compose.yaml_template

name: ${STACKNAME}

# common settings for all containers
x-common: &common
  domainname: $DNS_DOMAIN
  extra_hosts: 
    idv.$DNS_DOMAIN: $IP_IDV
    rl.$DNS_DOMAIN: $IP_RL
    idcon.$DNS_DOMAIN: $IP_IDCON
    iman.$DNS_DOMAIN: $IP_IMAN
    osp.$DNS_DOMAIN: $IP_OSP
    apps.$DNS_DOMAIN: $IP_APPS
    forms.$DNS_DOMAIN: $IP_FORMS
    sspr.$DNS_DOMAIN: $IP_SSPR
    db.$DNS_DOMAIN: $IP_DB
    mail.$DNS_DOMAIN: $IP_MAIL
    # mq.$DNS_DOMAIN: $IP_MQ
    mp.$DNS_DOMAIN: $IP_MP_SERV
    mp_data.$DNS_DOMAIN: $IP_MP_DATA
    mp_connid.$DNS_DOMAIN: $IP_MP_CONNID
  logging:
    driver: local
    options:
      max-size: "10m"
      max-file: "3"
  
services:

  idv:
    <<: *common
    pull_policy: never
    build: 
      context: images/identityengine
      platforms: 
        - "linux/amd64"
    platform: linux/amd64
    profiles: ["idv","dirxml","apps","all"]
    restart: unless-stopped
    stop_grace_period: 300s
    environment:
      TZ: Europe/Berlin
      SILENT_INSTALL_FILE: /config/silent.properties
      debug: "n"
    ports:
      - "$PORT_LDAP:$PORT_LDAP"
      - "$PORT_LDAPS:$PORT_LDAPS"
      - "$PORT_IMON:$PORT_IMON"
      - "$PORT_IMONS:$PORT_IMONS"
    hostname: idv
    networks:
      default:
        ipv4_address: $IP_IDV
    volumes:
      - config:/config
      - trace:/var/log/idm
      - cache:/var/idm/cache

  rl:
    <<: *common
    pull_policy: never
    build: 
      context: images/remoteloader
      platforms: 
        - "linux/amd64"
    platform: linux/amd64
    profiles: ["rl","dirxml","all"]
    restart: unless-stopped
    stop_grace_period: 100s
    environment:
      TZ: Europe/Berlin
      RL_DRIVER_STARTUP: StartupRL.txt
    hostname: rl
    networks:
      default:
        ipv4_address: $IP_RL
    volumes:
      - config:/config
      - trace:/var/log/idm
      - cache:/var/idm/cache
  
  idcon:
    <<: *common
    pull_policy: never
    build:
      context: images/identityconsole
      platforms: 
        - "linux/amd64"
    platform: linux/amd64
    profiles: ["idcon","all"]
    restart: on-failure:5
    environment:
      TZ: Europe/Berlin
      ACCEPT_EULA: "Y"
      DEBUG_MODE: false
    ports:
      - "$PORT_IDCON:$PORT_IDCON"
    hostname: idcon
    networks:
      default:
        ipv4_address: $IP_IDCON
    volumes:
      - config:/config
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 200M
          pids: 300

  iman:
    <<: *common
    pull_policy: never
    build:
      context: images/imanager
      platforms: 
        - "linux/amd64"
    platform: linux/amd64
    profiles: ["iman","all"]
    restart: on-failure:5
    environment:
      TZ: Europe/Berlin
    ports:
      - "$PORT_IMAN:8443"
    hostname: iman
    networks:
      default:
        ipv4_address: $IP_IMAN
    volumes:
      - config:/config
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 1000M
          pids: 300

  db:
    <<: *common
    # Using the official platform-specific image
    image: postgres:14.16
    profiles: ["db","apps","all"]
    restart: unless-stopped
    cpuset: '1'
    pids_limit: 300
    stop_grace_period: 180s
    environment:
      TZ: Europe/Berlin
      POSTGRES_PASSWORD: $COMMON_PW
    ports:
      - "$PORT_DB:5432"
    hostname: db
    networks:
      default:
        ipv4_address: $IP_DB
    volumes:
      - db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 3

  mail:
    <<: *common
    # Using the official platform-specific image
    image: maildev/maildev:latest
    profiles: ["mail","all"]
    restart: unless-stopped
    environment:
      MAILDEV_WEB_PORT: $PORT_MAIL
      MAILDEV_HTTPS: true
      MAILDEV_HTTPS_KEY: /config/mail/mail.key
      MAILDEV_HTTPS_CERT: /config/mail/mail.crt
      MAILDEV_SMTP_PORT: $PORT_SMTP
      MAILDEV_MAIL_DIRECTORY: /config/mail/data
      # for more options, see https://github.com/maildev/maildev
    ports:
      - "$PORT_MAIL:$PORT_MAIL"
      - "$PORT_SMTP:$PORT_SMTP"
    hostname: mail
    networks:
      default:
        ipv4_address: $IP_MAIL
    volumes:
      - config:/config

  osp:
    <<: *common
    pull_policy: never
    build:
      context: images/osp
      platforms: 
        - "linux/amd64"
    platform: linux/amd64
    depends_on:
      - idv
    profiles: ["osp","apps","all"]
    restart: unless-stopped
    stop_grace_period: 180s
    environment:
      TZ: Europe/Berlin
      SILENT_INSTALL_FILE: /config/silent.properties
      debug: n
    ports:
      - '$PORT_OSP:$PORT_OSP'
    hostname: osp
    networks:
      default:
        ipv4_address: $IP_OSP
    volumes:
      - config:/config

  # mq:
  #   <<: *common
  #   image: ${IMAGE_PREFIX}/activemq:idm-4.10.0-533
  #   platform: linux/amd64
  #   profiles: ${FANOUT_PROFILES}
  #   restart: unless-stopped
  #   stop_grace_period: 100s
  #   env_file:
  #     - ./config/silent.properties
  #   environment:
  #     TZ: Europe/Berlin
  #     debug: n
  #   hostname: mq
  #   networks:
  #     default:
  #       ipv4_address: $IP_MQ
  #   volumes:
  #     - config:/config

  apps:
    <<: *common
    build:
      context: images/userapp
      platforms: 
        - "linux/amd64"
    platform: linux/amd64
    depends_on:
      - db
      - osp
    profiles: ["apps","all"]
    restart: on-failure:5
    stop_grace_period: 300s
    cpuset: '2'
    pids_limit: 300
    environment:
      TZ: Europe/Berlin
      SILENT_INSTALL_FILE: /config/silent.properties
      debug: n
    ports:
      - "$PORT_APPS:$PORT_APPS"
    hostname: apps
    networks:
      default:
        ipv4_address: $IP_APPS
    volumes:
      - config:/config

  forms:
    <<: *common
    build:
      context: images/forms
      platforms: 
        - "linux/amd64"
    platform: linux/amd64
    depends_on:
      - apps
    profiles: ["apps","all"]
    restart: on-failure:5
    stop_grace_period: 180s
    cpuset: '1'
    pids_limit: 300
    environment:
      TZ: Europe/Berlin
      SILENT_INSTALL_FILE: /config/silent.properties
      debug: n
    ports:
      - "$PORT_FORMS:$PORT_FORMS"
    hostname: forms
    networks:
      default:
        ipv4_address: $IP_FORMS
    volumes:
      - config:/config

  sspr:
    <<: *common
    build:
      context: images/sspr/sspr-webapp
      platforms: 
        - "linux/amd64"
    platform: linux/amd64
    depends_on:
      - osp
    profiles: ["sspr","apps","all"]
    restart: on-failure:5
    stop_grace_period: 180s
    cpuset: '1'
    pids_limit: 300
    env_file: config/silent.properties
    environment:
      TZ: Europe/Berlin
      SILENT_INSTALL_FILE: /tmp/silent.properties
      debug: n
    ports:
      - "$PORT_SSPR:8443"
    hostname: sspr
    networks:
      default:
        ipv4_address: $IP_SSPR
    volumes:
      - sspr:/config

  mp_server:
    <<: *common
    #image: evolveum/midpoint:${MP_VER:-latest}
    build:
      context: images/midpoint
      platforms: 
        - "linux/amd64"
    platform: linux/amd64
    profiles: ["midpoint","all"]
    hostname: mp
    depends_on:
      mp_init:
        condition: service_completed_successfully
      mp_data:
        condition: service_started
    command: [ "/opt/midpoint/bin/midpoint.sh", "container" ]
    ports:
      - $PORT_MP_SERV:$PORT_MP_SERV
    environment:
     - MP_SET_midpoint_administrator_initialPassword=$KC_DEFAULT_ADMIN_PW
     - MP_SET_midpoint_repository_jdbcUsername=midpoint
     - MP_SET_midpoint_repository_jdbcPassword=secret.db.pw.007
     - MP_SET_midpoint_repository_jdbcUrl=jdbc:postgresql://mp_data:5432/midpoint
     - MP_SET_midpoint_repository_database=postgresql
     - MP_SET_server_port=$PORT_MP_SERV
     - MP_SET_server_ssl_enabled=true
     - MP_SET_server_ssl_keyStoreType=PKCS12
     - MP_SET_server_ssl_key-store=/opt/certs/keys.pfx
     - MP_SET_server_ssl_key-store-password=n0v3ll
     - MP_SET_server_ssl_key-alias=tomcat
     - MP_SET_server_ssl_trust-store=/opt/certs/keys.pfx
     - MP_SET_server_ssl_trust-store-password=n0v3ll
     - MP_UNSET_midpoint_repository_hibernateHbm2ddl=1
     - MP_NO_ENV_COMPAT=1
    networks:
      default:
        ipv4_address: $IP_MP_SERV
    volumes:
     - mp_home:/opt/midpoint/var

