docker-compose.yml

version: '3'
services:
  # Service subkey order: build/image, entrypoint, command, * (alphabetically)
  # Beware: https://github.com/docker-library/docs/tree/master/openjdk#environment-variables-with-periods-in-their-names
  # TODO Replace sleep with a reliable mechanism.

  dozzle: # Map to host ports 9xxx.
    image: amir20/dozzle:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      default:
        aliases:
          - dozzle.localhost
    ports:
      - '9080:8080'
    restart: unless-stopped

  clienta: # Map to host ports 11xxx.
    image: tara-govsso-exampleclient:latest
    entrypoint: bash -c 'sleep 15 && /cnb/process/web'
    depends_on:
      - inproxy
    deploy:
      resources:
        limits:
          memory: 650M
    environment:
      - server.port=11443
      - spring.application.name=govsso-clienta
      - govsso.client-id=client-a
      - govsso.client-secret=secreta
      - govsso.redirect-uri=https://clienta.localhost:11443/login/oauth2/code/govsso
      - govsso.post-logout-redirect-uri=https://clienta.localhost:11443/?show-post-logout-message
      - govsso.issuer-uri=https://inproxy.localhost:13443/
      - govsso.trust-store=file:/var/certs/clienta.localhost.govsso.truststore.p12
      - govsso.trust-store-password=changeit
      - example-client.logo=client-a.svg
      - server.ssl.key-store-type=PKCS12
      - server.ssl.key-store=/var/certs/clienta.localhost.keystore.p12
      - server.ssl.key-store-password=changeit
      - BPL_DEBUG_ENABLED=true
      # TODO Tune memory calculator (see https://stackoverflow.com/a/67595951 for more information).
      - BPL_JVM_THREAD_COUNT=10
      - SPRING_PROFILES_ACTIVE=govsso
    networks:
      default:
        aliases:
          - clienta.localhost
    ports:
      - '11000:8000'
      - '11443:11443'
    restart: unless-stopped
    volumes:
      - ./local/tls/clienta/clienta.localhost.keystore.p12:/var/certs/clienta.localhost.keystore.p12:ro
      - ./local/tls/clienta/clienta.localhost.govsso.truststore.p12:/var/certs/clienta.localhost.govsso.truststore.p12:ro

  clientb: # Map to host ports 12xxx.
    image: tara-govsso-exampleclient:latest
    entrypoint: bash -c 'sleep 15 && /cnb/process/web'
    depends_on:
      - inproxy
    deploy:
      resources:
        limits:
          memory: 650M
    environment:
      - server.port=12443
      - spring.application.name=govsso-clientb
      - govsso.client-id=client-b
      - govsso.client-secret=secretb
      - govsso.redirect-uri=https://clientb.localhost:12443/login/oauth2/code/govsso
      - govsso.post-logout-redirect-uri=https://clientb.localhost:12443/?show-post-logout-message
      - govsso.issuer-uri=https://inproxy.localhost:13443/
      - govsso.trust-store=file:/var/certs/clientb.localhost.govsso.truststore.p12
      - govsso.trust-store-password=changeit
      - example-client.logo=client-b.svg
      - example-client.messages.title=GovSSO Client B (LOCAL)
      - server.ssl.key-store-type=PKCS12
      - server.ssl.key-store=/var/certs/clientb.localhost.keystore.p12
      - server.ssl.key-store-password=changeit
      - BPL_DEBUG_ENABLED=true
      # TODO Tune memory calculator (see https://stackoverflow.com/a/67595951 for more information).
      - BPL_JVM_THREAD_COUNT=10
      - SPRING_PROFILES_ACTIVE=govsso
    networks:
      default:
        aliases:
          - clientb.localhost
    ports:
      - '12000:8000'
      - '12443:12443'
    restart: unless-stopped
    volumes:
      - ./local/tls/clientb/clientb.localhost.keystore.p12:/var/certs/clientb.localhost.keystore.p12:ro
      - ./local/tls/clientb/clientb.localhost.govsso.truststore.p12:/var/certs/clientb.localhost.govsso.truststore.p12:ro

