docker-compose.yaml

#
# Copyright 2023 Stacklok, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

version: '3.2'
services:
  minder:
    container_name: minder_server
    build:
      context: .
      dockerfile: ./docker/minder/Dockerfile
    image: minder:latest

    command: [
      "serve",
      "--grpc-host=0.0.0.0",
      "--http-host=0.0.0.0",
      "--metric-host=0.0.0.0",
      "--db-host=postgres",
      "--issuer-url=http://keycloak:8080",
      "--config=/app/server-config.yaml",
      # If you don't want to store your GitHub client ID and secret in the main
      # config file, point to them here:
      # "--github-client-id-file=/secrets/github_client_id",
      # "--github-client-secret-file=/secrets/github_client_secret",
    ]
    restart: always # keep the server running
    read_only: true
    ports:
      - "8080:8080"
      - "8090:8090"
      - "9090:9090"
    volumes:
      - ./server-config.yaml:/app/server-config.yaml:z
      # If you don't want to store your GitHub client ID and secret in the main
      # config file, point to them here:
      # - ./.github_client_id:/secrets/github_client_id:z
      # - ./.github_client_secret:/secrets/github_client_secret:z
      # If you're using a GitHub App, you'll need to provide the private key:
      - ./.secrets/:/app/.secrets/:z
      - ./.ssh:/app/.ssh:z
    environment:
      - KO_DATA_PATH=/app/
      # Use viper environment variables to set specific paths to keys;
      # these values are relative paths in server-config.yaml, but it's not clear
      # what they are relative _to_...
      - MINDER_AUTH_ACCESS_TOKEN_PRIVATE_KEY=/app/.ssh/access_token_rsa
      - MINDER_AUTH_ACCESS_TOKEN_PUBLIC_KEY=/app/.ssh/access_token_rsa.pub
      - MINDER_AUTH_REFRESH_TOKEN_PRIVATE_KEY=/app/.ssh/refresh_token_rsa
      - MINDER_AUTH_REFRESH_TOKEN_PUBLIC_KEY=/app/.ssh/refresh_token_rsa.pub
      - MINDER_AUTH_TOKEN_KEY=/app/.ssh/token_key_passphrase
      - MINDER_UNSTABLE_TRUSTY_ENDPOINT=https://api.trustypkg.dev
      - MINDER_PROVIDER_GITHUB_APP_PRIVATE_KEY=/app/.secrets/github-app.pem
      - MINDER_LOG_GITHUB_REQUESTS=1
    networks:
      - app_net
    depends_on:
      postgres:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      openfga:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
      keycloak-config:
        condition: service_completed_successfully
  migrate:
    container_name: minder_migrate_up
    build:
      context: .
      dockerfile: ./docker/minder/Dockerfile
    image: minder:latest

    command: [
      "migrate",
      "up",
      "--yes",
      "--db-host=postgres",
      "--config=/app/server-config.yaml",
      ]
    volumes:
      - ./server-config.yaml:/app/server-config.yaml:z
      - ./database/migrations:/app/database/migrations:z
    environment:
      - KO_DATA_PATH=/app/
    networks:
      - app_net
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 120s
    depends_on:
      postgres:
        condition: service_healthy
      openfga:
        condition: service_healthy
  postgres:
      container_name: postgres_container
      image: postgres:16.1-alpine
      restart: always
      user: postgres
      environment:
        POSTGRES_USER: postgres
        POSTGRES_PASSWORD: postgres
        POSTGRES_DB: minder
      ports:
        - "5432:5432"
      healthcheck:
        test: ["CMD-SHELL", "pg_isready"]
        interval: 10s
        timeout: 5s
        retries: 5
      networks:
        - app_net

  keycloak:
    container_name: keycloak_container
    image: quay.io/keycloak/keycloak:23.0
    command: ["start-dev"]
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_HEALTH_ENABLED: "true"
    healthcheck:
      test: ["CMD", "/opt/keycloak/bin/kcadm.sh", "config", "credentials", "--server", "http://localhost:8080", "--realm", "master", "--user", "admin", "--password", "admin"]
      interval: 10s
      timeout: 5s
      retries: 10
    ports:
      - "8081:8080"
    volumes:
      - ./identity/themes:/opt/keycloak/themes:z
    networks:
      - app_net

  keycloak-config:
    container_name: keycloak_config
    image: bitnami/keycloak-config-cli:5.10.0
    entrypoint: ["java", "-jar", "/opt/bitnami/keycloak-config-cli/keycloak-config-cli.jar"]
    environment:
      KEYCLOAK_URL: http://keycloak:8080
      KEYCLOAK_USER: admin
      KEYCLOAK_PASSWORD: admin
      KC_MINDER_SERVER_SECRET: secret
      IMPORT_VARSUBSTITUTION_ENABLED: "true"
      IMPORT_FILES_LOCATIONS: /config/*.yaml
    volumes:
      - ./identity/config:/config:z
    networks:
      - app_net

    depends_on:
      keycloak:
        condition: service_healthy

  openfga:
    container_name: openfga
    image: openfga/openfga:v1.5.0
    command: [
      "run",
      "--playground-port=8085"
    ]
    healthcheck:
      test:
        - CMD
        - grpc_health_probe
        - "-addr=:8081"
    ports:
      - 8082:8080
      - 8083:8081
      - 8085:8085
    networks:
      - app_net
networks:
  app_net:
    driver: bridge