docker-compose.yml

# This docker-compose file sets up ORY Kratos, ORY Hydra, and this app in a network and configures
# in such a way that ORY Kratos is the Login Provider for ORY Hydra.

x-kong-config: &kong-env
  KONG_DATABASE: postgres
  KONG_PG_DATABASE: kong
  KONG_PG_HOST: postgres-kong
  KONG_PG_USER: kong
  KONG_PG_PASSWORD: kong


services:

  kong-migrations:
    image: "kong:latest"
    command: kong migrations bootstrap
    depends_on:
      - postgres-kong
    environment:
      <<: *kong-env 
    networks:
      - intranet
    restart: on-failure


  kong:
    image: "kong:latest"
    environment:
      <<: *kong-env 
      KONG_ADMIN_ACCESS_LOG: /dev/stdout
      KONG_ADMIN_ERROR_LOG: /dev/stderr
      KONG_PROXY_LISTEN: "${KONG_PROXY_LISTEN:-0.0.0.0:8000}"
      KONG_ADMIN_LISTEN: "${KONG_ADMIN_LISTEN:-0.0.0.0:8001}"
      KONG_PROXY_ACCESS_LOG: /dev/stdout
      KONG_PROXY_ERROR_LOG: /dev/stderr
      KONG_PREFIX: ${KONG_PREFIX:-/var/run/kong}
      KONG_DECLARATIVE_CONFIG: "/opt/kong/kong.yaml"
    networks:
      - intranet
    ports:
      - "${KONG_INBOUND_PROXY_LISTEN:-0.0.0.0}:8000:8000/tcp"
      - "${KONG_INBOUND_SSL_PROXY_LISTEN:-0.0.0.0}:8443:8443/tcp"
      - "127.0.0.1:8001:8001/tcp"
      - "127.0.0.1:8444:8444/tcp"
    healthcheck:
      test: ["CMD", "kong", "health"]
      interval: 10s
      timeout: 10s
      retries: 10
    restart: on-failure:5
    read_only: true
    volumes:
      - kong_prefix_vol:${KONG_PREFIX:-/var/run/kong}
      - kong_tmp_vol:/tmp
      - ./kong:/opt/kong
    security_opt:
      - no-new-privileges


  postgres-kong:
    image: postgres:latest
    environment:
      POSTGRES_DB: kong
      POSTGRES_USER: kong
      POSTGRES_PASSWORD: kong
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "kong"]
      interval: 30s
      timeout: 30s
      retries: 3
    restart: on-failure
    networks:
      - intranet


  postgres-hydra:
    image: postgres:latest
    ports:
      - "5433:5432"
    environment:
      - POSTGRES_USER=hydra
      - POSTGRES_PASSWORD=secret
      - POSTGRES_DB=hydra
    networks:
      - intranet


  hydra-migrate:
    image: oryd/hydra:latest
    links:
      - postgres-hydra:postgres-hydra
    environment:
      - DSN=postgres://hydra:secret@postgres-hydra:5432/hydra?sslmode=disable&max_conns=20&max_idle_conns=4
 
    command:
      migrate sql -e --yes
    restart: on-failure
    networks:
      - intranet

  hydra:
    image: oryd/hydra:latest
    depends_on:
      - hydra-migrate
    links:
      - postgres-hydra:postgres-hydra

    ports:
      - "4444:4444" # Public port
      - "4445:4445" # Admin port
      - "5555:5555" # Port for hydra token user
    command:
      # serve all --dangerous-force-http
      serve all -c /etc/config/hydra/hydra.yml --dev
    restart: on-failure # TODO figure out why we need this (incorporate health check into hydra migrate command?)
    environment:
      - LOG_LEAK_SENSITIVE_VALUES=true
      - URLS_SELF_ISSUER=http://127.0.0.1:4444
      - URLS_SELF_PUBLIC=http://127.0.0.1:4444
      - URLS_CONSENT=http://127.0.0.1:3000/auth/hydra/consent
      - URLS_LOGIN=http://127.0.0.1:3000/auth/hydra/login
      - URLS_LOGOUT=http://127.0.0.1:3000/logout
      - SECRETS_SYSTEM=youReallyNeedToChangeThis
      - OIDC_SUBJECT_IDENTIFIERS_SUPPORTED_TYPES=public,pairwise
      - OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT=youReallyNeedToChangeThis
      - DSN=postgres://hydra:secret@postgres-hydra:5432/hydra?sslmode=disable&max_conns=20&max_idle_conns=4
    networks:
      - intranet
    volumes:
      -
        type: bind
        source: ./hydra
        target: /etc/config/hydra

  kratos-selfservice-ui-node:
    image: oryd/kratos-selfservice-ui-node:latest
    environment:
      - HYDRA_ADMIN_URL=http://hydra:4445
      - KRATOS_PUBLIC_URL=http://kratos:4433/
      - KRATOS_ADMIN_URL=http://kratos:4434/
      - SECURITY_MODE=standalone
      #- KRATOS_BROWSER_URL=http://127.0.0.1:4433/
      # - http://127.0.0.1:4455/
      - COOKIE_SECRET=THISISASUPERSECRET1
      - CSRF_COOKIE_NAME=_HOST-localhost-x-csrf-token
      - CSRF_COOKIE_SECRET=THISISTHE1SECRET
      # - PORT=4455
      - PORT=4435
      - KRATOS_BROWSER_URL=http://127.0.0.1:4455/.ory/kratos/public
      - JWKS_URL=http://oathkeeper:4456/.well-known/jwks.json
      - SECURITY_MODE=jwks
    ports:
      - "4435:4435"
    networks:
      - intranet
    volumes:
      - /tmp/ui-node/logs:/root/.npm/_logs






  postgres-kratos:
    image: postgres:latest
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_USER=kratos
      - POSTGRES_PASSWORD=secret
      - POSTGRES_DB=kratos
    networks:
      - intranet


  kratos-migrate:
    image: oryd/kratos:latest
    links:
      - postgres-kratos:postgres-kratos
    environment:
      - DSN=postgres://kratos:secret@postgres-kratos:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
    volumes:
      -
        type: bind
        source: ./kratos
        target: /etc/config/kratos
    command:
      -c /etc/config/kratos/kratos.yml migrate sql -e --yes
    restart: on-failure
    networks:
      - intranet

  kratos:
    depends_on:
      - kratos-migrate
    image: oryd/kratos:latest
    ports:
      - "4433:4433" # public
      - "4434:4434" # admin
    restart: unless-stopped
    links:
      - postgres-kratos:postgres-kratos
    environment:
      - DSN=postgres://kratos:secret@postgres-kratos:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
      #- SERVE_PUBLIC_BASE_URL=http://127.0.0.1:4455/.ory/kratos/public/
    command:
      serve -c /etc/config/kratos/kratos.yml --dev
    volumes:
      -
        type: bind
        source: ./kratos
        target: /etc/config/kratos
    networks:
      - intranet

  keto:
    image: oryd/keto:latest
    ports:
      - "4466:4466"
      - "4467:4467"
    command: serve -c /home/ory/keto.yml
    restart: on-failure
    volumes:
      - type: bind
        source: ./keto
        target: /home/ory

  oathkeeper:
    image: oryd/oathkeeper:latest
    depends_on:
      - kratos
    ports:
      - 4455:4455
      - 4456:4456
    command:
      serve proxy -c "/etc/config/oathkeeper/oathkeeper.yml"
    environment:
      - LOG_LEVEL=debug
    restart: on-failure
    networks:
      - intranet
    volumes:
      - ./oathkeeper/:/etc/config/oathkeeper

  mailslurper:
    image: oryd/mailslurper:latest-smtps
    ports:
      - "4436:4436"
      - "4437:4437"
    networks:
      - intranet

networks:
  intranet:

volumes:
  kong_data: {}
  kong_prefix_vol:
    driver_opts:
      type: tmpfs
      device: tmpfs
  kong_tmp_vol:
    driver_opts:
      type: tmpfs
      device: tmpfs