docker-compose.yaml

#
# Copyright 2023 Stacklok, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

version: '3.2'
services:
  minder:
    build: .
    image: minder:latest

    command: [
      "serve",
      "--grpc-host=0.0.0.0",
      "--http-host=0.0.0.0",
      "--metric-host=0.0.0.0",
      "--db-host=postgres",
      "--config=/app/config.yaml",
      # If you don't want to store your GitHub client ID and secret in the main
      # config file, point to them here:
      # "--github-client-id-file=/secrets/github_client_id",
      # "--github-client-secret-file=/secrets/github_client_secret",
      ]
    restart: always # keep the server running
    read_only: true
    ports:
      - "8080:8080"
      - "8090:8090"
      - "9090:9090"
    volumes:
          - ./config.yaml:/app/config.yaml:z
          # If you don't want to store your GitHub client ID and secret in the main
          # config file, point to them here:
          # - ./.github_client_id:/secrets/github_client_id:z
          # - ./.github_client_secret:/secrets/github_client_secret:z
          - ./.ssh:/app/.ssh:z
    environment:
      - KO_DATA_PATH=/app/
      # Use viper environment variables to set specific paths to keys;
      # these values are relative paths in config.yaml, but it's not clear
      # what they are relative _to_...
      - MINDER_AUTH_ACCESS_TOKEN_PRIVATE_KEY=/app/.ssh/access_token_rsa
      - MINDER_AUTH_ACCESS_TOKEN_PUBLIC_KEY=/app/.ssh/access_token_rsa.pub
      - MINDER_AUTH_REFRESH_TOKEN_PRIVATE_KEY=/app/.ssh/refresh_token_rsa
      - MINDER_AUTH_REFRESH_TOKEN_PUBLIC_KEY=/app/.ssh/refresh_token_rsa.pub
      - MINDER_AUTH_TOKEN_KEY=/app/.ssh/token_key_passphrase
    networks:
      - app_net
    depends_on:
      postgres:
        condition: service_healthy
      keycloak:
        condition: service_healthy
#      migrate:
#        condition: service_completed_successfully
  migrate:
    build: .
    image: minder:latest

    command: [
      "migrate",
      "up",
      "--yes",
      "--db-host=postgres",
      "--config=/app/config.yaml",
      ]
    volumes:
          - ./config.yaml:/app/config.yaml:z
          - ./database/migrations:/app/database/migrations:z
    environment:
      - KO_DATA_PATH=/app/
    networks:
      - app_net
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 120s
    depends_on:
      postgres:
        condition: service_healthy
  postgres:
      container_name: postgres_container
      image: postgres:15-alpine
      restart: always
      user: postgres
      environment:
        POSTGRES_USER: postgres
        POSTGRES_PASSWORD: postgres
        POSTGRES_DB: minder
      ports:
        - "5432:5432"
      healthcheck:
        test: ["CMD-SHELL", "pg_isready"]
        interval: 10s
        timeout: 5s
        retries: 5
      networks:
        - app_net

  keycloak:
    container_name: keycloak_container
    image: quay.io/keycloak/keycloak:22.0
    command: ["start-dev"]
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_MINDER_SERVER_SECRET: secret
      KC_HEALTH_ENABLED: "true"
    healthcheck:
      test: ["CMD", "/opt/keycloak/bin/kcadm.sh", "get", "realms/stacklok", "--fields", "enabled"]
      interval: 10s
      timeout: 5s
      retries: 10
    ports:
      - "8081:8080"
    volumes:
      - ./identity/themes:/opt/keycloak/themes:z
      - ./identity/scripts:/opt/keycloak/scripts:z
    networks:
      - app_net
    entrypoint: ["/opt/keycloak/scripts/kc-setup.sh"]
networks:
  app_net:
    driver: bridge