toktagger/docker-compose.yml at dev · ukaea/toktagger · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
services:
  caddy:
    image: caddy:2.10-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    environment:
      TOKTAGGER_HOST: ${TOKTAGGER_HOST:?}
      KEYCLOAK_HOST: ${KEYCLOAK_HOST:?}
    volumes:
      - ./deploy/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - api
      - keycloak

  api:
    build:
      context: .
      target: production
      args:
        EXTRAS: ${TOKTAGGER_EXTRAS:-}
    image: toktagger:latest
    restart: unless-stopped
    depends_on:
      mongo:
        condition: service_healthy
      keycloak:
        condition: service_healthy
    environment:
      DATABASE_MONGO_URL: mongodb://${MONGO_USERNAME:-toktagger}:${MONGO_PASSWORD:?}@mongo:27017
      SERVER_WORKERS: ${SERVER_WORKERS:-4}
      MODELS_MAX_ACTORS: ${MODELS_MAX_ACTORS:-5}
      SERVER_FORWARDED_ALLOW_IPS: "*"
      AUTH_PROVIDER: oidc
      AUTH_ISSUER_URL: http://keycloak:8080/realms/toktagger
      AUTH_CLIENT_ID: toktagger
      AUTH_CLIENT_SECRET: ${KEYCLOAK_CLIENT_SECRET:?}
      AUTH_SECRET_KEY: ${AUTH_SECRET_KEY:?}
      AUTH_PUBLIC_URL: https://${TOKTAGGER_HOST:?}
    volumes:
      - toktagger_data:/data

  mongo:
    image: mongo:${MONGO_VERSION:-8.0}
    restart: unless-stopped
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGO_USERNAME:-toktagger}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_PASSWORD:?}
    volumes:
      - mongo_data:/data/db
    healthcheck:
      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping')"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 20s

  keycloak:
    image: quay.io/keycloak/keycloak:26.8.0
    restart: unless-stopped
    command: ["start", "--import-realm"]
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: ${POSTGRES_PASSWORD:?}
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:?}
      KC_HOSTNAME: https://${KEYCLOAK_HOST:?}
      KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
      KC_HTTP_ENABLED: "true"
      KC_PROXY_HEADERS: xforwarded
      KC_HEALTH_ENABLED: "true"
      KEYCLOAK_CLIENT_SECRET: ${KEYCLOAK_CLIENT_SECRET:?}
      TOKTAGGER_PUBLIC_URL: https://${TOKTAGGER_HOST:?}
    volumes:
      - ./deploy/keycloak/toktagger-realm.json:/opt/keycloak/data/import/toktagger-realm.json:ro
    healthcheck:
      test:
        - CMD-SHELL
        - >-
          exec 3<>/dev/tcp/localhost/9000 &&
          printf 'GET /health/ready HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 &&
          grep -q '"status": "UP"' <&3
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 30s

  postgres:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U keycloak -d keycloak"]
      interval: 5s
      timeout: 5s
      retries: 10

volumes:
  caddy_data:
  caddy_config:
  toktagger_data:
  mongo_data:
  postgres_data: