docker-compose.dev.yml

services:
  traefik:
    image: "traefik:latest"
    container_name: traefik
    restart: unless-stopped
    command:
      # - --metrics
      # - --metrics.prometheus.buckets=0.1,0.3,1.2,5.0
      - "--log.level=ERROR"
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      # - --accesslog=true
      # - --accesslog.filepath=/var/log/traefik/access.log
      - --accesslog.format=json

      - --certificatesresolvers.md-resolver.acme.tlschallenge=true
      - --certificatesresolvers.md-resolver.acme.email=support@multifactor.com
      - --certificatesresolvers.md-resolver.acme.storage=/letsencrypt/acme.json

      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443

      - "--entrypoints.ldap.address=:389"
      - "--entrypoints.ldaps.address=:636"

      - "--entrypoints.kdc.address=:88"
      - "--entrypoints.kadmind.address=:749"

      - --entryPoints.websecure.http.tls=true
      - --entryPoints.websecure.http.tls.certResolver=md-resolver

      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
    ports:
      - "80:80"
      - "8080:8080"
      - "443:443"
      - "389:389"
      - "636:636"
      - "88:88"
      - "749:749"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - ./certs:/letsencrypt

    deploy:
      resources:
        limits:
          cpus: '0.50'
          memory: 96M
        reservations:
          cpus: '0.25'
          memory: 32M

  interface:
    build:
      context: ./interface
      dockerfile: ./configurations/docker/Dockerfile
      args:
        DOCKER_BUILDKIT: 1
    container_name: multidirectory_interface
    restart: unless-stopped
    hostname: interface
    environment:
      API_URL: https://${DOMAIN}/api
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.interface.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.interface.entrypoints=websecure"
      - "traefik.http.routers.interface.tls.certresolver=md-resolver"
      - "traefik.http.services.interface.loadbalancer.server.port=80"

  cert_check:
    image: multidirectory
    container_name: multidirectory_certs_check
    restart: "no"
    volumes:
      - ./certs:/certs
      - ./app:/app
    command: ./extra/generate_cert.sh

  migrations:
    image: multidirectory
    container_name: multidirectory_migrations
    restart: "no"
    environment:
      DEBUG: 1
      POSTGRES_USER: user
      POSTGRES_PASSWORD: 4002afa6900c4072a5577a30de99633e
      SECRET_KEY: 6a0452ae20cab4e21b6e9d18fa4b7bf397dd66ec3968b2d74
      DOMAIN: ${DOMAIN}
    command: alembic upgrade head
    depends_on:
      postgres:
        condition: service_healthy

  ldap_server:
    build:
      context: .
      dockerfile: .docker/Dockerfile
      args:
        DOCKER_BUILDKIT: 1
      target: runtime
    image: multidirectory
    restart: unless-stopped
    hostname: multidirectory
    volumes:
      - ./certs:/certs
      - ./logs:/app/logs
    command: python . --loop uvloop
    tty: true
    environment:
      DEBUG: 1
      POSTGRES_USER: user
      POSTGRES_PASSWORD: 4002afa6900c4072a5577a30de99633e
      SECRET_KEY: 6a0452ae20cab4e21b6e9d18fa4b7bf397dd66ec3968b2d74
      MFA_API_SOURCE: dev
      DOMAIN: ${DOMAIN}
    depends_on:
      migrations:
        condition: service_completed_successfully
    deploy:
      mode: replicated
      replicas: 4
      endpoint_mode: dnsrr
      resources:
        limits:
          cpus: '1.0'
          memory: 100M
        reservations:
          cpus: '0.25'
          memory: 20M
    labels:
      - traefik.enable=true

      - traefik.tcp.routers.ldap.rule=HostSNI(`*`)
      - traefik.tcp.routers.ldap.entrypoints=ldap
      - traefik.tcp.routers.ldap.service=ldap
      - traefik.tcp.services.ldap.loadbalancer.server.port=389

      - traefik.tcp.routers.ldaps.rule=HostSNI(`*`)
      - traefik.tcp.routers.ldaps.entrypoints=ldaps
      - traefik.tcp.routers.ldaps.service=ldaps
      - traefik.tcp.services.ldaps.loadbalancer.server.port=636
    healthcheck:
      test: ["CMD-SHELL", "nc -zv 127.0.0.1 389 636"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 3s

  api_server:
    image: multidirectory
    container_name: multidirectory_api
    restart: unless-stopped
    environment:
      USE_CORE_TLS: 1
      DEBUG: 1
      POSTGRES_USER: user
      POSTGRES_PASSWORD: 4002afa6900c4072a5577a30de99633e
      SECRET_KEY: 6a0452ae20cab4e21b6e9d18fa4b7bf397dd66ec3968b2d74
      MFA_API_SOURCE: dev
      DOMAIN: ${DOMAIN}
    hostname: api_server
    volumes:
      - ./app:/app
      - ./certs:/certs
      - ./logs:/app/logs
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`${DOMAIN}`) && PathPrefix(`/api`)"
      - "traefik.http.routers.api.tls.certresolver=md-resolver"
      - "traefik.http.routers.api.entrypoints=websecure"
      - "traefik.http.services.api.loadbalancer.server.port=8000"
      - "traefik.http.routers.api.service=api"
      - "traefik.http.routers.api.middlewares=api_strip"
      - "traefik.http.middlewares.api_strip.stripprefix.prefixes=/api"
      - "traefik.http.middlewares.api_strip.stripprefix.forceslash=false"
      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https,wss"

    command: uvicorn --factory web_app:create_prod_app --host 0.0.0.0 --port 8000 --loop uvloop --reload
    depends_on:
      migrations:
        condition: service_completed_successfully

  postgres:
    container_name: MD-postgres
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: 4002afa6900c4072a5577a30de99633e
      PGDATA: /data/postgres
    volumes:
       - d_postgres:/data/postgres
    expose:
      - 5432
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d postgres -U user"]
      interval: 1s
      timeout: 15s
      retries: 10
      start_period: 3s

  kdc:
    build:
      context: .
      dockerfile: ./.docker/krb.Dockerfile
    container_name: kdc
    restart: unless-stopped
    hostname: kerberos
    volumes:
      - d_keyfile:/etc/krb5.d/
      - d_kdc:/etc
    image: krb5md
    tty: true
    depends_on:
      - ldap_server
    command: /usr/sbin/krb5kdc -n -w 4

    labels:
      - traefik.enable=true
      - traefik.tcp.routers.kdc.rule=HostSNI(`*`)
      - traefik.tcp.routers.kdc.entrypoints=kdc
      - traefik.tcp.routers.kdc.service=kdc
      - traefik.tcp.services.kdc.loadbalancer.server.port=88

  kadmin_api:
    image: krb5md
    container_name: kadmin-api
    restart: unless-stopped
    volumes:
      - ./certs:/certs
      - d_keyfile:/etc/krb5.d/
      - .kerberos/:/server/
      - d_kdc:/etc
    tty: true
    depends_on:
      ldap_server:
        condition: service_healthy
      cert_check:
        condition: service_completed_successfully
    ports:
      - 8000:8000
    working_dir: /server
    command: uvicorn --factory config_server:create_app
             --host 0.0.0.0 --ssl-keyfile=/certs/krbkey.pem
             --ssl-certfile=/certs/krbcert.pem
             --reload

  kadmind:
    container_name: kadmind
    restart: unless-stopped
    hostname: kerberos
    volumes:
      - d_keyfile:/etc/krb5.d/
      - d_kdc:/etc
    image: krb5md
    tty: true
    depends_on:
      - ldap_server
      - kdc
    command: kadmind -nofork
    labels:
      - traefik.enable=true
      - traefik.tcp.routers.kadmind.rule=HostSNI(`*`)
      - traefik.tcp.routers.kadmind.entrypoints=kadmind
      - traefik.tcp.routers.kadmind.service=kadmind
      - traefik.tcp.services.kadmind.loadbalancer.server.port=749

volumes:
  d_postgres:
  d_pgadmin:
  d_keyfile:
  d_kdc: