compose.yaml

version: '3'

services:
  db:
    image: postgres:15.3-alpine
    ports:
      - 5432:5432
    environment:
      - POSTGRES_USER=admin
      - POSTGRES_PASSWORD=password
      - POSTGRES_DB=dbildungs-iam-server
  keycloak:
    image: ghcr.io/dbildungsplattform/dbildungs-iam-keycloak:latest
    environment:
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=admin
      - PI_ADMIN_USER=admin
      - PI_ADMIN_PASSWORD=admin
      - PI_REALM=defrealm
      - PI_BASE_URL=http://privacy-idea:8080
      - STATUS_REDIRECT_URL=https://status.dev.spsh.dbildungsplattform.de/
    entrypoint: '/opt/keycloak/bin/kc.sh start-dev'
    command:
      # Internal DB but still persisted in container
      - '--db=dev-file'
      # No caching
      - '--cache=local'
      # We have no way of checking for the health probe so we might just as well turn it off
      - '--health-enabled=false'
      # Import SPSH-Realm
      - '--import-realm'
    ports:
      - 8080:8080
      - 8443:8443
    volumes:
      - ./config/dev-realm-spsh.json:/opt/keycloak/data/import/realm.json

  redis:
    image: redis:7.2.2
    healthcheck:
      test: ['CMD', 'redis-cli', '--raw', 'incr', 'ping']
    ports:
      - 6379:6379
    command: redis-server --requirepass password

  backend:
    profiles:
      - full-backend
    image: ghcr.io/dbildungsplattform/dbildungs-iam-server
    build:
      context: .
    depends_on:
      keycloak:
        condition: service_started
      db:
        condition: service_started
      redis:
        condition: service_healthy
    environment:
      NODE_ENV: dev
      DEPLOY_STAGE: dev
    network_mode: host
    volumes:
      - source: 'config'
        target: '/app/config'
        type: bind
  db-init:
    profiles:
      - db-init
    image: ghcr.io/dbildungsplattform/dbildungs-iam-server
    build:
      context: .
    depends_on:
      - db
    environment:
      NODE_ENV: dev
      DEPLOY_STAGE: dev
    command: ['node', 'dist/src/console/main.js', 'db', 'init']
    volumes:
      - source: 'config'
        target: '/app/config'
        type: bind
  openldap:
    image: osixia/openldap:1.5.0
    container_name: openldap
    command: --copy-service --loglevel debug
    ports:
      - 389:389
      - 636:636
    volumes:
      - ./config/ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom
    environment:
      - LDAP_ORGANISATION=schule-sh-de
      - LDAP_DOMAIN=schule-sh.de
      - LDAP_BASE_DN=dc=schule-sh,dc=de
      - LDAP_ADMIN_PASSWORD=admin
      - LDAP_CONFIG_PASSWORD=config
      - LDAP_RFC2307BIS_SCHEMA=true
      - LDAP_REMOVE_CONFIG_AFTER_SETUP=true
      - LDAP_TLS_VERIFY_CLIENT=never
  openldap-admin:
    image: osixia/phpldapadmin:0.9.0
    container_name: ldap-admin
    restart: 'no'
    environment:
      PHPLDAPADMIN_LDAP_HOSTS: openldap
      PHPLDAPADMIN_HTTPS: 'false'
    depends_on:
      - openldap
    ports:
      - 9007:80
      - 4443:443

  privacy-idea:
    image: khalibre/privacyidea:latest
    container_name: privacy-idea
    ports:
      - 5000:8080
    environment:
      - PI_ADMIN_USER=admin
      - PI_ADMIN_PASSWORD=admin
      - PI_DB_TYPE=mysql
      - PI_DB_HOST=mariadb
      - PI_DB_PORT=3306
      - PI_DB_NAME=ducsxqm001
      - PI_DB_USER=admin
      - PI_DB_PASSWORD=password
      - PI_DB_VENDOR=mysql
      - PI_SUPERUSER_REALM="administrator,api"
      - PI_PAGE_TITLE=Schulportal SH
      - PI_SECRET_KEY=secret
      - PI_PEPPER=pepper
      - PI_LOGLEVEL=DEBUG
    depends_on:
      maria-db:
        condition: service_healthy
    volumes:
      - ./privacyidea/encfile:/data/privacyidea/keys/encfile
      - ./privacyidea/dummy_private.pem:/data/privacyidea/keys/private.pem
      - ./privacyidea/dummy_public.pem:/data/privacyidea/keys/public.pem

  maria-db:
    image: mariadb:latest
    container_name: mariadb
    ports:
      - 3306:3306
    environment:
      - MYSQL_ROOT_PASSWORD=password
      - MYSQL_DATABASE=ducsxqm001
      - MYSQL_USER=admin
      - MYSQL_PASSWORD=password
    healthcheck:
      test: ['CMD', 'healthcheck.sh', '--connect', '--innodb_initialized']
      start_period: 10s
      interval: 10s
      timeout: 5s
      retries: 3
    volumes:
      - mariadb:/var/lib/mysql
      - ./privacyidea/dump.sql:/docker-entrypoint-initdb.d/dump.sql

  cron-service:
    build: ./charts/dbildungs-iam-server/cron
    environment:
      - KC_CLIENT_ID=spsh-service
      - KC_TOKEN_URL=http://keycloak:8080/realms/SPSH/protocol/openid-connect/token
      - BACKEND_ENDPOINT_URL=http://host.docker.internal:9090/api/cron/kopers-lock
      - HTTP_METHOD=PUT
      - JWKS_FILE_PATH=/keys/jwks.json
    volumes:
      - ./charts/dbildungs-iam-server/cron/scripts:/scripts
      - ./charts/dbildungs-iam-server/cron/keys/dummy_jwks.json:/keys/jwks.json:ro
    depends_on:
      - keycloak

volumes:
  db-data:
  mariadb: