docker-compose.yml

version: "3.6"

services:
  certs:
    build:
      context: ./oidc-cert
    environment:
      - CA_KEY=oidc-ca.key
      - CA_EXPIRE=3650
      - SSL_KEY_SIZE=2048
    env_file:
      - ".env"
    volumes:
      - certs:/certs
      - /var/run/docker.sock:/tmp/docker.sock:ro

  mitmproxy:
    build:
      context: ./mitmproxy
    depends_on:
      - certs
    environment:
      - CA_DIR=${CA_DIR}
      - CA_CERT=${CA_CERT}
      - CA_KEY=${CA_KEY}
    dns:
      - 127.0.0.1
    ports:
      - "8042:8042"
      - "8080:8080"
      - "8081:8081"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./mitmproxy/scripts:/home/mitmproxy/scripts
      - certs:/certs:ro
    networks:
      - opnet
      - rpnet
      - profnet

  professos:
    build:
      context: ./professos
      args:
        gitbranch: master
        GITHUB_TOKEN: ${GITHUB_TOKEN}
        DISABLE_TLS_TRUST_CHECK: "true"
        CA_CERT: ${CA_CERT}
        CONTROLLER_HOST: ${CONTROLLER_HOST}
        HONEST_OP_HOST: ${HONEST_OP_HOST}
        EVIL_OP_HOST: ${EVIL_OP_HOST}
        HONEST_RP_HOST: ${HONEST_RP_HOST}
        EVIL_RP_HOST: ${EVIL_RP_HOST}
        TEST_RP_HOST: ${MITREID_CLIENT_HOST}
        TEST_OP_HOST: ${MITREID_SERVER_HOST}
    environment:
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
    env_file:
      - .proxy_env
    depends_on:
      - certs
    ports:
      - "9990:9990"   # enable management interface
      - "8888:8080"   # web interface
      - "8787:8787"   # debugging interface
    volumes:
      - certs:/certs:ro
    networks:
      profnet:
        aliases:
          - ${CONTROLLER_HOST}
          - ${HONEST_OP_HOST}
          - ${EVIL_OP_HOST}
          - ${HONEST_RP_HOST}
          - ${EVIL_RP_HOST}

  lab:
    build:
      context: ./oidc-lab
      args:
        CA_CERT: ${CA_CERT}
        CLIENT_HOST: ${LAB_HOST}
    depends_on:
      - certs
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    environment:
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${LAB_HOST}
    networks:
      - opnet
      - rpnet
      - profnet


########################################################################################################################
# OpenID Provider
########################################################################################################################

  mitreid-server:
    build:
      context: op/mitreid-server
      args:
        BRANCH: "mitreid-connect-1.3.3"
        ISSUER: ${MITREID_SERVER_HOST}
        SERVER_HOST: ${MITREID_SERVER_HOST}
        CONTROLLER_URL: ${CONTROLLER_HOST}
    depends_on:
      - certs
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    environment:
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${MITREID_SERVER_HOST}
    networks:
      - opnet

  identity-server4:
    build:
      context: op/identity-server4
      args:
        BRANCH: "3.1.2"
        ISSUER: ${IDENTITY_SERVER4_HOST}
        SERVER_HOST: ${IDENTITY_SERVER4_HOST}
        CONTROLLER_URL: ${CONTROLLER_HOST}
    depends_on:
      - certs
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    environment:
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${IDENTITY_SERVER4_HOST}
    networks:
      - opnet

###
# phpOIDC OP
###
  php-oidc-op:
    build:
      context: op/php-oidc-op
      args:
        BRANCH: "master"
        SERVER_HOST: ${PHP_OIDC_OP_HOST}
        CONTROLLER_URL: ${CONTROLLER_HOST}
    depends_on:
      - certs
      - php-oidc-mysql
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    environment:
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${PHP_OIDC_OP_HOST}
    networks:
      - opnet
      - backend

  php-oidc-mysql:
    image: mysql:5.7.30
    ports:
      - "3306:3306"
    environment:
      MYSQL_ROOT_PASSWORD: "root2pass"
      MYSQL_USER: "phpoidc"
      MYSQL_PASSWORD: "phpoidcpass"
      MYSQL_DATABASE: "phpoidc_01"
    volumes:
      - ./op/php-oidc-op/dump/:/docker-entrypoint-initdb.d
    networks:
      - backend


