forked from baron/baron-sso
311 lines
13 KiB
YAML
311 lines
13 KiB
YAML
services:
|
|
postgres_ory:
|
|
image: postgres:${ORY_POSTGRES_TAG:-17-alpine}
|
|
container_name: ory_postgres
|
|
environment:
|
|
- POSTGRES_USER=${ORY_POSTGRES_USER:-ory}
|
|
- POSTGRES_PASSWORD=${ORY_POSTGRES_PASSWORD:-secret}
|
|
- POSTGRES_DB=${ORY_POSTGRES_DB:-ory}
|
|
volumes:
|
|
- ./docker/ory/init-db:/docker-entrypoint-initdb.d
|
|
- ory_postgres_data:/var/lib/postgresql/data
|
|
networks:
|
|
- ory-net
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"pg_isready -U ${ORY_POSTGRES_USER:-ory} -d ${KRATOS_DB:-ory_kratos}",
|
|
]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# --- Kratos ---
|
|
kratos-migrate:
|
|
image: oryd/kratos:${KRATOS_VERSION:-v26.2.0}
|
|
environment:
|
|
- DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
|
|
- KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL}
|
|
- KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL}
|
|
- KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}
|
|
- KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["${KRATOS_UI_URL}","${KRATOS_UI_URL}/","${USERFRONT_URL}","${USERFRONT_URL}/","${USERFRONT_URL}/ko","${USERFRONT_URL}/ko/","${USERFRONT_URL}/en","${USERFRONT_URL}/en/","${USERFRONT_URL}/auth/callback","${USERFRONT_URL}/ko/auth/callback","${USERFRONT_URL}/en/auth/callback","${ADMINFRONT_URL}/auth/callback","${DEVFRONT_URL}/auth/callback","${ORGFRONT_URL}/auth/callback"]}
|
|
- KRATOS_SELFSERVICE_FLOWS_ERROR_UI_URL=${KRATOS_UI_URL}/error
|
|
- KRATOS_SELFSERVICE_FLOWS_SETTINGS_UI_URL=${KRATOS_UI_URL}/error?error=settings_disabled
|
|
- KRATOS_SELFSERVICE_FLOWS_RECOVERY_UI_URL=${KRATOS_UI_URL}/recovery
|
|
- KRATOS_SELFSERVICE_FLOWS_VERIFICATION_UI_URL=${KRATOS_UI_URL}/verification
|
|
- KRATOS_SELFSERVICE_FLOWS_LOGIN_UI_URL=${KRATOS_UI_URL}/login
|
|
- KRATOS_SELFSERVICE_FLOWS_REGISTRATION_UI_URL=${KRATOS_UI_URL}/registration
|
|
- KRATOS_SELFSERVICE_FLOWS_LOGOUT_AFTER_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}/login
|
|
volumes:
|
|
- ./config/.generated/ory/kratos:/etc/config/kratos
|
|
command: migrate sql up -e -c /etc/config/kratos/kratos.yml --yes
|
|
depends_on:
|
|
postgres_ory:
|
|
condition: service_healthy
|
|
networks:
|
|
- ory-net
|
|
|
|
kratos:
|
|
image: oryd/kratos:${KRATOS_VERSION:-v26.2.0}
|
|
container_name: ory_kratos
|
|
environment:
|
|
- DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
|
|
- COOKIE_SECRET=${COOKIE_SECRET:-localcookie123}
|
|
- KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL}
|
|
- KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL}
|
|
- KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}
|
|
- KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["${KRATOS_UI_URL}","${KRATOS_UI_URL}/","${USERFRONT_URL}","${USERFRONT_URL}/","${USERFRONT_URL}/ko","${USERFRONT_URL}/ko/","${USERFRONT_URL}/en","${USERFRONT_URL}/en/","${USERFRONT_URL}/auth/callback","${USERFRONT_URL}/ko/auth/callback","${USERFRONT_URL}/en/auth/callback","${ADMINFRONT_URL}/auth/callback","${DEVFRONT_URL}/auth/callback","${ORGFRONT_URL}/auth/callback"]}
|
|
- KRATOS_SELFSERVICE_FLOWS_ERROR_UI_URL=${KRATOS_UI_URL}/error
|
|
- KRATOS_SELFSERVICE_FLOWS_SETTINGS_UI_URL=${KRATOS_UI_URL}/error?error=settings_disabled
|
|
- KRATOS_SELFSERVICE_FLOWS_RECOVERY_UI_URL=${KRATOS_UI_URL}/recovery
|
|
- KRATOS_SELFSERVICE_FLOWS_VERIFICATION_UI_URL=${KRATOS_UI_URL}/verification
|
|
- KRATOS_SELFSERVICE_FLOWS_LOGIN_UI_URL=${KRATOS_UI_URL}/login
|
|
- KRATOS_SELFSERVICE_FLOWS_REGISTRATION_UI_URL=${KRATOS_UI_URL}/registration
|
|
- KRATOS_SELFSERVICE_FLOWS_LOGOUT_AFTER_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}/login
|
|
volumes:
|
|
- ./config/.generated/ory/kratos:/etc/config/kratos
|
|
command: serve -c /etc/config/kratos/kratos.yml --dev --watch-courier
|
|
depends_on:
|
|
kratos-migrate:
|
|
condition: service_completed_successfully
|
|
networks:
|
|
- ory-net
|
|
- kratosnet
|
|
|
|
# --- Hydra ---
|
|
hydra-migrate:
|
|
image: oryd/hydra:${HYDRA_VERSION:-v26.2.0}
|
|
environment:
|
|
- DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
|
|
command: migrate sql up -e --yes
|
|
depends_on:
|
|
postgres_ory:
|
|
condition: service_healthy
|
|
networks:
|
|
- ory-net
|
|
|
|
hydra:
|
|
image: oryd/hydra:${HYDRA_VERSION:-v26.2.0}
|
|
container_name: ory_hydra
|
|
environment:
|
|
- DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
|
|
- URLS_SELF_ISSUER=${HYDRA_PUBLIC_URL}
|
|
- URLS_LOGIN=${HYDRA_LOGIN_URL:-${USERFRONT_URL}/login}
|
|
- URLS_CONSENT=${HYDRA_CONSENT_URL:-${USERFRONT_URL}/consent}
|
|
- URLS_ERROR=${HYDRA_ERROR_URL:-${USERFRONT_URL}/error}
|
|
- SECRETS_SYSTEM=${ORY_POSTGRES_PASSWORD}
|
|
volumes:
|
|
- ./config/.generated/ory/hydra:/etc/config/hydra
|
|
command: serve -c /etc/config/hydra/hydra.yml all --dev
|
|
depends_on:
|
|
hydra-migrate:
|
|
condition: service_completed_successfully
|
|
networks:
|
|
- ory-net
|
|
- hydranet
|
|
|
|
# --- Keto ---
|
|
keto-migrate:
|
|
image: oryd/keto:${KETO_VERSION:-v26.2.0}
|
|
environment:
|
|
- DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KETO_DB:-ory_keto}?sslmode=disable&max_conns=20
|
|
volumes:
|
|
- ./config/.generated/ory/keto:/etc/config/keto
|
|
command: ["migrate", "up", "-c", "/etc/config/keto/keto.yml", "--yes"]
|
|
depends_on:
|
|
postgres_ory:
|
|
condition: service_healthy
|
|
networks:
|
|
- ory-net
|
|
|
|
keto:
|
|
image: oryd/keto:${KETO_VERSION:-v26.2.0}
|
|
container_name: ory_keto
|
|
environment:
|
|
- DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KETO_DB:-ory_keto}?sslmode=disable&max_conns=20
|
|
volumes:
|
|
- ./config/.generated/ory/keto:/etc/config/keto
|
|
command: serve -c /etc/config/keto/keto.yml
|
|
depends_on:
|
|
keto-migrate:
|
|
condition: service_completed_successfully
|
|
networks:
|
|
- ory-net
|
|
|
|
# --- Oathkeeper ---
|
|
oathkeeper_logs_init:
|
|
image: alpine:latest
|
|
command:
|
|
[
|
|
"sh",
|
|
"-c",
|
|
"mkdir -p /var/log/oathkeeper && chown -R ${OATHKEEPER_UID:-1001}:${OATHKEEPER_GID:-1001} /var/log/oathkeeper",
|
|
]
|
|
volumes:
|
|
- oathkeeper_logs:/var/log/oathkeeper
|
|
networks:
|
|
- ory-net
|
|
|
|
oathkeeper:
|
|
image: oryd/oathkeeper:${OATHKEEPER_VERSION:-v26.2.0}
|
|
container_name: ory_oathkeeper
|
|
user: "${OATHKEEPER_UID:-1001}:${OATHKEEPER_GID:-1001}"
|
|
ports:
|
|
- "4457:4455" # Proxy
|
|
environment:
|
|
- APP_ENV=${APP_ENV:-development}
|
|
- LOG_LEVEL=debug
|
|
- OATHKEEPER_INTROSPECT_CLIENT_ID=${OATHKEEPER_INTROSPECT_CLIENT_ID:-oathkeeper-introspect}
|
|
- OATHKEEPER_INTROSPECT_CLIENT_SECRET=${OATHKEEPER_INTROSPECT_CLIENT_SECRET:-oathkeeper-secret}
|
|
volumes:
|
|
- ./config/.generated/ory/oathkeeper:/etc/config/oathkeeper
|
|
- oathkeeper_logs:/var/log/oathkeeper
|
|
entrypoint: ["/etc/config/oathkeeper/entrypoint.sh"]
|
|
depends_on:
|
|
oathkeeper_logs_init:
|
|
condition: service_completed_successfully
|
|
networks:
|
|
- ory-net
|
|
- public_net
|
|
|
|
ory_clickhouse:
|
|
image: clickhouse/clickhouse-server:latest
|
|
container_name: ory_clickhouse
|
|
environment:
|
|
- CLICKHOUSE_USER=${ORY_CLICKHOUSE_USER:-ory}
|
|
- CLICKHOUSE_PASSWORD=${ORY_CLICKHOUSE_PASSWORD:-orypass}
|
|
volumes:
|
|
- ory_clickhouse_data:/var/lib/clickhouse
|
|
- ./docker/ory/clickhouse:/docker-entrypoint-initdb.d
|
|
networks:
|
|
- ory-net
|
|
|
|
ory_vector:
|
|
image: timberio/vector:0.36.0-alpine
|
|
container_name: ory_vector
|
|
environment:
|
|
- ORY_CLICKHOUSE_USER=${ORY_CLICKHOUSE_USER:-ory}
|
|
- ORY_CLICKHOUSE_PASSWORD=${ORY_CLICKHOUSE_PASSWORD:-orypass}
|
|
volumes:
|
|
- ./docker/ory/vector:/etc/vector
|
|
- oathkeeper_logs:/var/log/oathkeeper
|
|
command: ["-c", "/etc/vector/vector.toml"]
|
|
depends_on:
|
|
- oathkeeper
|
|
- ory_clickhouse
|
|
networks:
|
|
- ory-net
|
|
|
|
# --- 초기화 & 헬스체크 ---
|
|
ory_stack_check:
|
|
image: alpine:latest
|
|
container_name: ory_stack_check
|
|
command: >
|
|
/bin/sh -c "
|
|
apk add --no-cache curl;
|
|
echo 'Wait for services...';
|
|
check_ready() {
|
|
name=\"$$1\";
|
|
url=\"$$2\";
|
|
max=\"$${ORY_STACK_CHECK_MAX_ATTEMPTS:-60}\";
|
|
i=1;
|
|
while [ \"$$i\" -le \"$$max\" ]; do
|
|
if curl --connect-timeout 2 --max-time 3 -fsS \"$$url\" >/dev/null; then
|
|
echo \"Ory service ready: $$name\";
|
|
return 0;
|
|
fi;
|
|
echo \"Waiting for Ory service: $$name ($$i/$$max)\";
|
|
i=$$((i + 1));
|
|
sleep 1;
|
|
done;
|
|
echo \"ERROR: Ory service not ready: $$name after $$max attempts ($$url)\" >&2;
