docker-compose.yml

services:
  mysqltestdb:
    image: mariadb:12
    environment:
      MARIADB_USER: blanco
      MARIADB_PASSWORD: blanco
      MARIADB_ROOT_PASSWORD: blanco
      MARIADB_DATABASE: blanco
    restart: unless-stopped
    volumes:
      # Uses a tmpfs volume to make tests extremely fast. The data in test
      # databases is not persisted across restarts, nor does it need to be.
      - type: tmpfs
        target: /var/lib/mysql
    ports:
      - "3306:3306"

  # PostgreSQL with SSL enabled for testing SSL connections, and PostGIS.
  # docker/postgres replaces the image's own init scripts, which would also
  # install the topology and tiger geocoder extensions and their schemas.
  postgrestestdb_ssl:
    image: postgis/postgis:17-3.5
    environment:
      POSTGRES_USER: blanco
      POSTGRES_PASSWORD: blanco
      POSTGRES_DB: blanco
    command: >
      bash -c "
        cp /test_certs/server.crt /var/lib/postgresql/server.crt &&
        cp /test_certs/server.key /var/lib/postgresql/server.key &&
        chmod 600 /var/lib/postgresql/server.key &&
        chown postgres:postgres /var/lib/postgresql/server.crt /var/lib/postgresql/server.key &&
        exec docker-entrypoint.sh postgres -c ssl=on -c ssl_cert_file=/var/lib/postgresql/server.crt -c ssl_key_file=/var/lib/postgresql/server.key
      "
    volumes:
      - ./crates/postgres/test_certs:/test_certs:ro
      - ./docker/postgres:/docker-entrypoint-initdb.d:ro
      - type: tmpfs
        target: /var/lib/postgresql/data
    ports:
      - "5488:5432"

  # CockroachDB, a single secure node keeping its data in memory. The image
  # makes its own certificates and the blanco user, and runs the scripts in
  # docker/cockroach once the node is up.
  cockroachtestdb:
    image: cockroachdb/cockroach:v26.3.2
    environment:
      COCKROACH_USER: blanco
      COCKROACH_PASSWORD: blanco
      COCKROACH_DATABASE: blanco
    command: start-single-node --store=type=mem,size=1GiB
    volumes:
      - ./docker/cockroach:/docker-entrypoint-initdb.d:ro
    ports:
      - "26258:26257"

  # ClickHouse for testing
  clickhousetestdb:
    image: clickhouse/clickhouse-server:latest
    environment:
      CLICKHOUSE_USER: blanco
      CLICKHOUSE_PASSWORD: blanco
      CLICKHOUSE_DB: blanco
    volumes:
      - type: tmpfs
        target: /var/lib/clickhouse
    ports:
      - "8124:8123"
      - "9000:9000"

  # SQL Server for testing
  mssqltestdb:
    image: mcr.microsoft.com/mssql/server:2022-latest
    # The 2022 image runs as the non-root `mssql` user (uid 10001), which can't
    # create its `/.system` directory or write to the root-owned `/var/opt/mssql`
    # tmpfs, so it fails to start. Run as root to sidestep the permission issue.
    user: root
    environment:
      ACCEPT_EULA: "Y"
      MSSQL_SA_PASSWORD: "Blanco_Passw0rd!"
      MSSQL_PID: "Developer"
    restart: unless-stopped
    volumes:
      - type: tmpfs
        target: /var/opt/mssql
    ports:
      - "1433:1433"

  # Redis for testing
  redis:
    image: redis:latest
    command: redis-server --requirepass blanco
    ports:
      - "6400:6379"
    restart: unless-stopped

  # SSH bastion for testing SSH-tunneled connections. It sits on the same
  # compose network as the database services, so the tunnel target is each
  # service's internal name + port (e.g. `mysqltestdb:3306`), reached from the
  # host via `localhost:2222`. Password auth with blanco/blanco; the image
  # enables `AllowTcpForwarding` so `direct-tcpip` channels can reach siblings.
  sshbastion:
    build:
      context: ./docker/sshbastion
    ports:
      - "2222:22"
    restart: unless-stopped