forked from baron/baron-sso
252 lines
9.5 KiB
YAML
252 lines
9.5 KiB
YAML
services:
|
|
postgres_ory:
|
|
image: postgres:${ORY_POSTGRES_TAG:-17-alpine}
|
|
container_name: ory_postgres
|
|
environment:
|
|
- POSTGRES_USER=${ORY_POSTGRES_USER:-ory}
|
|
- POSTGRES_PASSWORD=${ORY_POSTGRES_PASSWORD:-secret}
|
|
- POSTGRES_DB=${ORY_POSTGRES_DB:-ory}
|
|
volumes:
|
|
- ./docker/ory/init-db:/docker-entrypoint-initdb.d
|
|
- ory_postgres_data:/var/lib/postgresql/data
|
|
networks:
|
|
- ory-net
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"pg_isready -U ${ORY_POSTGRES_USER:-ory} -d ${KRATOS_DB:-ory_kratos}",
|
|
]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
kratos-migrate:
|
|
image: oryd/kratos:${KRATOS_VERSION:-v26.2.0}
|
|
environment:
|
|
- DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
|
|
- KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL}
|
|
- KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL}
|
|
- KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}
|
|
- KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["${KRATOS_UI_URL}","${USERFRONT_URL}"]}
|
|
volumes:
|
|
- ../config/.generated/ory/kratos:/etc/config/kratos
|
|
command: migrate sql up -e -c /etc/config/kratos/kratos.yml --yes
|
|
depends_on:
|
|
postgres_ory:
|
|
condition: service_healthy
|
|
networks:
|
|
- ory-net
|
|
|
|
kratos:
|
|
image: oryd/kratos:${KRATOS_VERSION:-v26.2.0}
|
|
container_name: ory_kratos
|
|
environment:
|
|
- DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KRATOS_DB:-ory_kratos}?sslmode=disable&max_conns=20
|
|
- COOKIE_SECRET=${COOKIE_SECRET:-localcookie123}
|
|
- KRATOS_SERVE_PUBLIC_BASE_URL=${KRATOS_BROWSER_URL}
|
|
- KRATOS_SERVE_ADMIN_BASE_URL=${KRATOS_ADMIN_URL}
|
|
- KRATOS_SELFSERVICE_DEFAULT_BROWSER_RETURN_URL=${KRATOS_UI_URL}
|
|
- KRATOS_SELFSERVICE_ALLOWED_RETURN_URLS=${KRATOS_ALLOWED_RETURN_URLS_JSON:-["${KRATOS_UI_URL}","${USERFRONT_URL}"]}
|
|
volumes:
|
|
- ../config/.generated/ory/kratos:/etc/config/kratos
|
|
command: serve -c /etc/config/kratos/kratos.yml
|
|
depends_on:
|
|
kratos-migrate:
|
|
condition: service_completed_successfully
|
|
networks:
|
|
- ory-net
|
|
- kratosnet
|
|
|
|
hydra-migrate:
|
|
image: oryd/hydra:${HYDRA_VERSION:-v26.2.0}
|
|
environment:
|
|
- DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
|
|
command: migrate sql up -e --yes
|
|
depends_on:
|
|
postgres_ory:
|
|
condition: service_healthy
|
|
networks:
|
|
- ory-net
|
|
|
|
hydra:
|
|
image: oryd/hydra:${HYDRA_VERSION:-v26.2.0}
|
|
container_name: ory_hydra
|
|
environment:
|
|
- DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${HYDRA_DB:-ory_hydra}?sslmode=disable&max_conns=20
|
|
- URLS_SELF_ISSUER=${HYDRA_PUBLIC_URL}
|
|
- URLS_LOGIN=${HYDRA_LOGIN_URL:-${USERFRONT_URL}/login}
|
|
- URLS_CONSENT=${HYDRA_CONSENT_URL:-${USERFRONT_URL}/consent}
|
|
- URLS_ERROR=${HYDRA_ERROR_URL:-${USERFRONT_URL}/error}
|
|
- SECRETS_SYSTEM=${ORY_POSTGRES_PASSWORD}
|
|
volumes:
|
|
- ../config/.generated/ory/hydra:/etc/config/hydra
|
|
command: serve -c /etc/config/hydra/hydra.yml all --dev
|
|
depends_on:
|
|
hydra-migrate:
|
|
condition: service_completed_successfully
|
|
networks:
|
|
- ory-net
|
|
- hydranet
|
|
|
|
keto-migrate:
|
|
image: oryd/keto:${KETO_VERSION:-v26.2.0}
|
|
environment:
|
|
- DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KETO_DB:-ory_keto}?sslmode=disable&max_conns=20
|
|
volumes:
|
|
- ../config/.generated/ory/keto:/etc/config/keto
|
|
command: ["migrate", "up", "-c", "/etc/config/keto/keto.yml", "--yes"]
|
|
depends_on:
|
|
postgres_ory:
|
|
condition: service_healthy
|
|
networks:
|
|
- ory-net
|
|
|
|
keto:
|
|
image: oryd/keto:${KETO_VERSION:-v26.2.0}
|
|
container_name: ory_keto
|
|
environment:
|
|
- DSN=postgres://${ORY_POSTGRES_USER}:${ORY_POSTGRES_PASSWORD}@postgres_ory:5432/${KETO_DB:-ory_keto}?sslmode=disable&max_conns=20
|
|
volumes:
|
|
- ../config/.generated/ory/keto:/etc/config/keto
|
|
command: serve -c /etc/config/keto/keto.yml
|
|
depends_on:
|
|
keto-migrate:
|
|
condition: service_completed_successfully
|
|
networks:
|
|
- ory-net
|
|
|
|
oathkeeper:
|
|
image: oryd/oathkeeper:${OATHKEEPER_VERSION:-v26.2.0}
|
|
container_name: oathkeeper
|
|
restart: unless-stopped
|
|
depends_on:
|
|
kratos:
|
|
condition: service_started
|
|
environment:
|
|
- APP_ENV=${APP_ENV:-development}
|
|
- LOG_LEVEL=debug
|
|
- OATHKEEPER_INTROSPECT_CLIENT_ID=${OATHKEEPER_INTROSPECT_CLIENT_ID:-oathkeeper-introspect}
|
|
- OATHKEEPER_INTROSPECT_CLIENT_SECRET=${OATHKEEPER_INTROSPECT_CLIENT_SECRET:-oathkeeper-secret}
|
|
volumes:
|
|
- ../config/.generated/ory/oathkeeper:/etc/config/oathkeeper
|
|
- oathkeeper_logs:/var/log/oathkeeper
|
|
entrypoint: ["/etc/config/oathkeeper/entrypoint.sh"]
|
|
networks:
|
|
- ory-net
|
|
- baron_net
|
|
- public_net
|
|
ports:
|
|
- "4455:4455"
|
|
- "4456:4456"
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://127.0.0.1:4456/health/ready"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
ory_stack_check:
|
|
image: alpine:latest
|
|
container_name: ory_stack_check
|
|
command: >
|
|
/bin/sh -c "
|
|
apk add --no-cache curl;
|
|
echo 'Wait for services...';
|
|
check_ready() {
|
|
name=\"$$1\";
|
|
url=\"$$2\";
|
|
max=\"$${ORY_STACK_CHECK_MAX_ATTEMPTS:-60}\";
|
|
i=1;
|
|
while [ \"$$i\" -le \"$$max\" ]; do
|
|
if curl --connect-timeout 2 --max-time 3 -fsS \"$$url\" >/dev/null; then
|
|
echo \"Ory service ready: $$name\";
|
|
return 0;
|
|
fi;
|
|
echo \"Waiting for Ory service: $$name ($$i/$$max)\";
|
|
i=$$((i + 1));
|
|
sleep 1;
|
|
done;
|
|
echo \"ERROR: Ory service not ready: $$name after $$max attempts ($$url)\" >&2;
|
|
echo \"ERROR: Check service logs: docker logs ory_$$name\" >&2;
|
|
return 1;
|
|
};
|
|
check_ready kratos http://kratos:4433/health/ready || exit 1;
|
|
check_ready hydra http://hydra:4444/health/ready || exit 1;
|
|
check_ready keto http://keto:4466/health/ready || exit 1;
|
|
echo 'Ory Stack is fully operational!';"
|
|
depends_on:
|
|
- kratos
|
|
- hydra
|
|
- keto
|
|
networks:
|
|
- ory-net
|
|
|
|
init-rp:
|
|
image: oryd/hydra:${HYDRA_CLI_VERSION:-v26.2.0}
|
|
container_name: init-rp
|
|
env_file:
|
|
- ../.env
|
|
entrypoint: ["/bin/sh", "-ec"]
|
|
command:
|
|
- |
|
|
echo "Creating/Updating OAuth2 Clients..."
|
|
|
|
hydra create oauth2-client \
|
|
--endpoint "$${HYDRA_ADMIN_URL}" \
|
|
--id adminfront \
|
|
--name "AdminFront" \
|
|
--grant-type authorization_code,refresh_token \
|
|
--response-type code \
|
|
--scope openid,offline_access,profile,email \
|
|
--token-endpoint-auth-method none \
|
|
--redirect-uri "$${ADMINFRONT_CALLBACK_URLS}"
|
|
|
|
hydra create oauth2-client \
|
|
--endpoint "$${HYDRA_ADMIN_URL}" \
|
|
--id devfront \
|
|
--name "DevFront" \
|
|
--grant-type authorization_code,refresh_token \
|
|
--response-type code \
|
|
--scope openid,offline_access,profile,email \
|
|
--token-endpoint-auth-method none \
|
|
--redirect-uri "$${DEVFRONT_CALLBACK_URLS}"
|
|
|
|
hydra create oauth2-client \
|
|
--endpoint "$${HYDRA_ADMIN_URL}" \
|
|
--id orgfront \
|
|
--name "OrgFront" \
|
|
--grant-type authorization_code,refresh_token \
|
|
--response-type code \
|
|
--scope openid,offline_access,profile,email \
|
|
--token-endpoint-auth-method none \
|
|
--redirect-uri "$${ORGFRONT_CALLBACK_URLS}"
|
|
|
|
echo "All RP clients initialized successfully."
|
|
depends_on:
|
|
ory_stack_check:
|
|
condition: service_completed_successfully
|
|
networks:
|
|
- ory-net
|
|
- hydranet
|
|
|
|
volumes:
|
|
ory_postgres_data:
|
|
oathkeeper_logs:
|
|
|
|
networks:
|
|
ory-net:
|
|
external: true
|
|
name: ory-net
|
|
hydranet:
|
|
external: true
|
|
name: hydranet
|
|
kratosnet:
|
|
external: true
|
|
name: kratosnet
|
|
public_net:
|
|
external: true
|
|
name: public_net
|
|
baron_net:
|
|
external: true
|
|
name: baron_net
|