  inproxy: # Map to host ports 13xxx.
    # First follow TARA-GovSSO-InProxy README.md to build this Docker image.
    image: tara-govsso-inproxy:latest
    depends_on:
      - hydra
      - session
    deploy:
      resources:
        limits:
          memory: 650M
    environment:
      - SPRING_PROFILES_ACTIVE=govsso
      - server.ssl.key-store-type=PKCS12
      - server.ssl.key-store=file:/var/certs/inproxy.localhost.keystore.p12
      - server.ssl.key-store-password=changeit
      - spring.cloud.gateway.httpclient.ssl.trustedX509Certificates=file:/var/certs/govsso-ca.localhost.crt
      - spring.cloud.discovery.client.simple.instances.hydra[0].uri=https://hydra.localhost:8443
      - spring.cloud.discovery.client.simple.instances.session[0].uri=https://session.localhost:15443
      - tara-govsso-inproxy.admin.base-url=https://admin.localhost:443
      - tara-govsso-inproxy.admin.token-request-allowed-ip-addresses-storage-path=/tmp/ipaddresses
      - tara-govsso-inproxy.admin.tls.trust-store=file:/var/certs/inproxy.localhost.admin.truststore.p12
      - tara-govsso-inproxy.admin.tls.trust-store-password=changeit
      - ELASTIC_APM_ENABLED=false
      - BPL_DEBUG_ENABLED=true
      # TODO Tune memory calculator (see https://stackoverflow.com/a/67595951 for more information).
      - BPL_JVM_THREAD_COUNT=10
    networks:
      default:
        aliases:
          - inproxy.localhost
    ports:
      - '13000:8000'
      - '13443:13443'
    restart: unless-stopped
    volumes:
      - ./local/tls/govsso-ca/govsso-ca.localhost.crt:/var/certs/govsso-ca.localhost.crt:ro
      - ./local/tls/inproxy/inproxy.localhost.admin.truststore.p12:/var/certs/inproxy.localhost.admin.truststore.p12:ro
      - ./local/tls/inproxy/inproxy.localhost.keystore.p12:/var/certs/inproxy.localhost.keystore.p12:ro

  hydra: # Map to host ports 14xxx.
    # TODO Temporarily a fork is used until all pull requests are merged upstream.
    image: oryd/hydra:feature-govsso # hydra:v2.1.2 image doesn't have shell, -sqlite image does.
    entrypoint: sh -c 'sleep 7 && hydra migrate sql --read-from-env --yes && hydra serve --config /etc/govsso-hydra/config.yml all'
    depends_on:
      - hydra-db
    deploy:
      resources:
        limits:
          memory: 250M
    environment:
      # TODO: move to govsso-hydra/config.yml
      - DSN=postgres://hydra:changeme@hydra-db.localhost:5432/hydra-db?sslmode=require&max_conns=20&max_idle_conns=4
      - SSL_CERT_FILE=/var/certs/govsso-ca.localhost.crt
      - HTTPS_PROXY=https://outproxy.localhost:8443
      - NO_PROXY=session.localhost:15443
    networks:
      default:
        aliases:
          - hydra.localhost
    ports:
      - '14443:8443'
      - '14445:4445'
    restart: unless-stopped
    volumes:
      - ./local/hydra:/etc/govsso-hydra:ro
      - ./local/tls/hydra/hydra.localhost.crt:/var/certs/hydra.localhost.crt:ro
      - ./local/tls/hydra/hydra.localhost.key:/var/certs/hydra.localhost.key:ro
      - ./local/tls/govsso-ca/govsso-ca.localhost.crt:/var/certs/govsso-ca.localhost.crt:ro

  session: # Map to host ports 15xxx.
    # First follow README.md to build this Docker image.
    image: govsso-session:latest
    depends_on:
      - tara
    deploy:
      resources:
        limits:
          memory: 650M
    environment:
      - JAVA_TOOL_OPTIONS=-Dfile.encoding=UTF8
      - management.endpoints.web.exposure.include=*
      - server.port=15443
      - govsso.base-url=https://inproxy.localhost:13443/
      # Has to point to hydra ADMIN port and should ignore reverse proxy (inproxy).
      - govsso.hydra.admin-url=https://hydra.localhost:4445/
      - govsso.tara.issuer-url=https://tara.localhost:16443
      - govsso.admin.host-url=https://admin.localhost:443/
      - govsso.security.cookie-signing-secret=exampleCookieSigningSecret123456
      - server.ssl.key-store-type=PKCS12
      - server.ssl.key-store=file:/var/certs/session.localhost.keystore.p12
      - server.ssl.key-store-password=changeit
      - govsso.hydra.tls.trust-store-location=file:/var/certs/session.localhost.hydra.truststore.p12
      - govsso.hydra.tls.trust-store-password=changeit
      - govsso.tara.tls.trust-store-location=file:/var/certs/session.localhost.tara.truststore.p12
      - govsso.tara.tls.trust-store-password=changeit
      - govsso.admin.tls.trust-store-location=file:/var/certs/session.localhost.admin.truststore.p12
      - govsso.admin.tls.trust-store-password=changeit
      - govsso.alerts.static-alert.message-templates[0].message=Tegemist on kohaliku arenduskeskkonnaga ja autentimiseks vajalik info on <a href="https://e-gov.github.io/GOVSSO/Testing">GovSSO dokumentatsioonis</a>!
      - govsso.alerts.static-alert.message-templates[0].locale=et
      - govsso.alerts.static-alert.message-templates[1].message=This is a local development environment and necessary information for testing is available in <a href="https://e-gov.github.io/GOVSSO/Testing">GovSSO documentation</a>!
      - govsso.alerts.static-alert.message-templates[1].locale=en
      - govsso.alerts.static-alert.message-templates[2].message=Это локальная платформа разработки, и информация, необходимая для аутентификации, находится в <a href="https://e-gov.github.io/GOVSSO/Testing">документации GovSSO</a>!
      - govsso.alerts.static-alert.message-templates[2].locale=ru
      - govsso.alerts.enabled=true
      - ELASTIC_APM_ENABLED=false
      - BPL_DEBUG_ENABLED=true
      # TODO Tune memory calculator (see https://stackoverflow.com/a/67595951 for more information).
      - BPL_JVM_THREAD_COUNT=10
    networks:
      default:
        aliases:
          - session.localhost
    ports:
      - '15000:8000'
      - '15443:15443'
    restart: unless-stopped
    volumes:
      - ./local/tls/session:/var/certs:ro

  setup:
    build: local/setup
    depends_on:
      - admin
    deploy:
      resources:
        limits:
          memory: 250M
    environment:
      - ADMIN_SERVICE_URL=admin.localhost:443 # Must be set without protocol
      - ADMIN_USER=admin
      - ADMIN_PASS=admin

  tara: # Map to host ports 16xxx.
    # TODO Use specific version.
    # TODO Optimize Dockerfile (use multi-stage to exclude build environment).
    build: https://github.com/aarmam/TARA-Mock.git#feature/GSSO-410
    deploy:
      resources:
        limits:
          memory: 250M
    networks:
      default:
        aliases:
          - tara.localhost
    ports:
      - '16443:16443'
    restart: unless-stopped
    volumes:
      - ./local/tara/config.json:/service/config.json:ro
      - ./local/tara/id-token:/var/id-token:ro
      - ./local/tls/tara:/var/certs:ro

  admin: # Map to host ports 17xxx.
    # First follow TARA-GovSSO-Admin README.md to build this Docker image.
    image: tara-admin:latest
    entrypoint: bash -c 'sleep 15 && /cnb/process/web'
    depends_on:
      - admin-db
      - hydra
      - smtp
    deploy:
      resources:
        limits:
          memory: 650M
    environment:
      - spring.application.name=govsso-admin
      - tara-oidc.url=https://hydra.localhost:4445/
      - auth.tls-truststore-path=/var/certs/admin.localhost.truststore.p12
      - auth.tls-truststore-password=changeit
      - spring.datasource.url=jdbc:postgresql://admin-db.localhost:5432/admin-db?sslmode=require
      - spring.mail.host=smtp.localhost
      - spring.mail.port=1025
      - spring.mail.username=
      - spring.mail.password=
      - spring.mail.properties.mail.smtp.auth=false
      - spring.mail.properties.mail.smtp.starttls.enable=false
      - tara.admin.sso-mode=true
      - server.port=443
      - server.ssl.enabled=true
      - server.ssl.key-store-type=PKCS12
      - server.ssl.key-store=/var/certs/admin.localhost.keystore.p12
      - server.ssl.key-store-password=changeit
      - server.ssl.protocol=TLS
      - server.ssl.enabled-protocols=TLSv1.3
      - BPL_DEBUG_ENABLED=true
      # TODO Tune memory calculator (see https://stackoverflow.com/a/67595951 for more information).
      - BPL_JVM_THREAD_COUNT=10
    networks:
      default:
        aliases:
          - admin.localhost
    ports:
      - '17000:8000'
      - '17443:443'
    restart: unless-stopped
    volumes:
      - ./local/tls/admin/admin.localhost.truststore.p12:/var/certs/admin.localhost.truststore.p12:ro
      - ./local/tls/admin/admin.localhost.keystore.p12:/var/certs/admin.localhost.keystore.p12:ro

  smtp: # Map to host ports 18xxx.
    image: mailhog/mailhog:v1.0.1
    networks:
      default:
        aliases:
          - smtp.localhost
    ports:
      - '18025:1025'
      - '18080:8025'
    restart: unless-stopped

  hydra-db: # Map to host ports 19xxx.
    build: local/hydra-db
    command: >
      -c ssl=on
      -c ssl_cert_file=/etc/ssl/certs/server.crt
      -c ssl_key_file=/etc/ssl/private/server.key
    deploy:
      resources:
        limits:
          memory: 250M
    healthcheck:
      test: pg_isready -U hydra -d hydra-db
      interval: 6s
      retries: 10
    environment:
      - POSTGRES_DB=hydra-db
      - POSTGRES_USER=hydra
      - POSTGRES_PASSWORD=changeme
    networks:
      default:
        aliases:
          - hydra-db.localhost
    ports:
      - '19432:5432'
    restart: unless-stopped
    volumes:
      - hydra-db-data:/var/lib/postgresql/data

  admin-db: # Map to host ports 20xxx.
    build: local/admin-db
    command: >
      -c ssl=on
      -c ssl_cert_file=/etc/ssl/certs/server.crt
      -c ssl_key_file=/etc/ssl/private/server.key
    deploy:
      resources:
        limits:
          memory: 250M
    environment:
      - POSTGRES_DB=admin-db
      - POSTGRES_USER=taraadmin
      - POSTGRES_PASSWORD=changeme
    networks:
      default:
        aliases:
          - admin-db.localhost
    ports:
      - '20432:5432'
    restart: unless-stopped
    volumes:
      - admin-db-data:/var/lib/postgresql/data

  outproxy: # Map to host ports 21xxx.
    image: httpd:2.4-alpine
    deploy:
      resources:
        limits:
          memory: 250M
    hostname: outproxy.localhost
    networks:
      default:
        aliases:
          - outproxy.localhost
    ports:
      - '21443:8443'
    restart: unless-stopped
    volumes:
      - ./local/outproxy/httpd.conf:/usr/local/apache2/conf/httpd.conf:ro
      - ./local/tls/outproxy/outproxy.localhost.crt:/var/certs/outproxy.localhost.crt:ro
      - ./local/tls/outproxy/outproxy.localhost.key:/var/certs/outproxy.localhost.key:ro

  hydra-janitor:
    build: local/hydra-janitor
    profiles:
      - hydra-janitor
    deploy:
      resources:
        limits:
          memory: 250M
    environment:
      - PGHOST=hydra-db.localhost
      - PGPORT=5432
      - PGUSER=hydra
      - PGPASSWORD=changeme
      - PGDATABASE=hydra-db
      - DSN=postgres://hydra:changeme@hydra-db.localhost:5432/hydra-db?sslmode=require&max_conns=20&max_idle_conns=4
    volumes:
      - ./local/hydra-janitor:/etc/hydra-janitor:ro
      - ./local/hydra:/etc/govsso-hydra:ro
      - ./local/tls/hydra/hydra.localhost.crt:/var/certs/hydra.localhost.crt:ro
      - ./local/tls/hydra/hydra.localhost.key:/var/certs/hydra.localhost.key:ro

  enduserselfservice: # Map to host ports 25xxx.
    # First follow GovSSO-EndUserSelfService README.md to build this Docker image.
    image: govsso-enduserselfservice:latest
    entrypoint: bash -c 'sleep 15 && /cnb/process/web'
    depends_on:
      - session
      - tara
    deploy:
      resources:
        limits:
          memory: 650M
    environment:
      - server.ssl.key-store-type=PKCS12
      - server.ssl.key-store=file:/var/certs/enduserselfservice.localhost.keystore.p12
      - server.ssl.key-store-password=changeit
      - ignite.ssl-context-factory.key-store-file-path=/var/certs/enduserselfservice.localhost.keystore.p12
      - ignite.ssl-context-factory.key-store-password=changeit
      - ignite.ssl-context-factory.trust-store-file-path=/var/certs/enduserselfservice.localhost.ignite.truststore.p12
      - ignite.ssl-context-factory.trust-store-password=changeit
      - govsso-enduserselfservice.time.local-zone=Europe/Tallinn
      - govsso-enduserselfservice.govsso-session.base-url=https://session.localhost:15443/
      - govsso-enduserselfservice.govsso-session.tls.trust-store=file:/var/certs/enduserselfservice.localhost.session.truststore.p12
      - govsso-enduserselfservice.govsso-session.tls.trust-store-password=changeit
      - tara.client-id=govsso-enduserselfservice
      - tara.client-secret=secret
      - tara.issuer-uri=https://tara.localhost:16443
      - tara.redirect-uri=https://enduserselfservice.localhost:25443/login/oauth2/code/tara
      - tara.trust-store=file:/var/certs/enduserselfservice.localhost.tara.truststore.p12
      - tara.trust-store-password=changeit
      - ELASTIC_APM_ENABLED=false
      - BPL_DEBUG_ENABLED=true
      # TODO Tune memory calculator (see https://stackoverflow.com/a/67595951 for more information).
      - BPL_JVM_THREAD_COUNT=10
    networks:
      default:
        aliases:
          - enduserselfservice.localhost
    ports:
      - '25000:8000'
      - '25443:25443'
    restart: unless-stopped
    volumes:
      - ./local/tls/enduserselfservice:/var/certs:ro

volumes:
  hydra-db-data:
  admin-db-data: