default.provisioners.yaml

# This file is generated by score-compose when score-compose init is called. This presents the default set of
# template provisioners provided for a basic set of resource types. This file can be overridden by adding new
# *.provisioners.yaml files in this directory or by editing this file in place and checking it into the source code.

# The default volume provisioner provided by score-compose allows basic volume resources to be created in the resources
# system. The volume resource just creates an ephemeral Docker volume with a random string as the name, and source
# attribute that we can reference.
- uri: template://default-provisioners/volume
  # By default, match all classes and ids of volume. If you want to override this, create another provisioner definition
  # with a higher priority.
  type: volume
  init: |
    randomVolumeName: {{ .Id | replace "." "-" }}-{{ randAlphaNum 6 }}
  # Store the random volume name if we haven't chosen one yet, otherwise use the one that exists already
  state: |
    name: {{ dig "name" .Init.randomVolumeName .State }}
  # Return a source value with the volume name. This can be used in volume resource references now.
  outputs: |
    type: volume
    source: {{ .State.name }}
  # Add a volume to the docker compose file. We assume our name is unique here. We also apply a label to help ensure
  # that we can track the volume back to the workload and resource that created it.
  volumes: |
    {{ .State.name }}:
      name: {{ .State.name }}
      driver: local
      labels:
        dev.score.compose.res.uid: {{ .Uid }}

# The default provisioner for service resources, this expects a workload and port name and will return the hostname and
# port required to contact it. This will validate that the workload and port exist, but won't enforce a dependency
# relationship yet.
- uri: template://default-provisioners/service-port
  type: service-port
  outputs: |
    {{ if not .Params.workload }}{{ fail "expected 'workload' param for the target workload name" }}{{ end }}
    {{ if not .Params.port }}{{ fail "expected 'port' param for the name of the target workload service port" }}{{ end }}
    {{ $w := (index .WorkloadServices .Params.workload) }}
    {{ if not $w }}{{ fail "unknown workload" }}{{ end }}
    {{ $p := (index $w.Ports .Params.port) }}
    {{ if not $p }}{{ fail "unknown service port" }}{{ end }}
    hostname: {{ $w.ServiceName | quote }}
    port: {{ $p.TargetPort }}

# The default redis provisioner adds a redis service to the project which returns a host, port, username, and password.
- uri: template://default-provisioners/redis
  # By default, match all redis types regardless of class and id. If you want to override this, create another
  # provisioner definition with a higher priority.
  type: redis
  # Init template has the default port and a random service name and password if needed later
  init: |
    port: 6379
    randomServiceName: redis-{{ randAlphaNum 6 }}
    randomPassword: {{ randAlphaNum 16 | quote }}
  # The only state we need to persist is the chosen random service name and password
  state: |
    serviceName: {{ dig "serviceName" .Init.randomServiceName .State | quote }}
    password: {{ dig "password" .Init.randomPassword .State | quote }}
  # Return the outputs schema that consumers expect
  outputs: |
    host: {{ .State.serviceName }}
    port: {{ .Init.port }}
    username: default
    password: {{ .State.password | quote }}
  # write the config file to the mounts directory
  files: |
    {{ .State.serviceName }}/redis.conf: |
      requirepass {{ .State.password }}
      port {{ .Init.port }}
      save 60 1
      loglevel warning
  # add a volume for persistence of the redis data
  volumes: |
    {{ .State.serviceName }}-data:
      name: {{ .State.serviceName }}-data
      driver: local
      labels:
        dev.score.compose.res.uid: {{ .Uid }}
  # And the redis service itself with volumes bound in
  services: |
    {{ .State.serviceName }}:
      labels:
        dev.score.compose.res.uid: {{ .Uid }}
      image: redis:7-alpine
      restart: always
      entrypoint: ["redis-server"]
      command: ["/usr/local/etc/redis/redis.conf"]
      volumes:
      - type: bind
        source: {{ .MountsDirectory }}/{{ .State.serviceName }}/redis.conf
        target: /usr/local/etc/redis/redis.conf
        read_only: true
      - type: volume
        source: {{ .State.serviceName }}-data
        target: /data
        volume:
          nocopy: true
  info_logs: |
    - "{{.Uid}}: To connect to redis: \"docker run -it --network {{ .ComposeProjectName }}_default --rm redis redis-cli -h {{ .State.serviceName | squote }} -a {{ .State.password | squote }}\""

# The default postgres provisioner adds a postgres instance and then ensures that the required databases are created on
# startup.
- uri: template://default-provisioners/postgres
  # By default, match all redis types regardless of class and id. If you want to override this, create another
  # provisioner definition with a higher priority.
  type: postgres
  # Init template has the random service name and password if needed later
  init: |
    randomServiceName: pg-{{ randAlphaNum 6 }}
    randomDatabase: db-{{ randAlpha 8 }}
    randomUsername: user-{{ randAlpha 8 }}
    randomPassword: {{ randAlphaNum 16 | quote }}
    sk: default-provisioners-postgres-instance
    publishPort: {{ dig "annotations" "compose.score.dev/publish-port" "0" .Metadata | quote }}
  # The state for each database resource is a unique db name and credentials
  state: |
    database: {{ dig "database" .Init.randomDatabase .State | quote }}
    username: {{ dig "username" .Init.randomUsername .State | quote }}
    password: {{ dig "password" .Init.randomPassword .State | quote }}
  # All instances agree on the shared state since there is no concurrency here
  shared: |
    {{ .Init.sk }}:
      instanceServiceName: {{ dig .Init.sk "instanceServiceName" .Init.randomServiceName .Shared | quote }}
      instancePassword: {{ dig .Init.sk "instancePassword" .Init.randomPassword .Shared | quote }}
  # The outputs are the core database outputs. We output both name and database for broader compatibility.
  outputs: |
    host: {{ dig .Init.sk "instanceServiceName" "" .Shared }}
    port: 5432
    name: {{ .State.database }}
    database: {{ .State.database }}
    username: {{ .State.username }}
    password: {{ .State.password }}
  # Write out an idempotent create script per database
  files: |
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}-db-scripts/{{ .State.database }}.sql: |
      SELECT 'CREATE DATABASE "{{ .State.database }}"' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '{{ .State.database }}')\gexec
      SELECT $$CREATE USER "{{ .State.username }}" WITH PASSWORD '{{ .State.password }}'$$ WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '{{ .State.username }}')\gexec
      GRANT ALL PRIVILEGES ON DATABASE "{{ .State.database }}" TO "{{ .State.username }}";
      \connect "{{ .State.database }}";
      GRANT ALL ON SCHEMA public TO "{{ .State.username }}";
  # Ensure the data volume exists
  volumes: |
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}-data:
      driver: local
  # Create 2 services, the first is the database itself, the second is the init container which runs the scripts
  services: |
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}:
      image: postgres:17-alpine
      restart: always
      environment:
        POSTGRES_USER: postgres
        POSTGRES_PASSWORD: {{ dig .Init.sk "instancePassword" "" .Shared | quote }}
      {{ if ne .Init.publishPort "0" }}
      ports:
      - target: 5432
        published: {{ .Init.publishPort }}
      {{ end }}
      volumes:
      - type: volume
        source: {{ dig .Init.sk "instanceServiceName" "" .Shared }}-data
        target: /var/lib/postgresql/data
      healthcheck:
        test: ["CMD", "pg_isready", "-U", "postgres"]
        interval: 2s
        timeout: 2s
        retries: 15
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}-init:
      image: postgres:17-alpine
      entrypoint: ["/bin/sh"]
      environment:
        POSTGRES_PASSWORD: {{ dig .Init.sk "instancePassword" "" .Shared | quote }}
      command:
      - "-c"
      - |
        cd /db-scripts
        ls db-*.sql | xargs cat | psql "postgresql://postgres:$${POSTGRES_PASSWORD}@{{ dig .Init.sk "instanceServiceName" "" .Shared }}:5432/postgres"
      labels:
        dev.score.compose.labels.is-init-container: "true"
      depends_on:
        {{ dig .Init.sk "instanceServiceName" "" .Shared }}:
          condition: service_healthy
          restart: true
      volumes:
      - type: bind
        source: {{ .MountsDirectory }}/{{ dig .Init.sk "instanceServiceName" "" .Shared }}-db-scripts
        target: /db-scripts
  info_logs: |
    - "{{.Uid}}: To connect to postgres, enter password {{ .State.password | squote }} at: \"docker run -it --network {{ .ComposeProjectName }}_default --rm postgres:17-alpine psql -h {{ dig .Init.sk "instanceServiceName" "" .Shared }} -U {{ .State.username }} --dbname {{ .State.database }}\""
    {{ if ne .Init.publishPort "0" }}
    - "{{.Uid}}: Or connect your postgres client to \"postgres://{{ .State.username }}:{{ .State.password }}@localhost:{{ .Init.publishPort }}/{{ .State.database }}\""
    {{ end }}

