docker-compose.yml

# For local development
# Copyright (c) 2024 MultiFactor
# License: https://github.com/MultiDirectoryLab/MultiDirectory/blob/main/LICENSE
services:
  traefik:
    image: "traefik:v2.6"
    container_name: "traefik"
    command:
      - "--log.level=INFO"
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.ldap.address=:389"
      - "--entrypoints.ldaps.address=:636"
      - "--entrypoints.kadmind.address=:749"
      - "--entrypoints.kpasswd.address=:464"
      - "--entrypoints.bind_dns.address=:53"
    ports:
      - "80:80"
      - "8080:8080"
      - "389:389"
      - "636:636"
      - "749:749"
      - "464:464"
      - "530:53"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  ldap_server:
    build:
      context: .
      dockerfile: ./.docker/dev.Dockerfile
      args:
        DOCKER_BUILDKIT: 1
      target: runtime
    image: multidirectory
    restart: unless-stopped
    # container_name: multidirectory
    volumes:
      - ./app:/app
      - ./certs:/certs
      - ldap_keytab:/LDAP_keytab/
    env_file:
      local.env
    command: python -OO multidirectory.py --ldap
    tty: true
    depends_on:
      migrations:
        condition: service_completed_successfully
      cert_local_check:
        condition: service_completed_successfully
    deploy:
      mode: replicated
      replicas: 2
      endpoint_mode: dnsrr
      resources:
        limits:
          cpus: '1.0'
          memory: 100M
        reservations:
          cpus: '0.25'
          memory: 20M
    labels:
      - traefik.enable=true

      - traefik.tcp.routers.ldap.rule=HostSNI(`*`)
      - traefik.tcp.routers.ldap.entrypoints=ldap
      - traefik.tcp.routers.ldap.service=ldap
      - traefik.tcp.services.ldap.loadbalancer.server.port=389

      - traefik.tcp.routers.ldaps.rule=HostSNI(`*`)
      - traefik.tcp.routers.ldaps.entrypoints=ldaps
      - traefik.tcp.routers.ldaps.service=ldaps
      - traefik.tcp.services.ldaps.loadbalancer.server.port=636
    healthcheck:
      test: ["CMD-SHELL", "nc -zv 127.0.0.1 389 636"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 3s

  api:
    image: multidirectory
    container_name: multidirectory_api
    volumes:
      - ./app:/app
      - ./certs:/certs
      - dns_server_file:/DNS_server_file/
      - dns_server_config:/DNS_server_configs/
      - ldap_keytab:/LDAP_keytab/
    env_file:
      local.env
    command: python multidirectory.py --http
    tty: true
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`md.localhost`) && PathPrefix(`/api`)"
      - "traefik.http.routers.api.entrypoints=web"
      - "traefik.http.services.api.loadbalancer.server.port=8000"
      - "traefik.http.routers.api.service=api"
      - "traefik.http.routers.api.middlewares=api_strip"
      - "traefik.http.middlewares.api_strip.stripprefix.prefixes=/api"
      - "traefik.http.middlewares.api_strip.stripprefix.forceslash=false"
    depends_on:
      migrations:
        condition: service_completed_successfully

    deploy:
      mode: global
      resources:
        limits:
          cpus: '0.50'
          memory: 150M

  migrations:
    image: multidirectory
    container_name: multidirectory_migrations
    restart: "no"
    volumes:
      - ./app:/app
    env_file:
      local.env
    command: alembic upgrade head
    depends_on:
      postgres:
        condition: service_healthy

  cert_check:
    image: multidirectory
    container_name: multidirectory_certs_check
    restart: "no"
    volumes:
      - ./certs:/certs
      - ./app:/app
    command: ./extra/generate_cert.sh

  cert_local_check:
    image: multidirectory
    container_name: multidirectory_local_certs_check
    restart: "no"
    volumes:
      - ./certs:/certs
    command: bash -c "test -f /certs/cert.pem && echo 'CERT EXISTS, SKIPPING...' || openssl req -nodes -new -x509 -keyout /certs/privkey.pem -out /certs/cert.pem -subj '/C=RU/ST=Moscow/L=Moscow/O=Global Security/OU=Multifactor/CN=md.multifactor.dev'";

  postgres:
    container_name: MD-postgres
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_USER: user1
      POSTGRES_PASSWORD: password123
      PGDATA: /data/postgres
    volumes:
       - postgres:/data/postgres
    ports:
      - 5432:5432

    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d postgres -U user1"]
      interval: 1s
      timeout: 15s
      retries: 10
      start_period: 3s

  pgadmin:
    container_name: pgadmin_container
    image: dpage/pgadmin4
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL:-pgadmin4@pgadmin.org}
      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_DEFAULT_PASSWORD:-admin}
      PGADMIN_CONFIG_SERVER_MODE: 'False'
    volumes:
       - pgadmin:/var/lib/pgadmin
    restart: unless-stopped
    logging:
      driver: "none"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pg.rule=Host(`pg.localhost`)"
      - "traefik.http.routers.pg.entrypoints=web"
      - "traefik.http.services.pg.loadbalancer.server.port=80"

  kadmin_api:
    image: krb5md
    container_name: kadmin_api
    restart: unless-stopped
    volumes:
      - ./certs:/certs
      - .kerberos/:/server/
      - kdc:/etc
    tty: true
    depends_on:
      ldap_server:
        condition: service_healthy
        restart: true
      cert_check:
        condition: service_completed_successfully
    ports:
      - 8000:8000
    working_dir: /server
    command: uvicorn --factory config_server:create_app
             --host 0.0.0.0 --ssl-keyfile=/certs/krbkey.pem
             --ssl-certfile=/certs/krbcert.pem
             --reload

  bind_dns:
    image: ubuntu/bind9:latest
    container_name: bind9
    hostname: bind9
    restart: unless-stopped
    volumes:
      - dns_server_file:/opt/
      - dns_server_config:/etc/bind/
    tty: true
    depends_on:
      ldap_server:
        condition: service_healthy
        restart: true
    command: bash -c "chown bind:bind /opt && test -f /opt/zone.key && echo 'KEY EXISTS, SKIPPING...' || tsig-keygen zone. > /opt/zone.key && source docker-entrypoint.sh"
    labels:
      - traefik.enable=true
      - traefik.tcp.routers.bind_dns.rule=HostSNI(`*`)
      - traefik.tcp.routers.bind_dns.entrypoints=bind_dns
      - traefik.tcp.routers.bind_dns.service=bind_dns
      - traefik.tcp.services.bind_dns.loadbalancer.server.port=53

  kdc:
    build:
      context: .
      dockerfile: ./.docker/krb.Dockerfile
    container_name: kdc
    hostname: kerberos
    restart: unless-stopped
    volumes:
      - kdc:/etc
    image: krb5md
    tty: true
    command: krb5kdc -n -w 4
    ports:
      - "88:88"
      - "88:88/udp"
    depends_on:
      ldap_server:
        condition: service_healthy
        restart: true

  kadmind:
    container_name: kadmind
    restart: unless-stopped
    hostname: kerberos
    volumes:
      - kdc:/etc
      - psync_queue:/var/spool/krb5-sync
    image: krb5md
    tty: true
    command: kadmind -nofork
    depends_on:
      ldap_server:
        condition: service_healthy
        restart: true
      kdc:
        condition: service_started
    labels:
      - traefik.enable=true
      - traefik.tcp.routers.kadmind.rule=HostSNI(`*`)
      - traefik.tcp.routers.kadmind.entrypoints=kadmind
      - traefik.tcp.routers.kadmind.service=kadmind
      - traefik.tcp.services.kadmind.loadbalancer.server.port=749

      - traefik.tcp.routers.kpasswd.rule=HostSNI(`*`)
      - traefik.tcp.routers.kpasswd.entrypoints=kpasswd
      - traefik.tcp.routers.kpasswd.service=kpasswd
      - traefik.tcp.services.kpasswd.loadbalancer.server.port=464

  shadow_api:
    image: multidirectory
    container_name: shadow_api
    restart: unless-stopped
    tty: true
    depends_on:
      migrations:
        condition: service_completed_successfully
      ldap_server:
        condition: service_healthy
        restart: true
    volumes:
      - ./app:/app
    env_file:
      local.env
    command: python multidirectory.py --shadow

  maintence:
    image: multidirectory
    container_name: md_maintence
    volumes:
      - ./certs:/certs
      - ./app:/app
      - psync_queue:/var/spool/krb5-sync
      - ldap_keytab:/LDAP_keytab/
    env_file:
      local.env
    command: python multidirectory.py --scheduler
    tty: true
    depends_on:
      migrations:
        condition: service_completed_successfully
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 100M
        reservations:
          cpus: '0.1'
          memory: 6M

  interface:
    container_name: multidirectory_interface
    build:
      context: ./interface
      dockerfile: configurations/docker/Dockerfile.dev
    restart: 'no'
    environment:
      - HUSKY=0
      - API_URL=https://md.localhost/api
      - NODE_ENV=development
    ports:
      - 9080:80
    working_dir: /app
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.multidirectory-app.rule=Host(`md.localhost`)'
      - 'traefik.http.routers.multidirectory-app.entrypoints=web'
    command:
      ng serve --host 0.0.0.0 --port 80 --poll 2000

  dragonfly:
    image: 'docker.dragonflydb.io/dragonflydb/dragonfly'
    container_name: dragonfly
    expose:
      - 6379
    deploy:
      resources:
        limits:
          cpus: '4.0'
          memory: 6GiB
        reservations:
          cpus: '0.75'
          memory: 1.5GiB

  redis-commander:
    container_name: redis-commander
    hostname: redis-commander
    image: ghcr.io/joeferner/redis-commander:latest
    restart: always
    environment:
      - REDIS_HOSTS=sessions:dragonfly:6379:1
    user: redis
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.rc.rule=Host(`rc.localhost`)"
      - "traefik.http.routers.rc.entrypoints=web"
      - "traefik.http.services.rc.loadbalancer.server.port=8081"
      - "traefik.http.routers.rc.service=rc"

volumes:
  postgres:
  pgadmin:
  wireshark:
  kdc:
  psync_queue:
  dns_server_file:
  dns_server_config:
  ldap_keytab:
  dragonflydata: