version: "3.8"

services:
  postgres:
    image: postgres:15
    environment:
      POSTGRES_DB: kestra
      POSTGRES_USER: kestra
      POSTGRES_PASSWORD: kestra
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U kestra"]
      interval: 5s
      timeout: 5s
      retries: 10

  kestra:
    image: kestra/kestra:latest-full
    pull_policy: always
    user: "root"
    command: server standalone --flow-path /flows
    volumes:
      - kestra_data:/app/storage
      - ./flows:/flows                         # auto-loads all flows on startup
      - /var/run/docker.sock:/var/run/docker.sock
      - /tmp/kestra-wd:/tmp/kestra-wd
      # Mount your Snowflake private key into the container (read-only).
      # SNOWFLAKE_PRIVATE_KEY_FILE must be an absolute path in your .env file.
      - ${SNOWFLAKE_PRIVATE_KEY_FILE}:/secrets/rsa_key.p8:ro
    environment:
      KESTRA_CONFIGURATION: |
        datasources:
          postgres:
            url: jdbc:postgresql://postgres:5432/kestra
            driverClassName: org.postgresql.Driver
            username: kestra
            password: kestra
        kestra:
          server:
            basicAuth:
              enabled: false
          repository:
            type: postgres
          storage:
            type: local
            local:
              basePath: "/app/storage"
          queue:
            type: postgres
          tasks:
            tmpDir:
              path: /tmp/kestra-wd/tmp
          url: http://localhost:8080/
          variables:
            env-vars-prefix: ""            # allows reading all env vars as {{ envs.VAR }}
      # Snowflake — key pair auth (no password); copy .env.example to .env and fill in
      SNOWFLAKE_ACCOUNT: ${SNOWFLAKE_ACCOUNT}
      SNOWFLAKE_USERNAME: ${SNOWFLAKE_USERNAME}
      SNOWFLAKE_PRIVATE_KEY_PASSPHRASE: ${SNOWFLAKE_PRIVATE_KEY_PASSPHRASE:-}
      SNOWFLAKE_WAREHOUSE: ${SNOWFLAKE_WAREHOUSE:-PROD_ETL_WAREHOUSE}
      SNOWFLAKE_DATABASE: ${SNOWFLAKE_DATABASE:-FACTS}
      SNOWFLAKE_SCHEMA: ${SNOWFLAKE_SCHEMA:-QA}   # default to QA for local dev
      SLACK_WEBHOOK_URL: ${SLACK_WEBHOOK_URL:-}
    ports:
      - "8080:8080"   # UI + API
      - "8081:8081"   # management
    depends_on:
      postgres:
        condition: service_healthy

volumes:
  postgres_data:
  kestra_data: