docker-compose.yml.example

# Temporal Standalone - Production Ready
# PostgreSQL 18 + Temporal Server + Temporal UI + Casdoor (OIDC)
# Single PostgreSQL with separate databases for main and visibility

services:
  # ============================================
  # PostgreSQL 18 - All Temporal Databases
  # - temporal: Workflow history, namespace metadata
  # - temporal_visibility: Indexed workflow data for search
  # - casdoor: OIDC identity provider
  # ============================================
  postgresql:
    image: postgres:18
    container_name: temporal-postgres
    environment:
      POSTGRES_PASSWORD: temporal
      POSTGRES_USER: temporal
    volumes:
      - postgres_data:/var/lib/postgresql
      - ./scripts/init-db.sh:/docker-entrypoint-initdb.d/init-db.sh:ro
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U temporal"]
      interval: 10s
      timeout: 5s
      retries: 12
    networks:
      - temporal-network

  # ============================================
  # Casdoor - OIDC Identity Provider
  # ============================================
  casdoor:
    image: casbin/casdoor:3.49.0
    container_name: temporal-casdoor
    depends_on:
      postgresql:
        condition: service_healthy
    environment:
      - RUNNING_IN_DOCKER=true
      - driverName=postgres
      - dataSourceName=user=casdoor password=casdoor_secret host=postgresql port=5432 sslmode=disable dbname=casdoor
      - appName=temporal
      - redisEndpoint=
      - isDemoMode=false
      - builtinOsrmMaptileUrl=
      - enableGzip=true
      - origin=http://${TEMPORAL_HOST:-localhost}:${CASDOOR_PORT:-8000}
    volumes:
      - casdoor_data:/storage
    ports:
      - "${CASDOOR_PORT:-8000}:8000"
    networks:
      - temporal-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/api/get-health"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s
    restart: unless-stopped

  # ============================================
  # Temporal Server
  # Uses temporalio/server (no auto-setup) — schema must exist already.
  # auto-setup was replaced because it re-runs schema migration on every restart,
  # which resets namespace retention and archival settings.
  # ============================================
  temporal:
    build:
      context: ./temporal-server-custom
      dockerfile: Dockerfile
    image: temporal-server-custom:latest
    container_name: temporal-server
    depends_on:
      postgresql:
        condition: service_healthy
      casdoor:
        condition: service_healthy
    environment:
      # Main database (workflow history)
      - DB=postgres12
      - DB_PORT=5432
      - DBNAME=temporal
      - POSTGRES_USER=temporal
      - POSTGRES_PWD=temporal
      - POSTGRES_SEEDS=postgresql
      # Visibility database (same server, different database)
      - VISIBILITY_DB=postgres12
      - VISIBILITY_DB_PORT=5432
      - VISIBILITY_POSTGRES_USER=temporal
      - VISIBILITY_POSTGRES_PWD=temporal
      - VISIBILITY_POSTGRES_SEEDS=postgresql
      - VISIBILITY_DBNAME=temporal_visibility
      # Dynamic config
      - DYNAMIC_CONFIG_FILE_PATH=config/dynamicconfig/docker.yaml
      # JWT Key Sources (Casdoor + UI server JWKS for API keys)
      - TEMPORAL_JWT_KEY_SOURCE1=http://${TEMPORAL_HOST:-localhost}:${CASDOOR_PORT:-8000}/.well-known/jwks
      - TEMPORAL_JWT_KEY_SOURCE2=http://temporal-ui:8080/.well-known/jwks.json
      - JWT_KEY_SOURCE1=http://${TEMPORAL_HOST:-localhost}:${CASDOOR_PORT:-8000}/.well-known/jwks
      - JWT_KEY_SOURCE2=http://temporal-ui:8080/.well-known/jwks.json
      - BROADCAST_ADDRESS=127.0.0.1
      - BIND_ON_IP=0.0.0.0
      - TEMPORAL_ROOT=/etc/temporal
      - TEMPORAL_CONFIG_DIR=config
      - TEMPORAL_ENVIRONMENT=docker
      - TEMPORAL_SERVICES=frontend,internal-frontend,history,matching,worker
    volumes:
      - ./config/temporal/dynamicconfig:/etc/temporal/config/dynamicconfig:ro
      - ./temporal-server-custom/config_template.yaml:/etc/temporal/config/docker.yaml:ro
    ports:
      - "${TEMPORAL_SERVER_PORT:-7233}:7233"
    networks:
      - temporal-network
    healthcheck:
      test: ["CMD-SHELL", "temporal operator cluster health || exit 0"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    restart: unless-stopped

  # ============================================
  # Configure Namespaces (retention + archive)
  # Runs after server is healthy, re-applies settings on every restart
  # to ensure retention/archive survive server restarts.
  # ============================================
  temporal-setup:
    image: temporalio/admin-tools:latest
    container_name: temporal-setup
    depends_on:
      temporal:
        condition: service_healthy
    volumes:
      - ./scripts/setup-namespaces.sh:/setup.sh:ro
    entrypoint: ["/bin/sh", "/setup.sh"]
    environment:
      - TEMPORAL_CLI_ADDRESS=temporal:7233
    networks:
      - temporal-network
    restart: "no"

  # ============================================
  # Temporal Web UI (com OIDC)
  # ============================================
  temporal-ui:
    image: temporalio/ui:2.52.0
    container_name: temporal-ui
    depends_on:
      temporal:
        condition: service_healthy
      casdoor:
        condition: service_healthy
    environment:
      - TEMPORAL_ADDRESS=temporal:7233
      - TEMPORAL_CORS_ORIGINS=http://${TEMPORAL_HOST:-localhost}:${TEMPORAL_UI_PORT:-8080}
      # OIDC Configuration via env
      - TEMPORAL_OIDC_ISSUER_URL=http://${TEMPORAL_HOST:-localhost}:${CASDOOR_PORT:-8000}
      - TEMPORAL_OIDC_CLIENT_ID=8269b3a04ee85269e59c
      - TEMPORAL_OIDC_CLIENT_SECRET=***
      - TEMPORAL_OIDC_CALLBACK_URL=http://${TEMPORAL_HOST:-localhost}:${TEMPORAL_UI_PORT:-8080}/auth/sso/callback
    # NOTE: Volume mount removed - custom UI has config baked in via docker-compose.override.yml
    # volumes:
    #   - ./config/ui/docker.yaml:/home/ui-server/config/docker.yaml:ro
    ports:
      - "${TEMPORAL_UI_PORT:-8080}:8080"
    networks:
      - temporal-network
    restart: unless-stopped

volumes:
  postgres_data:
  casdoor_data:

networks:
  temporal-network:
    driver: bridge
    name: temporal-network