# Kong API gateway override.
#
# Replaces the default Envoy gateway with Kong. Enable with:
#   sh run.sh config add kong
#   sh run.sh start
#
# This overrides the `api-gw` service in place, so its dependents (functions),
# the reverse-proxy overrides (caddy/nginx), and the `kong`/`envoy` network
# aliases keep working unchanged. Kong re-adds an HTTPS listener on 8443.

services:
  api-gw:
    container_name: supabase-kong
    image: kong/kong:3.9.3
    healthcheck:
      test: !override ["CMD", "kong", "health"]
      interval: 5s
      timeout: 5s
      retries: 5
    ports: !override
      - ${API_GW_HTTP_PORT:-${KONG_HTTP_PORT:-8000}}:8000/tcp
      - ${KONG_HTTPS_PORT:-8443}:8443/tcp
    volumes: !override
      - ./volumes/api/kong.yml:/home/kong/temp.yml:ro,z
      - ./volumes/api/kong-entrypoint.sh:/home/kong/kong-entrypoint.sh:ro,z
      #- ./volumes/api/server.crt:/home/kong/server.crt:ro
      #- ./volumes/api/server.key:/home/kong/server.key:ro
    environment: !override
      KONG_DATABASE: "off"
      KONG_DECLARATIVE_CONFIG: /usr/local/kong/kong.yml
      KONG_ROUTER_FLAVOR: expressions
      KONG_DNS_ORDER: LAST,A,CNAME
      KONG_DNS_NOT_FOUND_TTL: 1
      KONG_DNS_VALID_TTL: 5
      KONG_PLUGINS: request-transformer,cors,key-auth,acl,basic-auth,request-termination,ip-restriction,post-function
      KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
      KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
      KONG_PROXY_ACCESS_LOG: /dev/stdout combined
      #KONG_SSL_CERT: /home/kong/server.crt
      #KONG_SSL_CERT_KEY: /home/kong/server.key
      SUPABASE_ANON_KEY: ${ANON_KEY}
      SUPABASE_SERVICE_KEY: ${SERVICE_ROLE_KEY}
      SUPABASE_PUBLISHABLE_KEY: ${SUPABASE_PUBLISHABLE_KEY:-}
      SUPABASE_SECRET_KEY: ${SUPABASE_SECRET_KEY:-}
      ANON_KEY_ASYMMETRIC: ${ANON_KEY_ASYMMETRIC:-}
      SERVICE_ROLE_KEY_ASYMMETRIC: ${SERVICE_ROLE_KEY_ASYMMETRIC:-}
      DASHBOARD_USERNAME: ${DASHBOARD_USERNAME}
      DASHBOARD_PASSWORD: ${DASHBOARD_PASSWORD}
    entrypoint: !override ["/bin/sh", "/home/kong/kong-entrypoint.sh"]