###
# Keycloak
###
  keycloak:
    build:
      context: op/keycloak
      args:
        SERVER_HOST: ${KEYCLOAK_HOST}
        CONTROLLER_URL: ${CONTROLLER_HOST}
    environment:
      DB_VENDOR: POSTGRES
      DB_ADDR: keycloak-postgres
      DB_DATABASE: keycloak
      DB_USER: keycloak
      DB_SCHEMA: public
      DB_PASSWORD: password
      KEYCLOAK_USER: admin
      KEYCLOAK_PASSWORD: 4dm1n
      PROXY_ADDRESS_FORWARDING: "true"
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${KEYCLOAK_HOST}
    depends_on:
      - keycloak-postgres
      - certs
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    networks:
      - opnet
      - backend

  keycloak-postgres:
    image: postgres:11
    volumes:
    -  ./op/keycloak/config/keycloak.sql:/docker-entrypoint-initdb.d/keycloak-code.sql
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: password
    networks:
      - backend

###
# Gravitee.io
##

  gravitee:
    build:
      context: op/gravitee
      dockerfile: Dockerfile.nginx
      args:
        SERVER_HOST: ${GRAVITEE_HOST}
        CONTROLLER_URL: ${CONTROLLER_HOST}
    volumes:
      - certs:/certs:ro
    environment:
      NGINX_PORT: 443
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${GRAVITEE_HOST}
    depends_on:
      - gravitee-management
      - gravitee-gateway
      - gravitee-webui
      - certs
    networks:
      - opnet
      - backend

  gravitee-mongodb:
    image: mongo:3.4
    networks:
      - backend

  gravitee-mongo-seed:
    build:
      context: op/gravitee
      dockerfile: Dockerfile.mongo
    links:
      - gravitee-mongodb
    networks:
      - backend

  gravitee-gateway:
    image: graviteeio/am-gateway:${GIO_AM_VERSION}
    links:
      - gravitee-mongodb
    depends_on:
      - gravitee-mongodb
    environment:
      - gravitee_management_mongodb_uri=mongodb://gravitee-mongodb:27017/graviteeam?serverSelectionTimeoutMS=5000&connectTimeoutMS=5000&socketTimeoutMS=5000
      - gravitee_oauth2_mongodb_uri=mongodb://gravitee-mongodb:27017/graviteeam?serverSelectionTimeoutMS=5000&connectTimeoutMS=5000&socketTimeoutMS=5000
    networks:
      - backend

  gravitee-management:
    image: graviteeio/am-management-api:${GIO_AM_VERSION}
    links:
      - gravitee-mongodb
    depends_on:
      - gravitee-mongodb
    environment:
      - gravitee_management_mongodb_uri=mongodb://gravitee-mongodb:27017/graviteeam?serverSelectionTimeoutMS=5000&connectTimeoutMS=5000&socketTimeoutMS=5000
      - gravitee_oauth2_mongodb_uri=mongodb://gravitee-mongodb:27017/graviteeam?serverSelectionTimeoutMS=5000&connectTimeoutMS=5000&socketTimeoutMS=5000
    networks:
      - backend

  gravitee-webui:
    image: graviteeio/am-management-ui:${GIO_AM_VERSION}
    depends_on:
      - gravitee-management
    environment:
      - MGMT_API_URL=https://gravitee/am
      - MGMT_UI_URL=https://gravitee/am/ui
    networks:
      - backend

  ###
  # node-provider
  ###
  node-oidc-provider:
    build:
      context: op/node-oidc-provider
      args:
        #ISSUER: ${HONEST_OP_HOST}
        CONTROLLER_URL: ${CONTROLLER_HOST}
        SERVER_HOST: ${NODE_OIDC_HOST}
    depends_on:
      - certs
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    environment:
      ISSUER: https://${NODE_OIDC_HOST}
      NODE_ENV: production
      DEBUG: oidc-provider:*
      NODE_TLS_REJECT_UNAUTHORIZED: 0
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${NODE_OIDC_HOST}
    networks:
      - opnet

