# Britive Bridge — standalone (single-container) deployment.
# One Bridge container + PostgreSQL. See:
#   https://learn.britive.com/bridge/deploy/single
#
# Before starting:
#   1. Put your encryption key in a .env file next to this file:
#        BRIDGE_ENCRYPTION_KEY_B64=<openssl rand -base64 32>   (keep it stable)
#   2. Set your tenant in bridge.yaml (server.auth.britive.tenant).
#   3. docker compose up -d   →   open https://localhost/
services:
  postgres:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: bridge
      POSTGRES_PASSWORD: bridge
      POSTGRES_DB: bridge
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "bridge"]
      interval: 5s
      retries: 10

  bridge:
    image: britive/bridge:latest        # pull from Docker Hub
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      # Path to the config file inside the container
      BRIDGE_CONFIG: /etc/britive-bridge/config.yaml
      # Read from the .env file next to this compose file. The :? makes
      # `docker compose up` fail fast if it isn't set. Keep this value stable.
      BRIDGE_ENCRYPTION_KEY_B64: "${BRIDGE_ENCRYPTION_KEY_B64:?set BRIDGE_ENCRYPTION_KEY_B64 (openssl rand -base64 32) in .env}"
      # Optional — Britive platform integration. The broker-pool token runs the
      # co-located Britive broker (JIT checkout provisioning) AND enables automatic
      # license retrieval + renewal. The broker creates checkouts against the Bridge
      # admin API using BRIDGE_CLUSTER_TOKEN, so set it too when enabling the broker
      # — otherwise checkouts fail with "cluster token required".
      # BRITIVE_BROKER_AUTH_TOKEN: "your-broker-pool-token"
      # BRITIVE_BROKER_TENANT_SUBDOMAIN: "your-tenant"                # e.g. acme
      # BRIDGE_CLUSTER_TOKEN: "generate-with: openssl rand -hex 32"   # required when the broker is enabled
      # BRIDGE_API_URL: "https://localhost:443"                       # this stack serves the API on 443 (broker default is :8080)
    volumes:
      - ./bridge.yaml:/etc/britive-bridge/config.yaml:ro
      - recordings:/data/recordings
    ports:
      - "443:443"     # web app (https://localhost)
      - "22:22"       # native SSH

volumes:
  pgdata:
  recordings:
