register-referentie/infra/opennotificaties/docker-compose.yml

# Open Notificaties (NRC) stack (S-01-c). Lean adaptation of the upstream dev compose:
# db (PostGIS) + redis (also the Celery broker) + migrate-init + the API + a celery worker.
#
# Shares the `cg` network with the OpenZaak stack so the two can reach each other.
# Run BOTH together (NRC needs OpenZaak's Autorisaties API for auth wiring):
#
#   docker compose -f infra/openzaak/docker-compose.yml -f infra/opennotificaties/docker-compose.yml up -d
#   curl -s -o /dev/null -w '%{http_code}\n' http://localhost:8001/admin/   # -> 302
#
# NRC is published on host :8001 (OpenZaak holds :8000).
services:
  nrc-db:
    image: docker.io/postgis/postgis:17-3.5
    environment:
      POSTGRES_USER: opennotificaties
      POSTGRES_PASSWORD: opennotificaties
      POSTGRES_DB: opennotificaties
    command: postgres -c max_connections=300
    volumes:
      - nrc-db:/var/lib/postgresql/data
    healthcheck:
      # pg_isready only checks TCP; the second clause verifies PostGIS is installed
      # so nrc-init migrations can safely start (avoids race on cold container start).
      test: ["CMD-SHELL", "pg_isready -U opennotificaties -d opennotificaties && psql -U opennotificaties -d opennotificaties -c 'SELECT PostGIS_Version();' -q 2>/dev/null"]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 15s
    networks: [cg]

  nrc-redis:
    image: docker.io/library/redis:7
    networks: [cg]

  nrc-init:
    # Plain base image — nrc-init runs migrations only (see command below).
    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
    environment: &nrc-env
      DJANGO_SETTINGS_MODULE: nrc.conf.docker
      SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
      DB_HOST: nrc-db
      DB_NAME: opennotificaties
      DB_USER: opennotificaties
      DB_PASSWORD: opennotificaties
      IS_HTTPS: "no"
      ALLOWED_HOSTS: "*"
      CACHE_DEFAULT: nrc-redis:6379/0
      CACHE_AXES: nrc-redis:6379/0
      CELERY_BROKER_URL: redis://nrc-redis:6379/1
      CELERY_RESULT_BACKEND: redis://nrc-redis:6379/1
      DISABLE_2FA: "true"
      OPENNOTIFICATIES_SUPERUSER_USERNAME: admin
      DJANGO_SUPERUSER_PASSWORD: admin
      OPENNOTIFICATIES_SUPERUSER_EMAIL: admin@localhost
      RUN_SETUP_CONFIG: "true"
      # Delivery cadence: nrc-beat fires `execute_notifications` this often to drain
      # scheduled notifications to subscribers. Upstream default is 20s; 5s keeps the
      # walking-skeleton + the verify smoke responsive.
      NOTIFICATION_SEC_INTERVAL: "5"
    # Runs migrations + setup_configuration (S-01-c): the JWT credential, the
    # Autorisaties-API delegation, and the `zaken` kanaal that let OpenZaak publish
    # notifications. data.yaml is streamed into this external volume by
    # infra/seed-config.sh (same pattern as oz-init). See data.yaml + ADR-0006.
    command: /setup_configuration.sh
    volumes:
      - nrc-config:/app/setup_configuration:ro
    depends_on:
      nrc-db:
        condition: service_healthy
      nrc-redis:
        condition: service_started
    networks: [cg]

  nrc-web:
    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
    environment: *nrc-env
    healthcheck:
      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    ports:
      - "8001:8000"
    depends_on:
      nrc-init:
        condition: service_completed_successfully
    networks: [cg]

  nrc-celery:
    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
    environment: *nrc-env
    command: /celery_worker.sh
    depends_on:
      nrc-init:
        condition: service_completed_successfully
    networks: [cg]

  # Celery beat: periodically fires `execute_notifications`, which drains the
  # ScheduledNotification rows the API creates on publish and hands them to the
  # worker for delivery. Without beat, notifications are accepted but never
  # delivered to subscribers — so it is required, not optional. See ADR-0007.
  nrc-beat:
    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
    environment: *nrc-env
    command: /celery_beat.sh
    depends_on:
      nrc-init:
        condition: service_completed_successfully
    networks: [cg]

volumes:
  nrc-db:
  # populated out-of-band by infra/seed-config.sh (docker cp) — see that script.
  nrc-config:
    external: true
    name: rr-nrc-config

networks:
  cg: