From 4e792c2d16a64efb603f5785bb7ea0559caccfa0 Mon Sep 17 00:00:00 2001
From: Niek Otten <not@respellion.nl>
Date: Thu, 16 Jul 2026 09:17:11 +0200
Subject: [PATCH] build(infra): serve the behandel portal in compose and gate
 it in the smoke (refs #13)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the behandel service (:8142, nginx → BFF, depends on Keycloak for the medewerker realm) to

docker-compose, add it to the smoke's WAIT_SVCS and the CI failure-log dump.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .gitea/workflows/ci.yaml |  2 +-
 Makefile                 |  2 +-
 infra/docker-compose.yml | 23 +++++++++++++++++++++++
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 2aff002..d9c6049 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -157,7 +157,7 @@ jobs:
       # Log dump must precede teardown (which removes the containers).
       - name: Dump container logs on failure
         if: failure()
-        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service 2>&1 || true
+        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service openbaar behandel 2>&1 || true
       - name: Tear down
         if: always()
         run: make down
diff --git a/Makefile b/Makefile
index d785565..40b9403 100644
--- a/Makefile
+++ b/Makefile
@@ -10,7 +10,7 @@ COMPOSE    := infra/docker-compose.yml
 # Long-running services with a healthcheck — the smoke polls these for readiness
 # (infra/wait-healthy.sh). One-shot init jobs (oz-init, nrc-init, flowable-init)
 # are not polled; they only need to have run. See docs/runbooks/gitea-actions-gotchas.md.
-WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api self-service openbaar
+WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api self-service openbaar behandel
 # Config files (OpenZaak data.yaml, Keycloak realms, Flowable BPMN) are streamed
 # into external named volumes via `docker cp` (infra/seed-config.sh) instead of
 # bind-mounted, because bind mounts don't reach sibling containers on the
diff --git a/infra/docker-compose.yml b/infra/docker-compose.yml
index c107ca0..1142dd5 100644
--- a/infra/docker-compose.yml
+++ b/infra/docker-compose.yml
@@ -486,6 +486,29 @@ services:
         condition: service_healthy
     networks: [cg]
 
+  # The behandel portal: nginx serves the Angular app and reverse-proxies /behandel to the BFF.
+  # Behandelaars log in against the Keycloak medewerker realm (ADR-0013; S-12).
+  behandel:
+    build:
+      context: ..
+      dockerfile: apps/behandel/Dockerfile
+    image: register-referentie/behandel:dev
+    ports:
+      - "8142:80"
+    healthcheck:
+      # 127.0.0.1, not localhost: nginx listens on IPv4 only, but localhost resolves to ::1 first.
+      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+      start_period: 10s
+    depends_on:
+      bff:
+        condition: service_healthy
+      keycloak:
+        condition: service_started
+    networks: [cg]
+
 volumes:
   oz-db:
   nrc-db: