${TAG_OVERRIDE:-debug}"
    depends_on:
      fieldtm-db:
        condition: service_healthy
    env_file:
      - .env
    networks:
      - ftm-net
    entrypoint: ["/migrate-entrypoint.sh"]
    restart: "on-failure:2"
    healthcheck:
      test: ["NONE"] # Set the health check test to NONE to disable it

  fieldtm-db:
    # Temp workaround until https://github.com/postgis/docker-postgis/issues/216
    image: "ghcr.io/hotosm/postgis:18-3.6-alpine"
    volumes:
      - ftm_db_data:/var/lib/postgresql/
    environment:
      - POSTGRES_USER=${FTM_DB_USER:-fieldtm}
      - POSTGRES_PASSWORD=${FTM_DB_PASSWORD:-fieldtm}
      - POSTGRES_DB=${FTM_DB_NAME:-fieldtm}
    ports:
      - "5438:5432"
    networks:
      - ftm-net
    restart: "unless-stopped"
    # We don't need to optimise connections like the prod deploy here.
    # Conversely, we increase connections for test runners.
    command: -c 'max_connections=300'
    healthcheck:
      test: pg_isready -U ${FTM_DB_USER:-fieldtm} -d ${FTM_DB_NAME:-fieldtm}
      start_period: 5s
      interval: 10s
      timeout: 5s
      retries: 3

  central-db:
    profiles: ["", "central"]
    image: "ghcr.io/hotosm/postgis:14-3.5-alpine"
    volumes:
      - central_db_data:/var/lib/postgresql/data/
    environment:
      - POSTGRES_USER=${CENTRAL_DB_USER:-odk}
      - POSTGRES_PASSWORD=${CENTRAL_DB_PASSWORD:-odk}
      - POSTGRES_DB=${CENTRAL_DB_NAME:-odk}
    ports:
      - "5434:5432"
    networks:
      - ftm-net
    restart: "unless-stopped"
    # Optimise to a low number of connections, see fieldtm-db service
    command: -c 'max_connections=64'
    healthcheck:
      test: pg_isready -U ${CENTRAL_DB_USER:-odk} -d ${CENTRAL_DB_NAME:-odk}
      start_period: 5s
      interval: 10s
      timeout: 5s
      retries: 3

  qfield-db:
    # Temp workaround until https://github.com/postgis/docker-postgis/issues/216
    image: "ghcr.io/hotosm/postgis:18-3.6-alpine"
    volumes:
      - qfield_db_data:/var/lib/postgresql/
    environment:
      - POSTGRES_USER=${FTM_DB_USER:-fieldtm}
      - POSTGRES_PASSWORD=${FTM_DB_PASSWORD:-fieldtm}
      - POSTGRES_DB=${FTM_DB_NAME:-fieldtm}
    ports:
      - "5435:5432"
    networks:
      - ftm-net
    restart: "unless-stopped"
    # Optimise to a low number of connections, see fieldtm-db service
    command: -c 'max_connections=64'
    healthcheck:
      test: pg_isready -U ${FTM_DB_USER:-fieldtm} -d ${FTM_DB_NAME:-fieldtm}
      start_period: 5s
      interval: 10s
      timeout: 5s
      retries: 3

  # Note we can't use compose 'extends' here due to double port definition / conflict
  qfield-app:
    <<: *qfield-common
    depends_on:
      qfield-db:
        condition: service_healthy
      s3-init:
        condition: service_completed_successfully
    ports:
      # In QField on desktop, double click Nyuki and enter http://localhost:8442
      - 8442:8000
    command:
      - sh
      - -c
      - |
        python manage.py migrate &&
        python manage.py collectstatic --noinput &&
        python manage.py createsuperuser --no-input || true &&
        python manage.py compilemessages &&
        exec gunicorn qfieldcloud.wsgi:application \
          --bind 0.0.0.0:8000 \
          --timeout 300 \
          --max-requests 300 \
          --workers 1 \
          --threads 4

  qfield-worker:
    <<: *qfield-common
    image: ghcr.io/opengisch/qfieldcloud-worker-wrapper:${QFIELDCLOUD_TAG:-26.3}
    depends_on:
      qfield-app:
        condition: service_healthy
      qfield-transformation-grids:
        condition: service_completed_successfully
      s3-init:
        condition: service_completed_successfully
    command: python manage.py dequeue
    user: root # required
    scale: 1
    stop_grace_period: 15m
    labels:
      ofelia.enabled: "false"
    healthcheck:
      test: ["CMD-SHELL", "tr '\\000' ' ' </proc/1/cmdline | grep -q 'python manage.py dequeue'"]
      start_period: 30s
      interval: 10s
      timeout: 5s
      retries: 10
    environment:
      <<: *qfield-common-env
    volumes:
      # Required to run qgis containers and process project files
      - /var/run/docker.sock:/var/run/docker.sock
      # Required to process geospatial datasets
      - qfield_transformation_grids:/transformation_grids
      # Required for loading feedback.json from QGIS job container
      - /tmp:/tmp

  qfield-init:
    <<: *qfield-common
    depends_on:
      qfield-app:
        condition: service_healthy
    environment:
      <<: *qfield-common-env
      ORG_NAME: HOTOSM
      QFIELDCLOUD_USER: ${QFIELDCLOUD_USER}
      QFIELDCLOUD_PASSWORD: ${QFIELDCLOUD_PASSWORD}
    restart: "on-failure:2"
    command:
      - sh
      - -c
      - |
        echo "Waiting for app to be ready..."
        until curl -sf http://qfield-app:8000/api/v1/status > /dev/null; do
          sleep 3
        done

        echo "Initializing organizations and users..."
        python - <<'PYCODE'
        import os, sys, django
        django.setup()

        from qfieldcloud.core.models import Organization, Person, User

        username = os.getenv("QFIELDCLOUD_USER")
        email = "svcftm@hotosm.org"
        password = os.getenv("QFIELDCLOUD_PASSWORD")
        org_name = os.getenv("ORG_NAME")

        if not all([username, password, org_name]):
            print("QFIELDCLOUD_USER or QFIELDCLOUD_PASSWORD or ORG_NAME not set")
            sys.exit(1)

        # Create or get the user (do not use get_or_create, as we need password hashing)
        user = None
        if not Person.objects.filter(username=username).exists():
            user = Person.objects.create_user(
                username=username,
                email=email,
                password=password,
                is_superuser=True,
                is_staff=True,
                has_accepted_tos=True,
            )

        # Create or get the organization
        org = None
        if not Organization.objects.filter(username=org_name).exists():
            org = Organization.objects.create(
                username=org_name,
                organization_owner=user,
                created_by=user,
                is_initially_trial=False,
            )

        if user and org:
            print(f"Initialized organization: {org.username}, owner: {user.username}")
        else:
            print("Org + user creation skipped, as they already exist.")
        PYCODE

  qfield-qgis:
    image: "ghcr.io/hotosm/qfield-project-packager:${QFIELDCLOUD_TAG:-26.3}"
    build:
      context: src/qfield
      args:
        QFIELDCLOUD_TAG: "${QFIELDCLOUD_TAG:-26.3}"
    depends_on:
      fieldtm-db:
        condition: service_healthy
    volumes:
      - ./src/qfield/project_gen_svc.py:/usr/src/app/project_gen_svc.py:ro
    environment:
      LOG_LEVEL: DEBUG
      FTM_DB_URL: "postgresql://${FTM_DB_USER:-fieldtm}:${FTM_DB_PASSWORD:-fieldtm}@fieldtm-db/${FTM_DB_NAME:-fieldtm}"
    networks:
      - ftm-net
    restart: "unless-stopped"
    healthcheck:
      test: timeout 5s bash -c ':> /dev/tcp/127.0.0.1/8080' || exit 1
      start_period: 10s
      interval: 5s
      retries: 5
      timeout: 5s

  qfield-transformation-grids:
    image: k3rnelpan1c/alpine-wget:latest
    command: |
      wget --mirror https://cdn.proj.org/ -P /transformation_grids --no-host-directories
      && chmod a+r /transformation_grids/*
    volumes:
      - qfield_transformation_grids:/transformation_grids
    restart: "on-failure:2"

  s3:
    image: docker.io/dxflrs/garage:v1.3.1
    volumes:
      - ./deploy/garage.toml:/etc/garage.toml:ro
      - garage_data:/var/lib/garage
    networks:
      - ftm-net
    restart: unless-stopped
    # https://git.deuxfleurs.fr/Deuxfleurs/garage/issues/1354
    # healthcheck:
    #   test: ["CMD-SHELL", "/garage node health-check"]
    #   start_period: 5s
    #   interval: 5s
    #   timeout: 5s
    #   retries: 10

  s3-init:
    image: docker.io/alpine:3.23
    depends_on:
      s3:
        condition: service_started
    network_mode: service:s3
    pid: service:s3
    environment:
      GARAGE_ADMIN_TOKEN: garage-admin-token
    restart: "on-failure:2"
    entrypoint:
      - /bin/sh
      - -eu
      - -c
      - |
        # chroot into the s3 container's filesystem so the garage binary runs
        # with its own libs/linker, while the shared network namespace keeps
        # 127.0.0.1:3901 pointing at the live Garage server
        G="chroot /proc/1/root /garage -c /etc/garage.toml"

        # Wait for server
        for i in $$(seq 1 20); do
          if $$G node id -q 2>/dev/null; then break; fi
          echo "Waiting for Garage RPC... ($$i/20)"
          sleep 3
        done
        $$G node id -q || { echo "Garage RPC not ready"; exit 1; }

        # Init garage nodes
        if $$G status 2>&1 | grep -q 'NO ROLE ASSIGNED'; then
          NODE_ID=$$($$G node id -q | cut -c1-16)
          $$G layout assign "$$NODE_ID" -z local -c 1G
          $$G layout apply --version 1
        fi

        # Create S3 bucket
        $$G key import --yes -n fieldtm-qfield \
          GK3515373e4c851ebaad366558 \
          7d37d093435a41f2aab8f13c19ba067d9776c90215f56614adad6ece597dbb34 || true
        $$G bucket create qfield-cloud || true
        $$G bucket allow qfield-cloud --key fieldtm-qfield --read --write --owner || true

        echo "Garage initialized."