docker-compose.yml

x-mastermind-environment:
  &default-mastermind-env
  - GLOBAL_SECRET_KEY=${GLOBAL_SECRET_KEY}
  - POSTGRESQL_HOST=waldur-db
  - POSTGRESQL_PASSWORD=${POSTGRESQL_PASSWORD}
  - RABBITMQ_HOST=waldur-queue
  - RABBITMQ_PASSWORD=${RABBITMQ_PASSWORD}
  - RABBITMQ_USERNAME=${RABBITMQ_USERNAME}
  - GLOBAL_DEFAULT_FROM_EMAIL=${GLOBAL_DEFAULT_FROM_EMAIL}
  - SENTRY_DSN=${SENTRY_DSN}
  - GLOBAL_DEBUG=${GLOBAL_DEBUG}
  - KEYCLOAK_SECRET=${KEYCLOAK_SECRET}
  - SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT}
  # Memory tuning. Defaults match the image; override in .env to retune.
  - GUNICORN_PRELOAD=${GUNICORN_PRELOAD:-true}
  - CELERY_WORKER_MAX_MEMORY_PER_CHILD=${CELERY_WORKER_MAX_MEMORY_PER_CHILD:-}

x-mastermind-volumes:
  &default-mastermind-volumes
  - ${CONFIG_FOLDER}/waldur-mastermind/override.conf.py:/etc/waldur/override.conf.py
  - ${CONFIG_FOLDER}/waldur-mastermind/logging.conf.py:/etc/waldur/logging.conf.py
  - ${CONFIG_FOLDER}/waldur-mastermind/saml2.conf.py:/etc/waldur/saml2.conf.py
  - ${CONFIG_FOLDER}/waldur-mastermind/id_rsa:/etc/waldur/id_rsa
  - ${CONFIG_FOLDER}/waldur-mastermind/id_rsa.pub:/etc/waldur/id_rsa.pub
  - ${CONFIG_FOLDER}/waldur-mastermind/saml2/credentials:/etc/waldur/saml2/credentials
  - ${CONFIG_FOLDER}/waldur-mastermind/saml2/metadata:/etc/waldur/saml2/metadata
  - ${CONFIG_FOLDER}/waldur-mastermind/valimo:/etc/waldur/valimo
  - ${CONFIG_FOLDER}/waldur-mastermind/notification-templates.yaml:/etc/waldur/notification-templates.yaml
  - ${CONFIG_FOLDER}/waldur-mastermind/auth.yaml:/etc/waldur/auth.yaml
  - ${CONFIG_FOLDER}/waldur-mastermind/support.yaml:/etc/waldur/support.yaml
  - ${CONFIG_FOLDER}/waldur-mastermind/whitelabeling.yaml:/etc/waldur/whitelabeling.yaml
  - ${CONFIG_FOLDER}/waldur-mastermind/marketplace.yaml:/etc/waldur/marketplace.yaml
  - ${CONFIG_FOLDER}/waldur-mastermind/marketplace-script.yaml:/etc/waldur/marketplace-script.yaml
  - ${CONFIG_FOLDER}/whitelabeling:/etc/waldur/icons
  - /var/run/docker.sock:/var/run/docker.sock
  - waldur_script_launchzone:/var/lib/waldur/waldur-script-launchzone

x-mastermind-hosts:
  &default-mastermind-hosts
  - ${EXTRA_HOST}

services:
  # PostgreSQL
  waldur-db:
    container_name: waldur-db
    image: '${DOCKER_REGISTRY_PREFIX}library/postgres:${WALDUR_POSTGRES_IMAGE_TAG}'
    user: root
    environment:
      - POSTGRES_USER=waldur
      - POSTGRES_PASSWORD=${POSTGRESQL_PASSWORD}
      - POSTGRES_DB=waldur
      - POSTGRES_HOST_AUTH_METHOD=scram-sha-256
      - POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256
    volumes:
      - "./pgsql:/var/lib/postgresql/data"
      # Create celery_results database in waldur-db container
      # Runs only when data directory is empty
      - "./config/createdb-celery_results.sql:/docker-entrypoint-initdb.d/createdb-celery_results.sql"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U waldur"]
      interval: 30s
      timeout: 30s
      retries: 3
    restart: always

  # RabbitMQ
  waldur-queue:
    container_name: waldur-queue
    image: '${DOCKER_REGISTRY_PREFIX}library/rabbitmq:4.1.2'
    environment:
      - RABBITMQ_DEFAULT_USER=${RABBITMQ_USERNAME}
      - RABBITMQ_DEFAULT_PASS=${RABBITMQ_PASSWORD}
    volumes:
      - ${CONFIG_FOLDER}/rabbitmq-enabled-plugins:/etc/rabbitmq/enabled_plugins
      - ${CONFIG_FOLDER}/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf
    restart: always

  # Fixing permissions of mounted script launchzone
  waldur-launchzone-init-volume:
    image: '${DOCKER_REGISTRY_PREFIX}opennode/waldur-mastermind:${WALDUR_MASTERMIND_IMAGE_TAG}'
    user: root
    volumes:
      - waldur_script_launchzone:/var/lib/waldur/waldur-script-launchzone
    command: chown -R 1001:${DOCKER_GROUP_ID} /var/lib/waldur/waldur-script-launchzone
    restart: "no"

  # DB migration
  waldur-mastermind-db-migration:
    container_name: waldur-mastermind-db-migration
    image: '${DOCKER_REGISTRY_PREFIX}opennode/waldur-mastermind:${WALDUR_MASTERMIND_IMAGE_TAG}'
    user: 1001:${DOCKER_GROUP_ID}
    environment: *default-mastermind-env
    volumes: *default-mastermind-volumes
    depends_on:
      waldur-db:
        condition: service_healthy
      waldur-queue:
        condition: service_started
      waldur-launchzone-init-volume:
        condition: service_completed_successfully
    command: initdb

  # Whitelabeling initialization
  waldur-mastermind-whitelabeling-init:
    container_name: waldur-mastermind-whitelabeling-init
    image: '${DOCKER_REGISTRY_PREFIX}opennode/waldur-mastermind:${WALDUR_MASTERMIND_IMAGE_TAG}'
    user: 1001:${DOCKER_GROUP_ID}
    environment: *default-mastermind-env
    volumes: *default-mastermind-volumes
    depends_on:
      waldur-db:
        condition: service_healthy
      waldur-launchzone-init-volume:
        condition: service_completed_successfully
    command: init-whitelabeling

  # Celery
  waldur-mastermind-worker:
    container_name: waldur-mastermind-worker
    image: '${DOCKER_REGISTRY_PREFIX}opennode/waldur-mastermind:${WALDUR_MASTERMIND_IMAGE_TAG}'
    user: 1001:${DOCKER_GROUP_ID}
    environment: *default-mastermind-env
    volumes: *default-mastermind-volumes
    depends_on:
      waldur-db:
        condition: service_healthy
      waldur-queue:
        condition: service_started
      waldur-launchzone-init-volume:
        condition: service_completed_successfully
      # `required: false` keeps this no-op when the matrix profile is
      # inactive (tuwunel is undefined). When matrix is active, the
      # worker waits for tuwunel's container so docker DNS resolves
      # tuwunel.internal before any background Matrix tasks fire.
      tuwunel:
        condition: service_started
        required: false
    healthcheck:
      test: ["CMD-SHELL", "celery -A waldur_core.server inspect ping"]
      interval: 30s
      timeout: 30s
      retries: 3
    command: worker
    restart: always
    extra_hosts: *default-mastermind-hosts

  # Celery-beat
  waldur-mastermind-beat:
    container_name: waldur-mastermind-beat
    image: '${DOCKER_REGISTRY_PREFIX}opennode/waldur-mastermind:${WALDUR_MASTERMIND_IMAGE_TAG}'
    user: 1001:${DOCKER_GROUP_ID}
    environment: *default-mastermind-env
    volumes: *default-mastermind-volumes
    depends_on:
      waldur-db:
        condition: service_healthy
      waldur-mastermind-worker:
        condition: service_started
      waldur-launchzone-init-volume:
        condition: service_completed_successfully
      tuwunel:
        condition: service_started
        required: false
    command: beat
    restart: always
    extra_hosts: *default-mastermind-hosts

  # MasterMind API
  waldur-mastermind-api:
    container_name: waldur-mastermind-api
    image: '${DOCKER_REGISTRY_PREFIX}opennode/waldur-mastermind:${WALDUR_MASTERMIND_IMAGE_TAG}'
    user: 1001:${DOCKER_GROUP_ID}
    environment: *default-mastermind-env
    volumes: *default-mastermind-volumes
    depends_on:
      waldur-mastermind-worker:
        condition: service_started
      waldur-mastermind-beat:
        condition: service_started
      waldur-db:
        condition: service_healthy
      waldur-queue:
        condition: service_started
      waldur-launchzone-init-volume:
        condition: service_completed_successfully
      tuwunel:
        condition: service_started
        required: false
    command: mastermind
    restart: always
    extra_hosts: *default-mastermind-hosts

  # HomePort
  waldur-homeport:
    container_name: waldur-homeport
    image: '${DOCKER_REGISTRY_PREFIX}opennode/waldur-homeport:${WALDUR_HOMEPORT_IMAGE_TAG}'
    environment:
      - API_URL=https://${WALDUR_DOMAIN:-localhost}/
      - TITLE=${WALDUR_TITLE:-"Waldur | Cloud Service Management"}
    volumes:
      - ${CONFIG_FOLDER}/waldur-homeport/config.template.json:/usr/share/nginx/config.template.json
      - ${CONFIG_FOLDER}/waldur-homeport/opt/waldur-homeport:/opt/waldur-homeport
    depends_on:
      waldur-db:
        condition: service_healthy
      waldur-mastermind-api:
        condition: service_started
    healthcheck:
      test: ["CMD-SHELL", "curl --silent --fail http://waldur-homeport:8080/ || exit 1"]
      interval: 30s
      timeout: 30s
      retries: 3
    restart: always


  # HTTP Router
  caddy-router:
    container_name: caddy
    image: '${DOCKER_REGISTRY_PREFIX}library/caddy:2'
    ports:
      - '${WALDUR_HTTP_PORT:-80}:80'
      - '${WALDUR_HTTPS_PORT:-443}:443'
    environment:
      - VIRTUAL_HOST=${WALDUR_DOMAIN:-localhost}
      - TLS=${TLS:-"certs@waldur.com"}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./config/caddy-includes/:/etc/caddy-includes
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      waldur-homeport:
        condition: service_healthy
    restart: always

  keycloak:
    container_name: keycloak
    image: '${DOCKER_REGISTRY_PREFIX}keycloak/keycloak:26.6.1'
    profiles: [keycloak]
    restart: always
    environment:
      - KC_DB=postgres
      - KC_DB_URL_HOST=keycloak-db
      - KC_DB_URL_DATABASE=keycloak
      - KC_DB_USERNAME=keycloak
      - KC_DB_PASSWORD=${KEYCLOAK_POSTGRESQL_PASSWORD}
      - KC_PROXY_HEADERS=xforwarded
      - KC_HTTP_ENABLED=true
      - KC_HTTP_RELATIVE_PATH=/auth
      - KC_HOSTNAME=https://${WALDUR_DOMAIN}/auth
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN_PASSWORD}
    volumes:
      - ./config/keycloak/realm.json:/opt/keycloak/data/import/realm.json
      - ./libraries/waldur-keycloak-mapper-1.4.0.jar:/opt/keycloak/providers/waldur-keycloak-mapper-1.4.0.jar:ro
    depends_on:
      keycloak-db:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/8080 && echo -e 'GET /auth/health/ready HTTP/1.1\\r\\nHost: localhost\\r\\n\\r\\n' >&3 && cat <&3 | grep -q 200"]
      interval: 30s
      timeout: 10s
      retries: 5
    command: start --import-realm

  # PostgreSQL
  keycloak-db:
    container_name: keycloak-db
    profiles: [keycloak]
    image: '${DOCKER_REGISTRY_PREFIX}library/postgres:${KEYCLOAK_POSTGRES_IMAGE_TAG}'
    user: root
    environment:
      - POSTGRES_USER=keycloak
      - POSTGRES_PASSWORD=${KEYCLOAK_POSTGRESQL_PASSWORD}
      - POSTGRES_DB=keycloak
      - POSTGRES_HOST_AUTH_METHOD=scram-sha-256
      - POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256
    volumes:
      - keycloak_db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U keycloak"]
      interval: 30s
      timeout: 30s
      retries: 3
    restart: always

  # --- Matrix chat add-on ---
  # Activate with: docker compose --profile matrix up -d
  # Add --profile matrix-rtc to enable Element Call (LiveKit voice/video).
  # See README "Matrix chat add-on" section for one-time appservice
  # registration steps and operational notes.

  # Fix ownership of the matrix secrets volume so the init script can
  # write to it as the 1001 user. Mirrors waldur-launchzone-init-volume.
  waldur-matrix-init-volume:
    container_name: waldur-matrix-init-volume
    profiles: [matrix]
    image: '${DOCKER_REGISTRY_PREFIX}opennode/waldur-mastermind:${WALDUR_MASTERMIND_IMAGE_TAG}'
    user: root
    volumes:
      - waldur_matrix_secrets:/var/lib/waldur/matrix
    command: chown -R 1001:${DOCKER_GROUP_ID} /var/lib/waldur/matrix
    restart: "no"

  waldur-matrix-init:
    container_name: waldur-matrix-init
    profiles: [matrix]
    image: '${DOCKER_REGISTRY_PREFIX}opennode/waldur-mastermind:${WALDUR_MASTERMIND_IMAGE_TAG}'
    user: 1001:${DOCKER_GROUP_ID}
    # The default mastermind env anchor is a YAML sequence, which cannot
    # be merged with `<<:`. List the inherited vars explicitly and append
    # the matrix-specific knobs the init script reads.
    environment:
      - GLOBAL_SECRET_KEY=${GLOBAL_SECRET_KEY}
      - POSTGRESQL_HOST=waldur-db
      - POSTGRESQL_PASSWORD=${POSTGRESQL_PASSWORD}
      - RABBITMQ_HOST=waldur-queue
      - RABBITMQ_PASSWORD=${RABBITMQ_PASSWORD}
      - RABBITMQ_USERNAME=${RABBITMQ_USERNAME}
      - GLOBAL_DEFAULT_FROM_EMAIL=${GLOBAL_DEFAULT_FROM_EMAIL}
      - SENTRY_DSN=${SENTRY_DSN}
      - GLOBAL_DEBUG=${GLOBAL_DEBUG}
      - KEYCLOAK_SECRET=${KEYCLOAK_SECRET}
      - SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT}
      - WALDUR_DOMAIN=${WALDUR_DOMAIN:-localhost}
      - WALDUR_MATRIX_BOT_LOCALPART=${WALDUR_MATRIX_BOT_LOCALPART:-waldur-bot}
      - WALDUR_MATRIX_OPEN_REGISTRATION=${WALDUR_MATRIX_OPEN_REGISTRATION:-false}
      - WALDUR_MATRIX_RTC_ENABLED=${WALDUR_MATRIX_RTC_ENABLED:-false}
    # Same set as *default-mastermind-volumes (a YAML sequence anchor
    # cannot be merged with extra items), plus the matrix bind mount and
    # the shared secrets volume.
    volumes:
      - ${CONFIG_FOLDER}/waldur-mastermind/override.conf.py:/etc/waldur/override.conf.py
      - ${CONFIG_FOLDER}/waldur-mastermind/logging.conf.py:/etc/waldur/logging.conf.py
      - ${CONFIG_FOLDER}/waldur-mastermind/saml2.conf.py:/etc/waldur/saml2.conf.py
      - ${CONFIG_FOLDER}/waldur-mastermind/id_rsa:/etc/waldur/id_rsa
      - ${CONFIG_FOLDER}/waldur-mastermind/id_rsa.pub:/etc/waldur/id_rsa.pub
      - ${CONFIG_FOLDER}/waldur-mastermind/saml2/credentials:/etc/waldur/saml2/credentials
      - ${CONFIG_FOLDER}/waldur-mastermind/saml2/metadata:/etc/waldur/saml2/metadata
      - ${CONFIG_FOLDER}/waldur-mastermind/valimo:/etc/waldur/valimo
      - ${CONFIG_FOLDER}/waldur-mastermind/notification-templates.yaml:/etc/waldur/notification-templates.yaml
      - ${CONFIG_FOLDER}/waldur-mastermind/auth.yaml:/etc/waldur/auth.yaml
      - ${CONFIG_FOLDER}/waldur-mastermind/support.yaml:/etc/waldur/support.yaml
      - ${CONFIG_FOLDER}/waldur-mastermind/whitelabeling.yaml:/etc/waldur/whitelabeling.yaml
      - ${CONFIG_FOLDER}/waldur-mastermind/marketplace.yaml:/etc/waldur/marketplace.yaml
      - ${CONFIG_FOLDER}/waldur-mastermind/marketplace-script.yaml:/etc/waldur/marketplace-script.yaml
      - ${CONFIG_FOLDER}/whitelabeling:/etc/waldur/icons
      - waldur_script_launchzone:/var/lib/waldur/waldur-script-launchzone
      - ${CONFIG_FOLDER}/matrix:/etc/waldur/matrix:ro
      - waldur_matrix_secrets:/var/lib/waldur/matrix
    depends_on:
      waldur-db:
        condition: service_healthy
      waldur-mastermind-db-migration:
        condition: service_completed_successfully
      waldur-launchzone-init-volume:
        condition: service_completed_successfully
      waldur-matrix-init-volume:
        condition: service_completed_successfully
    command: ["/etc/waldur/matrix/init-matrix.sh"]
    restart: "no"

