첫 커밋: 로컬 프로젝트 업로드

baron-sso/docker/compose.ory.yaml

@@ -0,0 +1,251 @@
+services:
+    postgres_ory:
+        image: postgres:${ORY_POSTGRES_TAG:-17-alpine}
+        container_name: ory_postgres
+        environment:
+            - POSTGRES_USER=${ORY_POSTGRES_USER:-ory}
+            - POSTGRES_PASSWORD=${ORY_POSTGRES_PASSWORD:-secret}
+            - POSTGRES_DB=${ORY_POSTGRES_DB:-ory}
+        volumes:
+            - ./docker/ory/init-db:/docker-entrypoint-initdb.d
+            - ory_postgres_data:/var/lib/postgresql/data
+        networks:
+            - ory-net
+        healthcheck:
+            test:
+                [
+                    "CMD-SHELL",
+                    "pg_isready -U ${ORY_POSTGRES_USER:-ory} -d ${KRATOS_DB:-ory_kratos}",
+                ]
+            interval: 5s
+            timeout: 5s
+            retries: 5
+
+    kratos-migrate:
+        image: oryd/kratos:${KRATOS_VERSION:-v26.2.0}
+        environment:
+            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
+            - KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL}
+            - KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL}
+            - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}
+            - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["${KRATOS_UI_URL}","${USERFRONT_URL}"]}
+        volumes:
+            - ../config/.generated/ory/kratos:/etc/config/kratos
+        command: migrate sql up -e -c /etc/config/kratos/kratos.yml --yes
+        depends_on:
+            postgres_ory:
+                condition: service_healthy
+        networks:
+            - ory-net
+
+    kratos:
+        image: oryd/kratos:${KRATOS_VERSION:-v26.2.0}
+        container_name: ory_kratos
+        environment:
+            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
+            - COOKIE_SECRET=${COOKIE_SECRET:-localcookie123}
+            - KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL}
+            - KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL}
+            - KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}
+            - KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["${KRATOS_UI_URL}","${USERFRONT_URL}"]}
+        volumes:
+            - ../config/.generated/ory/kratos:/etc/config/kratos
+        command: serve -c /etc/config/kratos/kratos.yml
+        depends_on:
+            kratos-migrate:
+                condition: service_completed_successfully
+        networks:
+            - ory-net
+            - kratosnet
+
+    hydra-migrate:
+        image: oryd/hydra:${HYDRA_VERSION:-v26.2.0}
+        environment:
+            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
+        command: migrate sql up -e --yes
+        depends_on:
+            postgres_ory:
+                condition: service_healthy
+        networks:
+            - ory-net
+
+    hydra:
+        image: oryd/hydra:${HYDRA_VERSION:-v26.2.0}
+        container_name: ory_hydra
+        environment:
+            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
+            - URLS_SELF_ISSUER=${HYDRA_PUBLIC_URL}
+            - URLS_LOGIN=${HYDRA_LOGIN_URL:-${USERFRONT_URL}/login}
+            - URLS_CONSENT=${HYDRA_CONSENT_URL:-${USERFRONT_URL}/consent}
+            - URLS_ERROR=${HYDRA_ERROR_URL:-${USERFRONT_URL}/error}
+            - SECRETS_SYSTEM=${ORY_POSTGRES_PASSWORD}
+        volumes:
+            - ../config/.generated/ory/hydra:/etc/config/hydra
+        command: serve -c /etc/config/hydra/hydra.yml all --dev
+        depends_on:
+            hydra-migrate:
+                condition: service_completed_successfully
+        networks:
+            - ory-net
+            - hydranet
+
+    keto-migrate:
+        image: oryd/keto:${KETO_VERSION:-v26.2.0}
+        environment:
+            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KETO_DB:-ory_keto}?sslmode=disable&max_conns=20
+        volumes:
+            - ../config/.generated/ory/keto:/etc/config/keto
+        command: ["migrate", "up", "-c", "/etc/config/keto/keto.yml", "--yes"]
+        depends_on:
+            postgres_ory:
+                condition: service_healthy
+        networks:
+            - ory-net
+
+    keto:
+        image: oryd/keto:${KETO_VERSION:-v26.2.0}
+        container_name: ory_keto
+        environment:
+            - DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KETO_DB:-ory_keto}?sslmode=disable&max_conns=20
+        volumes:
+            - ../config/.generated/ory/keto:/etc/config/keto
+        command: serve -c /etc/config/keto/keto.yml
+        depends_on:
+            keto-migrate:
+                condition: service_completed_successfully
+        networks:
+            - ory-net
+
+    oathkeeper:
+        image: oryd/oathkeeper:${OATHKEEPER_VERSION:-v26.2.0}
+        container_name: oathkeeper
+        restart: unless-stopped
+        depends_on:
+            kratos:
+                condition: service_started
+        environment:
+            - APP_ENV=${APP_ENV:-development}
+            - LOG_LEVEL=debug
+            - OATHKEEPER_INTROSPECT_CLIENT_ID=${OATHKEEPER_INTROSPECT_CLIENT_ID:-oathkeeper-introspect}
+            - OATHKEEPER_INTROSPECT_CLIENT_SECRET=${OATHKEEPER_INTROSPECT_CLIENT_SECRET:-oathkeeper-secret}
+        volumes:
+            - ../config/.generated/ory/oathkeeper:/etc/config/oathkeeper
+            - oathkeeper_logs:/var/log/oathkeeper
+        entrypoint: ["/etc/config/oathkeeper/entrypoint.sh"]
+        networks:
+            - ory-net
+            - baron_net
+            - public_net
+        ports:
+            - "4455:4455"
+            - "4456:4456"
+        healthcheck:
+            test: ["CMD", "wget", "-qO-", "http://127.0.0.1:4456/health/ready"]
+            interval: 5s
+            timeout: 5s
+            retries: 5
+
+    ory_stack_check:
+        image: alpine:latest
+        container_name: ory_stack_check
+        command: >
+            /bin/sh -c "
+              apk add --no-cache curl;
+              echo 'Wait for services...';
+              check_ready() {
+                name=\"$$1\";
+                url=\"$$2\";
+                max=\"$${ORY_STACK_CHECK_MAX_ATTEMPTS:-60}\";
+                i=1;
+                while [ \"$$i\" -le \"$$max\" ]; do
+                  if curl --connect-timeout 2 --max-time 3 -fsS \"$$url\" >/dev/null; then
+                    echo \"Ory service ready: $$name\";
+                    return 0;
+                  fi;
+                  echo \"Waiting for Ory service: $$name ($$i/$$max)\";
+                  i=$$((i + 1));
+                  sleep 1;
+                done;
+                echo \"ERROR: Ory service not ready: $$name after $$max attempts ($$url)\" >&2;
+                echo \"ERROR: Check service logs: docker logs ory_$$name\" >&2;
+                return 1;
+              };
+              check_ready kratos http://kratos:4433/health/ready || exit 1;
+              check_ready hydra http://hydra:4444/health/ready || exit 1;
+              check_ready keto http://keto:4466/health/ready || exit 1;
+              echo 'Ory Stack is fully operational!';"
+        depends_on:
+            - kratos
+            - hydra
+            - keto
+        networks:
+            - ory-net
+
+    init-rp:
+        image: oryd/hydra:${HYDRA_CLI_VERSION:-v26.2.0}
+        container_name: init-rp
+        env_file:
+            - ../.env
+        entrypoint: ["/bin/sh", "-ec"]
+        command:
+            - |
+                echo "Creating/Updating OAuth2 Clients..."
+
+                hydra create oauth2-client \
+                  --endpoint "$${HYDRA_ADMIN_URL}" \
+                  --id adminfront \
+                  --name "AdminFront" \
+                  --grant-type authorization_code,refresh_token \
+                  --response-type code \
+                  --scope openid,offline_access,profile,email \
+                  --token-endpoint-auth-method none \
+                  --redirect-uri "$${ADMINFRONT_CALLBACK_URLS}"
+
+                hydra create oauth2-client \
+                  --endpoint "$${HYDRA_ADMIN_URL}" \
+                  --id devfront \
+                  --name "DevFront" \
+                  --grant-type authorization_code,refresh_token \
+                  --response-type code \
+                  --scope openid,offline_access,profile,email \
+                  --token-endpoint-auth-method none \
+                  --redirect-uri "$${DEVFRONT_CALLBACK_URLS}"
+
+                hydra create oauth2-client \
+                  --endpoint "$${HYDRA_ADMIN_URL}" \
+                  --id orgfront \
+                  --name "OrgFront" \
+                  --grant-type authorization_code,refresh_token \
+                  --response-type code \
+                  --scope openid,offline_access,profile,email \
+                  --token-endpoint-auth-method none \
+                  --redirect-uri "$${ORGFRONT_CALLBACK_URLS}"
+
+                echo "All RP clients initialized successfully."
+        depends_on:
+            ory_stack_check:
+                condition: service_completed_successfully
+        networks:
+            - ory-net
+            - hydranet
+
+volumes:
+    ory_postgres_data:
+    oathkeeper_logs:
+
+networks:
+    ory-net:
+        external: true
+        name: ory-net
+    hydranet:
+        external: true
+        name: hydranet
+    kratosnet:
+        external: true
+        name: kratosnet
+    public_net:
+        external: true
+        name: public_net
+    baron_net:
+        external: true
+        name: baron_net