# This resource provides a minio based S3 bucket with AWS-style credentials.
# This provides some common and well known outputs that can be used with any generic AWS s3 client.
# If the provider has a publish port annotation, it can expose a management port on the local network for debugging and
# connectivity.
- uri: template://default-provisioners/s3
  type: s3
  # The init template contains some initial seed data that can be used it needed.
  init: |
    randomServiceName: minio-{{ randAlphaNum 6 }}
    randomUsername: user-{{ randAlpha 8 }}
    randomPassword: {{ randAlphaNum 16 | quote }}
    randomBucket: bucket-{{ randAlpha 8 | lower }}-{{ .Id | lower | trunc 47 }}
    randomAccessKeyId: {{ randAlphaNum 20 | quote }}
    randomSecretKey: {{ randAlphaNum 40 | quote }}
    sk: default-provisioners-minio-instance
    publishPort: {{ dig "annotations" "compose.score.dev/publish-port" "0" .Metadata | atoi }}
  # The only instance state is the bucket name, for now we provision a single aws key across s3 resources.
  state: |
    bucket: {{ dig "bucket" .Init.randomBucket .State | quote }}
  # The shared state contains the chosen service name and credentials
  shared: |
    {{ .Init.sk }}:
      instanceServiceName: {{ dig .Init.sk "instanceServiceName" .Init.randomServiceName .Shared | quote }}
      instanceUsername: {{ dig .Init.sk "instanceUsername" .Init.randomUsername .Shared | quote }}
      instancePassword: {{ dig .Init.sk "instancePassword" .Init.randomPassword .Shared | quote }}
      instanceAccessKeyId: {{ dig .Init.sk "instanceAccessKeyId" .Init.randomAccessKeyId .Shared | quote }}
      instanceSecretKey: {{ dig .Init.sk "instanceSecretKey" .Init.randomSecretKey .Shared | quote }}
      publishPort: {{ with (dig .Init.sk "publishPort" 0 .Shared) }}{{ if ne . 0 }}{{ . }}{{ else }}{{ $.Init.publishPort }}{{ end }}{{ end }}
  # the outputs that we can expose
  outputs: |
    bucket: {{ .State.bucket }}
    access_key_id: {{ dig .Init.sk "instanceAccessKeyId" "" .Shared | quote }}
    secret_key: {{ dig .Init.sk "instanceSecretKey" "" .Shared | quote }}
    endpoint: http://{{ dig .Init.sk "instanceServiceName" "" .Shared }}:9000
    # for compatibility with Humanitec's existing s3 resource
    region: ""
    aws_access_key_id: {{ dig .Init.sk "instanceAccessKeyId" "" .Shared | quote }}
    aws_secret_key: {{ dig .Init.sk "instanceSecretKey" "" .Shared | quote }}
  # we store 2 files, 1 is always the same and overridden, the other is per bucket
  files: |
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}-setup-scripts/00-svcacct.sh: |
      mc alias set myminio http://{{ dig .Init.sk "instanceServiceName" "" .Shared }}:9000 {{ dig .Init.sk "instanceUsername" "" .Shared }} {{ dig .Init.sk "instancePassword" "" .Shared }}
      mc admin user svcacct info myminio {{ dig .Init.sk "instanceAccessKeyId" "" .Shared | quote }} || mc admin user svcacct add myminio {{ dig .Init.sk "instanceUsername" "" .Shared | quote }} --access-key {{ dig .Init.sk "instanceAccessKeyId" "" .Shared | quote }} --secret-key {{ dig .Init.sk "instanceSecretKey" "" .Shared | quote }}
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}-setup-scripts/10-bucket-{{ .State.bucket }}.sh: |
      mc alias set myminio http://{{ dig .Init.sk "instanceServiceName" "" .Shared }}:9000 {{ dig .Init.sk "instanceUsername" "" .Shared }} {{ dig .Init.sk "instancePassword" "" .Shared }}
      mc mb -p myminio/{{ .State.bucket }}
  volumes: |
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}-data:
      driver: local
  # 2 services, the minio one, and the init container which ensures the service account and buckets exist
  services: |
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}:
      image: quay.io/minio/minio
      command: ["server", "/data", "--console-address", ":9001"]
      restart: always
      {{ if ne .Init.publishPort 0 }}
      ports:
      - target: 9001
        published: {{ .Init.publishPort }}
      {{ end }}
      healthcheck:
        test: ["CMD-SHELL", "mc alias set myminio http://localhost:9000 {{ dig .Init.sk "instanceUsername" "" .Shared }} {{ dig .Init.sk "instancePassword" "" .Shared }}"]
        interval: 2s
        timeout: 2s
        retries: 15
      environment:
        MINIO_ROOT_USER: {{ dig .Init.sk "instanceUsername" "" .Shared | quote }}
        MINIO_ROOT_PASSWORD: {{ dig .Init.sk "instancePassword" "" .Shared | quote }}
      volumes:
      - type: volume
        source: {{ dig .Init.sk "instanceServiceName" "" .Shared }}-data
        target: /data
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}-init:
      image: quay.io/minio/minio
      entrypoint: ["/bin/sh"]
      command:
      - "-c"
      - "for s in $$(ls /setup-scripts -1); do sh /setup-scripts/$$s; done"
      labels:
        dev.score.compose.labels.is-init-container: "true"
      depends_on:
        {{ dig .Init.sk "instanceServiceName" "" .Shared }}:
          condition: service_healthy
          restart: true
      volumes:
      - type: bind
        source: {{ .MountsDirectory }}/{{ dig .Init.sk "instanceServiceName" "" .Shared }}-setup-scripts
        target: /setup-scripts
  info_logs: |
    - "{{.Uid}}: To connect with a minio client: use the myminio alias at \"docker run -it --network {{ .ComposeProjectName }}_default --rm --entrypoint /bin/bash quay.io/minio/minio -c 'mc alias set myminio http://{{ dig .Init.sk "instanceServiceName" "" .Shared }}:9000 {{ dig .Init.sk "instanceAccessKeyId" "" .Shared }} {{ dig .Init.sk "instanceSecretKey" "" .Shared }}; bash'\""
    {{ if ne .Init.publishPort 0 }}
    - "{{.Uid}}: Or enter {{ dig .Init.sk "instanceUsername" "" .Shared }} / {{ dig .Init.sk "instancePassword" "" .Shared }} at https://localhost:{{ .Init.publishPort }}"
    {{ end }}

