docker-compose.yaml

# SPDX-FileCopyrightText: Copyright 2023 The Minder Authors
# SPDX-License-Identifier: Apache-2.0

services:
  minder:
    container_name: minder_server
    build:
      context: .
      dockerfile: ./docker/minder/Dockerfile
    image: minder:latest

    command: [
      "serve",
      "--grpc-host=0.0.0.0",
      "--http-host=0.0.0.0",
      "--metric-host=0.0.0.0",
      "--db-host=postgres",
      "--issuer-url=http://keycloak:8080",
      "--config=/app/server-config.yaml",
      # If you don't want to store your GitHub client ID and secret in the main
      # config file, point to them here:
      # "--github-client-id-file=/secrets/github_client_id",
      # "--github-client-secret-file=/secrets/github_client_secret",
    ]
    restart: always # keep the server running
    read_only: true
    ports:
      - "8080:8080"
      - "8090:8090"
      - "9090:9090"
    volumes:
      - ./server-config.yaml:/app/server-config.yaml:z
      - ./flags-config.yaml:/app/flags-config.yaml:z
      # If you don't want to store your GitHub client ID and secret in the main
      # config file, point to them here:
      # - ./.github_client_id:/secrets/github_client_id:z
      # - ./.github_client_secret:/secrets/github_client_secret:z
      # If you're using a GitHub App, you'll need to provide the private key:
      - ./.secrets/:/app/.secrets/:z
      - ./.ssh:/app/.ssh:z
    environment:
      - KO_DATA_PATH=/app/
      # Use viper environment variables to set specific paths to keys;
      # these values are relative paths in server-config.yaml, but it's not clear
      # what they are relative _to_...
      - MINDER_AUTH_ACCESS_TOKEN_PRIVATE_KEY=/app/.ssh/access_token_rsa
      - MINDER_AUTH_ACCESS_TOKEN_PUBLIC_KEY=/app/.ssh/access_token_rsa.pub
      - MINDER_AUTH_REFRESH_TOKEN_PRIVATE_KEY=/app/.ssh/refresh_token_rsa
      - MINDER_AUTH_REFRESH_TOKEN_PUBLIC_KEY=/app/.ssh/refresh_token_rsa.pub
      - MINDER_AUTH_TOKEN_KEY=/app/.ssh/token_key_passphrase
      - MINDER_UNSTABLE_TRUSTY_ENDPOINT=https://api.trustypkg.dev
      - MINDER_PROVIDER_GITHUB_APP_PRIVATE_KEY=/app/.secrets/github-app.pem
      - MINDER_FLAGS_GO_FEATURE_FILE_PATH=/app/flags-config.yaml
      - MINDER_LOG_GITHUB_REQUESTS=1
      - MINDER_AUTHZ_API_URL=http://openfga:8080
      - MINDER_IDENTITY_SERVER_ISSUER_URL=http://keycloak:8080
    working_dir: /app
    networks:
      - app_net
    depends_on:
      postgres:
        condition: service_healthy
      keycloak:
        condition: service_healthy
      openfga:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
      keycloak-config:
        condition: service_completed_successfully
      nats:
        condition: service_healthy

  migrate:
    container_name: minder_migrate_up
    build:
      context: .
      dockerfile: ./docker/minder/Dockerfile
    image: minder:latest

    command: [
      "migrate",
      "up",
      "--yes",
      "--db-host=postgres",
      "--config=/app/server-config.yaml",
      ]
    volumes:
      - ./server-config.yaml:/app/server-config.yaml:z
      - ./database/migrations:/app/database/migrations:z
    environment:
      - KO_DATA_PATH=/app/
      - MINDER_AUTHZ_API_URL=http://openfga:8080
    networks:
      - app_net
    deploy:
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
        window: 120s
    depends_on:
      postgres:
        condition: service_healthy
      openfga:
        condition: service_healthy
  postgres:
      container_name: postgres_container
      image: postgres:17.2-alpine
      restart: always
      user: postgres
      environment:
        POSTGRES_USER: postgres
        POSTGRES_PASSWORD: postgres
        POSTGRES_DB: minder
      ports:
        - "5432:5432"
      healthcheck:
        test: ["CMD-SHELL", "pg_isready"]
        interval: 10s
        timeout: 5s
        retries: 5
      networks:
        - app_net

  keycloak:
    container_name: keycloak_container
    image: quay.io/keycloak/keycloak:25.0
    command: ["start-dev"]
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_HEALTH_ENABLED: "true"
    healthcheck:
      test: ["CMD", "/opt/keycloak/bin/kcadm.sh", "config", "credentials", "--server", "http://localhost:8080", "--realm", "master", "--user", "admin", "--password", "admin"]
      interval: 10s
      timeout: 5s
      retries: 10
    ports:
      - "8081:8080"
    volumes:
      - ./identity/themes:/opt/keycloak/themes:z
    networks:
      - app_net

  keycloak-config:
    container_name: keycloak_config
    image: bitnami/keycloak-config-cli:6.1.6
    entrypoint: ["java", "-jar", "/opt/bitnami/keycloak-config-cli/keycloak-config-cli.jar"]
    environment:
      KEYCLOAK_URL: http://keycloak:8080
      KEYCLOAK_USER: admin
      KEYCLOAK_PASSWORD: admin
      KC_MINDER_SERVER_SECRET: secret
      IMPORT_VARSUBSTITUTION_ENABLED: "true"
      IMPORT_FILES_LOCATIONS: /config/*.yaml
    volumes:
      - ./identity/config:/config:z
    networks:
      - app_net

    depends_on:
      keycloak:
        condition: service_healthy

  openfga:
    container_name: openfga
    image: openfga/openfga:v1.8.1
    command: [
      "run",
      "--playground-port=8085"
    ]
    healthcheck:
      test:
        - CMD
        - grpc_health_probe
        - "-addr=:8081"
    ports:
      - 8082:8080
      - 8083:8081
      - 8085:8085
    networks:
      - app_net

  nats:
    container_name: nats
    image: nats:2.10.22
    entrypoint: ["./nats-server"]
    command: ["--http_port", "8222", "-js"]
    healthcheck:
      test: ["CMD", "./nats-server", "-c", "/nats-server.conf", "-t"]
    ports:
      - 4222:4222  # Clients
      - 8222:8222  # HTTP monitoring
    networks:
      - app_net

networks:
  app_net:
    driver: bridge