|
|
echo \"ERROR: Check service logs: docker logs ory_$$name\" >&2;
|
|
return 1;
|
|
};
|
|
check_ready kratos http://kratos:4433/health/ready || exit 1;
|
|
check_ready hydra http://hydra:4444/health/ready || exit 1;
|
|
check_ready keto http://keto:4466/health/ready || exit 1;
|
|
echo 'Ory Stack is fully operational!';"
|
|
depends_on:
|
|
- kratos
|
|
- hydra
|
|
- keto
|
|
networks:
|
|
- ory-net
|
|
|
|
# 기본 RP (Admin Front 등) 자동 등록 컨테이너
|
|
init-rp:
|
|
image: oryd/hydra:${HYDRA_CLI_VERSION:-v26.2.0}
|
|
env_file:
|
|
- .env
|
|
entrypoint: ["/bin/sh", "-ec"]
|
|
command:
|
|
- |
|
|
hydra delete oauth2-client --endpoint "$${HYDRA_ADMIN_URL}" adminfront >/dev/null 2>&1 || true
|
|
hydra delete oauth2-client --endpoint "$${HYDRA_ADMIN_URL}" devfront >/dev/null 2>&1 || true
|
|
hydra delete oauth2-client --endpoint "$${HYDRA_ADMIN_URL}" orgfront >/dev/null 2>&1 || true
|
|
hydra delete oauth2-client --endpoint "$${HYDRA_ADMIN_URL}" "$${OATHKEEPER_INTROSPECT_CLIENT_ID:-oathkeeper-introspect}" >/dev/null 2>&1 || true
|
|
|
|
hydra create oauth2-client \
|
|
--endpoint "$${HYDRA_ADMIN_URL}" \
|
|
--id adminfront \
|
|
--name "AdminFront" \
|
|
--grant-type authorization_code,refresh_token \
|
|
--response-type code \
|
|
--scope openid,offline_access,profile,email \
|
|
--token-endpoint-auth-method none \
|
|
--redirect-uri ${ADMINFRONT_CALLBACK_URLS}
|
|
|
|
hydra create oauth2-client \
|
|
--endpoint "$${HYDRA_ADMIN_URL}" \
|
|
--id devfront \
|
|
--name "DevFront" \
|
|
--grant-type authorization_code,refresh_token \
|
|
--response-type code \
|
|
--scope openid,offline_access,profile,email \
|
|
--token-endpoint-auth-method none \
|
|
--redirect-uri ${DEVFRONT_CALLBACK_URLS}
|
|
|
|
hydra create oauth2-client \
|
|
--endpoint "$${HYDRA_ADMIN_URL}" \
|
|
--id orgfront \
|
|
--name "OrgFront" \
|
|
--grant-type authorization_code,refresh_token \
|
|
--response-type code \
|
|
--scope openid,offline_access,profile,email \
|
|
--token-endpoint-auth-method none \
|
|
--redirect-uri ${ORGFRONT_CALLBACK_URLS}
|
|
|
|
hydra create oauth2-client \
|
|
--endpoint "$${HYDRA_ADMIN_URL}" \
|
|
--id "$${OATHKEEPER_INTROSPECT_CLIENT_ID:-oathkeeper-introspect}" \
|
|
--secret "$${OATHKEEPER_INTROSPECT_CLIENT_SECRET:-oathkeeper-secret}" \
|
|
--grant-type client_credentials \
|
|
--response-type token \
|
|
--scope openid,offline_access,profile,email
|
|
depends_on:
|
|
ory_stack_check:
|
|
condition: service_completed_successfully
|
|
networks:
|
|
- hydranet
|
|
|
|
volumes:
|
|
ory_postgres_data:
|
|
ory_clickhouse_data:
|
|
oathkeeper_logs:
|
|
|
|
networks:
|
|
ory-net:
|
|
external: true
|
|
name: ory-net
|
|
hydranet:
|
|
external: true
|
|
name: hydranet
|
|
kratosnet:
|
|
external: true
|
|
name: kratosnet
|
|
public_net:
|
|
external: true
|
|
name: public_net
|