dev-ops/compose/docker-compose.yml

#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

version: "3.8"
services:
  db:
    container_name: custos_db
    image: mariadb:11.2
    restart: always
    command: --character-set-server=utf8 --collation-server=utf8_general_ci
    ports:
      - "3306:3306"
    environment:
      MARIADB_ROOT_PASSWORD: root
      MARIADB_USER: admin
      MARIADB_PASSWORD: admin
      MAX_ALLOWED_PACKET: 1073741824
    volumes:
      - ./dbinit:/docker-entrypoint-initdb.d
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 30s

  keycloak:
    container_name: custos_keycloak
    image: quay.io/keycloak/keycloak:26.0
    restart: unless-stopped
    command: ["start-dev", "--import-realm"]
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_DB: mariadb
      KC_DB_URL: jdbc:mariadb://db:3306/keycloak
      KC_DB_USERNAME: admin
      KC_DB_PASSWORD: admin
      KC_HOSTNAME_URL: http://localhost:8081
      KC_HOSTNAME_STRICT: "false"
      KC_HTTP_ENABLED: "true"
      KC_HEALTH_ENABLED: "true"
    ports:
      - "8081:8080"
      - "9001:9000"
    volumes:
      - ./keycloak/import:/opt/keycloak/data/import:ro
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/9000 && printf 'GET /health/ready HTTP/1.0\\r\\n\\r\\n' >&3 && grep -q '\"status\": \"UP\"' <&3"]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 60s

  adminer:
    image: adminer
    restart: always
    ports:
      - 18080:8080

  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    restart: unless-stopped
    ports:
      - "19090:9090"
    volumes:
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
    extra_hosts:
      - "host.docker.internal:host-gateway"

  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: unless-stopped
    ports:
      - "13000:3000"
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: admin
      GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH: /var/lib/grafana/dashboards/amie-service.json
    volumes:
      - ./grafana/provisioning:/etc/grafana/provisioning
      - ./grafana/dashboards:/var/lib/grafana/dashboards

  vault:
    image: vault:1.11.0
    container_name: vault
    restart: unless-stopped
    ports:
      - "8201:8201"
      - "8200:8200"
    environment:
      VAULT_ADDR: http://0.0.0.0:8201
      VAULT_API_ADDR: http://127.0.0.1:8200
      VAULT_CLUSTER_ADDR: http://127.0.0.1:8201
      VAULT_LOCAL_CONFIG: '{"listener": [{"tcp":{"address": "0.0.0.0:8201","tls_disable":"1"}}], "default_lease_ttl": "168h", "max_lease_ttl": "720h", "ui": true}'
    cap_add:
      - IPC_LOCK
    volumes:
      - ./vault/data:/vault/data
      - ./vault/config:/vault/config
    entrypoint: vault server
    command: -config=/vault/config/vault-config.hcl
    healthcheck:
      test: "vault login 00000000-0000-0000-0000-000000000000 &&
                   vault kv get secret &&
                   vault secrets disable secret &&
                   vault secrets enable -version=1 -path=secret kv &&
                   vault secrets enable -version=1 -path=resourcesecret kv"
      interval: 5s