# The default AMQP provisioner provides a simple rabbitmq instance with default configuration and plugins.
- uri: template://default-provisioners/rabbitmq
  type: amqp
  init: |
    randomServiceName: rabbitmq-{{ randAlphaNum 6 }}
    randomVHost: vhost-{{ randAlpha 8 }}
    randomUsername: user-{{ randAlpha 8 }}
    randomPassword: {{ randAlphaNum 16 | quote }}
    sk: default-provisioners-rabbitmq
    publishPort: {{ dig "annotations" "compose.score.dev/publish-port" "0" .Metadata | atoi }}
    publishManagementPort: {{ dig "annotations" "compose.score.dev/publish-management-port" "0" .Metadata | atoi }}
  state: |
    vhost: {{ dig "vhost" .Init.randomVHost .State | quote }}
    username: {{ dig "username" .Init.randomUsername .State | quote }}
    password: {{ dig "password" .Init.randomPassword .State | quote }}
  outputs: |
    host: {{ dig .Init.sk "instanceServiceName" "" .Shared }}
    port: 5672
    vhost: {{ .State.vhost }}
    username: {{ .State.username }}
    password: {{ .State.password }}
  shared: |
    {{ .Init.sk }}:
      instanceServiceName: {{ dig .Init.sk "instanceServiceName" .Init.randomServiceName .Shared | quote }}
      instanceErlangCookie: {{ dig .Init.sk "instanceErlangCookie" (randAlpha 20) .Shared }}
      {{ $publishPorts := (list) }}
      {{ if ne .Init.publishPort 0 }}{{ $publishPorts = (append $publishPorts (dict "target" 5672 "published" .Init.publishPort)) }}{{ end }}
      {{ $x := (dig "annotations" "compose.score.dev/publish-management-port" "0" .Metadata | atoi) }}
      {{ if ne .Init.publishManagementPort 0 }}{{ $publishPorts = (append $publishPorts (dict "target" 15672 "published" .Init.publishManagementPort)) }}{{ end }}
      publishPorts: {{ $publishPorts | toJson }}
  volumes: |
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}-data:
      driver: local
  files: |
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}-db-scripts/{{ .State.vhost }}.sh: |
      rabbitmqctl list_vhosts | grep {{ .State.vhost }} || rabbitmqctl add_vhost {{ .State.vhost }}
      rabbitmqctl list_users | grep {{ .State.username }} || rabbitmqctl add_user {{ .State.username }} {{ .State.password }}
      rabbitmqctl set_user_tags {{ .State.username }} administrator
      rabbitmqctl set_permissions -p {{ .State.vhost }} {{ .State.username }} ".*" ".*" ".*"
      rabbitmqctl set_topic_permissions -p {{ .State.vhost }} {{ .State.username }} ".*" ".*" ".*"
  services: |
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}:
      image: rabbitmq:3-management-alpine
      restart: always
      environment:
        RABBITMQ_ERLANG_COOKIE: {{ dig .Init.sk "instanceErlangCookie" "" .Shared }}
        RABBITMQ_DEFAULT_USER: guest
        RABBITMQ_DEFAULT_PASS: guest
      ports: {{ dig .Init.sk "publishPorts" "" .Shared | toJson}}
      volumes:
      - type: volume
        source: {{ dig .Init.sk "instanceServiceName" "" .Shared }}-data
        target: /var/lib/rabbitmq
      healthcheck:
        test: ["CMD-SHELL", "rabbitmq-diagnostics -q check_port_connectivity"]
        interval: 2s
        timeout: 5s
        retries: 15
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}-init:
      image: rabbitmq:3-management-alpine
      entrypoint: ["/bin/sh"]
      environment:
        RABBITMQ_ERLANG_COOKIE: {{ dig .Init.sk "instanceErlangCookie" "" .Shared }}
      command:
      - "-c"
      - |
        set -exu
        for s in /db-scripts/*.sh; do source $$s; done
      depends_on:
        {{ dig .Init.sk "instanceServiceName" "" .Shared }}:
          condition: service_healthy
          restart: true
      labels:
        dev.score.compose.labels.is-init-container: "true"
      network_mode: service:{{ dig .Init.sk "instanceServiceName" "" .Shared }}
      volumes:
      - type: bind
        source: {{ .MountsDirectory }}/{{ dig .Init.sk "instanceServiceName" "" .Shared }}-db-scripts
        target: /db-scripts
  info_logs: |
    {{ if ne .Init.publishManagementPort 0 }}
    - "{{.Uid}}: Browse the rabbitmq UI at \"http://localhost:{{ .Init.publishManagementPort }}\""
    {{ end }}

# The default dns provisioner just outputs localhost as the hostname every time.
# This is because without actual control of a dns resolver we can't do any accurate routing on any other name. This
# can be replaced by a new provisioner in the future.
- uri: template://default-provisioners/dns
  type: dns
  init: |
    randomHostname: dns{{ randAlphaNum 6 | lower }}.localhost
  state: |
    instanceHostname: {{ dig "instanceHostname" .Init.randomHostname .State | quote }}
  outputs: |
    host: {{ .State.instanceHostname }}

# The default route provisioner sets up an nginx service with an HTTP service that can route on our prefix paths.
# It assumes the hostnames and routes provided have no overlaps. Weird behavior may happen if there are overlaps.
- uri: template://default-provisioners/route
  type: route
  init: |
    randomServiceName: routing-{{ randAlphaNum 6 }}
    sk: default-provisioners-routing-instance
    {{ if not (regexMatch "^/|(/([^/]+))+$" .Params.path) }}{{ fail "params.path start with a / but cannot end with /" }}{{ end }}
    {{ if not (regexMatch "^[a-z0-9_.-]{1,253}$" .Params.host) }}{{ fail (cat "params.host must be a valid hostname but was" .Params.host) }}{{ end }}
    {{ $ports := (index .WorkloadServices .SourceWorkload).Ports }}
    {{ if not $ports }}{{ fail "no service ports exist" }}{{ end }}
    {{ $port := index $ports (print .Params.port) }}
    {{ if not $port.TargetPort }}{{ fail "params.port is not a named service port" }}{{ end }}

  shared: |
    {{ .Init.sk }}:
      instancePort: {{ dig .Init.sk "instancePort" 8080 .Shared }}
      instanceServiceName: {{ dig .Init.sk "instanceServiceName" .Init.randomServiceName .Shared | quote }}
      {{ $targetHost := (index .WorkloadServices .SourceWorkload).ServiceName }}
      {{ $ports := (index .WorkloadServices .SourceWorkload).Ports }}
      {{ $port := index $ports (print .Params.port) }}
      {{ $targetPort := $port.TargetPort }}
      {{ $target := (printf "%s:%d" $targetHost $targetPort) }}
      {{ $hBefore := dig .Init.sk "hosts" (dict) .Shared }}
      {{ $rBefore := dig .Params.host (dict) $hBefore }}
      {{ $pathType := dig "compose.score.dev/route-provisioner-path-type" "Prefix" (dig "annotations" (dict) (.Metadata | default (dict))) }}
      {{ $inner := dict "path" .Params.path "target" $target "port" $targetPort "path_type" $pathType }}
      {{ $rAfter := (merge $rBefore (dict .Uid $inner)) }}
      {{ $hAfter := (merge $hBefore (dict .Params.host $rAfter)) }}
      hosts: {{ $hAfter | toRawJson }}
  files: |
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}/nginx.conf: |
      worker_processes 1;
      worker_rlimit_nofile 8192;
      events {
        worker_connections 4096;
      }
      http {
        resolver 127.0.0.11;

        {{ range $h, $r := (dig .Init.sk "hosts" "" .Shared) }}
        server {
          listen 80;
          listen [::]:80;
          server_name {{ $h }};

          proxy_set_header X-Real-IP              $remote_addr;
          proxy_set_header X-Forwarded-For        $remote_addr;
          proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;
          proxy_set_header Proxy                  "";
          proxy_connect_timeout                   5s;
          proxy_send_timeout                      60s;
          proxy_read_timeout                      60s;
          proxy_buffers                           16 4k;
          proxy_buffer_size                       2k;
          client_max_body_size                    10m;
      {{ dig "compose.score.dev/route-provisioner-server-snippet" "" (dig "annotations" (dict) ($.Metadata | default (dict))) | indent 4 }}

          location = /favicon.ico {
            return 204;
            access_log     off;
            log_not_found  off;
          }

          {{ range $k, $v := $r }}
          # the basic path variant, "/" or "/one/two"
          location ~ ^{{ index $v "path" }}$ {
            set $backend {{ index $v "target" }};
            proxy_pass http://$backend;
      {{ dig "compose.score.dev/route-provisioner-location-snippet" "" (dig "annotations" (dict) ($.Metadata | default (dict))) | indent 6 }}
          }

          # The prefix match variants are included by default but can be excluded via 'compose.score.dev/route-provisioner-path-type' annotation
          {{ if eq (index $v "path_type") "Prefix" }}
          location ~ ^{{ index $v "path" | trimSuffix "/" }}/.* {
            set $backend {{ index $v "target" }};
            proxy_pass http://$backend;
      {{ dig "compose.score.dev/route-provisioner-location-snippet" "" (dig "annotations" (dict) ($.Metadata | default (dict))) | indent 6 }}
          }
          {{ end }}
          {{ end }}
        }
        {{ end }}
      }

  services: |
    {{ $p := (dig .Init.sk "instancePort" 0 .Shared) }}
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}:
      image: "nginx:1-alpine"
      restart: always
      ports:
        - published: {{ $p }}
          target: 80
      volumes:
        - type: bind
          source: {{ .MountsDirectory }}/{{ dig .Init.sk "instanceServiceName" "" .Shared }}/nginx.conf
          target: /etc/nginx/nginx.conf
          readOnly: true
  info_logs: |
    {{ $p := (dig .Init.sk "instancePort" 0 .Shared) }}
    - "{{.Uid}}: To connect to this route, http://{{ .Params.host }}:{{ $p }}{{ .Params.path }} (make sure {{ .Params.host }} resolves to localhost)"

# The default mongodb provisioner adds a mongodb service to the project which returns a host, port, username, and password, and connection string.
- uri: template://default-provisioners/mongodb
  type: mongodb
  init: |
    port: 27017
    randomServiceName: mongo-{{ randAlphaNum 6 }}
    randomUsername: user-{{ randAlpha 8 }}
    randomPassword: {{ randAlphaNum 16 | quote }}
  state: |
    serviceName: {{ dig "serviceName" .Init.randomServiceName .State | quote }}
    username: {{ dig "username" .Init.randomUsername .State | quote }}
    password: {{ dig "password" .Init.randomPassword .State | quote }}
  outputs: |
    host: {{ .State.serviceName }}
    port: {{ .Init.port }}
    username: {{ .State.username | quote }}
    password: {{ .State.password | quote }}
    connection: "mongodb://{{ .State.username }}:{{ .State.password }}@{{ .State.serviceName }}:{{ .Init.port }}/"
  volumes: |
    {{ .State.serviceName }}-data:
      name: {{ .State.serviceName }}-data
      driver: local
      labels:
        dev.score.compose.res.uid: {{ .Uid }}
  services: |
    {{ .State.serviceName }}:
      labels:
        dev.score.compose.res.uid: {{ .Uid }}
      image: mongo:8
      restart: always
      environment:
        MONGO_INITDB_ROOT_USERNAME: {{ .State.username | quote }}
        MONGO_INITDB_ROOT_PASSWORD: {{ .State.password | quote }}
      healthcheck:
        test: ["CMD-SHELL", "echo 'db.runCommand(\"ping\").ok' | mongosh -u $$MONGO_INITDB_ROOT_USERNAME -p $$MONGO_INITDB_ROOT_PASSWORD"]
        interval: 2s
        timeout: 5s
        retries: 15
        start_period: 10s
      volumes:
      - type: volume
        source: {{ .State.serviceName }}-data
        target: /data/db
        volume:
          nocopy: true
  info_logs: |
    - "{{.Uid}}: To connect to mongo: \"docker exec -ti {{ .ComposeProjectName }}-{{ .State.serviceName }}-1 mongosh -u {{ .State.username }} -p {{ .State.password }}\""

# The default mysql provisioner adds a mysql instance and then ensures that the required databases are created on
# startup.
- uri: template://default-provisioners/mysql
  # By default, match all mysql types regardless of class and id. If you want to override this, create another
  # provisioner definition with a higher priority.
  type: mysql
  # Init template has the random service name and password if needed later
  init: |
    randomServiceName: mysql-{{ randAlphaNum 6 }}
    randomDatabase: db{{ randAlpha 8 }}
    randomUsername: user-{{ randAlpha 8 }}
    randomPassword: {{ randAlphaNum 16 | quote }}
    randomRootPassword: {{ randAlphaNum 16 | quote }}
    sk: default-provisioners-mysql-instance
    publishPort: {{ dig "annotations" "compose.score.dev/publish-port" "0" .Metadata | quote }}
  # The state for each database resource is a unique db name and credentials
  state: |
    database: {{ dig "database" .Init.randomDatabase .State | quote }}
    username: {{ dig "username" .Init.randomUsername .State | quote }}
    password: {{ dig "password" .Init.randomPassword .State | quote }}
  # All instances agree on the shared state since there is no concurrency here
  shared: |
    {{ .Init.sk }}:
      instanceServiceName: {{ dig .Init.sk "instanceServiceName" .Init.randomServiceName .Shared | quote }}
      instancePassword: {{ dig .Init.sk "instancePassword" .Init.randomPassword .Shared | quote }}
      instanceRootPassword: {{ dig .Init.sk "instanceRootPassword" .Init.randomRootPassword .Shared | quote }}
  # The outputs are the core database outputs. We output both name and database for broader compatibility.
  outputs: |
    host: {{ dig .Init.sk "instanceServiceName" "" .Shared }}
    port: 3306
    name: {{ .State.database }}
    database: {{ .State.database }}
    username: {{ .State.username }}
    password: {{ .State.password }}
  # Write out an idempotent create script per database
  files: |
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}-db-scripts/{{ .State.database }}.sql: |
      CREATE DATABASE IF NOT EXISTS {{ .State.database }};
      USE {{ .State.database }};
      CREATE USER IF NOT EXISTS '{{ .State.username }}'@'localhost' IDENTIFIED BY '{{ .State.password }}';
      GRANT ALL PRIVILEGES ON {{ .State.database }} TO '{{ .State.username }}'@'localhost';
      FLUSH PRIVILEGES;
  # Ensure the data volume exists
  volumes: |
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}-data:
      driver: local
  # Create an services with the database itself
  services: |
    {{ dig .Init.sk "instanceServiceName" "" .Shared }}:
      image: mysql:8
      restart: always
      environment:
        MYSQL_DATABASE: {{ .State.database }}
        MYSQL_USER: {{ .State.username }}
        MYSQL_PASSWORD: {{ dig .Init.sk "instancePassword" "" .Shared | quote }}
        MYSQL_ROOT_PASSWORD: {{ dig .Init.sk "instanceRootPassword" "" .Shared | quote }}
      {{ if ne .Init.publishPort "0" }}
      ports:
      - target: 3306
        published: {{ .Init.publishPort }}
      {{ end }}
      volumes:
      - type: bind
        source: {{ .MountsDirectory }}/{{ dig .Init.sk "instanceServiceName" "" .Shared }}-db-scripts
        target: /docker-entrypoint-initdb.d/
      - type: volume
        source: {{ dig .Init.sk "instanceServiceName" "" .Shared }}-data
        target: /var/lib/mysql
      healthcheck:
        test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-uroot", "-p$${MYSQL_ROOT_PASSWORD}"]
        interval: 5s
        timeout: 3s
        retries: 10
  info_logs: |
    - "{{.Uid}}: To connect to mysql, enter password {{ .State.password | squote }} at: \"docker run -it --network {{ .ComposeProjectName }}_default --rm mysql:8 mysql -h {{ dig .Init.sk "instanceServiceName" "" .Shared }} -u {{ .State.username }} -p\""
    {{ if ne .Init.publishPort "0" }}
    - "{{.Uid}}: Or connect your mysql client to \"
    mysql://{{ .State.username }}:{{ .State.password }}@{{ dig .Init.sk "instanceServiceName" "" .Shared }}:{{ .Init.publishPort }}/{{ .State.database }}\""
    {{ end }}

- uri: template://default-provisioners/kafka-topic
  type: kafka-topic
  init: |
    brokerPort: 9092
    ctrlPort: 9093
  state: |
    topic: {{ dig "topic" (print "topic-" (randAlphaNum 6)) .State | quote }}
  shared: |
    shared_kafka_instance_name: {{ dig "shared_kafka_instance_name" (print "kafka-" (randAlphaNum 6)) .Shared | quote }}
  services: |
    {{ .Shared.shared_kafka_instance_name }}:
      image: bitnami/kafka:latest
      restart: always
      environment:
        KAFKA_CFG_NODE_ID: "0"
        KAFKA_CFG_PROCESS_ROLES: controller,broker
        KAFKA_CFG_LISTENERS: "PLAINTEXT://:{{ .Init.brokerPort }},CONTROLLER://:{{ .Init.ctrlPort }}"
        KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP: "CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT"
        KAFKA_CFG_CONTROLLER_QUORUM_VOTERS: "0@{{ .Shared.shared_kafka_instance_name }}:{{ .Init.ctrlPort }}"
        KAFKA_CFG_CONTROLLER_LISTENER_NAMES: CONTROLLER
        KAFKA_CFG_AUTO_CREATE_TOPICS_ENABLE: "false"
      healthcheck:
        test: ["CMD", "kafka-topics.sh", "--list", "--bootstrap-server=localhost:{{ .Init.brokerPort }}"]
        interval: 2s
        timeout: 2s
        retries: 10
      {{ $publishPort := (dig "annotations" "compose.score.dev/publish-port" "0" .Metadata | atoi) }}
      {{ if ne $publishPort 0 }}
      ports:
      - target: {{ .Init.brokerPort }}
        published: {{ $publishPort }}
      {{ end }}
      volumes:
      - type: volume
        source: {{ .Shared.shared_kafka_instance_name }}-data
        target: /bitnami/kafka
    {{ .State.topic }}-init:
      image: bitnami/kafka:latest
      entrypoint: ["/bin/sh"]
      command: ["-c", "kafka-topics.sh --topic={{.State.topic}} --bootstrap-server=localhost:{{ .Init.brokerPort }} --describe || kafka-topics.sh --topic={{.State.topic}} --bootstrap-server=localhost:{{ .Init.brokerPort }} --create --partitions=3"]
      network_mode: "service:{{ .Shared.shared_kafka_instance_name }}"
      labels:
        dev.score.compose.labels.is-init-container: "true"
      depends_on:
        {{ .Shared.shared_kafka_instance_name }}:
          condition: service_healthy
          restart: true
  volumes: |
    {{ .Shared.shared_kafka_instance_name }}-data:
      driver: local
  outputs: |
    host: {{ .Shared.shared_kafka_instance_name }}
    port: "{{ .Init.brokerPort }}"
    name: {{ .State.topic }}
    num_partitions: 3

# The default elasticsearch provisioner adds a elasticsearch instance.
- uri: template://default-provisioners/elasticsearch
  # By default, match all elasticsearch types regardless of class and id.
  # If you want to override this, create another provisioner definition with a higher priority.
  type: elasticsearch
  # Init template has the random service name and password if needed later
  init: |
    serviceName: elasticsearch
    randomPassword: {{ randAlphaNum 16 | quote }}
    clusterName: cluster-ecs-{{ randAlphaNum 6 }}
    username: elastic
    sk: default-provisioners-elasticsearch-instance
    publishPort: {{ dig "annotations" "compose.score.dev/publish-port" "9200" .Metadata | quote }}
    license: {{ dig "annotations" "compose.score.dev/license" "basic" .Metadata | quote }}
    stackVersion: {{ dig "annotations" "compose.score.dev/stack-version" "8.14.0" .Metadata | quote }}
    esMemLimit: {{ dig "annotations" "compose.score.dev/es-mem-limit" "1073741824" .Metadata | quote }}
  # The state for each elasticsearch resource is a unique host, port, and credentials
  state: |
    clusterName: {{ dig "clusterName" .Init.clusterName .State | quote }}
    username: {{ dig "username" .Init.username .State | quote }}
    password: {{ dig "password" .Init.randomPassword .State | quote }}
    host: {{ dig "host" .Init.serviceName .State | quote }}
  outputs: |
    host: {{ .State.host }}
    port: {{ .Init.publishPort }}
    username: {{ .State.username | quote }}
    password: {{ .State.password | quote }}
  # Ensure the data volume exists
  volumes: |
    ecscerts:
      driver: local
    ecsdata:
      driver: local
  # Create 2 services, the first is the setup container which creates the certificates, the second is the elasticsearch itself
  services: |
    setup:
      image: docker.elastic.co/elasticsearch/elasticsearch:{{ .Init.stackVersion }}
      volumes:
      - type: volume
        source: ecscerts
        target: /usr/share/elasticsearch/config/certs
      user: "0"
      command:
      - "bash"
      - "-c"
      - |
        if [ ! -f config/certs/ca.zip ]; then
          echo "Creating CA";
          bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
          unzip config/certs/ca.zip -d config/certs;
        fi;
        if [ ! -f config/certs/certs.zip ]; then
          echo "Creating certs";
          echo -ne \
          "instances:\n"\
          "  - name: {{ .State.host }}\n"\
          "    dns:\n"\
          "      - {{ .State.host }}\n"\
          "      - localhost\n"\
          "    ip:\n"\
          "      - 127.0.0.1\n"\
          > config/certs/instances.yml;
          bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key;
          unzip config/certs/certs.zip -d config/certs;
        fi;
        echo "Setting file permissions"
        chown -R root:root config/certs;
        find . -type d -exec chmod 750 \{\} \;;
        find . -type f -exec chmod 640 \{\} \;;
        echo "Waiting for Elasticsearch availability";
        until curl -s --cacert config/certs/ca/ca.crt https://{{ .State.host }}:9200 | grep -q "missing authentication credentials"; do sleep 10; done;
        echo "All done!";
      healthcheck:
        test: ["CMD-SHELL", "[ -f config/certs/{{ .State.host }}/{{ .State.host }}.crt ]"]
        interval: 1s
        timeout: 5s
        retries: 120
    {{ .State.host }}:
      depends_on:
        setup:
          condition: service_healthy
      image: docker.elastic.co/elasticsearch/elasticsearch:{{ .Init.stackVersion }}
      labels:
        co.elastic.logs/module: elasticsearch
      volumes:
      - type: volume
        source: ecscerts
        target: /usr/share/elasticsearch/config/certs
      - type: volume
        source: ecsdata
        target: /usr/share/elasticsearch/data
      ports:
      - target: 9200
        published: {{ .Init.publishPort }}
      environment:
        - node.name={{ .State.host }}
        - cluster.name={{ .State.clusterName }}
        - discovery.type=single-node
        - bootstrap.memory_lock=true
        - ELASTIC_PASSWORD={{ .State.password }}
        - xpack.security.enabled=true
        - xpack.security.http.ssl.enabled=true
        - xpack.security.http.ssl.key=certs/{{ .State.host }}/{{ .State.host }}.key
        - xpack.security.http.ssl.certificate=certs/{{ .State.host }}/{{ .State.host }}.crt
        - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
        - xpack.security.transport.ssl.enabled=true
        - xpack.security.transport.ssl.key=certs/{{ .State.host }}/{{ .State.host }}.key
        - xpack.security.transport.ssl.certificate=certs/{{ .State.host }}/{{ .State.host }}.crt
        - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
        - xpack.security.transport.ssl.verification_mode=certificate
        - xpack.license.self_generated.type={{ .Init.license }}
      mem_limit: {{ .Init.esMemLimit }}
      ulimits:
        memlock:
          soft: -1
          hard: -1
      healthcheck:
        test:
          [
            "CMD-SHELL",
            "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
          ]
        interval: 10s
        timeout: 10s
        retries: 120
  info_logs: |
    - "{{.Uid}}: To connect to elasticsearch:\n
        download certificate from container per command like: \n
        \tdocker cp [CONTAINER-NAME]:/usr/share/elasticsearch/config/certs/ca/ca.crt /tmp/ \n
        and than check connection per culr like: \n
        \tcurl --cacert /tmp/ca.crt -u {{ .State.username }}:{{ .State.password }} https://localhost:{{ .Init.publishPort }}"