Microservices and an API Gateway

import Vapor

/// One binary, three roles. The role and the peer URLs come from the environment, as they would from Compose.
func configure(_ app: Application) async throws {
    let role = Environment.get("SERVICE_NAME") ?? "gateway"
    let usersURL = Environment.get("USERS_URL") ?? "http://127.0.0.1:8081"
    let catalogURL = Environment.get("CATALOG_URL") ?? "http://127.0.0.1:8082"
    try await addServiceKey(to: app)

    switch role {
    case "users":
        app.serviceIdentity = ServiceIdentity(name: "users", allowedCallers: ["gateway", "catalog"])
        try await usersRoutes(app)
    case "catalog":
        app.serviceIdentity = ServiceIdentity(name: "catalog", allowedCallers: ["gateway"])
        // The catalog may retry its read of the users service, but only briefly: the gateway above it waits 2 seconds.
        catalogRoutes(app, users: UpstreamClient(name: "users", baseURL: usersURL, timeout: .milliseconds(400), attempts: 2))
    default:
        app.serviceIdentity = ServiceIdentity(name: "gateway", allowedCallers: [])
        // One layer retries (the one next to the failing dependency); the gateway does not retry on top of it.
        gatewayRoutes(app, users: UpstreamClient(name: "users", baseURL: usersURL, timeout: .seconds(1)),
                      catalog: UpstreamClient(name: "catalog", baseURL: catalogURL, timeout: .seconds(2)))
    }
    app.get("healthz") { _ in "ok" }
}

import Fluent
import FluentSQLiteDriver
import Vapor

/// The users service's table. Nothing outside the users service opens this database.
final class UserRow: Model, @unchecked Sendable {
    static let schema = "users"

    @ID(key: .id) var id: UUID?
    @Field(key: "email") var email: String
    @Field(key: "display_name") var displayName: String
    @Field(key: "password_hash") var passwordHash: String

    init() {}
}

/// The catalog service's review table. `user_id` is a plain value, not `@Parent`: the users table is in another
/// database, so there is no foreign key and no join. The catalog asks the users service when it needs a name.
final class ReviewRow: Model, @unchecked Sendable {
    static let schema = "reviews"

    @ID(key: .id) var id: UUID?
    @Field(key: "isbn") var isbn: String
    @Field(key: "user_id") var userID: UUID
    @Field(key: "stars") var stars: Int

    init() {}
}

struct CreateUsers: AsyncMigration {
    func prepare(on database: any Database) async throws {
        try await database.schema(UserRow.schema)
            .id()
            .field("email", .string, .required)
            .field("display_name", .string, .required)
            .field("password_hash", .string, .required)
            .unique(on: "email")
            .create()
    }
    func revert(on database: any Database) async throws { try await database.schema(UserRow.schema).delete() }
}

/// Each service connects to its own database, named by its own environment variable. In Compose these point at
/// different containers (or different databases on one server with different credentials).
func configureUsersDatabase(_ app: Application) async throws {
    app.databases.use(.sqlite(.file(Environment.get("USERS_DB_FILE") ?? "users.sqlite")), as: .sqlite)
    app.migrations.add(CreateUsers())
    try await app.autoMigrate()
}

import JWT
import Vapor

/// The claims of a service-to-service token: who is calling (`iss`, `sub`), which service it is meant for (`aud`),
/// and a lifetime of one minute.
struct ServiceClaims: JWTPayload {
    enum CodingKeys: String, CodingKey {
        case issuer = "iss", subject = "sub", audience = "aud", expiration = "exp"
    }

    var issuer: IssuerClaim
    var subject: SubjectClaim
    var audience: AudienceClaim
    var expiration: ExpirationClaim

    init(from caller: String, to callee: String, now: Date = .now) {
        issuer = IssuerClaim(value: "bookshelf-services")
        subject = SubjectClaim(value: caller)
        audience = AudienceClaim(value: [callee])
        expiration = ExpirationClaim(value: now.addingTimeInterval(60))
    }

    func verify(using algorithm: some JWTAlgorithm) async throws {
        try expiration.verifyNotExpired()
        guard issuer.value == "bookshelf-services" else {
            throw JWTError.claimVerificationFailure(failedClaim: issuer, reason: "unexpected issuer")
        }
    }
}

/// Which service this process is. It is configuration, never something a request can change.
struct ServiceIdentity: Sendable {
    let name: String
    /// The only callers allowed to reach this service's `/internal` routes.
    let allowedCallers: Set<String>
}

extension Application {
    private struct IdentityKey: StorageKey { typealias Value = ServiceIdentity }

    var serviceIdentity: ServiceIdentity {
        get { storage[IdentityKey.self]! }
        set { storage[IdentityKey.self] = newValue }
    }
}

let serviceKeyID: JWKIdentifier = "service-tokens"

extension Request {
    /// Mints a short-lived token addressed to one callee. Signing an HMAC takes microseconds, so there is no
    /// caching: a stolen token is useful for at most a minute and only against the service it names.
    func serviceToken(for callee: String) async throws -> String {
        try await jwt.sign(ServiceClaims(from: application.serviceIdentity.name, to: callee), kid: serviceKeyID)
    }
}

/// Rejects every request that does not carry a valid service token addressed to this service from an allowed caller.
struct ServiceAuthMiddleware: AsyncMiddleware {
    func respond(to request: Request, chainingTo next: any AsyncResponder) async throws -> Response {
        guard let bearer = request.headers.bearerAuthorization else { throw Abort(.unauthorized) }
        let identity = request.application.serviceIdentity
        let claims: ServiceClaims
        do {
            claims = try await request.jwt.verify(bearer.token, as: ServiceClaims.self)
            try claims.audience.verifyIntendedAudience(includes: identity.name)
        } catch {
            request.logger.warning("service token rejected", metadata: ["reason": "\(error)"])
            throw Abort(.unauthorized)
        }
        guard identity.allowedCallers.contains(claims.subject.value) else { throw Abort(.forbidden) }
        request.logger[metadataKey: "caller"] = "\(claims.subject.value)"
        return try await next.respond(to: request)
    }
}

/// Reads the service signing secret. Production must provide it; development falls back to an obvious placeholder.
func addServiceKey(to app: Application) async throws {
    let secret: String
    if let fromEnvironment = Environment.get("SERVICE_JWT_SECRET") {
        secret = fromEnvironment
    } else if app.environment == .production {
        throw Abort(.internalServerError, reason: "SERVICE_JWT_SECRET is required")
    } else {
        secret = "change-me-change-me-change-me-32"
    }
    guard secret.utf8.count >= 32 else { throw Abort(.internalServerError, reason: "SERVICE_JWT_SECRET is too short") }
    await app.jwt.keys.add(hmac: HMACKey(from: secret), digestAlgorithm: .sha256, kid: serviceKeyID)
}

import AsyncHTTPClient
import NIOCore
import Vapor

/// A call to another Bookshelf service: a service token for the callee, a timeout, the request id, a mapping from
/// transport failures to 502/504 and a bounded retry for idempotent reads.
struct UpstreamClient: Sendable {
    let name: String
    let baseURL: String
    /// The budget for one attempt. It must be shorter than the timeout of whoever is calling *this* service.
    var timeout: TimeAmount = .seconds(2)
    /// 1 means "never retry". Retries apply to idempotent methods only.
    var attempts = 1

    func send(
        _ method: HTTPMethod, _ path: String, query: String? = nil,
        headers extra: HTTPHeaders = [:], body: ByteBuffer? = nil,
        on req: Request
    ) async throws -> ClientResponse {
        let idempotent = method == .GET || method == .HEAD
        return try await withRetries(attempts: idempotent ? attempts : 1) {
            try await sendOnce(method, path, query: query, headers: extra, body: body, on: req)
        }
    }

    private func sendOnce(
        _ method: HTTPMethod, _ path: String, query: String?, headers extra: HTTPHeaders, body: ByteBuffer?,
        on req: Request
    ) async throws -> ClientResponse {
        var headers = extra
        headers.replaceOrAdd(name: .authorization, value: "Bearer \(try await req.serviceToken(for: name))")
        headers.replaceOrAdd(name: "X-Request-ID", value: req.id)
        var url = URI(string: baseURL + path)
        url.query = query
        var outgoing = ClientRequest(method: method, url: url, headers: headers, body: body)
        outgoing.timeout = timeout
        do {
            let response = try await req.client.send(outgoing)
            if response.status.code >= 500 { throw Abort(.badGateway, reason: "\(name) answered \(response.status.code)") }
            return response
        } catch let error as HTTPClientError where error == .deadlineExceeded || error == .readTimeout || error == .connectTimeout {
            throw Abort(.gatewayTimeout, reason: "\(name) did not answer in time")
        } catch let error as any AbortError {
            throw error
        } catch {
            throw Abort(.badGateway, reason: "\(name) is unreachable")
        }
    }
}

/// Retries an idempotent operation with exponential backoff and jitter, only for failures that may be transient.
func withRetries<Result: Sendable>(
    attempts: Int, initialDelay: Duration = .milliseconds(100), _ operation: @Sendable () async throws -> Result
) async throws -> Result {
    var delay = initialDelay
    for attempt in 1...attempts {
        do {
            return try await operation()
        } catch let error as Abort where attempt < attempts && [.badGateway, .gatewayTimeout].contains(error.status) {
            try await Task.sleep(for: delay * Double.random(in: 0.5...1.5))
            delay *= 2
        }
    }
    preconditionFailure("unreachable: the last attempt either returns or throws")
}

import NIOCore
import Vapor

/// A user the gateway has authenticated. The gateway, not the browser, decides who this is.
struct GatewayUser: Sendable { let id: String; let role: String }

/// Remembers recent introspection answers so a burst of requests with one token asks the users service once.
/// The cache is short on purpose: it is also how long a revoked token keeps working.
actor IntrospectionCache {
    private var entries: [String: (user: GatewayUser, expires: Date)] = [:]
    func get(_ token: String) -> GatewayUser? {
        guard let entry = entries[token], entry.expires > .now else { return nil }
        return entry.user
    }
    func put(_ token: String, _ user: GatewayUser, ttl: TimeInterval = 30) {
        if entries.count > 10_000 { entries.removeAll() }   // crude bound; production uses an LRU
        entries[token] = (user, .now.addingTimeInterval(ttl))
    }
}

struct UserAuthMiddleware: AsyncMiddleware {
    let users: UpstreamClient
    let cache: IntrospectionCache

    func respond(to request: Request, chainingTo next: any AsyncResponder) async throws -> Response {
        guard let token = request.headers.bearerAuthorization?.token else { throw Abort(.unauthorized) }
        if let cached = await cache.get(token) {
            request.storage[GatewayUserKey.self] = cached
            return try await next.respond(to: request)
        }
        let body = ByteBuffer(string: String(decoding: try JSONEncoder().encode(IntrospectRequest(token: token)), as: UTF8.self))
        let response = try await users.send(
            .POST, "/internal/introspect", headers: ["Content-Type": "application/json"], body: body, on: request)
        let result = try response.content.decode(Introspection.self)
        guard result.active, let id = result.userID, let role = result.role else { throw Abort(.unauthorized) }
        let user = GatewayUser(id: id, role: role)
        await cache.put(token, user)
        request.storage[GatewayUserKey.self] = user
        return try await next.respond(to: request)
    }
}

struct GatewayUserKey: StorageKey { typealias Value = GatewayUser }

extension Request {
    var gatewayUser: GatewayUser? { storage[GatewayUserKey.self] }
}

/// Request headers passed to a service. The user's `Authorization` header is deliberately absent: the service
/// receives a service token instead, plus the identity the gateway established.
private let passedRequestHeaders: [HTTPHeaders.Name] = [
    .accept, .acceptLanguage, .contentType, .ifNoneMatch, HTTPHeaders.Name("traceparent"), HTTPHeaders.Name("tracestate"),
]
private let hopByHop: Set<String> = [
    "connection", "keep-alive", "proxy-authenticate", "proxy-authorization", "te", "trailer", "transfer-encoding",
    "upgrade", "content-length", "date",
]

/// Relays `/api/<prefix>/**` to `<service>/internal/<prefix>/**`.
func relay(_ routes: some RoutesBuilder, prefix: String, to service: UpstreamClient) {
    for method in [HTTPMethod.GET, .POST, .PUT, .DELETE] {
        routes.on(method, "api", PathComponent(stringLiteral: prefix), "**", body: .collect(maxSize: "256kb")) { req async throws -> Response in
            let segments = req.parameters.getCatchall()
            guard !segments.contains(where: { $0 == ".." || $0 == "." || $0.contains("/") }) else { throw Abort(.badRequest) }
            let path = segments.compactMap { $0.addingPercentEncoding(withAllowedCharacters: .urlPathAllowed) }.joined(separator: "/")

            var headers = HTTPHeaders()
            for name in passedRequestHeaders { for value in req.headers[name] { headers.add(name: name, value: value) } }
            if let user = req.gatewayUser {
                headers.replaceOrAdd(name: "X-User-Id", value: user.id)
                headers.replaceOrAdd(name: "X-User-Role", value: user.role)
            }
            let upstream = try await service.send(
                req.method, "/internal/\(prefix)/\(path)", query: req.url.query,
                headers: headers, body: req.body.data, on: req)

            var responseHeaders = HTTPHeaders()
            for (name, value) in upstream.headers where !hopByHop.contains(name.lowercased()) {
                responseHeaders.add(name: name, value: value)
            }
            return Response(status: upstream.status, headers: responseHeaders,
                            body: upstream.body.map { Response.Body(buffer: $0) } ?? .empty)
        }
    }
}

/// One screen, two services: the gateway composes the answer so the mobile app makes one request.
struct BookOverview: Content { let book: Book; let reviews: [ReviewView]; let viewer: String }

func gatewayRoutes(_ app: Application, users: UpstreamClient, catalog: UpstreamClient) {
    // Public: logging in is the one route that needs no user token. Only /auth/login is exposed, not all of /auth.
    app.post("api", "auth", "login") { req async throws -> Response in
        let upstream = try await users.send(
            .POST, "/auth/login", headers: ["Content-Type": "application/json"], body: req.body.data, on: req)
        return Response(status: upstream.status, headers: ["Content-Type": "application/json"],
                        body: upstream.body.map { Response.Body(buffer: $0) } ?? .empty)
    }

    let protected = app.grouped(UserAuthMiddleware(users: users, cache: IntrospectionCache()))

    protected.get("api", "books", ":isbn", "overview") { req async throws -> BookOverview in
        let isbn = try req.parameters.require("isbn")
        let headers: HTTPHeaders = ["X-User-Id": req.gatewayUser?.id ?? ""]
        async let bookResponse = catalog.send(.GET, "/internal/books/\(isbn)", headers: headers, on: req)
        async let reviewsResponse = catalog.send(.GET, "/internal/books/\(isbn)/reviews", headers: headers, on: req)
        let (bookReply, reviewsReply) = try await (bookResponse, reviewsResponse)
        guard bookReply.status == .ok else { throw Abort(bookReply.status) }
        return BookOverview(
            book: try bookReply.content.decode(Book.self),
            reviews: try reviewsReply.content.decode([ReviewView].self),
            viewer: req.gatewayUser?.id ?? "")
    }

    relay(protected, prefix: "books", to: catalog)
}

import JWT
import Vapor

let userKeyID: JWKIdentifier = "user-tokens"

/// What the users service puts in the access tokens it issues. Only the users service holds this key.
struct UserToken: JWTPayload {
    enum CodingKeys: String, CodingKey { case subject = "sub", audience = "aud", expiration = "exp", role }

    var subject: SubjectClaim
    var audience: AudienceClaim
    var expiration: ExpirationClaim
    var role: String

    func verify(using algorithm: some JWTAlgorithm) async throws {
        try expiration.verifyNotExpired()
        try audience.verifyIntendedAudience(includes: "bookshelf-api")
    }
}

struct LoginRequest: Content { let email: String; let password: String }
struct LoginResponse: Content { let accessToken: String; let expiresIn: Int }
struct IntrospectRequest: Content { let token: String }
struct Introspection: Content { let active: Bool; let userID: String?; let role: String? }
struct PublicUser: Content { let id: String; let displayName: String }

/// The users service owns its data. Here the "database" is an actor; the section on per-service databases shows
/// the Fluent version. No other service reads these records: they ask over HTTP.
actor UserStore {
    struct Record { let id: String; let email: String; let passwordHash: String; let displayName: String; let role: String }
    private var byEmail: [String: Record] = [:]
    private var byID: [String: Record] = [:]

    init() throws {
        // A cheap cost factor keeps the demo fast; production uses the default cost.
        let records = [
            Record(id: "u-1", email: "reader@example.test", passwordHash: try Bcrypt.hash("change-me", cost: 4),
                   displayName: "Ada Reader", role: "member"),
            Record(id: "u-2", email: "editor@example.test", passwordHash: try Bcrypt.hash("change-me", cost: 4),
                   displayName: "Ed Editor", role: "editor"),
        ]
        for record in records { byEmail[record.email] = record; byID[record.id] = record }
    }

    func authenticate(email: String, password: String) -> Record? {
        guard let record = byEmail[email], (try? Bcrypt.verify(password, created: record.passwordHash)) == true else {
            return nil
        }
        return record
    }

    func user(id: String) -> Record? { byID[id] }
}

extension Application {
    private struct UsersKey: StorageKey { typealias Value = UserStore }

    var users: UserStore {
        get { storage[UsersKey.self]! }
        set { storage[UsersKey.self] = newValue }
    }
}

struct MissingSecret: Error {
    let variable: String
}

func usersRoutes(_ app: Application) async throws {
    // Production must provide USER_JWT_SECRET; development and tests use an obvious 32-byte placeholder.
    let secret: String
    if let fromEnvironment = Environment.get("USER_JWT_SECRET") {
        secret = fromEnvironment
    } else if app.environment == .production {
        throw MissingSecret(variable: "USER_JWT_SECRET")
    } else {
        secret = "change-me-too-change-me-too-32by"
    }
    await app.jwt.keys.add(hmac: HMACKey(from: secret), digestAlgorithm: .sha256, kid: userKeyID)
    app.users = try UserStore()

    // Public through the gateway: log in and receive a user access token.
    app.post("auth", "login") { req async throws -> LoginResponse in
        let login = try req.content.decode(LoginRequest.self)
        guard let user = await req.application.users.authenticate(email: login.email, password: login.password) else {
            throw Abort(.unauthorized, reason: "Invalid credentials.")
        }
        let claims = UserToken(
            subject: .init(value: user.id), audience: .init(value: ["bookshelf-api"]),
            expiration: .init(value: .now.addingTimeInterval(15 * 60)), role: user.role)
        return LoginResponse(accessToken: try await req.jwt.sign(claims, kid: userKeyID), expiresIn: 900)
    }

    // Internal: only other services, with a service token, reach these routes.
    let internalRoutes = app.grouped("internal").grouped(ServiceAuthMiddleware())

    // Token introspection: the gateway asks the owner of the keys whether a user token is good.
    internalRoutes.post("introspect") { req async throws -> Introspection in
        let body = try req.content.decode(IntrospectRequest.self)
        guard let claims = try? await req.jwt.verify(body.token, as: UserToken.self) else {
            return Introspection(active: false, userID: nil, role: nil)
        }
        return Introspection(active: true, userID: claims.subject.value, role: claims.role)
    }

    internalRoutes.get("users", ":id") { req async throws -> PublicUser in
        let id = try req.parameters.require("id")
        guard let user = await req.application.users.user(id: id) else { throw Abort(.notFound) }
        return PublicUser(id: user.id, displayName: user.displayName)
    }
}

import Vapor

struct Book: Content, Sendable { let isbn: String; let title: String; let authors: [String] }
struct ReviewView: Content, Sendable { let userID: String; let reviewer: String; let stars: Int; let text: String }

