docker-compose.dev.yaml

# good to specify the project name for a more consistent resulting environment. For example, network names
# are prefixed by the compose file's project name https://docs.docker.com/compose/how-tos/networking/
name: iidi

networks:
  host-loopback:
    driver: bridge
    driver_opts:
      # the default docker bridge driver behaviour is to bind exposed ports on 0.0.0.0, making them accessible
      # from the local network. Not good, unless you're on a known-safe network (ha) and specifically want to
      # serve dev traffic from other local devices (e.g. testing on mobile devices).
      # Configuring this network to bind on loopback instead, so that only incoming traffic from the host machine
      # can reach our containers on their dev ports
      com.docker.network.bridge.host_binding_ipv4: '127.0.0.1'
  gateway:
    driver: bridge
    internal: true
  on-fhir-db:
    # If/when access is needed, run docker compose with a shell attached to the db cluster directly, don't open to host network
    driver: bridge
    internal: true
  on-bullmq-redis:
    # If/when access is needed, run docker compose with a shell attached to the db cluster directly, don't open to host network
    driver: bridge
    internal: true
  on-internal:
    driver: bridge
    internal: true
  bc-fhir-db:
    # If/when access is needed, run docker compose with a shell attached to the db cluster directly, don't open to host network
    driver: bridge
    internal: true
  bc-bullmq-redis:
    # If/when access is needed, run docker compose with a shell attached to the db cluster directly, don't open to host network
    driver: bridge
    internal: true
  bc-internal:
    driver: bridge
    internal: true
  federal-internal:
    driver: bridge
    internal: true

configs:
  gateway.default.conf:
    # Configure this to mock the behaviour of the /k8s cluster's gateway configuration
    # Note: double $'s (`$$`) below are escaped single $'s, to avoid docker compose variable interpolation
    content: |
      server {
          location /on/fhir/ {
              # set proxy headers
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              
              # WebSocket support
              proxy_http_version 1.1;
              proxy_set_header Upgrade $$http_upgrade;
              proxy_set_header Connection "upgrade";

              # prevent nginx from dropping the port from localhost urls
              absolute_redirect off;

              proxy_pass http://on-fhir:8080/fhir/;
          }
          location /on/aggregator/ {
              # set proxy headers
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              
              # WebSocket support
              proxy_http_version 1.1;
              proxy_set_header Upgrade $$http_upgrade;
              proxy_set_header Connection "upgrade";

              # prevent nginx from dropping the port from localhost urls
              absolute_redirect off;

              proxy_pass http://on-aggregator:5000/;
          }
          location /on/browser/ {
              # set proxy headers
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              
              # WebSocket support
              proxy_http_version 1.1;
              proxy_set_header Upgrade $$http_upgrade;
              proxy_set_header Connection "upgrade";

              # prevent nginx from dropping the port from localhost urls
              absolute_redirect off;

              # fix relative paths in returned HTML/JS/CSS
              # necessary for the patient browser as it doesn't let us directly configure a server root like the fhir servers do
              sub_filter_once off; sub_filter_types *;
              sub_filter '/assets' '/on/browser/assets';
              sub_filter '/images' '/on/browser/images';
              proxy_pass http://on-patient-browser:80/;
          }
          location /on/inbound/ {
              # set proxy headers
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              
              # WebSocket support
              proxy_http_version 1.1;
              proxy_set_header Upgrade $$http_upgrade;
              proxy_set_header Connection "upgrade";

              # prevent nginx from dropping the port from localhost urls
              absolute_redirect off;

              proxy_pass http://on-transfer-inbound:3000/;
          }
          location /on/outbound/ {
              # set proxy headers
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              
              # WebSocket support
              proxy_http_version 1.1;
              proxy_set_header Upgrade $$http_upgrade;
              proxy_set_header Connection "upgrade";

              # prevent nginx from dropping the port from localhost urls
              absolute_redirect off;

              proxy_pass http://on-transfer-outbound:3000/;
          }

          location /bc/fhir/ {
              # set proxy headers
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              
              # WebSocket support
              proxy_http_version 1.1;
              proxy_set_header Upgrade $$http_upgrade;
              proxy_set_header Connection "upgrade";

              # prevent nginx from dropping the port from localhost urls
              absolute_redirect off;

              proxy_pass http://bc-fhir:8080/fhir/;
          }
          location /bc/aggregator/ {
              # set proxy headers
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              
              # WebSocket support
              proxy_http_version 1.1;
              proxy_set_header Upgrade $$http_upgrade;
              proxy_set_header Connection "upgrade";

              # prevent nginx from dropping the port from localhost urls
              absolute_redirect off;

              proxy_pass http://bc-aggregator:5000/;
          }
          location /bc/browser/ {
              # set proxy headers
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              
              # WebSocket support
              proxy_http_version 1.1;
              proxy_set_header Upgrade $$http_upgrade;
              proxy_set_header Connection "upgrade";

              # prevent nginx from dropping the port from localhost urls
              absolute_redirect off;

              # fix relative paths in returned HTML/JS/CSS
              # necessary for the patient browser as it doesn't let us directly configure a server root like the fhir servers do
              sub_filter_once off; sub_filter_types *;
              sub_filter '/assets' '/bc/browser/assets';
              sub_filter '/images' '/bc/browser/images';
              proxy_pass http://bc-patient-browser:80/;
          }
          location /bc/inbound/ {
              # set proxy headers
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              
              # WebSocket support
              proxy_http_version 1.1;
              proxy_set_header Upgrade $$http_upgrade;
              proxy_set_header Connection "upgrade";

              # prevent nginx from dropping the port from localhost urls
              absolute_redirect off;

              proxy_pass http://bc-transfer-inbound:3000/;
          }
          location /bc/outbound/ {
              # set proxy headers
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              
              # WebSocket support
              proxy_http_version 1.1;
              proxy_set_header Upgrade $$http_upgrade;
              proxy_set_header Connection "upgrade";

              # prevent nginx from dropping the port from localhost urls
              absolute_redirect off;

              proxy_pass http://bc-transfer-outbound:3000/;
          }

          location /fed/federator/ {
              # set proxy headers
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              
              # WebSocket support
              proxy_http_version 1.1;
              proxy_set_header Upgrade $$http_upgrade;
              proxy_set_header Connection "upgrade";

              # prevent nginx from dropping the port from localhost urls
              absolute_redirect off;

              proxy_pass http://federator:3000/;
          }
          location /fed/dashboard/ {
              # set proxy headers
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              
              # WebSocket support
              proxy_http_version 1.1;
              proxy_set_header Upgrade $$http_upgrade;
              proxy_set_header Connection "upgrade";

              # prevent nginx from dropping the port from localhost urls
              absolute_redirect off;

              proxy_pass http://dashboard:3838/;
          }

          location / {
              # set proxy headers
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              
              # WebSocket support
              proxy_http_version 1.1;
              proxy_set_header Upgrade $$http_upgrade;
              proxy_set_header Connection "upgrade";

              # prevent nginx from dropping the port from localhost urls
              absolute_redirect off;

              proxy_pass http://demo-portal:8080/;
          }
          location /demo-transfer-dashboard/ {
              # set proxy headers
              proxy_set_header Host $$host;
              proxy_set_header X-Real-IP $$remote_addr;
              proxy_set_header X-Forwarded-For $$proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $$scheme;
              
              # WebSocket support
              proxy_http_version 1.1;
              proxy_set_header Upgrade $$http_upgrade;
              proxy_set_header Connection "upgrade";

              # prevent nginx from dropping the port from localhost urls
              absolute_redirect off;

              proxy_pass http://demo-transfer-dashboard:3005/demo-transfer-dashboard/;

              # This part's important. rspack dev server URIs are a mix of static content resources on the server and SPA routes.
              # If the dev server doesn't have a resource, then it must be assumed that URI is actually an SPA route,
              # so replace UI server 404's with the index.html, to load the SPA and let it handle the route client side.
              # In deployments, the static file server should itself use nginx with an equivalent config (using `try_file`,
              # but that's not an option when proxying). Direct requests to the rspack dev server also work as expected by default,
              # but not when proxied through nginx like this (nginx layers in its own 404 response by default)
              proxy_intercept_errors on;
              error_page 404 = /index.html;
          }
      }
  hapi:
    file: ./hapi-dev.application.yaml
  dev-private-key.conf:
    content: |
      -----BEGIN PRIVATE KEY-----
      MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCkfEGarFSuxaUt
      GHC7m/Rr45AbUge7S7DRUyqofM6SWDt4tWE3/JNlsVWsNUyrIJKYIMrOVcfmKTRS
      Ber8WFuE7MjTRqXJvupO6vNxo3G/Y63CEoHIxkzsR01OZaGCbaU/yejs5HKXnn+g
      KNxLJGRYxOHg+IsRIM2ZkqjSdGvY2Z+XzUuMA2HhFv3BOMcnAoqTUpat4YsahKfs
      8XRUhf57FWttbRjNz5t6MMdahD3rLGyGkxlTCw1T6LpGMscj2c36r8JRITXp688x
      y6k1JktpVlUFVkY6aykgIzjClDCE53dAEq1V6qa6EqvMkgAPBl9jNRdY9N6u/Ln5
      q4KDLj6hAgMBAAECggEATzIemjzgNxglm+1ZFhOUXz/9mhHodBcRBvBOqToSceb2
      l3tpWD4NsBhuohA1nm1797BORYOK0HhFXzrHNgHK6tjhJsystVLtWNsKJMxnz5lM
      R5WGlKdZ0SfRgm4vke998ZUjR7AEtpjTZUdXLfzTLeR5x0qUFsafB5LUIyR36ruz
      1VxXcTntdSPu199J1BcUFbsH0tW3b3oK0NR/iCbtISpohBfqO70XADHZdUzJ2uGU
      3JWKG9EXMPhjO1jbwrQU6God7or1WagLrddCqGa72eGJhSt5cQEcgin0gayPH2Be
      zwydfJYmoTPdGdFJgD8HEnQlY/DRxfALE7Iv0PevqwKBgQDRYlVNCiptZUK4QFdh
      P27ylqMU52S8i2CGL/LA4QY36Wx7zXIlgeMPKtn6FLJatnhffVOFWnCutND8E/6J
      c39/EUcBZcLYsOS3SL8zyTOykNbuA4nGoagYLie0WHFKMJTH+wZ4Rtmx4xxSgXIr
      lByLpbUN6iqW6DB1FawjIbl5LwKBgQDJGvVP+hUZTs2fgYlaz6Xtc0zL1/Vb6NJk
      N391aQWHCSaxgADvYX5kgWfAqwXYe7VWwt2C3botJfEDn/OD103nFAa79QDtnsCz
      5yip0V1K3PTmIIr6NC1eut4S8BB4AH761qKYv8XyRvYq+Jq59WkZtu1Icwsvr+eY
      8mmAg0ExLwKBgGiew5Rs4eorUH0T2RVERsF7txy4ycLTuXUS/C6XwS2quoPZkZFg
      Jv3rIWMteDiPN/Iugs7885S30DxEGUjApxHsphfyqrrvGDjkZnUPsX8lk971caAI
      Ih+C4F/iWSkCwTRzHzZ14Exb+EjZWRyhMuor8B11xbYFakD2hT5AmZYNAoGBAIFv
      hXZ9SnkofDXuhL5bKbuj20jT7YrDVi7EfZfPCYy5OhtCfNeV02jS1TlvmeqU7Mkz
      0Kh7F2oZon8nwu8Xc3+IJzFwZrGJ3ROtc0GhjD8z6bf4OBsD3DO9aFOeCauC/jdq
      T+qqe7gNLkHIEqYfqw6u6xgXW5rMx+5sD7V0RVBnAoGBAIczI4KAvqCFiQm3I4iM
      a7Cig+xuYWcupgRZ/9oLMSoGjnlKoVPQXkFI3xSD1+tGFOReQkY8D0xuBlVliWT9
      IfasWSXTObh81fantIiqmgZzMQ1Wbz2OjCexF/vOHh+Ryr1a9+7WEqBwfdXAvSw6
      KwdDDg03Wzhv0UyXhk4fp/Nt
      -----END PRIVATE KEY-----
  dev-public-key.conf:
    content: |
      -----BEGIN PUBLIC KEY-----
      MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApHxBmqxUrsWlLRhwu5v0
      a+OQG1IHu0uw0VMqqHzOklg7eLVhN/yTZbFVrDVMqyCSmCDKzlXH5ik0UgXq/Fhb
      hOzI00alyb7qTurzcaNxv2OtwhKByMZM7EdNTmWhgm2lP8no7ORyl55/oCjcSyRk
      WMTh4PiLESDNmZKo0nRr2Nmfl81LjANh4Rb9wTjHJwKKk1KWreGLGoSn7PF0VIX+
      exVrbW0Yzc+bejDHWoQ96yxshpMZUwsNU+i6RjLHI9nN+q/CUSE16evPMcupNSZL
      aVZVBVZGOmspICM4wpQwhOd3QBKtVeqmuhKrzJIADwZfYzUXWPTervy5+auCgy4+
      oQIDAQAB
      -----END PUBLIC KEY-----

services:
  gateway:
    image: nginx:1.27.3
    tty: ${DOCKER_TTY:-true}
    restart: always
    configs:
      - source: gateway.default.conf
        target: /etc/nginx/conf.d/default.conf
        mode: 0444 # this is the default value, making explicit as something in codespaces seems to overide it
    networks:
      - gateway
      - host-loopback
    ports:
      - 8080:80

  on-fhir-db: &fhir-db-service
    image: postgres:14.11-alpine
    tty: ${DOCKER_TTY:-true}
    restart: always
    networks:
      - on-fhir-db
    ports:
      - 5432:5432
    environment: &fhir-db-env
      POSTGRES_DB: hapi-fhir-db
      POSTGRES_USER: hapi-fhir-db
      POSTGRES_PASSWORD: local-dev-value
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U hapi-fhir-db -d hapi-fhir-db']
      interval: 10s
      retries: 5
      start_period: 30s
      timeout: 10s
  on-fhir: &fhir-service
    image: hapiproject/hapi:latest
    tty: ${DOCKER_TTY:-true}
    restart: always
    networks:
      - gateway
      - on-fhir-db
      - on-internal
    ports:
      - 8080:8080
    configs:
      - source: hapi
        target: /app/config/application.yaml
        mode: 0444 # this is the default value, making explicit as something in codespaces seems to overide it
    environment:
      # NOTE: the env vars below are interpolated in to the hapi application.yaml at run time
      # If you add any env vars for other purposes, put them above this comment, to keep track of things
      <<: *fhir-db-env
      DB_PORT: 5432
      DB_HOST: on-fhir-db
      FHIR_SERVER_ADDRESS: '${IIDI_NGINX_HOST:-http://localhost:8080}/on/fhir' # see proxy address via gateway.default.conf
  on-synthesizer: &synthesizer-service
    image: synthesizer:1.4
    pull_policy: never # this is a named local image, disable docker default attempt to pull from a remote
    build:
      context: ./synthesizer
    tty: ${DOCKER_TTY:-true}
    restart: on-failure # reattempt until successful
    networks:
      - on-internal
    environment:
      NUM_RECORDS: 100
      PT: on
      FHIR_URL: http://on-fhir:8080/fhir # in this case, resolved inside the container, with container networking
  on-aggregator: &aggregator-service
    image: aggregator:1.10
    pull_policy: never # this is a named local image, disable docker default attempt to pull from a remote
    build:
      context: ./aggregator
    tty: ${DOCKER_TTY:-true}
    restart: always
    configs:
      - source: dev-public-key.conf
        target: /dev-secrets/public_key.pem
        mode: 0444 # this is the default value, making explicit as something in codespaces seems to overide it
    networks:
      - gateway
      - on-internal
    ports:
      - 5000:5000
    environment:
      IS_LOCAL_DEV: true
      AGGREGATION_INTERVAL: 60
      FHIR_URL: http://on-fhir:8080/fhir # in this case, resolved inside the container, with container networking
      PUBLIC_KEY_PATH: /dev-secrets/public_key.pem
  on-patient-browser: &patient-browser-service
    image: patient-browser:1.1
    pull_policy: never # this is a named local image, disable docker default attempt to pull from a remote
    build:
      context: ./patient-browser
    tty: ${DOCKER_TTY:-true}
    restart: always
    networks:
      - gateway
      - on-internal
    ports:
      - 80:80
    environment:
      FHIR_URL: '${IIDI_NGINX_HOST:-http://localhost:8080}/on/fhir/' # in this case, resolved in the host browser, not container networking, see gateway.default.conf
  on-transfer-inbound: &transfer-inbound-service
    image: node-dev:1.0
    pull_policy: never # this is a named local image, disable docker default attempt to pull from a remote
    build:
      context: ./node-dev-docker-env
      dockerfile: ./Dockerfile.node-dev
    tty: ${DOCKER_TTY:-true}
    restart: always
    volumes:
      - ./transfer-inbound:/home/node-dev/project
      - ./transfer-inbound/.env.node-dev-docker-env-overrides:/home/node-dev/project/.env
    command: npm run dev:${DOCKER_API_COMMAND:-docker} # 'docker' or 'docker-debug'
    networks:
      - gateway
      - on-internal
        # node-dev images need to reach the internet for installing packages at run time, and to surface debug servers directly.
        # For docker networking and prod-parity purposes, service-to-service communications should still go through the nginx gateway
      - host-loopback
    ports:
      - 3001:3000
      - 9231:9229 # for the node debug server, when active; see node-dev-docker-env/package.json `dev:docker-debug` script
    environment:
      EXPRESS_PORT: 3000
      DEV_IS_LOCAL_ENV: True
      FHIR_URL: http://on-fhir:8080/fhir # in this case, resolved inside the container, with container networking
    develop:
      watch:
        # Sync code changes then restart the service
        - action: sync+restart
          path: ./transfer-inbound
          target: /home/node-dev/project
          ignore:
            - node_modules/
            - .env.node-dev-docker-env-overrides
        # Rebuild if Dockerfile or dependencies change
        - action: rebuild
          path: node-dev-docker-env/Dockerfile.node-dev
        - action: rebuild
          path: node-dev-docker-env/package.json
  on-bullmq-redis: &bullmq-redis
    image: redis:7.4.1-alpine
    tty: ${DOCKER_TTY:-true}
    restart: always
    networks:
      - on-bullmq-redis
    ports:
      - 6379:6379
    command: /bin/sh -c "redis-server --requirepass $$REDIS_PASSWORD --port $$REDIS_PORT --loglevel notice"
    environment: &bullmq-env
      REDIS_PORT: 6379
      REDIS_PASSWORD: local-dev-value
  on-transfer-outbound: &transfer-outbound-service
    image: node-dev:1.0
    pull_policy: never # this is a named local image, disable docker default attempt to pull from a remote
    build:
      context: ./node-dev-docker-env
      dockerfile: ./Dockerfile.node-dev
    tty: ${DOCKER_TTY:-true}
    restart: always
    volumes:
      - ./transfer-outbound:/home/node-dev/project
      - ./transfer-outbound/.env.node-dev-docker-env-overrides:/home/node-dev/project/.env
    command: npm run dev:${DOCKER_API_COMMAND:-docker} # 'docker' or 'docker-debug'
    networks:
      - gateway
      - on-internal
      - on-bullmq-redis
        # node-dev images need to reach the internet for installing packages at run time, and to surface debug servers directly.
        # For docker networking and prod-parity purposes, service-to-service communications should still go through the nginx gateway
      - host-loopback
    ports:
      - 3002:3000
      - 9232:9229 # for the node debug server, when active; see node-dev-docker-env/package.json `dev:docker-debug` script
    environment:
      <<: *bullmq-env
      EXPRESS_PORT: 3000
      DEV_IS_LOCAL_ENV: True
      REDIS_HOST: on-bullmq-redis
      FHIR_URL: http://on-fhir:8080/fhir # in this case, resolved inside the container, with container networking
      OWN_TRANSFER_CODE: 'ON'
      INBOUND_TRANSFER_SERIVCES_BY_TRANSFER_CODE: '{ "BC": "http://gateway:80/bc/inbound" }' # resolved inside the container, with container networking

  bc-fhir-db:
    <<: *fhir-db-service
    networks:
      - bc-fhir-db
  bc-fhir:
    <<: *fhir-service
    networks:
      - gateway
      - bc-fhir-db
      - bc-internal
    ports:
      - 8080:8080
    environment:
      <<: *fhir-db-env
      DB_PORT: 5432
      DB_HOST: bc-fhir-db
      FHIR_SERVER_ADDRESS: '${IIDI_NGINX_HOST:-http://localhost:8080}/bc/fhir' # see proxy address via gateway.default.conf
  bc-synthesizer:
    <<: *synthesizer-service
    networks:
      - bc-internal
    environment:
      NUM_RECORDS: 100
      PT: bc
      FHIR_URL: http://bc-fhir:8080/fhir # in this case, resolved inside the container, with container networking
  bc-aggregator:
    <<: *aggregator-service
    networks:
      - gateway
      - bc-internal
    environment:
      IS_LOCAL_DEV: true
      AGGREGATION_INTERVAL: 60
      FHIR_URL: http://bc-fhir:8080/fhir # in this case, resolved inside the container, with container networking
      PUBLIC_KEY_PATH: /dev-secrets/public_key.pem
  bc-patient-browser:
    <<: *patient-browser-service
    networks:
      - gateway
      - bc-internal
    environment:
      FHIR_URL: '${IIDI_NGINX_HOST:-http://localhost:8080}/bc/fhir/' # in this case, resolved in the host browser, not container networking, see gateway.default.conf
  bc-transfer-inbound:
    <<: *transfer-inbound-service
    command: npm run dev # note: only opening debug ports on the ON services
    networks:
      - gateway
      - bc-internal
        # node-dev images need to reach the internet for installing packages at run time, and to surface debug servers directly.
        # For docker networking and prod-parity purposes, service-to-service communications should still go through the nginx gateway
      - host-loopback
    ports:
      - 3003:3000
    environment:
      FHIR_URL: http://bc-fhir:8080/fhir # in this case, resolved inside the container, with container networking
  bc-bullmq-redis:
    <<: *bullmq-redis
    networks:
      - bc-bullmq-redis
    environment:
      <<: *bullmq-env
  bc-transfer-outbound:
    <<: *transfer-outbound-service
    command: npm run dev # note: only opening debug ports on the ON services
    networks:
      - gateway
      - bc-internal
      - bc-bullmq-redis
        # node-dev images need to reach the internet for installing packages at run time, and to surface debug servers directly.
        # For docker networking and prod-parity purposes, service-to-service communications should still go through the nginx gateway
      - host-loopback
    ports:
      - 3004:3000
    environment:
      <<: *bullmq-env
      EXPRESS_PORT: 3000
      DEV_IS_LOCAL_ENV: True
      REDIS_HOST: bc-bullmq-redis
      FHIR_URL: http://bc-fhir:8080/fhir # in this case, resolved inside the container, with container networking
      OWN_TRANSFER_CODE: 'BC'
      INBOUND_TRANSFER_SERIVCES_BY_TRANSFER_CODE: '{ "ON": "http://gateway:80/on/inbound" }' # resolved inside the container, with container networking

  federator:
    image: node-dev:1.0
    pull_policy: never # this is a named local image, disable docker default attempt to pull from a remote
    build:
      context: ./node-dev-docker-env
      dockerfile: ./Dockerfile.node-dev
    tty: ${DOCKER_TTY:-true}
    restart: always
    volumes:
      - ./federator:/home/node-dev/project
      - ./federator/.env.node-dev-docker-env-overrides:/home/node-dev/project/.env
    configs:
      - source: dev-private-key.conf
        target: /dev-secrets/private_key.pem
        mode: 0444 # this is the default value, making explicit as something in codespaces seems to overide it
    command: npm run dev:${DOCKER_API_COMMAND:-docker} # 'docker' or 'docker-debug'
    networks:
      - gateway
      - federal-internal
        # node-dev images need to reach the internet for installing packages at run time, and to surface debug servers directly.
        # For docker networking and prod-parity purposes, service-to-service communications should still go through the nginx gateway
      - host-loopback
    ports:
      - 3000:3000
      - 9229:9229 # for the node debug server, when active; see node-dev-docker-env/package.json `dev:docker-debug` script
    environment:
      EXPRESS_PORT: 3000
      DEV_IS_LOCAL_ENV: True
      AGGREGATOR_URLS: 'http://gateway/on/aggregator,http://gateway/bc/aggregator'
      PRIVATE_KEY_PATH: '/dev-secrets/private_key.pem'
  dashboard:
    image: rshiny-dashboard:1.0
    pull_policy: never # this is a named local image, disable docker default attempt to pull from a remote
    build:
      context: ./rshiny-dashboard
    tty: ${DOCKER_TTY:-true}
    restart: always
    networks:
      - gateway
      - federal-internal
    ports:
      - 3838:3838
    environment:
      AGGREGATOR_URL: http://federator:3000/aggregated-data

  demo-portal:
    image: demo-portal:1.5
    pull_policy: never # this is a named local image, disable docker default attempt to pull from a remote
    build:
      context: ./demo-portal
    tty: ${DOCKER_TTY:-true}
    networks:
      - gateway
    ports:
      - 8080:8080
    environment:
      FED_DASHBOARD_URL: '${IIDI_NGINX_HOST:-http://localhost:8080}/fed/dashboard'
      FED_FEDERATOR_URL: '${IIDI_NGINX_HOST:-http://localhost:8080}/fed/federator/aggregated-data'
      BC_BROWSER_URL: '${IIDI_NGINX_HOST:-http://localhost:8080}/bc/browser'
      BC_FHIR_URL: '${IIDI_NGINX_HOST:-http://localhost:8080}/bc/fhir'
      BC_AGGREGATOR_URL: '${IIDI_NGINX_HOST:-http://localhost:8080}/bc/aggregator/aggregated-data'
      BC_DEMO_TRANSFER_DASHBOARD_URL: '${IIDI_NGINX_HOST:-http://localhost:8080}/demo-transfer-dashboard?pt=BC'
      ON_BROWSER_URL: '${IIDI_NGINX_HOST:-http://localhost:8080}/on/browser'
      ON_FHIR_URL: '${IIDI_NGINX_HOST:-http://localhost:8080}/on/fhir'
      ON_AGGREGATOR_URL: '${IIDI_NGINX_HOST:-http://localhost:8080}/on/aggregator/aggregated-data'
      ON_DEMO_TRANSFER_DASHBOARD_URL: '${IIDI_NGINX_HOST:-http://localhost:8080}/demo-transfer-dashboard?pt=ON'
  demo-transfer-dashboard:
    image: node-dev:1.0
    pull_policy: never # this is a named local image, disable docker default attempt to pull from a remote
    build:
      context: ./node-dev-docker-env
      dockerfile: ./Dockerfile.node-dev
    tty: ${DOCKER_TTY:-true}
    restart: always
    volumes:
      - ./demo-transfer-dashboard:/home/node-dev/project
      - ./demo-transfer-dashboard/.env.node-dev-docker-env-overrides:/home/node-dev/project/.env
    command: npm run dev:${DOCKER_API_COMMAND:-docker} # 'docker' or 'docker-debug'
    networks:
      - gateway
        # node-dev images need to reach the internet for installing packages at run time, and to surface debug servers directly.
        # For docker networking and prod-parity purposes, service-to-service communications should still go through the nginx gateway
      - host-loopback
    ports:
      # configuring the websocket rsbuild uses to send hot reload signals is a bother with out proxy setup. The websockets can still
      # connect, bypassing the nginx proxy, if this container is 1) conntected to the host-loopback and 2) has the same exposed container port
      # (3005 right now) as it serves on internally (see the PORT env var below)
      - 3005:3005
      - 9233:9229 # for the node debug server, when active; see node-dev-docker-env/package.json `dev:docker-debug` script
    environment:
      PORT: 3005
      BASE_PATH: /demo-transfer-dashboard # see docker-compose nginx config, the rsbuild is behind a proxy path, needs to be configured to serve relative to it
      # the demo transfer dashboard will make transfer-outbound API request from the browser, so request must go through the nginx gateway paths
      ON_OUTBOUND_URL: '${IIDI_NGINX_HOST:-http://localhost:8080}/on/outbound'
      BC_OUTBOUND_URL: '${IIDI_NGINX_HOST:-http://localhost:8080}/bc/outbound'