services:
  cert-gen:
    image: ras-certgen:latest
    volumes:
      - ./certs:/work/certs
    working_dir: /work/certs
    entrypoint: [ "/bin/sh", "-c" ]
    environment:
      - OSCAR_HOST=${OSCAR_HOST}
    command:
      - "openssl req -x509 -newkey rsa:${CERT_KEY_BITS:-2048}
         -keyout ca-key.pem
         -out ca.crt
         -sha256 -days 365 -nodes
         -subj \"/CN=Open OSCAR Server Root CA\"
         && openssl req -newkey rsa:${CERT_KEY_BITS:-2048}
         -keyout key.pem
         -out server.csr
         -sha256 -nodes
         -subj \"/CN=${OSCAR_HOST}\"
         && echo \"basicConstraints=critical,CA:FALSE\" > server.ext
         && echo \"keyUsage=critical,digitalSignature,keyEncipherment\" >> server.ext
         && echo \"extendedKeyUsage=serverAuth\" >> server.ext
         && echo \"subjectAltName=DNS:${OSCAR_HOST},DNS:api.oscar.aol.com,DNS:api.screenname.aol.com,DNS:login.oscar.aol.com,DNS:my.screenname.aol.com,DNS:api.aim.net\" >> server.ext
         && openssl x509 -req
         -in server.csr
         -CA ca.crt -CAkey ca-key.pem -CAcreateserial
         -out cert.pem
         -sha256 -days 365
         -extfile server.ext
         && cat cert.pem key.pem > server.pem
         && rm cert.pem key.pem ca-key.pem server.csr server.ext ca.srl"

  nss-gen:
    image: ras-certgen:latest
    volumes:
      - ./certs:/work/certs
    working_dir: /work/certs
    entrypoint: [ "/bin/sh", "-c" ]
    command:
      - "rm -rf nss
         && mkdir -p nss
         && certutil -N -d nss --empty-password
         && certutil -A -n \"Open OSCAR Server Root CA\" -t \"CT,,C\" -i ca.crt -d nss"

  open-oscar-server:
    image: ras:latest
    ports:
      - "5190:5190"
      - "8080:8080"
      - "9898:9898"
      - "1088:1088"
      - "4000:4000/udp"
    env_file:
      - ./config/ssl/settings.env
    volumes:
      - .:/project
    working_dir: /project

  nginx:
    image: ${NGINX_IMAGE:-ras-nginx:1.28.0-openssl-1.0.2u}
    # nginx resolves the upstream hostname at startup, so the server container
    # must exist first.
    depends_on:
      - open-oscar-server
    ports:
      - "80:80"
      - "443:443"
      - "5193:5193"
    volumes:
      - ./config/ssl/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./certs:/etc/nginx/certs:ro
      - ${CLIENT_DIR:-./clients}:/srv/client:ro