docker-compose.yml

name: ${PROJECT_NAME:-d2e}
networks:
  alp:
  data:

volumes:
  caddy:
  cdw-config-cachedb-data-1:
  minio-data-1:
  pg-minerva-data-1:
  r-libs:
  trex:
  demodb-data:
  hana-data:
  supabase-storage-data:
  hades-data:
  audit-logs:

x-envs:
  env_converter: &x-converter
    URL__DATABASE_LIST__GET: http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/gateway/api/db/database-creds/
    DB_CREDENTIALS__PRIVATE_KEY: ${DB_CREDENTIALS__INTERNAL__DECRYPT_PRIVATE_KEY}
    IDP__ALP_SVC__CLIENT_ID: ${LOGTO__D2E_SVC__CLIENT_ID:-${LOGTO__ALP_SVC__CLIENT_ID}}
    IDP__ALP_SVC__CLIENT_SECRET: ${LOGTO__D2E_SVC__CLIENT_SECRET:-${LOGTO__ALP_SVC__CLIENT_SECRET}}
    IDP__SCOPE: https://alp-default
    IDP_SUBJECT_PROP: sub
  pg: &x-pg
    PG__DB_NAME: alp
    ## Flag to display executed Knex queries in log
    PG__DEBUG: ${PG_DEBUG:-1}
    PG__HOST: ${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}
    PG__MAX_POOL: ${PG__MAX_POOL:-1}
    PG__MIN_POOL: ${PG__MIN_POOL:-1}
    PG__PORT: ${PG_PORT:-5432}
    PG__IDLE_TIMEOUT_IN_MS: ${PG__IDLE_TIMEOUT_IN_MS:-30000}
    PG__DIALECT: postgresql
    PG__SSL: ${PG__SSL:-false}
  trex_sql: &x-trex-sql
    TREX__SQL__HOST: ${PROJECT_NAME:-d2e}-trex
    TREX__SQL__PORT: ${TREX__SQL__PORT:-5433}
    TREX__SQL__USER: postgres
    TREX__SQL__PASSWORD: ${TREX__SQL__PASSWORD:?TREX__SQL__PASSWORD must be set (run d2e init); refusing default pencil} # Password for the trex sql interface
    TREX__SQL__DBNAME: postgres
  # "https://${PROJECT_NAME:-d2e}-minerva-portal-server-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:41105",
  tls: &x-tls
    TLS__INTERNAL__CA_CRT: ${TLS__INTERNAL__CA_CRT}
    TLS__INTERNAL__CRT: ${TLS__INTERNAL__CRT}
    TLS__INTERNAL__DOMAIN: ${TLS__INTERNAL__DOMAIN:-d2e.local}
    TLS__INTERNAL__KEY: ${TLS__INTERNAL__KEY}

services:
  # OHDSI WebAPI for Atlas3 (with trex dependencies)
  trex:
    image: ${DOCKER_IMAGE_PREFIX:-ghcr.io/ohdsi/}d2e-trex:${DOCKER_TAG_NAME:-develop}
    container_name: ${PROJECT_NAME:-d2e}-trex
    hostname: ${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}
    extra_hosts:
      - "${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:host-gateway"
    depends_on:
      # trex now provisions the database itself (runD2eBootstrap), so it only
      # needs Postgres up. It deliberately does NOT wait for alp-logto-post-init
      # any more: logto cannot migrate until trex has created logto_postgres and
      # the logto schema, so trex must start FIRST. Keeping the old edge would
      # deadlock (trex -> post-init -> logto -> trex's bootstrap).
      alp-minerva-postgres:
        condition: service_healthy
    networks:
      alp:
        priority: 20
      data:
        priority: 10
    volumes:
      - trex:/usr/src/data
      - cdw-config-cachedb-data-1:/usr/src/cdw_data/dynamically_generated
      - hades-data:/data/hades
      - audit-logs:/var/log/d2e/audit
      # `notebook` schema (studies/notebooks) + its PostGraphile grants, applied
      # as a trex migrations plugin. trex runs it against _config (the alp
      # Postgres catalog) and tracks applied versions in
      # notebook.refinery_schema_history. The image does not ship it, so this
      # mount is its only source; the CLI stages the files next to its embedded
      # copy of this compose file.
      - ./services/trex/migrations/notebook:/usr/src/bundled-plugins/notebook-schema:ro
      # d2e's DB provisioning plugin (d2e-bootstrap) is baked into the image and
      # deliberately NOT mounted here: the CLI runs this file on its own, and a
      # mount whose source it has not staged makes Docker create an empty
      # directory that hides the image's copy, so trex aborts at boot. The
      # live-edit mount lives in docker-compose-local.yml.
      # WebAPI/Logto seeding SQL, applied by the d2e-compat atlas-db-init block
      # once webapi.sec_role and logto.users exist. Replaces the webapi-init
      # container, which ran the same files through psql.
      - ./services/atlas-db-init:/usr/src/atlas-db-init:ro
    ports:
      - "8090:8080"
    healthcheck:
      # trex's main mounts built-in routes under BASE_PATH (=/trex), so the
      # internal health endpoint is /trex/_internal/health. (D2E_COMPAT routes
      # like /WebAPI and /portal are mounted at root, separately.)
      test: ["CMD-SHELL", "curl -fk https://localhost:33000/trex/_internal/health || curl -f http://localhost:33001/trex/_internal/health || exit 1"]
      interval: 10s
      timeout: 10s
      retries: 30
      start_period: 120s
    entrypoint: ["/bin/sh","-c"]
    command:
      - |
        mkdir -p /usr/src/cert
        printf '%s' "$$TLS__INTERNAL__CRT" > /usr/src/cert/cert.pem
        (umask 077; printf '%s' "$$TLS__INTERNAL__KEY" > /usr/src/cert/key.pem)
        printf '%s' "$$TLS__INTERNAL__CA_CRT" > /usr/src/cert/ca.pem
        cp /usr/src/cert/ca.pem /usr/local/share/ca-certificates/d2e-internal-ca.crt
        # Optional additional trust anchors, for upstreams that are not ours — the
        # PS config server is typically external/HANA-side with its own CA. This is
        # the supported way to reach such a server: the edge-function shim has no
        # per-request TLS control and there is no verification bypass.
        #
        # Accepts one or more concatenated PEM blocks, split into one file each:
        # update-ca-certificates appends a whole file to the bundle but only hashes
        # its FIRST certificate into the CApath symlinks, so a multi-cert file would
        # be trusted by bundle readers and silently ignored by CApath readers.
        # The value needs real newlines; a .env-style string with literal \n will
        # not parse, so the count is asserted below rather than failing later at
        # the first TLS call.
        if [ -n "$${TLS__EXTRA__CA_CRTS:-}" ]; then
          printf '%s\n' "$$TLS__EXTRA__CA_CRTS" |
            awk 'BEGIN{n=0} /^-----BEGIN CERTIFICATE-----$$/{n++} n>0{print > ("/usr/local/share/ca-certificates/d2e-extra-ca-" n ".crt")}'
          got=0
          for f in /usr/local/share/ca-certificates/d2e-extra-ca-*.crt; do
            [ -e "$$f" ] || continue
            if grep -qx -- '-----END CERTIFICATE-----' "$$f"; then
              got=$$((got + 1))
            else
              echo "FATAL: $$f has no END line; TLS__EXTRA__CA_CRTS is truncated or malformed" >&2
              exit 1
            fi
          done
          if [ "$$got" -eq 0 ]; then
            echo "FATAL: TLS__EXTRA__CA_CRTS is set but contains no PEM certificate. It needs real newlines -- a .env-style value with literal \\n will not parse." >&2
            exit 1
          fi
          echo "installed $$got extra CA certificate(s)"
        fi
        update-ca-certificates
        mkdir -p /usr/src/data/flow_staging && chmod 1777 /usr/src/data/flow_staging || exit 1
        # This command replaces the image's own CMD, so the --enable-otel flag
        # from Dockerfile.v2 never runs here; it must be re-added to this exec.
        exec /usr/src/entrypoint.sh $${TREX_OTEL_ENABLED:+--enable-otel}
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}
    environment:
      <<:
        - *x-converter
        - *x-tls
        - *x-pg
        - *x-trex-sql
      # With the rebuilt trexas runtime (cert_provider fix), the worker HTTP client
      # honors DENO_TLS_CA_STORE=system, so it trusts the internal CA installed into
      # the OS store by the command above (via update-ca-certificates).
      DENO_TLS_CA_STORE: system
      # Extra trust anchors for non-internal upstreams (e.g. an external PS config
      # server with its own CA). One or more concatenated PEM blocks; installed into
      # the OS store by the command above, so DENO_TLS_CA_STORE=system picks them up.
      TLS__EXTRA__CA_CRTS: ${TLS__EXTRA__CA_CRTS:-}
      # Java analog of DENO_TLS_CA_STORE for the embedded native WebAPI. The GraalVM
      # libwebapi-native.so bakes its truststore at build time and ignores the OS store
      # (update-ca-certificates), so WebApiNativeLibrary.start() reads this PEM at startup
      # and installs a composite SSLContext (JDK roots + this internal CA) before Spring
      # boots — needed for OIDC discovery/JWKS over the internal self-signed TLS. The file
      # is written by this service's command above (line ~115).
      WEBAPI_TRUST_CERTS: /usr/src/cert/ca.pem
      # Plugin paths for trex - must match volume mount at /usr/src/data
      PLUGINS_PATH: /usr/src/data/plugins
      DATASOURCE_DRIVERCLASSNAME: org.postgresql.Driver
      DATASOURCE_URL: jdbc:postgresql://alp-minerva-postgres:5432/alp?currentSchema=webapi
      DATASOURCE_USERNAME: postgres
      DATASOURCE_PASSWORD: ${PG_SUPER_PASSWORD}
      DATASOURCE_OHDSI_SCHEMA: webapi
      JASYPT_ENCRYPTOR_ENABLED: ${JASYPT_ENCRYPTOR_ENABLED:-false}
      JASYPT_ENCRYPTOR_PASSWORD: ${JASYPT_ENCRYPTOR_PASSWORD:-}
      JASYPT_ENCRYPTOR_ALGORITHM: ${JASYPT_ENCRYPTOR_ALGORITHM:-PBEWITHSHA256AND256BITAES-CBC-BC}
      SPRING_JPA_PROPERTIES_HIBERNATE_DEFAULT_SCHEMA: webapi
      SPRING_BATCH_REPOSITORY_TABLEPREFIX: webapi.batch_
      # Flyway migration settings
      FLYWAY_DATASOURCE_USERNAME: postgres
      FLYWAY_DATASOURCE_PASSWORD: ${PG_SUPER_PASSWORD}
      SPRING_FLYWAY_URL: jdbc:postgresql://alp-minerva-postgres:5432/alp?currentSchema=webapi
      SPRING_FLYWAY_USER: postgres
      SPRING_FLYWAY_PASSWORD: ${PG_SUPER_PASSWORD}
      SPRING_FLYWAY_SCHEMAS: webapi
      SPRING_FLYWAY_TABLE: flyway_schema_history
      SPRING_FLYWAY_PLACEHOLDERS_OHDSISCHEMA: webapi
      # No SPRING_FLYWAY_BASELINE_VERSION: on an empty schema Flyway baselines at v1
      # and applies all migrations, including the early ones that create cc_* tables.
      # Existing installs already have history rows so this is a no-op for them.
      # Security configuration
      SECURITY_PROVIDER: AtlasRegularSecurity
      SECURITY_ORIGIN: "*"
      SECURITY_SSL_ENABLED: "false"
      # Enable forwarded headers support for reverse proxy
      SERVER_FORWARD_HEADERS_STRATEGY: NATIVE
      # Auth providers - OpenID via Logto + Database auth
      SECURITY_AUTH_JDBC_ENABLED: "true"
      SECURITY_AUTH_WINDOWS_ENABLED: "false"
      SECURITY_AUTH_KERBEROS_ENABLED: "false"
      SECURITY_AUTH_OIDC_ENABLED: "true"
      SECURITY_AUTH_FACEBOOK_ENABLED: "false"
      SECURITY_AUTH_GITHUB_ENABLED: "false"
      SECURITY_AUTH_GOOGLE_ENABLED: "false"
      SECURITY_AUTH_LDAP_ENABLED: "false"
      SECURITY_AUTH_AD_ENABLED: "false"
      SECURITY_AUTH_CAS_ENABLED: "false"
      # Database authentication configuration (uses webapi_security schema in alp-minerva-postgres)
      SECURITY_DB_DATASOURCE_SCHEMA: webapi_security
      SECURITY_DB_DATASOURCE_URL: "jdbc:postgresql://alp-minerva-postgres:5432/alp?currentSchema=webapi_security"
      SECURITY_DB_DATASOURCE_DRIVERCLASSNAME: org.postgresql.Driver
      SECURITY_DB_DATASOURCE_USERNAME: postgres
      SECURITY_DB_DATASOURCE_PASSWORD: ${PG_SUPER_PASSWORD}
      SECURITY_DB_DATASOURCE_AUTHENTICATIONQUERY: "SELECT password, email AS firstname, NULL AS middlename, email AS lastname FROM webapi_security.security WHERE email = ?"
      # Native WebAPI reads its auth datasource under security.auth.db.datasource.*
      # (not the legacy security.db.datasource.* above).
      SECURITY_AUTH_DB_ENABLED: "true"
      SECURITY_AUTH_DB_DATASOURCE_DRIVERCLASSNAME: org.postgresql.Driver
      SECURITY_AUTH_DB_DATASOURCE_URL: "jdbc:postgresql://alp-minerva-postgres:5432/alp?currentSchema=webapi_security"
      SECURITY_AUTH_DB_DATASOURCE_USERNAME: postgres
      SECURITY_AUTH_DB_DATASOURCE_PASSWORD: ${PG_SUPER_PASSWORD}
      SECURITY_AUTH_DB_DATASOURCE_SCHEMA: webapi_security
      # OpenID Connect configuration — the identity provider trex serves at
      # /trex/oidc. Discovery goes straight to trex rather than through Caddy:
      # it is the same container that issues the tokens, so there is no TLS or
      # forwarded-header question to work around.
      SECURITY_AUTH_OIDC_CLIENTID: ${TREX__OIDC__WEBAPI_CLIENT_ID:-d2e-webapi}
      SECURITY_AUTH_OIDC_APISECRET: ${TREX__OIDC__WEBAPI_CLIENT_SECRET:?TREX__OIDC__WEBAPI_CLIENT_SECRET must be set (run d2e init)}
      # SECURITY_AUTH_OIDC_APISECRET above is WebAPI's, and WebAPI now
      # authenticates against trex. d2e-compat still verifies the portal's
      # Logto tokens and historically read that same variable as Logto's
      # secret, so it has to be given Logto's under its own name -- otherwise
      # the portal code exchange goes to Logto carrying trex's secret and is
      # rejected with 401.
      LOGTO__CLIENT_SECRET: ${LOGTO__D2E_APP__CLIENT_SECRET:-${LOGTO__ALP_APP__CLIENT_SECRET}}
      # The issuer trex advertises, which is also what its tokens carry. WebAPI
      # runs alongside trex rather than behind the gateway, so this address does
      # not resolve for it -- SECURITY_AUTH_OIDC_INTERNALURL below is where the
      # metadata and signing keys are actually read from. Both are needed: the
      # issuer cannot be swapped for the internal address without invalidating
      # every token, and the internal address cannot be reached from a browser.
      SECURITY_AUTH_OIDC_URL: "https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${D2E__PUBLIC_PORT_SUFFIX-${CADDY_PORT:+:${CADDY_PORT}}}/trex/oidc/.well-known/openid-configuration"
      SECURITY_AUTH_OIDC_INTERNALURL: "http://${PROJECT_NAME:-d2e}-trex:33001/trex/oidc"
      # External URL for browser redirects - used to rewrite internal OIDC URLs to external ones
      SECURITY_AUTH_OIDC_EXTERNALURL: "https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${D2E__PUBLIC_PORT_SUFFIX-${CADDY_PORT:+:${CADDY_PORT}}}/trex/oidc"
      # @better-auth/oauth-provider serves RP-initiated logout at
      # /oauth2/end-session and hard-codes that path; /session/end was the
      # hand-written provider's and answers 404 now. The provider also refuses
      # a client whose row does not carry enable_end_session, which the seeder
      # sets for every client it registers.
      SECURITY_AUTH_OIDC_LOGOUTURL: "https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${D2E__PUBLIC_PORT_SUFFIX-${CADDY_PORT:+:${CADDY_PORT}}}/trex/oidc/oauth2/end-session"
      # trex emits the application role array as `roles`; `trex_role` is a
      # different claim entirely — trex's own admin/user system role, which
      # must never be read as a WebAPI role.
      SECURITY_AUTH_OIDC_ROLESCLAIM: "roles"
      # NOTE: scopes `openid profile email` are added by default by the new WebAPI; extraScopes no longer required
      # OAuth callback URLs - must use external URL for browser redirects
      # NOTE: callback path now includes /openid segment (Spring oauth2Login convention).
      # The Logto app's redirect URI must be updated to end with /user/oauth/callback/openid
      SECURITY_AUTH_OAUTH_CALLBACK_API: "https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:${CADDY_PORT:-${PORT:-443}}/WebAPI/user/oauth/callback"
      SECURITY_AUTH_OAUTH_CALLBACK_UI: "https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:${CADDY_PORT:-${PORT:-443}}/atlas/#/welcome"
      # TrexSQL configuration
      # PG__ vars needed by trex (npm start) for database connection
      PG__DB_NAME: alp
      PG__HOST: ${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}
      PG__PORT: ${PG_PORT:-5432}
      # Schemas PostGraphile introspects for /trex/graphql - `notebook` exposes
      # the studies/notebooks tables provisioned by the notebook-schema
      # migrations plugin mounted above.
      PG_SCHEMA: ${PG_SCHEMA:-trexdb,notebook}
      # ── DB bootstrap (replaces the alp-minerva-pg-mgmt-init container) ──────
      # trex's d2e-compat runD2eBootstrap() reads these before plugin init and
      # provisions the login users, the anon/authenticated/service_role roles,
      # the schemas and their grants. Same contract the retired container used,
      # so the SQL is unchanged and re-runs idempotently on every boot.
      POSTGRES_MANAGE_CONFIG: |-
        {
         "databases": {
          "+${PG_DB_NAME:-alp}": {
           "schemas": {
            "+cdw_config": {},
            "+jobplugins": {},
            "+logto": {},
            "+portal": {},
            "+public": {},
            "+qe_config": {},
            "+terminology": {},
            "+usermgmt": {},
            "+files_manager": {},
            "+perseus": {},
            "+white_rabbit": {},
            "+trex": {},
            "+storage": {},
            "+strategus": {},
            "+notebook": {},
            "+network": {},
            "+analytics": {}
           }
          }
         }
        }
      POSTGRES_MANAGE_USERS: |-
        {
         "${PG_DB_NAME:-alp}": {
          "manager": "${PG_ADMIN_USER:-alp_pg_admin_user}",
          "managerPassword": "${PG_ADMIN_PASSWORD}",
          "reader": "${PG_WRITE_USER:-alp_pg_write_user}",
          "readerPassword": "${PG_WRITE_PASSWORD}",
          "writer": "${PG_WRITE_USER:-alp_pg_write_user}",
          "writerPassword": "${PG_WRITE_PASSWORD}",
          "logtoManager": "${PG_LOGTO_MANAGER:-${PG__LOGTO_MANAGER_USER:-logto_postgres}}",
          "logtoManagerPassword": "${PG__LOGTO_MANAGER_PASSWORD}"
         }
        }
      POSTGRES_MANAGE_ROLES_USERS: ${POSTGRES_MANAGE_ROLES_USERS:-{}}
      # ── OIDC provider ───────────────────────────────────────────────────────
      # trex is the identity provider for Atlas and WebAPI. The issuer is the
      # externally reachable origin, not an internal one: it is baked into every
      # token and re-checked by the relying party, so it has to be the URL a
      # browser sees. BASE_PATH is appended, giving /trex/oidc/*.
      # trex is the identity provider for the whole stack, not just WebAPI.
      # d2e-compat verifies portal bearers against it and the portal login
      # flow points at it. Installations that still hold their users in Logto
      # run with D2E_IDP_MODE=logto-federated, which keeps Logto as an upstream
      # sign-in option and migrates those users on boot (alp-idp-migration-init).
      D2E_IDP: ${D2E_IDP:-trex}
      # trex or logto-federated. Stamped into the env file by `d2e init` / `d2e start`;
      # logto-federated is applied with docker-compose-logto-federation.yml.
      D2E_IDP_MODE: ${D2E_IDP_MODE:-trex}
      # D2E_IDP_AUDIENCES, D2E_IDP_RESOURCE and D2E_IDP_SCOPE are left unset on
      # purpose. Under D2E_IDP=trex the engine derives all three from the issuer
      # and the client id, and each one REPLACES that derivation rather than
      # extending it. An audience list naming only the client id -- the value
      # that was right before the provider moved onto @better-auth/oauth-provider
      # -- rejects every access token the portal presents, and a rejection for a
      # mismatched audience is indistinguishable from one for a forged token.
      # A resource other than the issuer fails the same way: the issuer is the
      # only resource the provider advertises, and a request that names none at
      # all gets an opaque access token the portal cannot read `roles` from.
      # trex authenticates users itself, so its native login surface has to be
      # on. It is off by default in the engine for stacks fronted by an external
      # IdP. Enabling it does not expose a default account: the seeded
      # admin@trex.local has a user row but NO credential (trexdb.account is
      # empty), so it cannot sign in until someone provisions one.
      TREX_IDP_ENABLED: "true"
      TREX_OIDC_PROVIDER_ENABLED: "true"
      # One sign-in spends a password grant and a code exchange, and the limit
      # is per address rather than per user, so everyone behind one gateway -
      # or a whole test run - shares the count.
      TREX_AUTH_RATE_LIMIT_MAX: ${TREX__AUTH_RATE_LIMIT_MAX:-2000}
      # The public origin: `iss` must name where the discovery document is
      # served. Server-side OIDC calls (d2e-compat's JWKS fetch and /oauth/token
      # proxy, trex-token) must not go through it: where the FQDN is `localhost`
      # -- any CLI install, local, CI -- it resolves to this container's own
      # loopback, nothing answers on 443, and every portal code exchange ends in
      # `fetch failed`. TREX_OIDC_INTERNAL_BASE routes those calls to trex
      # directly on the compose network, which works for every FQDN, while `iss`
      # stays the public issuer.
      TREX_OIDC_INTERNAL_BASE: "http://${PROJECT_NAME:-d2e}-trex:33001"
      TREX_OIDC_ISSUER: "https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${D2E__PUBLIC_PORT_SUFFIX-${CADDY_PORT:+:${CADDY_PORT}}}"
      # trex ships no login UI; an unauthenticated /authorize lands here.
      TREX_OIDC_LOGIN_URL: "https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:${CADDY_PORT:-${PORT:-443}}/d2e-login/"
      # WebAPI is the only relying party: Atlas reaches the IdP through it. The
      # registration is upserted on every boot, so these values are the source of
      # truth and a changed URL needs no manual fix-up.
      TREX_OIDC_CLIENT_ID: ${TREX__OIDC__WEBAPI_CLIENT_ID:-d2e-webapi}
      TREX_OIDC_CLIENT_SECRET: ${TREX__OIDC__WEBAPI_CLIENT_SECRET:?TREX__OIDC__WEBAPI_CLIENT_SECRET must be set (run d2e init)}
      TREX_OIDC_CLIENT_NAME: "D2E WebAPI"
      # Spring's oauth2Login appends the registration id, hence the /openid tail.
      # Two relying parties share this registration: WebAPI (Spring appends the
      # /openid registration id) and the portal, whose callback d2e-compat builds
      # from the same clientId. A redirect URI that is not listed here is refused
      # at /authorize, so the portal cannot log in without its entry.
      #
      # WebAPI derives the redirect URI it asks for from the request it received,
      # so reaching Atlas by any other name than the one below - another
      # hostname, an address, a different port - produces a URI that is not on
      # this list and the sign-in ends in "unregistered redirect_uri".
      # TREX_OIDC__EXTRA_REDIRECT_URIS registers those additional origins; give
      # it whole callback URLs, comma separated.
      TREX_OIDC_CLIENT_REDIRECT_URIS: "https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:${CADDY_PORT:-${PORT:-443}}/WebAPI/user/oauth/callback/openid,https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:${CADDY_PORT:-${PORT:-443}}/d2e/portal/login-callback,https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:${CADDY_PORT:-${PORT:-443}}/atlas-login/,https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}/WebAPI/user/oauth/callback/openid,https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}/d2e/portal/login-callback,https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}/atlas-login/${TREX_OIDC__EXTRA_REDIRECT_URIS:+,${TREX_OIDC__EXTRA_REDIRECT_URIS}}"
      TREX_OIDC_CLIENT_POST_LOGOUT_URIS: "https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:${CADDY_PORT:-${PORT:-443}}/atlas/,https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:${CADDY_PORT:-${PORT:-443}}/d2e/portal,https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}/atlas/,https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}/d2e/portal"
      # The ceiling /authorize narrows every request to, not a grant: it issues
      # only what the request asks for. d2e-compat asks for offline_access on
      # every sign-in because the provider issues a refresh token only when
      # that scope was granted, so a row without it refuses every sign-in with
      # an invalid_scope naming a scope nobody configured. The seeder writes
      # this column only when this variable is set, leaving a row seeded by an
      # older image on its old list until it is named here.
      TREX_OIDC_CLIENT_SCOPES: "openid profile email idp_groups offline_access"
      # client_credentials clients for trex's provider (LOGTO__CLIENT_APPS shape).
      # alp-svc omitted: its only caller needs a psConfig route not set up here.
      TREX_OIDC_SERVICE_CLIENTS: '[{"name":"alp-data","id":"${LOGTO__D2E_DATA__CLIENT_ID:-${LOGTO__ALP_DATA__CLIENT_ID}}","secret":"${LOGTO__D2E_DATA__CLIENT_SECRET:-${LOGTO__ALP_DATA__CLIENT_SECRET}}"}]'
      TREX_SQL_PASSWORD: ${TREX__SQL__PASSWORD:?TREX__SQL__PASSWORD must be set (run d2e init); refusing default pencil}
      TREX__SQL__PORT: ${TREX__SQL__PORT:-5433}
      TREX__SQL__DBNAME: postgres
      TREX__ENDPOINT_URL: "http://localhost:33001"
      TREX_ROUTES: '{"d2e":"http://localhost:33001"}'
      TREX_EXTENSIONS_PATH: /usr/src/node_modules/@trex
      TREX_POOL_SIZE: ${TREX_POOL_SIZE:-1024}
      TREXSQL_ENABLED: "true"
      # hades-api Run backend: R env cache + per-run output, both under the
      # hades-data volume; work schema for staged cohort/analysis data.
      HADES_ENVS_BASE_DIR: /data/hades/envs
      HADES_OUTPUT_BASE_DIR: /data/hades/runs
      HADES_WORK_SCHEMA: _config.work
      SWARM_NODE: d2e
      SWARM_CONFIG: |-
        {
          "cluster_id": "d2e",
          "nodes": {
            "d2e": {
              "gossip_addr": "0.0.0.0:4200",
              "extensions": [
                {
                  "name": "trexas",
                  "config": {
                    "host": "0.0.0.0",
                    "port": 33001,
                    "main_service_path": "/usr/src/core/server/index.eszip",
                    "event_worker_path": "/usr/src/core/event/index.eszip",
                    "tls_port": 33000,
                    "tls_cert_path": "/usr/src/cert/cert.pem",
                    "tls_key_path": "/usr/src/cert/key.pem"
                  }
                },
                {
                  "name": "pgwire",
                  "config": { "host": "0.0.0.0", "port": 5433, "password": "${TREX__SQL__PASSWORD:?TREX__SQL__PASSWORD must be set (run d2e init); refusing default pencil}" }
                }
              ]
            }
          }
        }
      REP_PG: postgres://postgres:${DEMO__DB_PASSWORD:-mypass}@demodb:5432/postgres
      TPM_USE_NODE_MODULES: "false"
      SERVICE_ROUTES: |-
        {
        "analytics": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001",
        "bookmark": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/analytics-svc/api/services/bookmark",
        "cdw": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001",
        "d2e-webapi": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/d2e-webapi",
        "webapi": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/WebAPI",
        "paConfig": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/pa-config-svc",
        "trex": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001",
        "queryGen": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001",
        "jobplugins": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001",
        "portalServer": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/system-portal",
        "dataset": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/gateway/api/dataset",
        "usermgmt": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/usermgmt/api",
        "strategus-analysis": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001",
        "terminology": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/terminology",
        "prefect": "https://${PROJECT_NAME:-d2e}-dataflow-gen-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:41120/d2e/api",
        "idIssuerUrl": "https://${PROJECT_NAME:-d2e}-logto-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:3001/oidc",
        "minio": "",
        "filesManager": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/files-manager/api",
        "whiteRabbit": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/white-rabbit/api",
        "alpdb": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/gateway/api/db",
        "logto": "https://${PROJECT_NAME:-d2e}-logto-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:3001",
        "supabaseStorage": "https://${PROJECT_NAME:-d2e}-supabase-storage-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:9000",
        "dataflowStorage": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/system-portal/supabase-storage",
        "mcp-server": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/mcp/chat",
        "materializeCohorts": "https://${PROJECT_NAME:-d2e}-materialize-cohorts:3333",
        "fhirServer": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:8094",
        "fhirGateway": "http://${PROJECT_NAME:-d2e}-trex.${TLS__INTERNAL__DOMAIN:-d2e.local}:33001/fhir-gateway"
        }
      PG_SUPER_PASSWORD: ${PG_SUPER_PASSWORD}
      PG_SUPER_USER: ${PG_SUPER_USER:-postgres}
      PG_MANAGE_PASSWORD: ${PG_ADMIN_PASSWORD}
      PG_MANAGE_USER: ${PG_ADMIN_USER:-alp_pg_admin_user}
      PG_PASSWORD: ${PG_WRITE_PASSWORD}
      PG_USER: ${PG_WRITE_USER:-alp_pg_write_user}
      PORTAL__LOG_DISCLAIMER: ${PORTAL__LOG_DISCLAIMER:-false}
      PREFECT_API_URL: ${PREFECT_API_URL:-https://${PROJECT_NAME:-d2e}-dataflow-gen-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:41120/d2e/api}
      # Gates the alp-dataflow-gen-init function (waitforEnvVar: PREFECT_HEALTH_CHECK)
      # so trex waits for the Prefect API to be reachable before seeding its
      # variables/blocks/workpool. Without it the init runs at boot before Prefect
      # is up, crashes with ECONNREFUSED, and DQD flow runs later fail with 500.
      PREFECT_HEALTH_CHECK: ${PREFECT_HEALTH_CHECK:-https://${PROJECT_NAME:-d2e}-dataflow-gen-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:41120/d2e/api/health}
      # The trex core auto-deploys flow plugins to Prefect (core/server/plugin/flow.ts):
      # it waits for a worker pool named PREFECT_POOL before registering deployments
      # and sets work_pool_name to it. Must match the pool created by the
      # dataflow-gen-worker. Default is the pixi process pool; rollback to the
      # docker worker = PREFECT_POOL=docker-pool + WORKPOOL_TYPE=docker (see the
      # alp-dataflow-gen-worker service comment).
      PREFECT_POOL: ${PREFECT_POOL:-process-pool}
      WORKPOOL_TYPE: ${WORKPOOL_TYPE:-process}
      DEFAULT_FLOW_COMMAND: ${DEFAULT_FLOW_COMMAND:-/app/run-flow.sh d2e-flows}
      # trex-embedded supabase storage (@trex/storage at /plugins/trex/storage-api):
      # flow.ts publishes flow plugin tarballs here and stamps plugin_artifact
      # into deployments; persistent backend path on the trex data volume.
      STORAGE_FILE_BACKEND_PATH: ${STORAGE_FILE_BACKEND_PATH:-/usr/src/data/storage}
      TREX_STORAGE_URL: ${TREX_STORAGE_URL_INTERNAL:-http://localhost:33001/plugins/trex/storage-api}
      TREX_STORAGE_SERVICE_KEY: ${TREX_STORAGE_SERVICE_KEY:-}
      DB_CREDENTIALS__PUBLIC_KEYS: |-
        {
         "DataPlatform": "",
         "Internal": "${DB_CREDENTIALS__INTERNAL__PUBLIC_KEY}"
        }
      DB_CREDENTIALS__PRIVATE_KEY: ${DB_CREDENTIALS__INTERNAL__DECRYPT_PRIVATE_KEY}
      GATEWAY__IDP_AUTH_TYPE: logto
      GATEWAY__IDP_SUBJECT_PROP: sub
      GATEWAY__WO_PROTOCOL_FQDN: ${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}
      HANA__DRIVER_CLASS_PATH: ${HANA__DRIVER_CLASS_PATH:-/app/inst/drivers/ngdbc-latest.jar}
      HANA_HINT: ${HANA_HINT:-USE_HEX_PLAN}
      CADDY__D2E__PUBLIC_FQDN: ${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}
      IDP__ALP_DATA_CLIENT_ID: ${LOGTO__D2E_DATA__CLIENT_ID:-${LOGTO__ALP_DATA__CLIENT_ID}}
      IDP__ALP_SVC_CLIENT_ID: ${LOGTO__D2E_SVC__CLIENT_ID:-${LOGTO__ALP_SVC__CLIENT_ID}}
      IDP__RELYING_PARTY: ${IDP__RELYING_PARTY}
      IDP__REQUIRED_CLAIM: ${IDP__REQUIRED_CLAIM-thirdPartyToken}
      LOGTO__AUDIENCES: https://alp-default
      LOGTO__CLIENT_ID: ${LOGTO__D2E_APP__CLIENT_ID:-${LOGTO__ALP_APP__CLIENT_ID}}
      LOGTO__D2E_SVC__CLIENT_ID: ${LOGTO__D2E_SVC__CLIENT_ID:-${LOGTO__ALP_SVC__CLIENT_ID}}
      LOGTO__D2E_SVC__CLIENT_SECRET: ${LOGTO__D2E_SVC__CLIENT_SECRET:-${LOGTO__ALP_SVC__CLIENT_SECRET}}
      LOGTO__D2E_DATA__CLIENT_ID: ${LOGTO__D2E_DATA__CLIENT_ID:-${LOGTO__ALP_DATA__CLIENT_ID}}
      LOGTO__D2E_DATA__CLIENT_SECRET: ${LOGTO__D2E_DATA__CLIENT_SECRET:-${LOGTO__ALP_DATA__CLIENT_SECRET}}
      # Must equal the iss claim Logto stamps into tokens (= Logto's ENDPOINT + /oidc).
      # Used by trex-TS authn middleware (JWKS URL) and portal config (iss validation).
      LOGTO__ISSUER: https://${PROJECT_NAME:-d2e}-logto-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:3001/oidc
      LOGTO__RESOURCE_API: https://alp-default
      LOGTO__SCOPE: ${LOGTO__SCOPE:-openid offline_access profile email}
      LOGTO__SVC_CLIENT_ID: ${LOGTO__D2E_SVC__CLIENT_ID:-${LOGTO__ALP_SVC__CLIENT_ID}}
      LOGTO__SVC_CLIENT_SECRET: ${LOGTO__D2E_SVC__CLIENT_SECRET:-${LOGTO__ALP_SVC__CLIENT_SECRET}}
      LOGTO__TOKEN_URL: https://${PROJECT_NAME:-d2e}-logto-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:3001/oidc/token
      LOGTO__ADMIN_SERVER__FQDN_URL: https://${PROJECT_NAME:-d2e}-logto-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:3002
      LOGTO__DEFAULT_TENANT__FQDN_URL: ${LOGTO__DEFAULT_TENANT__FQDN_URL:-https://default.logto.app/api}
      LOGTO__CLIENTID_PASSWORD__BASIC_AUTH: ${LOGTO__CLIENTID_PASSWORD__BASIC_AUTH}
      LOGTO_API_M2M_CLIENT_ID: ${LOGTO_API_M2M_CLIENT_ID}
      LOGTO_API_M2M_CLIENT_SECRET: ${LOGTO_API_M2M_CLIENT_SECRET}
      NODE_ENV: development
      POSTGRES__DRIVER_CLASS_PATH: ${POSTGRES__DRIVER_CLASS_PATH:-/app/inst/drivers/postgresql-42.3.1.jar}
      PREFECT_DOCKER_NETWORK: "${PROJECT_NAME:-d2e}_data"
      PREFECT_DOCKER_VOLUMES: '${PREFECT_DOCKER_VOLUMES_CUSTOM:-["${PROJECT_NAME:-d2e}_trex:/app/duckdb_data"]}'
      GH_TOKEN: ${GH_TOKEN}
      PLUGINS_API_VERSION: ${PLUGINS_API_VERSION:-latest}
      PLUGINS_REGISTRY: ${PLUGINS_REGISTRY:-https://pkgs.dev.azure.com/data2evidence/d2e/_packaging/d2e/npm/registry/}
      TPM_REGISTRY_URL: ${PLUGINS_REGISTRY:-https://pkgs.dev.azure.com/data2evidence/d2e/_packaging/d2e/npm/registry/}
      PLUGINS_IMAGE_TAG: ${PLUGINS_IMAGE_TAG:-develop}
      PLUGINS_FLOW_CUSTOM_REPO_IMAGE_CONFIG: "${PLUGINS_FLOW_CUSTOM_REPO_IMAGE_CONFIG:-{}}" #{"current": "ghcr.io/ohdsi/d2e", "new": ""}
      PLUGINS_INFORMATION_URL: ${PLUGINS_INFORMATION_URL:-https://feeds.dev.azure.com/data2evidence/d2e/_apis/packaging/Feeds/d2e/packages?api-version=7.1&includeDescription=true}
      PROJECT_NAME: ${PROJECT_NAME:-d2e}
      DATAFLOW_TEMPLATE_REPO_URL: ${DATAFLOW_TEMPLATE_REPO_URL:-https://github.com/data2evidence/templates.git}
      DATAFLOW_TEMPLATE_BRANCH: ${DATAFLOW_TEMPLATE_BRANCH:-main}
      NOTEBOOK_TEMPLATE_REPO_URL: ${NOTEBOOK_TEMPLATE_REPO_URL:-https://github.com/data2evidence/templates.git}
      NOTEBOOK_TEMPLATE_REPO_BRANCH: ${NOTEBOOK_TEMPLATE_REPO_BRANCH:-main}
      FHIR_STRUCTURE_MAP_TEMPLATE_REPO_URL: ${FHIR_STRUCTURE_MAP_TEMPLATE_REPO_URL:-https://github.com/data2evidence/templates.git}
      FHIR_STRUCTURE_MAP_TEMPLATE_REPO_BRANCH: ${FHIR_STRUCTURE_MAP_TEMPLATE_REPO_BRANCH:-main}
      GOOGLE_APPLICATION_CREDENTIALS: /usr/src/data/google-credentials.json
      PG_ADMIN_PASSWORD: ${PG_ADMIN_PASSWORD}
      PG_WRITE_PASSWORD: ${PG_WRITE_PASSWORD}
      PG_STUDY_RESULTS_READ_PASSWORD: ${PG_STUDY_RESULTS_READ_PASSWORD}
      PG_STUDY_RESULTS_ADMIN_PASSWORD: ${PG_STUDY_RESULTS_ADMIN_PASSWORD}
      SUPABASE_STORAGE_JWT_TOKEN: ${SUPABASE_STORAGE_JWT_TOKEN}
      SUPABASE_STORAGE_JWT_SECRET: ${SUPABASE_STORAGE_JWT_SECRET}
      PERSEUS__FILES_MANAGER_HOST: trex
      isHttpTestRun: ${isHttpTestRun:-false}
      isTestEnv: ${isTestEnv:-false}
      HTTPTEST_DB_DIALECT: ${HTTPTEST_DB_DIALECT:-duckdb}
      local: ${local}
      TESTSCHEMA: ${TESTSCHEMA}
      REFRESH_TOKEN__ENDPOINT: ${REFRESH_TOKEN__ENDPOINT}
      REFRESH_TOKEN__CLIENT_ID: ${REFRESH_TOKEN__CLIENT_ID}
      REFRESH_TOKEN__CLIENT_SECRET: ${REFRESH_TOKEN__CLIENT_SECRET}
      EXCLUDE_ANALYSIS_IDS: ${EXCLUDE_ANALYSIS_IDS}
      DC_HANA_READ_ROLE: ${DC_HANA_READ_ROLE}
      MINIO__SECRET_KEY: ${MINIO__SECRET_KEY}
      DEMO__DB_PASSWORD: ${DEMO__DB_PASSWORD:-mypass}
      USE_PUBLIC_WEBAPI_PROXY: ${USE_PUBLIC_WEBAPI_PROXY:-false}
      PUBLIC_WEBAPI_PROXY_URL: ${PUBLIC_WEBAPI_PROXY_URL:-http://localhost:3001}
      PUBLIC_WEBAPI_DATASOURCE: ${PUBLIC_WEBAPI_DATASOURCE:-SYNPUF1K}
      AZURE_OPENAI_API_KEY: ${AZURE_OPENAI_API_KEY:-}
      AZURE_OPENAI_API_ENDPOINT: ${AZURE_OPENAI_API_ENDPOINT:-}
      AZURE_OPENAI_API_DEPLOYMENT_NAME: ${AZURE_OPENAI_API_DEPLOYMENT_NAME:-}
      AZURE_OPENAI_API_VERSION: ${AZURE_OPENAI_API_VERSION:-}
      AZURE_OPENAI_API_INSTANCE_NAME: ${AZURE_OPENAI_API_INSTANCE_NAME:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      GOOGLE_API_KEY: ${GOOGLE_API_KEY:-}
      OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-}
      OLLAMA_API_KEY: ${OLLAMA_API_KEY:-}
      AI_MODEL: ${AI_MODEL:-}
      COHORT_HISTORY_MAX_TOKENS: ${COHORT_HISTORY_MAX_TOKENS:-4000}
      # Pythia agent (Amazon Bedrock). AWS_BEARER_TOKEN_BEDROCK from the deploy env.
      AWS_REGION: ${AWS_REGION:-us-east-1}
      BAO_AGENT_MODEL: ${BAO_AGENT_MODEL:-us.anthropic.claude-sonnet-4-6}
      # WebAPI trexsql.proxy probes localhost:8001 by default; the pythia mount lives on the Deno listener (33001).
      BAO_AGENT_UPSTREAM_BASE: ${BAO_AGENT_UPSTREAM_BASE:-http://localhost:33001/plugins/ohdsi/pythia}
      # Agent runtime reads TREX_AGENTS_DEFAULT_MODEL (provider/modelId), not BAO_AGENT_MODEL.
      TREX_AGENTS_DEFAULT_MODEL: ${TREX_AGENTS_DEFAULT_MODEL:-bedrock/${BAO_AGENT_MODEL:-us.anthropic.claude-sonnet-4-6}}
      AWS_BEARER_TOKEN_BEDROCK: ${AWS_BEARER_TOKEN_BEDROCK:-}
      D2E_MEMORY_LIMIT: ${D2E_MEMORY_LIMIT:-}
      D2E_SWAP_LIMIT: ${D2E_SWAP_LIMIT:-}
      D2E_DUCKDB_MEMORY_LIMIT: ${D2E_DUCKDB_MEMORY_LIMIT:-15GB}
      D2E_DUCKDB_THREADS: ${D2E_DUCKDB_THREADS:-}
      INSTALL_SQLALCHEMY: ${INSTALL_SQLALCHEMY:-}
      IS_SELF_MANAGED_ROLES: ${IS_SELF_MANAGED_ROLES:-false}
      AUTO_GRANT_RESEARCHER_BY_DATASET_CODES: ${AUTO_GRANT_RESEARCHER_BY_DATASET_CODES:-${AZ_AUTO_GRANT_RESEARCHER_BY_DATASET_CODES:-}}
      IDP__AUTO_PROVISION_USERS: ${IDP__AUTO_PROVISION_USERS:-false}
      # Follows D2E_IDP above. Left on logto, group memberships are written to
      # an identity provider the tokens no longer come from, so study roles
      # never reach the claim the portal reads and datasets stay invisible.
      USER_MGMT__ROLE_SOURCE: ${USER_MGMT__ROLE_SOURCE:-trex}
      # Role assignments are written to trex, which is also the identity provider
      # issuing the tokens they travel in.
      IDP__ROLE_STORE: "trex"
      TREX__ADMIN_URL: "http://${PROJECT_NAME:-d2e}-trex:33001/trex/admin/roles"
      # Upstream provider registration and identity pre-linking (IdP migration).
      TREX__FEDERATION_ADMIN_URL: "http://${PROJECT_NAME:-d2e}-trex:33001/trex/admin/federation"
      # Account provisioning, as opposed to role assignment above. Used to
      # create the initial user in the IdP so usermgmt can record its subject.
      TREX__AUTH_URL: "http://${PROJECT_NAME:-d2e}-trex:33001/trex/auth/v1"
      D2E__SEED_USER: ${D2E__SEED_USER:-}
      D2E__SETUP_USER: ${D2E__SETUP_USER:-d2e-setup@d2e.local}
      # Optional override only: usermgmt runs as a function worker inside the
      # trex container, and trex already injects this same credential as
      # SUPABASE_SERVICE_ROLE_KEY into every such worker's environment.
      TREX__SERVICE_ROLE_KEY: ${TREX__SERVICE_ROLE_KEY:-}
      USERMGMT__AUTO_PROVISION_ENABLED: ${USERMGMT__AUTO_PROVISION_ENABLED:-false}
      USERMGMT__AUTO_PROVISION_CONNECTORS: ${USERMGMT__AUTO_PROVISION_CONNECTORS:-}
      USERMGMT__AUTO_PROVISION_DEFAULT_TENANT_ID: ${USERMGMT__AUTO_PROVISION_DEFAULT_TENANT_ID:-}
      USERMGMT__AUTO_PROVISION_ROLE_HOOK_URL: ${USERMGMT__AUTO_PROVISION_ROLE_HOOK_URL:-}
      USERMGMT__AUTO_PROVISION_ROLE_HOOK_SECRET: ${USERMGMT__AUTO_PROVISION_ROLE_HOOK_SECRET:-}
      USERMGMT__AUTO_PROVISION_ROLE_HOOK_TIMEOUT_MS: ${USERMGMT__AUTO_PROVISION_ROLE_HOOK_TIMEOUT_MS:-5000}
      USERMGMT__ENTITLEMENTS_SYNC_ENABLED: ${USERMGMT__ENTITLEMENTS_SYNC_ENABLED:-false}
      USERMGMT__ENTITLEMENTS_PHYSIONET_BASE_URL: ${USERMGMT__ENTITLEMENTS_PHYSIONET_BASE_URL:-}
      USERMGMT__ENTITLEMENTS_TIMEOUT_MS: ${USERMGMT__ENTITLEMENTS_TIMEOUT_MS:-10000}
      USERMGMT__ENTITLEMENTS_TOKEN_CLAIM: ${USERMGMT__ENTITLEMENTS_TOKEN_CLAIM:-physionet_access_token}
      USERMGMT__ENTITLEMENTS_REFRESH_TOKEN_CLAIM: ${USERMGMT__ENTITLEMENTS_REFRESH_TOKEN_CLAIM:-physionet_refresh_token}
      USERMGMT__ENTITLEMENTS_PHYSIONET_CLIENT_ID: ${USERMGMT__ENTITLEMENTS_PHYSIONET_CLIENT_ID:-}
      USERMGMT__ENTITLEMENTS_PHYSIONET_CLIENT_SECRET: ${USERMGMT__ENTITLEMENTS_PHYSIONET_CLIENT_SECRET:-}
      USERMGMT__ENTITLEMENTS_PHYSIONET_TOKEN_PATH: ${USERMGMT__ENTITLEMENTS_PHYSIONET_TOKEN_PATH:-/oauth/token/}
      USERMGMT__ENTITLEMENTS_DATASET_MAPPING: ${USERMGMT__ENTITLEMENTS_DATASET_MAPPING:-}
      # Upstream idp group id -> d2e scope, keyed by idp_provider (JSON). Read by
      # the alp-usermgmt function; empty means no federated group maps to a role.
      IDP__GROUP_ROLE_MAPPING: ${IDP__GROUP_ROLE_MAPPING:-}
      # network-api function (plugins/functions/package.json) stays inactive
      # until these are non-empty.
      NETWORK_COGNITO_DOMAIN: ${NETWORK_COGNITO_DOMAIN:-}
      NETWORK_CENTRAL_API_URL: ${NETWORK_CENTRAL_API_URL:-}
      NETWORK_MACHINE_CLIENT_ID: ${NETWORK_MACHINE_CLIENT_ID:-}
      NETWORK_CLIENT_SECRET: ${NETWORK_CLIENT_SECRET:-}
      NETWORK_TOKEN_SCOPE: ${NETWORK_TOKEN_SCOPE:-}
      NETWORK_ENC_KEY: ${NETWORK_ENC_KEY:-}
      # Coordinator-scoped auth for study publish (POST /studies, POST
      # /studies/{id}/publish). Scaffold only — central has no path today for
      # a client_credentials token to receive role=coordinator, so network-api
      # keeps GET /coordinator/state reporting configured:false regardless of
      # these being set. See plugins/sibyl_functions/network-api/index.ts header.
      NETWORK_COORDINATOR_CLIENT_ID: ${NETWORK_COORDINATOR_CLIENT_ID:-}
      NETWORK_COORDINATOR_CLIENT_SECRET: ${NETWORK_COORDINATOR_CLIENT_SECRET:-}
      NETWORK_COORDINATOR_TOKEN_SCOPE: ${NETWORK_COORDINATOR_TOKEN_SCOPE:-}
      CACHE_FLOW_LEVEL_CONCURRENCY: ${CACHE_FLOW_LEVEL_CONCURRENCY:-1}
      CACHE_TABLE_LEVEL_CONCURRENCY: ${CACHE_TABLE_LEVEL_CONCURRENCY:-1}
      CACHE_TASK_TIMEOUT: ${CACHE_TASK_TIMEOUT:-10800}
      CACHE_CHUNK_TIMEOUT: ${CACHE_CHUNK_TIMEOUT:-3600}
      # alp-dataflow-gen-init seeds this as the `duckdb_data_folder` Prefect variable,
      # which the cache flows resolve their .db path from. It was declared only in that
      # function's trex env profile and in CI the variable came out null, so every cache
      # build died in Path(None) -- seed.ts posts `value: undefined`, which Prefect
      # stores as null rather than rejecting. Declaring it on the container the init
      # runs in makes the seeded value the real one. trex mounts the same volume at
      # /usr/src/data and attaches cache catalogs out of /usr/src/data/cache; a flow
      # container sees that volume as /app/duckdb_data.
      DUCKDB__DATA_FOLDER: ${DUCKDB__DATA_FOLDER:-/app/duckdb_data/cache}
      ANALYTICS_STREAMING_CHUNK_SIZE_BY_DIALECT: '${ANALYTICS_STREAMING_CHUNK_SIZE_BY_DIALECT:-{"hana": 10000}}'
      IS_AUDIT_LOG_ENABLED: ${IS_AUDIT_LOG_ENABLED:-false}
      IS_CDM_SQL_AUDIT_LOG_ENABLED: ${IS_CDM_SQL_AUDIT_LOG_ENABLED:-false}
      AUDIT_LOG_TO_CONSOLE: ${AUDIT_LOG_TO_CONSOLE:-false}
      ANALYTICS_HANA_STREAMING_ENABLED: ${ANALYTICS_HANA_STREAMING_ENABLED:-false}
      # TREX_DEBUG_GC: ${TREX_DEBUG_GC:-0}
      # RUST_LOG: ${RUST_LOG:-info}
      # --- trex main (FROM trexsql) requirements ---
      # trexsql entrypoint refuses to start without TREX_ROOT_KEY (>=40 chars).
      TREX_ROOT_KEY: ${TREX_ROOT_KEY:?TREX_ROOT_KEY must be set (run d2e init); trex refuses to boot without it}
      # trex main connects to Postgres for trexdb schema, auth keys, event_log.
      DATABASE_URL: postgres://postgres:${PG_SUPER_PASSWORD}@${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}:${PG_PORT:-5432}/alp
      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:-${TREX_ROOT_KEY}}
      BETTER_AUTH_URL: "http://localhost:33001/trex"
      BASE_PATH: /trex
      SCHEMA_DIR: /usr/src/core/schema
      PLUGINS_DEV_PATH: "/usr/src/plugins-dev:/usr/src/bundled-plugins"
      D2E_COMPAT: "true"
      # OpenTelemetry is off by default: deno_telemetry is only turned on when
      # trex is started with --enable-otel (see the command above), not by
      # these OTEL_EXPORTER_* vars alone.
      TREX_OTEL_ENABLED: ${TREX_OTEL_ENABLED:-}
      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
      OTEL_EXPORTER_OTLP_PROTOCOL: ${OTEL_EXPORTER_OTLP_PROTOCOL:-}
      OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
      OTEL_SERVICE_NAME: ${OTEL_SERVICE_NAME:-}
      COHORT_CACHE_TTL_HOURS: ${COHORT_CACHE_TTL_HOURS:-24}
      COHORT_CACHE_MAX_AGE_DAYS: ${COHORT_CACHE_MAX_AGE_DAYS:-30}

  alp-caddy:
    container_name: &c1 ${PROJECT_NAME:-d2e}-caddy
    hostname: ${PROJECT_NAME:-d2e}-caddy.${TLS__INTERNAL__DOMAIN:-d2e.local}
    platform: linux/amd64
    image: caddy:2.8-alpine
    logging:
      options:
        tag: *c1
    networks:
      alp:
        priority: 20
    command: >
      sh -c "
        mkdir -p /srv/caddy-config &&
        printf '%s' \"$$TLS__INTERNAL__CA_CRT\" > /srv/caddy-config/ca.pem &&
        cat <<EOT > /srv/caddy-config/Caddyfile
        {
          debug
          servers {
            protocols h1
          }
          pki {
            ca local {
              name \"D2E Local CA\"
              root_cn \"D2E Local CA - 2024 ECC Root\"
              intermediate_cn \"D2E Local CA - ECC Intermediate\"
            }
          }
        }

        (publicurlredirect) {
          ${CADDY__D2E__ALIAS_PUBLIC_FQDN:-${CADDY__ALP__ALIAS_PUBLIC_FQDN:-}} {
            $TLS__CADDY_DIRECTIVE
            redir https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}{uri} permanent
          }
        }

        (proxy_headers_codespaces) {
          header_up Host {upstream_hostport}
          header_up X-Forwarded-Host ${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}
          header_up X-Forwarded-Proto {scheme}
          # {remote_host}, not {remote}: Caddy's {remote} is the peer's
          # host:PORT, and nothing downstream can parse an X-Forwarded-For
          # spelled that way. Better Auth's isValidIP refuses it outright, so
          # trex resolved no client IP at all and its rate limiter keyed every
          # caller into ONE bucket per path — which is how 594 anonymous
          # requests closed /oauth2/userinfo for the whole installation in 2.4
          # seconds. Logto reads the same header (TRUST_PROXY_HEADER=true).
          # trex normalises this defensively, so the two repositories can ship
          # in either order.
          header_up X-Forwarded-For {remote_host}
        }

        (proxy_headers_default) {
          header_up Host ${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:${CADDY_PORT:-${PORT:-443}}
          header_up X-Forwarded-Host ${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:${CADDY_PORT:-${PORT:-443}}
          header_up X-Forwarded-Port ${CADDY_PORT:-${PORT:-443}}
          header_up X-Forwarded-Proto https
          # {remote_host}, not {remote}: Caddy's {remote} is the peer's
          # host:PORT, and nothing downstream can parse an X-Forwarded-For
          # spelled that way. Better Auth's isValidIP refuses it outright, so
          # trex resolved no client IP at all and its rate limiter keyed every
          # caller into ONE bucket per path — which is how 594 anonymous
          # requests closed /oauth2/userinfo for the whole installation in 2.4
          # seconds. Logto reads the same header (TRUST_PROXY_HEADER=true).
          # trex normalises this defensively, so the two repositories can ship
          # in either order.
          header_up X-Forwarded-For {remote_host}
        }

        (portal) {
          log {
            format console {
              level_format color
            }
          }

          # Logto api server
          @logto {
            path /api/*
            path /oidc/*
            path /sign-in
            path /consent
            path /callback/* # For azure connector

            path /d2e/logto/index.*
            path /d2e/logto/assets/* # logto assets are moved to this path
          }

          handle @logto {
            uri strip_prefix /d2e/logto
            reverse_proxy https://${PROJECT_NAME:-d2e}-logto-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:3001 {
              import ${PROXY_HEADERS_MODE:-proxy_headers_default}
              # Host + X-Forwarded-* make Logto (TRUST_PROXY_HEADER=true) emit external URLs
              # for browser-facing endpoints (authorize/sign-in). The issuer claim itself is
              # sourced from Logto's ENDPOINT env var (internal http://alp-caddy:8080), which
              # lets WebAPI's Spring OAuth2 client validate iss without TLS/DNS gymnastics.
              header_up Host ${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}
              transport http {
                tls
                tls_trust_pool file /srv/caddy-config/ca.pem
                read_buffer 8192
              }
            }
          }

          # Redirect uppercase /Atlas to lowercase /atlas
          @atlas_uppercase {
            path_regexp atlas_case ^/Atlas(.*)$$
          }
          redir @atlas_uppercase /atlas{re.atlas_case.1} 301

          # Bare root lands on Atlas. Matched exactly so only "/" moves: every
          # other path still falls through to the trex gateway below.
          @root path /
          redir @root /atlas/ 302

          @studio path /plugins/trex/studio /plugins/trex/studio/*
          handle @studio {
            reverse_proxy http://${PROJECT_NAME:-d2e}-trex:33001 {
              import ${PROXY_HEADERS_MODE:-proxy_headers_default}
              transport http {
                read_buffer 8192
              }
              header_down -X-Frame-Options
              header_down -Content-Security-Policy
            }
          }

          # Default handler - all other routes go to trex gateway
          handle {
            reverse_proxy http://${PROJECT_NAME:-d2e}-trex:33001 {
              import ${PROXY_HEADERS_MODE:-proxy_headers_default}
              transport http {
                read_buffer 8192
              }
            }
          }
        }

        $INSTANCE_SPECIFIC_CONFIG

        # Enable if need to access admin console
        # http://localhost:3002 {
        #   uri strip_prefix /d2e/logto
        #   reverse_proxy http://${PROJECT_NAME:-d2e}-logto-1:3002 {
        #     header_up Host {host}
        #     header_up X-Forwarded-Proto http
        #     header_up X-Forwarded-Port 3002
        #     transport http {
        #       read_buffer 8192
        #     }
        #   }
        # }

        # Internal HTTP listener for service-to-service communication (avoids TLS issues)
        # Does NOT set X-Forwarded headers - metadata will have internal URLs for token exchange
        :8080 {
          @oidc {
            path /oidc/*
          }
          handle @oidc {
            reverse_proxy https://${PROJECT_NAME:-d2e}-logto-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:3001 {
              transport http {
                tls
                tls_trust_pool file /srv/caddy-config/ca.pem
              }
            }
          }

          # Enable if need to access admin console
          # @admin_api path /api/*
          # handle @admin_api {
          #   reverse_proxy http://${PROJECT_NAME:-d2e}-logto-1:3002
          # }
          
          # @admin_auth path /sign-in* /sign-up* /consent* /forgot-password* /callback/* /social/*
          # handle @admin_auth {
          #   reverse_proxy http://${PROJECT_NAME:-d2e}-logto-1:3001
          # }

          respond 404
        }

        https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${CADDY__ADDITIONAL_HOSTS:+, ${CADDY__ADDITIONAL_HOSTS}} {
          $TLS__CADDY_DIRECTIVE

          @aliasbasepaths {
              path_regexp portal_basepath ^/(d2e|portal)(/)?$
          }
          redir @aliasbasepaths /d2e/portal
          import portal
        }

        # Plain-HTTP listener (no TLS) so service workers register without a
        # trusted cert. Reuses the same handles via the (portal) snippet.
        # localhost over http is a secure context, so the results-viewer
        # shinylive service worker registers without the self-signed-cert error.
        # Access the app at http://localhost:41180.
        http://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:41180 {
          @aliasbasepaths2 {
              path_regexp portal_basepath ^/(d2e|portal)(/)?$
          }
          redir @aliasbasepaths2 /d2e/portal
          import portal
        }
      EOT
        caddy run --environ --config /srv/caddy-config/Caddyfile --adapter caddyfile
      "
    ports:
      - ${CADDY_PORT:-${PORT:-443}}:443
      - 41180:41180  # plain-http route (no TLS) so service workers work locally
      # - 3002:3002 # Enable if need to access admin console
      # - 8080:8080 # Enable if need to access admin console
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}
    volumes:
      - caddy:/data
    environment:
      CADDY__D2E__PUBLIC_FQDN: ${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}
      TLS__CADDY_DIRECTIVE: ${TLS__CADDY_DIRECTIVE:-tls internal}
      INSTANCE_SPECIFIC_CONFIG: ${INSTANCE_SPECIFIC_CONFIG:-}
      CADDY__D2E__ALIAS_PUBLIC_FQDN: ${CADDY__D2E__ALIAS_PUBLIC_FQDN:-${CADDY__ALP__ALIAS_PUBLIC_FQDN:-}}
      PROJECT_NAME: ${PROJECT_NAME:-d2e}
      # Read by the entrypoint above to write /srv/caddy-config/ca.pem, which the
      # tls_trust_pool directives use. Only the CA is passed — not the *x-tls
      # anchor — so the internal private key stays out of this container.
      TLS__INTERNAL__CA_CRT: ${TLS__INTERNAL__CA_CRT}

  alp-dataflow-gen:
    container_name: &c2 ${PROJECT_NAME:-d2e}-dataflow-gen-1
    depends_on:
      # No edge to alp-logto-post-init: it sits behind the logto profile and
      # compose cannot express a dependency that applies only when a profile is
      # active, so waiting on it would break every default start.
      # Needs the alp_pg_* users, which trex's bootstrap creates.
      trex:
        condition: service_healthy
    healthcheck:
      interval: 30s
      retries: 30
      start_period: 30s
      test:
        [
          "CMD-SHELL",
          "curl -fk https://localhost:41120/d2e/api/health || exit 1",
        ]
      timeout: 30s
    hostname: &dataflow-gen-hostname ${PROJECT_NAME:-d2e}-dataflow-gen-1.${TLS__INTERNAL__DOMAIN:-d2e.local}
    image: ${DOCKER_IMAGE_PREFIX:-ghcr.io/ohdsi/}d2e-dataflow-gen:${DOCKER_TAG_NAME:-develop}
    platform: linux/amd64
    logging:
      options:
        tag: *c2
    networks:
      alp:
        priority: 20
      data:
        priority: 10
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}
    environment:
      <<:
        - *x-converter
        - *x-pg
        - *x-tls
      LOCAL_DEBUG: "false"
      DATAFLOW_GEN_HOSTNAME: *dataflow-gen-hostname
      PREFECT_API_DATABASE_CONNECTION_URL: postgresql+asyncpg://${PG_SUPER_USER:-postgres}:${PG_SUPER_PASSWORD}@${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}:${PG_PORT:-5432}/${PG_DB_NAME:-alp}
      PREFECT_API_DEFAULT_LIMIT: 5000
      PREFECT_SERVER_API_BASE_PATH: /d2e/api
      PREFECT_UI_SERVE_BASE: /d2e
      # Relative API URL: the UI calls whatever origin it was loaded from
      # (localhost, 127.0.0.1, or the Caddy public FQDN), so API calls stay
      # same-origin and avoid the cross-origin CORS preflight that the
      # in-container nginx answers with 503. Must line up with
      # PREFECT_SERVER_API_BASE_PATH (/d2e/api) above.
      PREFECT_UI_API_URL: /d2e/api
      PREFECT_UI_URL: https://127.0.0.1:41120/d2e
      PREFECT_LOGGING_LEVEL: DEBUG
      PREFECT_LOGGING_SERVER_LEVEL: WARNING
      PREFECT_SERVER_ANALYTICS_ENABLED: "false"
      # Prefect itself stays on loopback, HTTP only; nginx (started by the
      # image's entrypoint.sh) is the only thing listening on 41120/the
      # docker network, terminating TLS with the shared TLS__INTERNAL__* cert.
      PREFECT_SERVER_API_HOST: 127.0.0.1
      PREFECT_UI_STATIC_DIRECTORY: /app/ui-files
      PREFECT_SERVER_API_PORT: 41121
      PREFECT_API_ENABLE_HTTP2: False

  # Pixi process worker: flow runs execute as subprocesses in per-plugin pixi
  # environments (run-flow.sh); plugin code+envs arrive as deployment-attached
  # artifacts from trex storage or the image's baked cache. Rollback to the
  # docker worker: PREFECT_POOL=docker-pool WORKPOOL_TYPE=docker (+ revert the
  # package.json command commit and use Dockerfile.docker-pool image).
  alp-dataflow-gen-worker:
    command:
      - pixi
      - run
      - --manifest-path
      - /opt/worker/pyproject.toml
      - sh
      - -c
      - >-
        rm -rf /root/.prefect/storage/run_cache.db /root/.prefect/storage/events.db;
        printf '%s\n' "$$TLS__INTERNAL__CA_CRT" > /usr/local/share/ca-certificates/d2e-internal-ca.crt;
        update-ca-certificates;
        printf '\n%s\n' "$$TLS__INTERNAL__CA_CRT" >> "$$(python -c 'import certifi; print(certifi.where())')";
        prefect work-pool create '${PREFECT_POOL:-process-pool}' --type ${WORKPOOL_TYPE:-process};
        prefect worker start --pool '${PREFECT_POOL:-process-pool}' --type ${WORKPOOL_TYPE:-process}
        --name prefect-${WORKPOOL_TYPE:-process}-worker --with-healthcheck
        --limit ${D2E_WORKER_FLOW_RUN_LIMIT:-3}

    container_name: &c83 ${PROJECT_NAME:-d2e}-dataflow-gen-worker
    platform: linux/amd64
    depends_on:
      # See alp-dataflow-gen: no edge to the profiled logto services.
      alp-dataflow-gen:
        condition: service_healthy
    healthcheck:
      interval: 30s
      retries: 30
      start_period: 30s
      test:
        [
          "CMD",
          "pixi",
          "run",
          "--manifest-path",
          "/opt/worker/pyproject.toml",
          "python",
          "-c",
          "import urllib.request, sys; sys.exit(0 if 200 <= urllib.request.urlopen('http://localhost:8080/health', timeout=5).getcode() < 300 else 1)",
        ]
      timeout: 30s
    hostname: ${PROJECT_NAME:-d2e}-dataflow-gen-worker.${TLS__INTERNAL__DOMAIN:-d2e.local}
    image: ${DOCKER_IMAGE_PREFIX:-ghcr.io/ohdsi/}d2e-dataflow-gen-worker:${DOCKER_TAG_NAME:-develop}
    logging:
      options:
        tag: *c83
    mem_limit: ${D2E_MEMORY_LIMIT:-16G}
    networks:
      data:
        priority: 20
    volumes:
      # duckdb/cachedb data shared with trexsql; plugins travel as artifacts,
      # not volumes. The docker.sock mount is gone with the docker worker.
      - trex:/app/duckdb_data
    environment:
      <<:
        - *x-tls
      PREFECT_API_URL: https://${PROJECT_NAME:-d2e}-dataflow-gen-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:41120/d2e/api
      PREFECT_API_ENABLE_HTTP2: False
      # Trust the internal self-signed CA across all Python HTTP stacks. The
      # command writes the CA into the OS store (update-ca-certificates) and the
      # certifi bundle; these point urllib/requests at the OS bundle (which then
      # includes the CA). provision-envs (entrypoint, urllib) picks it up on its
      # next 30s poll once the command has run.
      SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
      REQUESTS_CA_BUNDLE: /etc/ssl/certs/ca-certificates.crt
      INSTALL_SQLALCHEMY_HANA: ${INSTALL_SQLALCHEMY_HANA:-true}
      # trex-embedded supabase storage (artifact source); service key = JWT
      # with role service_role signed with trex's PGRST_JWT_SECRET
      TREX_STORAGE_URL: ${TREX_STORAGE_URL:-http://${PROJECT_NAME:-d2e}-trex:33001/plugins/trex/storage-api}
      TREX_STORAGE_SERVICE_KEY: ${TREX_STORAGE_SERVICE_KEY:-}
      D2E_MEMORY_LIMIT: ${D2E_MEMORY_LIMIT:-16G}
      D2E_SWAP_LIMIT: ${D2E_SWAP_LIMIT:-64G}
      PREFECT_WORKER_WEBSERVER_HOST: 0.0.0.0
      PREFECT_TASKS_CACHE_ENABLED: false
      PREFECT_FLOW_RUN_CACHE_ENABLED: false
      PREFECT_RESULTS_PERSIST_BY_DEFAULT: false
      PREFECT_EVENTS_ENABLED: false
      # cohort_discovery: Hutch Relay Task API connection, shared across every
      # dataset's poller runs
      TASK_API_BASE_URL: ${TASK_API_BASE_URL:-}
      TASK_API_USERNAME: ${TASK_API_USERNAME:-}
      TASK_API_PASSWORD: ${TASK_API_PASSWORD:-}
      TASK_API_TYPE: ${TASK_API_TYPE:-a}
      TASK_API_ENFORCE_HTTPS: ${TASK_API_ENFORCE_HTTPS:-true}
      LOW_NUMBER_SUPPRESSION_THRESHOLD: ${LOW_NUMBER_SUPPRESSION_THRESHOLD:-10}
      ROUNDING_TARGET: ${ROUNDING_TARGET:-10}
      D2E_BIGQUERY_JDBC_URL: ${D2E_BIGQUERY_JDBC_URL:-}

  # Needed only for future alterations of schema when version upgrades
  # alp-logto-db-post-alterations-init:
  #   depends_on:
  #       alp-minerva-postgres:
  #         condition: service_healthy
  #   image: ghcr.io/logto-io/logto:1.12
  #   entrypoint: ["sh", "-c", "npm run alteration deploy latest"]
  #   environment:
  #     CI: true
  #     DB_URL: postgres://${PG_SUPER_USER:-postgres}:${PG_SUPER_PASSWORD}@alp-minerva-postgres-1:${PG_PORT:-5432}/${PG_DB_NAME:-postgres}
  #   networks:
  #     - alp

  alp-logto-post-init:
    # Opt-in with `--profile logto`. trex is the identity provider now, so this
    # does not start by default.
    profiles: [logto]
    container_name: ${PROJECT_NAME:-d2e}-logto-post-init-1
    depends_on:
      alp-logto:
        condition: service_healthy
    image: ${DOCKER_IMAGE_PREFIX:-ghcr.io/ohdsi/}d2e-logto-post-init:${DOCKER_TAG_NAME:-develop}
    networks:
      alp:
        priority: 20
    platform: linux/amd64
    # The image's ENTRYPOINT is ["npm","run","seed"] with no shell, so the CA has
    # to be written here. NODE_EXTRA_CA_CERTS is the only route that works in this
    # image: it has no update-ca-certificates, and Node does not read the OS trust
    # store anyway. Verified that Node 18's global fetch (undici) honours it.
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        mkdir -p /tmp/cert
        printf '%s' "$$TLS__INTERNAL__CA_CRT" > /tmp/cert/ca.pem
        if [ ! -s /tmp/cert/ca.pem ]; then
          echo "FATAL: TLS__INTERNAL__CA_CRT is empty; refusing to seed without CA trust" >&2
          exit 1
        fi
        export NODE_EXTRA_CA_CERTS=/tmp/cert/ca.pem
        exec npm run seed
    environment:
      ENV_TYPE: ${ENV_TYPE:-local}
      # This container POSTs the M2M client secret, the basic-auth credentials and
      # every LOGTO__CLIENT_APPS secret to logto's admin API over the internal TLS
      # endpoint, so it verifies that endpoint against the internal CA. Only the CA
      # is passed, not the *x-tls anchor, which would also hand it the internal
      # private key it has no use for.
      TLS__INTERNAL__CA_CRT: ${TLS__INTERNAL__CA_CRT}
      # Used by src/middleware/logto.ts to derive the admin-server URL when
      # LOGTO__ADMIN_SERVER__FQDN_URL is unset; without it the fallback assumes a
      # container name the deployment may not use.
      PROJECT_NAME: ${PROJECT_NAME:-d2e}
      PG__DB_NAME: alp
      PG__HOST: ${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}
      PG__PASSWORD: ${PG__LOGTO_MANAGER_PASSWORD}
      PG__PORT: ${PG_PORT:-5432}
      PG__USER: ${PG__LOGTO_MANAGER_USER:-logto_postgres}
      PG__SSL: ${PG__SSL:-false}
      PG__SCHEMA: logto
      LOGTO__CONNECTOR_CONFIG: ${LOGTO__CONNECTOR_CONFIG:-}
      LOGTO__ENABLE_REGISTRATION: ${LOGTO__ENABLE_REGISTRATION:-false}
      LOGTO__DISABLE_BASIC_AUTH: ${LOGTO__DISABLE_BASIC_AUTH:-false}
      LOGTO__SOCIAL_SIGNIN_TARGETS: ${LOGTO__SOCIAL_SIGNIN_TARGETS:-}
      # LOGTO__CONNECTOR_CONFIG: '{ "id": "y9nq6f91yeg19kwt1x6xz","connectorId": "azuread-alp", "config": { "clientId": "${ENTRA__CLIENT_ID}", "tenantId": "${ENTRA__TENANT_ID}", "clientSecret": "${ENTRA__CLIENT_SECRET}", "cloudInstance": "https://login.microsoftonline.com", "scopes": "openid,profile,email,offline_access"}, "syncProfile": true}'
      # LOGTO__CONNECTOR_CONFIG: '{ "id": "9mf50ajua2ye7pydd2nxk", "connectorId": "entra-external-id-alp", "config": { "clientId": "${ENTRA_EXTID__CLIENT_ID}", "clientSecret": "${ENTRA_EXTID__CLIENT_SECRET}", "tenantSubdomain": "${ENTRA_EXTID__TENANT_SUBDOMAIN}", "tenantId": "${ENTRA_EXTID__TENANT_ID}", "scopes": "openid,profile,email,offline_access"}, "syncProfile": true}'
      # LOGTO__CUSTOM_JWT: '{"environmentVariables": {"clientId": "${ENTRA__CLIENT_ID}", "tenantId": "${ENTRA__TENANT_ID}", "clientSecret": "${ENTRA__CLIENT_SECRET}"}, "script": "/**\n* This function is called during the access token generation process to get custom claims for the JWT token.\n* Limit custom claims to under 50KB.\n*\n* @param {Object} payload - The input payload of the function.\n* @param {AccessTokenPayload} payload.token -The JWT token.\n* @param {Context} payload.context - Logto internal data that can be used to pass additional information\n* @param {EnvironmentVariables} [payload.environmentVariables] - The environment variables.\n*\n* @returns The custom claims.\n*/\n\n// @ts-ignore\nconst getCustomJwtClaims = async ({ token, context, environmentVariables, extra }) => {\n  const clientId = environmentVariables?.clientId || \"\";\n  const clientSecret = environmentVariables?.clientSecret || \"\";\n  const tenantId = environmentVariables?.tenantId || \"\";\n  const refreshToken = extra.thirdPartyRefreshToken || \"\";\n\n  const tokenEndpoint = `https://login.microsoftonline.com/$${tenantId}/oauth2/v2.0/token`;\n\n  const params =\n    `client_id=$${encodeURIComponent(clientId)}` +\n    `&client_secret=$${encodeURIComponent(clientSecret)}` +\n    `&refresh_token=$${encodeURIComponent(refreshToken)}` +\n    `&grant_type=refresh_token` +\n    `&scope=openid`;\n\n  let thirdPartyToken = extra.thirdPartyToken;\n  let thirdPartyRefreshToken = refreshToken;\n  try {\n    const response = await fetch(tokenEndpoint, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: params,\n    });\n\n    if (!response.ok) {\n      const responseBody = await response.text();\n      throw new Error(`Error refreshing token: $${response.statusText}: $${responseBody}: $${params}`);\n    }\n\n    const data = await response.json();\n    thirdPartyToken = data.id_token;\n    thirdPartyRefreshToken = data.refresh_token;\n  } catch (error) {}\n\n  const email = context.user?.primaryEmail || \"\";\n\n  const scopes = [];\n\n  for (const role of context.user.roles || []) {\n    for (const scope of role.scopes || []) {\n      scopes.push(scope.name);\n    }\n  }\n\n  return { thirdPartyToken, thirdPartyRefreshToken, email, roles: scopes };\n};\n", "tokenSample": {"aud": "http://localhost:3000/api/test", "gty": "authorization_code", "jti": "f1d3d2d1-1f2d-3d4e-5d6f-7d8a9d0e1d2", "kind": "AccessToken", "scope": "read write", "grantId": "grant_123", "clientId": "my_app", "accountId": "uid_123"}, "contextSample": {"user": {"id": "123", "name": "Foo Bar", "roles": [], "avatar": "https://example.com/avatar.png", "profile": {}, "username": "foo", "customData": {}, "identities": {}, "hasPassword": false, "primaryEmail": "foo@logto.io", "primaryPhone": "+1234567890", "applicationId": "my-app", "organizations": [], "ssoIdentities": [], "organizationRoles": [], "mfaVerificationFactors": []}}}'
      LOGTO__CUSTOM_JWT: '{"script": "/**\n* This function is called during the access token generation process to get custom claims for the JWT token.\n* Limit custom claims to under 50KB.\n*\n* @param {Object} payload - The input payload of the function.\n* @param {AccessTokenPayload} payload.token -The JWT token.\n* @param {Context} payload.context - Logto internal data that can be used to pass additional information\n* @param {EnvironmentVariables} [payload.environmentVariables] - The environment variables.\n*\n* @returns The custom claims.\n*/\n\n// @ts-ignore\nconst getCustomJwtClaims = async ({ token, context, environmentVariables, extra }) => {\n  let rewrites = [];\n  try {\n    const raw = environmentVariables && environmentVariables.scopeRewrites;\n    if (raw) {\n      const parsed = JSON.parse(raw);\n      if (Array.isArray(parsed)) rewrites = parsed;\n    }\n  } catch (e) {}\n\n  const applyRewrites = (name) => {\n    for (let i = 0; i < rewrites.length; i++) {\n      const rule = rewrites[i];\n      if (!rule || !rule.pattern) continue;\n      const re = new RegExp(rule.pattern);\n      if (re.test(name)) return name.replace(re, rule.replacement || \"\");\n    }\n    return name;\n  };\n\n  const scopes = [];\n\n  for (const role of context.user.roles || []) {\n    for (const scope of role.scopes || []) {\n      scopes.push(applyRewrites(scope.name));\n    }\n  }\n\n  // Expose the human username on the access token so downstream consumers\n  // (OHDSI WebAPI / Atlas3) display the real login instead of the opaque `sub`.\n  const username = context.user?.username || \"\";\n  const name = context.user?.name || \"\";\n  const email = context.user?.primaryEmail || \"\";\n\n  return { roles: scopes, physionet_access_token: extra?.thirdPartyToken || null, physionet_refresh_token: extra?.thirdPartyRefreshToken || null, username, name: name || username, preferred_username: username || name, email };\n};\n", "tokenSample": {"aud": "http://localhost:3000/api/test", "gty": "authorization_code", "jti": "f1d3d2d1-1f2d-3d4e-5d6f-7d8a9d0e1d2", "kind": "AccessToken", "scope": "read write", "grantId": "grant_123", "clientId": "my_app", "accountId": "uid_123"}, "contextSample": {"user": {"id": "123", "name": "Foo Bar", "roles": [], "avatar": "https://example.com/avatar.png", "profile": {}, "username": "foo", "customData": {}, "identities": {}, "hasPassword": false, "primaryEmail": "foo@logto.io", "primaryPhone": "+1234567890", "applicationId": "my-app", "organizations": [], "ssoIdentities": [], "organizationRoles": [], "mfaVerificationFactors": []}}, "environmentVariables": {}}'
      # Rewrite Logto scope names to canonical WebAPI sec_role names
      LOGTO__JWT_SCOPE_REWRITES: '[{"pattern":"^cohort-reader$","replacement":"cohort reader"},{"pattern":"^cohort-creator$","replacement":"cohort creator"},{"pattern":"^concept-set-creator$","replacement":"concept set creator"},{"pattern":"^source-user-(.+)$","replacement":"Source user ($$1)"}]'
      LOGTO__CLIENT_APPS: '[{"name":"alp-svc","description":"alp-svc","type":"MachineToMachine", "id": "${LOGTO__D2E_SVC__CLIENT_ID:-${LOGTO__ALP_SVC__CLIENT_ID}}", "secret": "${LOGTO__D2E_SVC__CLIENT_SECRET:-${LOGTO__ALP_SVC__CLIENT_SECRET}}"},{"name":"alp-data","description":"alp-data","type":"MachineToMachine", "id": "${LOGTO__D2E_DATA__CLIENT_ID:-${LOGTO__ALP_DATA__CLIENT_ID}}", "secret": "${LOGTO__D2E_DATA__CLIENT_SECRET:-${LOGTO__ALP_DATA__CLIENT_SECRET}}"},{"name":"alp-app","description":"alp-app","type":"Traditional", "id": "${LOGTO__D2E_APP__CLIENT_ID:-${LOGTO__ALP_APP__CLIENT_ID}}", "secret": "${LOGTO__D2E_APP__CLIENT_SECRET:-${LOGTO__ALP_APP__CLIENT_SECRET}}", "oidcClientMetadata":{"redirectUris":["https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}/d2e/portal/login-callback","https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}/d2e/ui/gateway/dashboard","https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}/WebAPI/user/oauth/callback/openid","https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}/atlas-login/","https://localhost:4000/d2e/portal/login-callback","https://localhost:8081","http://localhost:41180/d2e/portal/login-callback","http://localhost:41180/d2e/ui/gateway/dashboard","http://localhost:41180/WebAPI/user/oauth/callback/openid","http://localhost:41180/atlas-login/"],"postLogoutRedirectUris":["https://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}/d2e/portal","https://localhost:4000/d2e/portal","https://localhost:8081","http://localhost:41180/d2e/portal"]},"customClientMetadata":{"corsAllowedOrigins":[],"refreshTokenTtlInDays":14,"alwaysIssueRefreshToken":true,"rotateRefreshToken":true}}]'
      LOGTO__RESOURCE: '{"name":"alp-default","indicator":"https://alp-default","accessTokenTtl":3600}'
      LOGTO__USER: '{"username":"admin","initialPassword":"Updatepassword12345"}'
      # Logto roles are mapped to scopes by name via LOGTO__ROLES_SCOPES below
      # (see services/alp-logto/post-init/src/main.ts; falls back to index-wise
      # pairing with LOGTO__SCOPES only when LOGTO__ROLES_SCOPES is empty). When a
      # scope's name matches a WebAPI sec_role (case-insensitive), WebAPI's OIDC
      # handler auto-syncs that role for the user; unmatched scope names are ignored.
      # The role.systemadmin → ["role.systemadmin","admin"] entry in LOGTO__ROLES_SCOPES
      # carries the `admin` WebAPI role onto users with role.systemadmin.
      LOGTO__ROLES: '[{"name":"role.systemadmin","description":"System admin","type":"User"},{"name":"role.useradmin","description":"User admin","type":"User"},{"name":"role.dashboardviewer","description":"Dashboard viewer","type":"User"},{"name":"role.viewer","description":"Viewer","type":"User"},{"name":"role.jobrunner","description":"Job runner","type":"User"},{"name":"role.studyresultsreader","description":"Study results reader","type":"User"},{"name":"role.etlmappingcontributor","description":"ETL mapping contributor","type":"User"}]'
      LOGTO__SCOPES: '[{"name":"role.systemadmin","description":"System admin"},{"name":"role.useradmin","description":"User admin"},{"name":"role.dashboardviewer","description":"Dashboard viewer"},{"name":"role.viewer","description":"Viewer"},{"name":"role.jobrunner","description":"Job runner"},{"name":"role.studyresultsreader","description":"Study results reader"},{"name":"role.etlmappingcontributor","description":"ETL mapping contributor"},{"name":"admin","description":"WebAPI admin role"},{"name":"anonymous","description":"WebAPI anonymous role"},{"name":"cohort-reader","description":"WebAPI cohort reader role (rewritten to \"cohort reader\" by JWT customizer)"},{"name":"cohort-creator","description":"WebAPI cohort creator role (rewritten to \"cohort creator\" by JWT customizer)"},{"name":"concept-set-creator","description":"WebAPI concept set creator role (rewritten to \"concept set creator\" by JWT customizer)"}]'
      LOGTO__ROLES_SCOPES: '[{"roleName":"role.systemadmin","scopeNames":["role.systemadmin","admin"]},{"roleName":"role.useradmin","scopeNames":["role.useradmin"]},{"roleName":"role.dashboardviewer","scopeNames":["role.dashboardviewer"]},{"roleName":"role.viewer","scopeNames":["role.viewer","anonymous"]},{"roleName":"role.jobrunner","scopeNames":["role.jobrunner"]},{"roleName":"role.studyresultsreader","scopeNames":["role.studyresultsreader"]},{"roleName":"role.etlmappingcontributor","scopeNames":["role.etlmappingcontributor"]}]'
      LOGTO__ADMIN_SERVER__FQDN_URL: "https://${PROJECT_NAME:-d2e}-logto-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:3002"
      LOGTO__CLIENTID_PASSWORD__BASIC_AUTH: ${LOGTO__CLIENTID_PASSWORD__BASIC_AUTH}
      LOGTO__ALP_ADMIN_APP: '{"application": {"id": "${LOGTO_API_M2M_CLIENT_ID}", "name":"alp-admin","description":"alp-admin", "secret": "${LOGTO_API_M2M_CLIENT_SECRET}"}, "role": { "name":"api-access","description":"Logto API access"}}'
      LOGTO__TERM_OF_USE_URL: ${LOGTO__TERM_OF_USE_URL:-}
      LOGTO__PRIVACY_POLICY_URL: ${LOGTO__PRIVACY_POLICY_URL:-}
      LOGTO__CUSTOM_CSS: ${LOGTO__CUSTOM_CSS:-}
      CADDY__D2E__PUBLIC_FQDN: ${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}${PORT:+:${PORT:-443}}

  alp-logto:
    # Opt-in with `--profile logto`; see alp-logto-post-init above.
    profiles: [logto]
    container_name: &c8 ${PROJECT_NAME:-d2e}-logto-1
    depends_on:
      # Only Postgres: the wait for trex's bootstrap is the beacon poll in the
      # entrypoint below, not a depends_on edge (that would be circular).
      alp-minerva-postgres:
        condition: service_healthy
    healthcheck:
      interval: 20s
      retries: 30
      start_period: 120s
      test:
        - CMD
        - wget
        - --proxy
        - off
        - --no-check-certificate
        - -O
        - logto.status
        - https://localhost:3001/api/status
    hostname: ${PROJECT_NAME:-d2e}-logto-1.${TLS__INTERNAL__DOMAIN:-d2e.local}
    platform: linux/amd64
    image: ${DOCKER_IMAGE_PREFIX:-ghcr.io/ohdsi/}d2e-logto:${DOCKER_TAG_NAME:-develop}
    logging:
      options:
        tag: *c8
    networks:
      alp:
        priority: 20
      data:
        priority: 10
    entrypoint:
      - sh
      - -c
      - |
        # TLS material first: it is instant, and the guard below then fails fast on a
        # misconfiguration instead of after the multi-minute database wait further down.
        # umask is scoped to the writes so the private key lands 0600 while cert.pem
        # and ca.pem stay readable to non-root consumers.
        (
          umask 077
          mkdir -p /tmp/cert
          printf '%s' "$$TLS__INTERNAL__CRT" > /tmp/cert/cert.pem
          printf '%s' "$$TLS__INTERNAL__KEY" > /tmp/cert/key.pem
          printf '%s' "$$TLS__INTERNAL__CA_CRT" > /tmp/cert/ca.pem
        )
        for pair in cert:TLS__INTERNAL__CRT key:TLS__INTERNAL__KEY ca:TLS__INTERNAL__CA_CRT; do
          if [ ! -s "/tmp/cert/$${pair%%:*}.pem" ]; then
            echo "FATAL: $${pair##*:} is empty; refusing to start" >&2
            exit 1
          fi
        done
        export HTTPS_CERT_PATH=/tmp/cert/cert.pem
        export HTTPS_KEY_PATH=/tmp/cert/key.pem
        export NODE_EXTRA_CA_CERTS=/tmp/cert/ca.pem
        # Wait for trex's DB bootstrap to create logto_postgres and the logto
        # schema before migrating. This is a poll rather than a depends_on
        # because trex -> alp-logto-post-init -> alp-logto already exists, so an
        # edge back to trex would be a circular dependency.
        # The gate has to be the privilege, not the schema. trex creates the schema
        # owned by postgres and grants logto_postgres CREATE on it as a separate
        # step, so a gate on existence alone lets logto start inside that window;
        # it then half-seeds and dies, and because the seed is not idempotent for
        # its logto_tenant_* roles, every later restart fails on "role already
        # exists" - a permanent crash loop from one early start.
        # The seed opens with `create schema if not exists logto`, and Postgres
        # checks CREATE on the database before it checks whether the schema
        # exists, so database CREATE is part of the gate too.
        # Connecting proves the login exists, the privilege checks prove the
        # grants landed. node is used deliberately: this image has neither curl nor
        # wget, but it does ship the pg client logto itself runs on.
        until node -e "
          const { Client } = require('pg');
          const c = new Client({ connectionString: process.env.DB_URL });
          c.connect()
            .then(() => c.query(\"select has_database_privilege(current_user, current_database(), 'CREATE') and case when to_regnamespace('logto') is null then false else has_schema_privilege(current_user, 'logto', 'CREATE') end as ok\"))
            .then(r => { c.end(); process.exit(r.rows[0].ok ? 0 : 1); })
            .catch(() => { try { c.end(); } catch (_) {} process.exit(1); });
        "; do
          echo "waiting for the trex database bootstrap ..."
          sleep 2
        done
        npm run cli db seed -- --swe && npm run cli db alteration deploy latest && node packages/core/d2e-grants.mjs && npm start
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}
    environment:
      <<:
        - *x-tls
      ADMIN_DISABLE_LOCALHOST: ${LOGTO__DISABLE_ADMIN_CONSOLE:-false}
      # ADMIN_ENDPOINT: http://${CADDY__D2E__PUBLIC_FQDN:-${CADDY__ALP__PUBLIC_FQDN:-localhost}}:3002 # Enable if need to access admin console
      DB_URL: postgres://${PG__LOGTO_MANAGER_USER:-logto_postgres}:${PG__LOGTO_MANAGER_PASSWORD}@${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}:${PG_PORT:-5432}/${PG_DB_NAME:-alp}?options=-c%20search_path%3Dlogto
      # ENDPOINT is the server-side base URL Logto stamps into token iss/discovery issuer (stable identity).
      # It must be reachable by backend services (e.g. WebAPI) that validate iss by fetching discovery.
      # Browser-visible URLs are derived per-request via TRUST_PROXY_HEADER=true + X-Forwarded-* from Caddy,
      # so users still see https://localhost:41100/... for sign-in/authorize.
      ENDPOINT: https://${PROJECT_NAME:-d2e}-logto-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:3001
      # Base URL the bundled connectors (alp-azuread, alp-entra-external-id) use to
      # call Logto's own API. They defaulted to http://localhost:$PORT, but with
      # HTTPS_CERT_PATH set there is no plaintext listener left, so those calls now
      # fail with ECONNRESET — which only shows up once a social connector is
      # configured. It must be a name the internal cert covers: `localhost` is not
      # in the SAN, hence the container's own FQDN. Verified against the internal CA
      # via NODE_EXTRA_CA_CERTS above; there is no verification bypass.
      LOGTO__SELF_BASE_URL: https://${PROJECT_NAME:-d2e}-logto-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:3001
      LOGTO_API_M2M_CLIENT_ID: ${LOGTO_API_M2M_CLIENT_ID}
      LOGTO_API_M2M_CLIENT_SECRET: ${LOGTO_API_M2M_CLIENT_SECRET}
      LOGTO_ROLES_AZ_GROUPS_MAPPING: ${LOGTO_ROLES_AZ_GROUPS_MAPPING:-{"role.systemadmin":"37b5364a-348c-494f-b67f-a59a40e52ab7","role.useradmin":"90597adc-92af-4649-8151-68c3b7feb66c","role.dashboardviewer":"50a3b140-21eb-46dd-9d81-61a77cbc81f5"}}
      NODE_ENV: test
      PROJECT_NAME: ${PROJECT_NAME:-d2e}
      PORT: 3001
      TRUST_PROXY_HEADER: true
      DATABASE_CONNECTION_TIMEOUT: 30000

  alp-minerva-postgres:
    container_name: &c17 ${PROJECT_NAME:-d2e}-minerva-postgres-1
    healthcheck:
      interval: 20s
      retries: 30
      start_period: 60s
      test:
        - CMD-SHELL
        - pg_isready
        - -d
        - ${POSTGRES_DB}
      timeout: 30s
    hostname: ${PROJECT_NAME:-d2e}-minerva-postgres-1.${TLS__INTERNAL__DOMAIN:-d2e.local}
    image: postgres:15-alpine
    logging:
      options:
        tag: *c17
    networks:
      alp:
        priority: 20
      data:
        priority: 10
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}
    command:
      - "postgres"
      - "-c"
      - "wal_level=logical"
      - "-c"
      - "max_connections=1000"
    shm_size: 1gb
    volumes:
      - pg-minerva-data-1:/var/lib/postgresql/data
      - ./cache/pgbackup:/backup
    environment:
      <<:
        - *x-tls
      POSTGRES_DB: ${PG_DB_NAME:-alp}
      POSTGRES_PASSWORD: ${PG_SUPER_PASSWORD}

  demodb:
    image: ohdsi/broadsea-atlasdb:2.3.0
    container_name: ${PROJECT_NAME:-d2e}-demodb
    mem_limit: "2G"
    command: >
      sh -c '
      set -e;
      echo "Starting PostgreSQL in background via original docker-entrypoint.sh...";
      /usr/local/bin/docker-entrypoint.sh postgres -c wal_level=logical &
      PG_PID=$!;
      echo "Waiting for PostgreSQL to become ready...";
        until pg_isready -q -U postgres -h localhost -p 5432; do
          echo "PostgreSQL is unavailable - sleeping for 1 second...";
          sleep 1;
        done;
      echo "PostgreSQL is ready on localhost:5432.";
      echo "Attempting to change password for user postgres...";
      psql -v ON_ERROR_STOP=1 -h localhost -U postgres -d postgres -c "ALTER USER postgres WITH PASSWORD '\''${DEMO__DB_PASSWORD:-mypass}'\'';";
      echo "Adding table cohort_definition to demo_cdm_results schema...";
      psql -v ON_ERROR_STOP=1 -h localhost -U postgres -d postgres -c "CREATE TABLE IF NOT EXISTS demo_cdm_results.cohort_definition ( cohort_definition_id integer NOT NULL, cohort_definition_name varchar(255) NOT NULL, cohort_definition_description text NULL, definition_type_concept_id integer NOT NULL, cohort_definition_syntax text NULL, subject_concept_id integer NOT NULL, cohort_initiation_date date NULL );";
      echo "PostgreSQL setup complete. Bringing PostgreSQL process (PID $PG_PID) to foreground...";
      wait $PG_PID;
      echo "PostgreSQL process (PID $PG_PID) has exited.";
      exit $?;'
    environment:
      POSTGRES_PASSWORD: ${DEMO__DB_PASSWORD:-mypass}
    networks:
      alp:
        priority: 20
      data:
        priority: 10
    platform: linux/amd64
    volumes:
      - demodb-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 10
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}

  supabase-storage:
    container_name: &c19 ${PROJECT_NAME:-d2e}-supabase-storage-${BASE_PORT:-1}
    depends_on:
      trex:
        condition: service_healthy
      alp-minerva-postgres:
        condition: service_healthy
    platform: linux/amd64
    healthcheck:
      # localhost is not a SAN on the internal cert, so validation is skipped here
      # (the CA chain itself is exercised by callers on the docker network).
      test: ["CMD-SHELL", "curl -fk https://localhost:9000/status || exit 1"]
      timeout: 30s
      interval: 10s
      retries: 20
      start_period: 40s
    # Must be the FQDN: the internal cert's only SAN is *.${TLS__INTERNAL__DOMAIN}.
    hostname: ${PROJECT_NAME:-d2e}-supabase-storage-1.${TLS__INTERNAL__DOMAIN:-d2e.local}
    # Custom image: postgresql-client pre-installed for offline capability, plus
    # nginx terminating internal TLS in front of storage-api (no native TLS).
    #
    # Build it locally before the first start:  docker compose build supabase-storage
    # (docker-compose-local.yml carries the build stanza; `npm run start` does not
    # build.) The entrypoint below lives only in this custom image, so a published
    # tag built before that entrypoint existed fails to start with
    # `stat /usr/src/entrypoint.sh: no such file or directory`. CI is unaffected —
    # it builds this image from source and deploys it by run tag.
    image: ${DOCKER_IMAGE_PREFIX:-ghcr.io/ohdsi/}d2e-supabase-storage:${DOCKER_TAG_NAME:-develop}
    logging:
      options:
        tag: *c19
    networks:
      alp:
        priority: 20
      data:
        priority: 10
    restart: ${DOCKER__RESTART_POLICY:-unless-stopped}
    volumes:
      - supabase-storage-data:/var/lib/storage
    # The image entrypoint writes the internal cert and starts nginx, then execs
    # its arguments -- so the command below still runs exactly as before.
    entrypoint: ["/usr/src/entrypoint.sh", "/bin/sh", "-c"]
    command: >
      "set -e;
      echo 'Waiting 30 seconds for trex migrations...';
      sleep 30;
      echo 'Starting storage server in background (will run migrations)...';
      node dist/start/server.js &
      SERVER_PID=\$!;
      echo 'Waiting 20 seconds for storage migrations to complete...';
      sleep 20;
      echo 'Updating public.objects view to include user_metadata...';
      export PGPASSWORD='${PG_SUPER_PASSWORD}';
      psql -h '${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}' -p '${PG_PORT:-5432}' -U '${PG_SUPER_USER:-postgres}' -d '${PG_DB_NAME:-alp}' -c 'ALTER TABLE IF EXISTS storage.objects DISABLE ROW LEVEL SECURITY;';
      psql -h '${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}' -p '${PG_PORT:-5432}' -U '${PG_SUPER_USER:-postgres}' -d '${PG_DB_NAME:-alp}' -c 'DROP VIEW IF EXISTS public.objects CASCADE;';
      psql -h '${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}' -p '${PG_PORT:-5432}' -U '${PG_SUPER_USER:-postgres}' -d '${PG_DB_NAME:-alp}' -c 'CREATE VIEW public.objects AS SELECT * FROM storage.objects;';
      psql -h '${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}' -p '${PG_PORT:-5432}' -U '${PG_SUPER_USER:-postgres}' -d '${PG_DB_NAME:-alp}' -c 'GRANT SELECT, INSERT, UPDATE, DELETE ON public.objects TO service_role;';
      psql -h '${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}' -p '${PG_PORT:-5432}' -U '${PG_SUPER_USER:-postgres}' -d '${PG_DB_NAME:-alp}' -c 'GRANT SELECT, INSERT, UPDATE, DELETE ON public.objects TO authenticated;';
      psql -h '${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}' -p '${PG_PORT:-5432}' -U '${PG_SUPER_USER:-postgres}' -d '${PG_DB_NAME:-alp}' -c 'GRANT SELECT ON public.objects TO anon;';
      echo 'View setup complete. Storage server continuing...';
      wait \$SERVER_PID;"
    environment:
      <<:
        - *x-tls
      PROJECT_REF: ${PROJECT_REF:-default}
      # storage-api stays on loopback, HTTP only; nginx (started by the image's
      # entrypoint.sh) is the only thing listening on 9000/the docker network,
      # terminating TLS with the shared TLS__INTERNAL__* cert. Resolution order in
      # the image's config is SERVER_HOST || HOST and SERVER_PORT || PORT.
      SERVER_HOST: 127.0.0.1
      SERVER_PORT: 9001
      PORT: 9001
      FILE_SIZE_LIMIT: 1048576000
      DATABASE_URL: postgres://${PG_SUPER_USER:-postgres}:${PG_SUPER_PASSWORD}@${PG_HOST:-${PROJECT_NAME:-d2e}-minerva-postgres-1}:${PG_PORT:-5432}/${PG_DB_NAME:-alp}
      PGRST_JWT_SECRET: ${SUPABASE_STORAGE_JWT_SECRET:?SUPABASE_STORAGE_JWT_SECRET must be set (run d2e init); refusing a known default secret}
      SERVICE_KEY: ${SUPABASE_STORAGE_JWT_TOKEN:?SUPABASE_STORAGE_JWT_TOKEN must be set (run d2e init); refusing a known default token}
      MIGRATIONS_SCHEMA: storage
      MIGRATIONS_TABLE: migrations
      SKIP_MIGRATIONS: "false"
      STORAGE_BACKEND: file
      GLOBAL_S3_BUCKET: stub
      # Inert under STORAGE_BACKEND=file, but kept consistent: the old value used the
      # compose service name, which is not a SAN on the internal cert -- the FQDN is
      # required if the S3 backend ever goes live.
      GLOBAL_S3_ENDPOINT: https://${PROJECT_NAME:-d2e}-supabase-storage-1.${TLS__INTERNAL__DOMAIN:-d2e.local}:9000/s3
      GLOBAL_S3_PROTOCOL: "https"
      GLOBAL_S3_FORCE_PATH_STYLE: true
      FILE_STORAGE_BACKEND_PATH: /var/lib/storage
      TENANT_ID: stub
      REGION: stub

  hana:
    container_name: hana
    hostname: hana
    image: saplabs/hanaexpress:2.00.082.00.20250528.1
    platform: linux/amd64
    ports:
      - 1128-1129:1128-1129
      - 39013:39013
      - 39017:39017
      - 39041-39045:39041-39045
      - 59013-59014:59013-59014
    volumes:
      - hana-data:/hana/mounts
    networks:
      alp:
      data:
    profiles: [hana]