  tuwunel:
    container_name: tuwunel
    profiles: [matrix]
    image: 'ghcr.io/matrix-construct/tuwunel:${WALDUR_TUWUNEL_IMAGE_TAG:-v1.7.1}'
    restart: always
    environment:
      TUWUNEL_CONFIG: /etc/waldur/matrix/tuwunel.toml
    volumes:
      - tuwunel_data:/var/lib/tuwunel
      - waldur_matrix_secrets:/etc/waldur/matrix:ro
    # `tuwunel.internal` is the dotted alias that mastermind uses as the
    # MATRIX_HOMESERVER_URL host — single-word service names fail Django's
    # URLValidator. Both names resolve to the same container.
    networks:
      default:
        aliases:
          - tuwunel.internal
    depends_on:
      waldur-matrix-init:
        condition: service_completed_successfully
    # Disable IPv6 in this netns. lk-jwt-service (matrix-rtc profile) shares
    # this namespace via `network_mode: service:tuwunel`; its Go dialer
    # honours RFC 6724 and would otherwise try [::1] first.
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
    # Tuwunel ships as a distroless image — no shell, no curl/wget — so we
    # rely on `restart: always` and verify reachability through Caddy
    # (curl https://${WALDUR_DOMAIN}/_matrix/client/versions) instead of
    # an in-container healthcheck.

  livekit:
    container_name: livekit
    profiles: [matrix-rtc]
    image: 'livekit/livekit-server:${WALDUR_LIVEKIT_IMAGE_TAG:-v1.12.0}'
    restart: always
    ports:
      - '${WALDUR_MATRIX_RTC_TCP_PORT:-7881}:7881/tcp'
      - '${WALDUR_MATRIX_RTC_UDP_PORT:-7882}:7882/udp'
      # TURN/UDP relay. LiveKit advertises the relay to clients on udp_port, so
      # it must be 443. Only listened on when WALDUR_MATRIX_TURN_ENABLED=true;
      # otherwise packets are dropped (harmless). 443/udp is free on a single
      # host — Caddy only binds 443/tcp.
      - '${WALDUR_MATRIX_TURN_UDP_PORT:-443}:443/udp'
    environment:
      LIVEKIT_CONFIG: |
        port: 7880
        bind_addresses: [""]
        rtc:
          tcp_port: 7881
          udp_port: 7882
          use_external_ip: false
          node_ip: ${WALDUR_LIVEKIT_NODE_IP:-127.0.0.1}
        keys:
          ${WALDUR_LIVEKIT_KEY:-devkey}: ${WALDUR_LIVEKIT_SECRET:-devsecret}
        # Embedded TURN/UDP relay for clients behind symmetric NAT where direct
        # media to node_ip fails. UDP-only on 443: needs no cert (unlike TURN/TLS),
        # and LiveKit advertises the relay to clients on udp_port — which must be
        # 443, the firewall-friendly port that is free on the host (Caddy holds
        # 443/tcp, not 443/udp). Does not help clients that block all outbound
        # UDP; that needs TURN/TLS on a dedicated IP (the helm topology).
        turn:
          enabled: ${WALDUR_MATRIX_TURN_ENABLED:-false}
          domain: ${WALDUR_DOMAIN:-localhost}
          udp_port: 443

  lk-jwt-service:
    container_name: lk-jwt-service
    profiles: [matrix-rtc]
    image: 'ghcr.io/element-hq/lk-jwt-service:${WALDUR_LK_JWT_IMAGE_TAG:-0.5.0}'
    restart: always
    # Share tuwunel's netns so federation discovery resolves "localhost"
    # back to the homeserver (same trick as docker/matrix-dev/).
    network_mode: "service:tuwunel"
    depends_on:
      - tuwunel
      - livekit
    environment:
      # URL returned to browsers in the JWT response. Must be reachable
      # from the public internet — LiveKit's signaling port (7880) is
      # not exposed on the host, so we tunnel WSS through Caddy. Media
      # still flows on the RTC ports below.
      LIVEKIT_URL: wss://${WALDUR_DOMAIN:-localhost}/livekit
      LIVEKIT_KEY: ${WALDUR_LIVEKIT_KEY:-devkey}
      LIVEKIT_SECRET: ${WALDUR_LIVEKIT_SECRET:-devsecret}
      LIVEKIT_FULL_ACCESS_HOMESERVERS: ${WALDUR_DOMAIN:-localhost}
      # Accept Caddy's self-signed cert when TLS=internal. Set to "" or
      # remove for deployments terminating TLS with a trusted certificate.
      LIVEKIT_INSECURE_SKIP_VERIFY_TLS: YES_I_KNOW_WHAT_I_AM_DOING

  logger:
    image: '${DOCKER_REGISTRY_PREFIX}umputun/docker-logger:v1.3.0'
    container_name: "logger"
    hostname: "logger"
    restart: always
    logging:
      driver: json-file
      options:
          max-size: "10m"
          max-file: "5"
    environment:
        - LOG_FILES=true
        - LOG_SYSLOG=false
        - MAX_FILES=10
        - MAX_SIZE=50
        - MAX_AGE=365
        - MIX_ERR=true
        - DEBUG=false
        - INCLUDE=waldur-db,waldur-queue,waldur-mastermind-db-migration,waldur-mastermind-worker,waldur-mastermind-beat,waldur-mastermind-api,waldur-homeport,caddy
    volumes:
        - ${LOG_FOLDER}:/srv/logs
        - /var/run/docker.sock:/var/run/docker.sock

volumes:
  caddy_data:
  caddy_config:
  keycloak_db:
  waldur_script_launchzone:
  tuwunel_data:
  waldur_matrix_secrets:

networks:
  default:
    driver: bridge
    driver_opts:
      com.docker.network.driver.mtu: ${MTU:-1500}