########################################################################################################################
# RP
########################################################################################################################

  mitreid-client:
    build:
      context: ./rp/mitreid-client
      args:
        ISSUER: ${HONEST_OP_HOST}
        CONTROLLER_URL: ${CONTROLLER_HOST}
        CLIENT_HOST: ${MITREID_CLIENT_HOST}
    depends_on:
      - certs
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    environment:
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${MITREID_CLIENT_HOST}
    networks:
      - rpnet

  angular-auth-oidc-client:
    build:
      context: ./rp/angular-auth-oidc-sample-client
      args:
        ISSUER: ${EVIL_OP_HOST}
        CONTROLLER_URL: ${CONTROLLER_HOST}
        CLIENT_HOST: ${ANGULAR_AUTH_CLIENT_HOST}
    depends_on:
      - certs
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    environment:
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${ANGULAR_AUTH_CLIENT_HOST}
    networks:
      - rpnet

  angular-oauth2-oidc-client:
    build:
      context: ./rp/angular-oauth2-oidc-client
      args:
        ISSUER: ${HONEST_OP_HOST}
        CONTROLLER_URL: ${CONTROLLER_HOST}
        CLIENT_HOST: ${ANGULAR_OAUTH2_CLIENT_HOST}
    depends_on:
      - certs
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    environment:
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${ANGULAR_OAUTH2_CLIENT_HOST}
    networks:
      - rpnet

  pyoidc-rp:
    build:
      context: ./rp/pyoidc-rp
      args:
        ISSUER: ${HONEST_OP_HOST}
        CONTROLLER_URL: ${CONTROLLER_HOST}
        CLIENT_HOST: ${PYOIDC_CLIENT_HOST}
    depends_on:
      - certs
      - keycloak
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    environment:
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${PYOIDC_CLIENT_HOST}
    networks:
      - rpnet

  py-oidcrp:
    build:
      context: ./rp/py-oidcrp
      args:
        ISSUER: ${HONEST_OP_HOST}
        ISSUER2: ${EVIL_OP_HOST}
        CONTROLLER_URL: ${CONTROLLER_HOST}
        CLIENT_HOST: ${PY_OIDC_CLIENT_HOST}
    depends_on:
      - certs
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    environment:
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${PY_OIDC_CLIENT_HOST}
    networks:
      - rpnet

  mod-auth-openidc:
    build:
      context: ./rp/mod-auth-openidc
      args:
        ISSUER: ${HONEST_OP_HOST}
        CONTROLLER_URL: ${CONTROLLER_HOST}
        CLIENT_HOST: ${MOD_OPENIDC_CLIENT_HOST}
    depends_on:
      - certs
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    environment:
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${MOD_OPENIDC_CLIENT_HOST}
    networks:
      - rpnet

  express-openid-client:
    build:
      context: rp/express-openid-client
      args:
        CONTROLLER_URL: ${CONTROLLER_HOST}
        CLIENT_HOST: ${EXPRESS_OPENID_CLIENT_HOST}
    depends_on:
      - certs
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    environment:
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${EXPRESS_OPENID_CLIENT_HOST}
    networks:
      - rpnet
      - opnet
      - profnet

  express-openid-client-prof:
    build:
      context: rp/express-openid-client
      args:
        ISSUER: ${EVIL_OP_HOST}
        CONTROLLER_URL: ${CONTROLLER_HOST}
        CLIENT_HOST: ${EXPRESS_OPENID_CLIENT_PROF_HOST}
    depends_on:
      - certs
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    environment:
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${EXPRESS_OPENID_CLIENT_PROF_HOST}
    networks:
      - rpnet
      - opnet
      - profnet

  ###
  # phpOIDC RP
  ###
  php-oidc-rp:
    build:
      context: ./rp/php-oidc-rp
      args:
        BRANCH: "master"
        CLIENT_HOST: ${PHP_OIDC_RP_HOST}
        CONTROLLER_URL: ${CONTROLLER_HOST}
    depends_on:
      - certs
      - php-oidc-mysql
    volumes:
      - certs:/certs:ro
    env_file:
      - .proxy_env
    environment:
      CA_DIR: ${CA_DIR}
      CA_CERT: ${CA_CERT}
      VIRTUAL_HOST: ${PHP_OIDC_RP_HOST}
    networks:
      - rpnet
      - backend


########################################################################################################################
# Networks & Volumes
########################################################################################################################
networks:
  profnet:
    name: profnet
    driver: bridge
    driver_opts:
      com.docker.network.bridge.name: oidc-profnet
  opnet:
    name: opnet
    driver: bridge
    internal: true
    driver_opts:
      com.docker.network.bridge.name: oidc-opnet
  rpnet:
    name: rpnet
    driver: bridge
    internal: true
    driver_opts:
      com.docker.network.bridge.name: oidc-rpnet
  backend:
    name: backend
    driver: bridge
    internal: true
    driver_opts:
      com.docker.network.bridge.name: oidc-backend

volumes:
  certs: