docker-compose.yml

#
# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2020
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

version: "3.5"

volumes:
  data:
  trustanchors:
  cabundle:
  setup:

services:
  trust:
    image: indigoiam/trustanchors:latest
    volumes:
      - trustanchors:/etc/grid-security/certificates
      - cabundle:/etc/pki
    environment:
      FORCE_TRUST_ANCHORS_UPDATE: 1

  db:
    image: ${DB_IMAGE}
    volumes:
      - data:/var/lib/mysql

    environment:
      TZ: UTC

    ports:
      - "3306:3306"

  iam-api:
    image: ${IAM_API_IMAGE}
    environment:
      TZ: UTC
      JAVA_TOOL_OPTIONS: -Dspring.profiles.active=compose,mysql -Djavax.net.ssl.trustStore=/etc/pki/java/cacerts -Djavax.net.ssl.trustStorePassword=changeit
      IAM_KC_BASE_URL: https://kc.local.io/auth
      IAM_KC_ADMIN_BASE_URL: https://kc.local.io/auth
      IAM_API_BASE_URL: https://api.test.io
      IAM_DB_HOST: db
      IAM_MAIL_HOST: mailhog
      IAM_MAIL_PORT: 1025

    depends_on:
      - trust
      - db
      - kc

    volumes:
      - ./assets/iam-api/application-compose.yml:/iam-ng/config/application-compose.yml:ro
      - cabundle:/etc/pki

    ports:
      - 9876

    command: -debug

  nginx:
    image: ${NGINX_IMAGE}
    environment:
      TZ: UTC

    depends_on:
      - trust

    volumes:
      - cabundle:/etc/pki
      - ./assets/nginx/certs:/certs:ro
      - ./assets/nginx/conf.d:/etc/nginx/conf.d:ro

    ports:
      - "443:443"
    
    networks:
      default:
        aliases:
          - api.local.io
          - kc.local.io
          - iam.local.io

  mailhog:
    image: ${MAILHOG_IMAGE}

    ports:
      - "1025:1025"
      - "8025:8025"

  kc-setup:
    image: ${NGINX_IMAGE}
    volumes:
      - setup:/iam:rw

    command: chown -R 1000:1000 /iam

  kc:
    image: ${KEYCLOAK_IMAGE}
    environment:
      TZ: UTC
      KEYCLOAK_USER: admin
      KEYCLOAK_PASSWORD: password
      PROXY_ADDRESS_FORWARDING: 'true'
      DB_VENDOR: mysql
      DB_ADDR: db
      DB_DATABASE: kc
      DB_USER: kc
      DB_PASSWORD: pwd
      JDBC_PARAMS: useSSL=false
      IAM_DASHBOARD_BASE_URL: https://iam.local.io

    command: -b 0.0.0.0 --debug 0.0.0.0:8787

    volumes:
      - setup:/iam:rw
      - ./assets/keycloak/scripts/setup-iam-realms.sh:/opt/jboss/keycloak/iam/setup-iam-realms.sh:ro

    depends_on:
      - db
      - kc-setup

    ports:
      - 8080
      - "8787:8787"

  cli:
    image: centos:7
    command: sleep infinity
    volumes:
      - cabundle:/etc/pki