/// The catalog service's own data (books and reviews). Reviews hold only a `userID`: the user record is not
/// here, it belongs to the users service.
struct CatalogData: Sendable {
    let books: [String: Book]
    let reviews: [String: [(userID: String, stars: Int, text: String)]]

    static let seed = CatalogData(
        books: [
            "9780441013593": Book(isbn: "9780441013593", title: "Dune", authors: ["Frank Herbert"]),
            "9780261103573": Book(isbn: "9780261103573", title: "The Fellowship of the Ring", authors: ["J. R. R. Tolkien"]),
        ],
        reviews: [
            "9780441013593": [("u-1", 5, "A classic."), ("u-2", 4, "Dense but rewarding.")],
        ])
}

extension Application {
    private struct CatalogKey: StorageKey { typealias Value = CatalogData }

    var catalogData: CatalogData {
        get { storage[CatalogKey.self] ?? .seed }
        set { storage[CatalogKey.self] = newValue }
    }
}

func catalogRoutes(_ app: Application, users: UpstreamClient) {
    let internalRoutes = app.grouped("internal").grouped(ServiceAuthMiddleware())

    internalRoutes.get("books", ":isbn") { req async throws -> Book in
        let isbn = try req.parameters.require("isbn")
        guard let book = req.application.catalogData.books[isbn] else { throw Abort(.notFound) }
        return book
    }

    // The catalog resolves reviewer names by asking the users service. The calls run concurrently; if one fails
    // the review is returned with a placeholder name instead of failing the whole page.
    internalRoutes.get("books", ":isbn", "reviews") { req async throws -> [ReviewView] in
        let isbn = try req.parameters.require("isbn")
        guard req.application.catalogData.books[isbn] != nil else { throw Abort(.notFound) }
        let rows = req.application.catalogData.reviews[isbn] ?? []
        return try await withThrowingTaskGroup(of: (Int, ReviewView).self) { group in
            for (index, row) in rows.enumerated() {
                group.addTask {
                    var name = "Unknown reader"
                    if let response = try? await users.send(.GET, "/internal/users/\(row.userID)", on: req),
                       response.status == .ok, let user = try? response.content.decode(PublicUser.self) {
                        name = user.displayName
                    }
                    return (index, ReviewView(userID: row.userID, reviewer: name, stars: row.stars, text: row.text))
                }
            }
            var results: [(Int, ReviewView)] = []
            for try await result in group { results.append(result) }
            return results.sorted { $0.0 < $1.0 }.map(\.1)
        }
    }
}

$ curl -s -X POST localhost:9080/api/auth/login -H 'content-type: application/json' \
    -d '{"email":"reader@example.test","password":"change-me"}'
{"expiresIn":900,"accessToken":"eyJhbGciOi..."}

$ curl -si localhost:9080/api/books/9780441013593/overview -H "authorization: Bearer $TOKEN"
HTTP/1.1 200 OK
content-type: application/json; charset=utf-8

{"viewer":"u-1","book":{"isbn":"9780441013593","authors":["Frank Herbert"],"title":"Dune"},"reviews":[{"stars":5,"userID":"u-1","text":"A classic.","reviewer":"Ada Reader"},{"stars":4,"userID":"u-2","text":"Dense but rewarding.","reviewer":"Ed Editor"}]}

$ curl -si localhost:9080/api/books/9780441013593 -H "authorization: Bearer $TOKEN"     # relayed
HTTP/1.1 200 OK
{"authors":["Frank Herbert"],"isbn":"9780441013593","title":"Dune"}

$ curl -si localhost:9080/api/books/9780441013593/overview | head -1                      # no token
HTTP/1.1 401 Unauthorized
$ curl -si 'localhost:9080/api/books/a/%2E%2E/b' -H "authorization: Bearer $TOKEN" | head -1
HTTP/1.1 400 Bad Request
$ curl -si localhost:9080/api/books/0000/overview -H "authorization: Bearer $TOKEN" | head -1
HTTP/1.1 404 Not Found

name: bookshelf

x-service: &service
  build: .
  restart: unless-stopped
  environment: &service-env
    SERVICE_JWT_SECRET: ${SERVICE_JWT_SECRET:?set SERVICE_JWT_SECRET in .env}
    LOG_LEVEL: info

services:
  gateway:
    <<: *service
    environment:
      <<: *service-env
      SERVICE_NAME: gateway
      USERS_URL: http://users:8080
      CATALOG_URL: http://catalog:8080
    ports:
      - "9080:8080"
    depends_on:
      users: { condition: service_healthy }
      catalog: { condition: service_healthy }

  users:
    <<: *service
    environment:
      <<: *service-env
      SERVICE_NAME: users
      USER_JWT_SECRET: ${USER_JWT_SECRET:?set USER_JWT_SECRET in .env}
      DATABASE_URL: postgres://users:${USERS_DB_PASSWORD:?set USERS_DB_PASSWORD}@users-db:5432/users
    depends_on:
      users-db: { condition: service_healthy }
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'exec 3<>/dev/tcp/127.0.0.1/8080 && printf \"GET /healthz HTTP/1.0\\r\\n\\r\\n\" >&3 && grep -q ok <&3'"]
      interval: 5s
      retries: 10

  catalog:
    <<: *service
    environment:
      <<: *service-env
      SERVICE_NAME: catalog
      USERS_URL: http://users:8080
      DATABASE_URL: postgres://catalog:${CATALOG_DB_PASSWORD:?set CATALOG_DB_PASSWORD}@catalog-db:5432/catalog
    depends_on:
      catalog-db: { condition: service_healthy }
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'exec 3<>/dev/tcp/127.0.0.1/8080 && printf \"GET /healthz HTTP/1.0\\r\\n\\r\\n\" >&3 && grep -q ok <&3'"]
      interval: 5s
      retries: 10

  users-db:
    image: postgres:17
    environment:
      POSTGRES_USER: users
      POSTGRES_PASSWORD: ${USERS_DB_PASSWORD:?set USERS_DB_PASSWORD}
      POSTGRES_DB: users
    volumes: ["users-data:/var/lib/postgresql/data"]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U users"]
      interval: 5s
      retries: 10

  catalog-db:
    image: postgres:17
    environment:
      POSTGRES_USER: catalog
      POSTGRES_PASSWORD: ${CATALOG_DB_PASSWORD:?set CATALOG_DB_PASSWORD}
      POSTGRES_DB: catalog
    volumes: ["catalog-data:/var/lib/postgresql/data"]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U catalog"]
      interval: 5s
      retries: 10

volumes:
  users-data:
  catalog-data:

# syntax=docker/dockerfile:1
FROM swift:6.3-noble AS build
WORKDIR /build
COPY Package.swift Package.resolved ./
RUN swift package resolve
COPY Sources ./Sources
RUN swift build -c release --static-swift-stdlib && \
    mkdir -p /staging && cp "$(swift build -c release --show-bin-path)/App" /staging/App

FROM ubuntu:noble
RUN useradd --system --create-home --shell /usr/sbin/nologin vapor
WORKDIR /app
COPY --from=build --chown=vapor:vapor /staging/App ./App
USER vapor
EXPOSE 8080
ENTRYPOINT ["./App"]
CMD ["serve", "--env", "production", "--hostname", "0.0.0.0", "--port", "8080"]

$ SERVICE_NAME=users   .build/debug/App serve --port 8081 &
$ SERVICE_NAME=catalog .build/debug/App serve --port 8082 &
$ SERVICE_NAME=gateway .build/debug/App serve --port 9080 &