  # mp_ninja:
  #   <<: *common
  #   image: evolveum/midpoint:${MP_VER:-latest}
  #   profiles: ["midpoint"]
  #   command: [ "tail", "-f", "/dev/null" ]
  #   depends_on:
  #     mp_data:
  #       condition: service_started
  #   environment:
  #    - MP_SET_midpoint_administrator_initialPassword=$KC_DEFAULT_ADMIN_PW
  #    - MP_SET_midpoint_repository_jdbcUsername=midpoint
  #    - MP_SET_midpoint_repository_jdbcPassword=secret.db.pw.007
  #    - MP_SET_midpoint_repository_jdbcUrl=jdbc:postgresql://mp_data:5432/midpoint
  #    - MP_SET_midpoint_repository_database=postgresql
  #    - MP_UNSET_midpoint_repository_hibernateHbm2ddl=1
  #    - MP_NO_ENV_COMPAT=1
  #   networks:
  #     default:
  #       ipv4_address: 172.77.7.24
  #   volumes:
  #    - mp_home:/opt/midpoint/var

  mp_connid:
    <<: *common
    image: is4it/connid-connector-server:1.6.0.0
    profiles: ["midpoint"]
    hostname: mp_connid
    networks:
      default:
        ipv4_address: $IP_MP_CONNID

  mp_data:
    <<: *common
    image: postgres:17-alpine
    profiles: ["midpoint"]
    environment:
     - POSTGRES_PASSWORD=secret.db.pw.007
     - POSTGRES_USER=midpoint
     - POSTGRES_INITDB_ARGS=--lc-collate=en_US.utf8 --lc-ctype=en_US.utf8
    networks:
      default:
        ipv4_address: $IP_MP_DATA
    volumes:
     - mp_data:/var/lib/postgresql/data
     - mp_backup:/backup

  mp_init:
    <<: *common
    image: evolveum/midpoint:${MP_VER:-latest}
    profiles: ["midpoint"]
    command: >
      bash -c "
      cd /opt/midpoint ;
      bin/midpoint.sh init-native ;
      echo ' - - - - - - ' ;
      bin/ninja.sh -B info >/dev/null 2>/tmp/ninja.log ;
      grep -q \"ERROR\" /tmp/ninja.log && (
      bin/ninja.sh run-sql --create --mode REPOSITORY  ;
      bin/ninja.sh run-sql --create --mode AUDIT
      ) ||
      echo -e '\\n Repository init is not needed...' ;
      "
    depends_on:
     - mp_data
    environment:
     - MP_SET_midpoint_repository_jdbcUsername=midpoint
     - MP_SET_midpoint_repository_jdbcPassword=secret.db.pw.007
     - MP_SET_midpoint_repository_jdbcUrl=jdbc:postgresql://mp_data:5432/midpoint
     - MP_SET_midpoint_repository_database=postgresql
     - MP_INIT_CFG=/opt/midpoint/var
    networks:
      default:
        ipv4_address: $IP_MP_INIT
    volumes:
     - mp_home:/opt/midpoint/var
 
  kc_server:
    #image: quay.io/keycloak/keycloak:${KC_VER:-latest}
    build:
      context: images/keycloak
    profiles: ["keycloak","all"]
    # start-dev, nicht in Produktivumgebungen
    command: start-dev
    depends_on:
      - kc_data
    environment:
      KC_DB: postgres
      KC_DB_URL_HOST: kc_data
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: helloKeycloak
      KC_BOOTSTRAP_ADMIN_USERNAME: init-admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: $KC_DEFAULT_ADMIN_PW
      KC_CLI_PASSWORD: $KC_DEFAULT_ADMIN_PW
      KC_HTTPS_CERTIFICATE_FILE: /opt/keycloak/conf/server.crt
      KC_HTTPS_CERTIFICATE_KEY_FILE: /opt/keycloak/conf/server.key
    ports:
      - "$PORT_KC_SERV:8443"
    networks:
      default:
        ipv4_address: $IP_KC_SERV

  kc_data:
    image: postgres:${KC_VER_DB:-18-alpine}
    profiles: ["keycloak","all"]
    restart: unless-stopped
    volumes:
      - kc_data:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: helloKeycloak
    networks:
      default:
        ipv4_address: $IP_KC_DATA

networks:
  default:
    driver: bridge
    driver_opts:
      com.docker.network.bridge.host_binding_ipv4: $DOCKER_HOST_BINDING
    attachable: true
    ipam:
      config:
        - subnet: $SUBNET

volumes:
  config:
  trace:
  cache:
  db:
  sspr:
  mp_home:
  mp_data:
  mp_backup:
  kc_data: