docker-compose.yml

version: "3.0"

services:

  # service container
  verification_code:
    build:
      context: ./verification_code
    image: catalyst_verification_code
    env_file: docker-compose.env
    container_name: verification_code
    networks:
      - catalyst-backend
    volumes:
      - verification_code_vol:/app/node_modules
      - ./verification_code:/app/:delegated #delegates speeds up mac os volumes
    command:
      - ./wait-for-it.sh
      - postgresd:5432
      - --
      - make
      - start-service
    environment:
      SERVICES: verification_code
      DB_NAME: verification_code
      NODE_INSPECT_PORT: 9033
      TRACING_ENABLED: 'true'
      POSTGRES_HOST: ${POSTGRES_HOST}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PORT: ${POSTGRES_PORT}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
      REDIS_HOST: ${REDIS_HOST}
      REDIS_PORT: ${REDIS_PORT}
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      KETO_ADMIN_URL: ${KETO_ADMIN_URL}
      ROOT_ORG_IDENTIFIER: ${ROOT_ORG_IDENTIFIER}
      KETO_RESOURCE_PREFIX: ${KETO_RESOURCE_PREFIX}
      KETO_ACTION_PREFIX: ${KETO_ACTION_PREFIX}
      KETO_SUBJECT_PREFIX: ${KETO_SUBJECT_PREFIX}
    ports:
      - "9033:9033"
    links:
      - nats
      - redis
      - jaeger
    depends_on:
      - nats
      - redis
      - postgresd

  # service container
  email:
    build:
      context: ./email
    image: catalyst_email
    env_file: docker-compose.env
    container_name: email
    networks:
      - catalyst-backend
    volumes:
      - email_vol:/app/node_modules
      - ./email:/app/:delegated #delegates speeds up mac os volumes
    command:
      - ./wait-for-it.sh
      - postgresd:5432
      - --
      - make
      - start-service
    environment:
      SERVICES: email
      EMAIL_DOMAIN: ${EMAIL_DOMAIN}
      EMAIL_API_KEY: ${EMAIL_API_KEY}
      EMAIL_PROVIDER: ${EMAIL_PROVIDER}
      NODE_INSPECT_PORT: 9031
      TRACING_ENABLED: 'true'
    ports:
      - "9031:9031"
    links:
      - nats
      - redis
      - jaeger
    depends_on:
      - nats
      - redis
      - postgresd

  # # service container
  # client:
  #   build:
  #     context: ./client
  #   container_name: client
  #   image: catalyst_client
  #   env_file: docker-compose.env
  #   networks:
  #     - catalyst-backend
  #     - catalyst-frontend
  #   volumes:
  #     - ./client:/app:delegated #delegates speeds up mac os volumes
  #     - client_vol:/app/node_modules
  #   command:
  #     - ./wait-for-it.sh
  #     - postgresd:5432
  #     - --
  #     - make
  #     - start-service
  #   environment:
  #     - ADMIN_OAUTH2_CLIENT_ID=${ADMIN_OAUTH2_CLIENT_ID}
  #     - ADMIN_OAUTH2_CLIENT_SECRET=${ADMIN_OAUTH2_CLIENT_SECRET}
  #     - HOST_NAME=${HOST_NAME}
  #     - SUB_PATH=admin
  #   ports:
  #     - 9089:80
  #     - 19000:19000
  #     - 19001:19001
  #     - 19002:19002
  #   links:
  #     - nats
  #     - redis
  #     - hydra
  #     - jaeger
  #   depends_on:
  #     - nats
  #     - redis
  #     - postgresd
  #     - traefik
  #     - api
  #   labels:
  #     - "traefik.enable=true"
  #     - "traefik.backend=client"
  #     - "traefik.port=8080"
  #     - "traefik.frontend.rule=Host:${HOST_NAME};PathPrefix:/"

  # service container
  admin:
    build:
      context: ./admin
    container_name: admin
    image: catalyst_admin
    env_file: docker-compose.env
    networks:
      - catalyst-backend
      - catalyst-frontend
    volumes:
      - ./admin:/app:delegated #delegates speeds up mac os volumes
      - admin_vol:/app/node_modules
    command:
      - ./wait-for-it.sh
      - postgresd:5432
      - --
      - make
      - start-service
    environment:
      - ADMIN_OAUTH2_CLIENT_ID=${ADMIN_OAUTH2_CLIENT_ID}
      - ADMIN_OAUTH2_CLIENT_SECRET=${ADMIN_OAUTH2_CLIENT_SECRET}
      - HOST_NAME=${HOST_NAME}
      - SUB_PATH=admin
    links:
      - nats
      - redis
      - hydra
      - jaeger
    depends_on:
      - nats
      - redis
      - postgresd
      - traefik
      - api
    labels:
      - "traefik.enable=true"
      - "traefik.backend=admin"
      - "traefik.port=3000"
      - "traefik.frontend.rule=Host:${HOST_NAME};PathPrefix:/admin"

  # service container
  api:
    build:
      context: ./api
    image: catalyst_api
    container_name: api
    env_file: docker-compose.env
    networks:
      - catalyst-backend
      - catalyst-frontend
    volumes:
      - ./api:/app:delegated #delegates speeds up mac os volumes
      - api_vol:/app/node_modules
    command:
      - ./wait-for-it.sh
      - postgresd:5432
      - --
      - make
      - start-service
    environment:
      SERVICES: api
      PORT: 3000
      LOGLEVEL: trace
      HOST_NAME: ${HOST_NAME}
      HYDRA_ADMIN_URL: http://hydra:4445
      KETO_ADMIN_URL: http://keto:4466
      NODE_INSPECT_PORT: 9030
      REDIS_HOST: ${REDIS_HOST}
      REDIS_PORT: ${REDIS_PORT}
      REDIS_PASSWORD: ${REDIS_PASSWORD}
    ports:
      - "9030:9030"
    links:
      - nats
      - redis
      - hydra
      - keto
    depends_on:
      - nats
      - redis
      - postgresd
      - traefik
      - hydra
      - keto
      - jaeger
    labels:
      - "traefik.enable=true"
      - "traefik.backend=api"
      - "traefik.port=3000"
      - "traefik.frontend.rule=Host:${HOST_NAME}"

  # service container
  user:
    build:
      context: ./user
    container_name: user
    image: catalyst_user
    env_file: docker-compose.env
    networks:
      - catalyst-backend
    volumes:
      - user_vol:/app/node_modules
      - ./user:/app/:delegated #delegates speeds up mac os volumes
    command:
      - ./wait-for-it.sh
      - postgresd:5432
      - --
      - make
      - start-service
    environment:
      SERVICES: user
      DB_NAME: user
      NODE_INSPECT_PORT: 9032
      TRACING_ENABLED: "true"
      POSTGRES_HOST: ${POSTGRES_HOST}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PORT: ${POSTGRES_PORT}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
      REDIS_HOST: ${REDIS_HOST}
      REDIS_PORT: ${REDIS_PORT}
      REDIS_PASSWORD: ${REDIS_PASSWORD}
      KETO_ADMIN_URL: ${KETO_ADMIN_URL}
      ROOT_ORG_IDENTIFIER: ${ROOT_ORG_IDENTIFIER}
      KETO_RESOURCE_PREFIX: ${KETO_RESOURCE_PREFIX}
      KETO_ACTION_PREFIX: ${KETO_ACTION_PREFIX}
      KETO_SUBJECT_PREFIX: ${KETO_SUBJECT_PREFIX}
    ports:
      - "9032:9032"
    links:
      - nats
      - redis
    depends_on:
      - nats
      - redis
      - postgresd
      - traefik
      - jaeger

  # microeservices messaging hub
  nats:
    image: nats
    container_name: nats
    ports:
      - "4222:4222"
    networks:
      - catalyst-backend

  # services cache container. Services containers
  # will use this for faster response rates
  redis:
    image: redis:alpine
    container_name: redis
    ports:
      - "6379:6379"
    environment:
      - REDIS_REPLICATION_MODE=master
      - REDIS_PORT_NUMBER=${REDIS_PORT}
      - REDIS_PASSWORD=${REDIS_PASSWORD}
    networks:
      - catalyst-backend
    volumes:
      - redis-data:/data


  # database
  postgresd:
    image: postgres:10
    container_name: postgresd
    env_file: .env
    restart: always
    networks:
      - catalyst-backend
    volumes:
      - ./postgres/init.sql:/docker-entrypoint-initdb.d/init.sql
      - ./postgres/data:/var/lib/postgresql/data
    ports:
      - "5432:5432"

  # migration container to setup postgres,
  # this usually will only migrate once
  # unless you delete ./postgres/data
  hydra-migrate:
    image: oryd/hydra:${HYDRA_VERSION}
    networks:
      - catalyst-backend
    environment:
      - DSN=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgresd:5432/${HYDRA_POSTGRES_DB}?sslmode=disable&max_conns=20&max_idle_conns=4
    command: migrate sql -e --yes
    depends_on:
      - postgresd
    restart: on-failure

  # the main hydra container providing
  # http(s)://hydra:4444(4445)
  hydra:
    image: oryd/hydra:${HYDRA_VERSION}
    container_name: hydra
    build:
      context: ./hydra
    links:
      - postgresd:postgresd
    depends_on:
      - postgresd
      - hydra-migrate
      - jaeger
      - traefik
    networks:
      - catalyst-backend
      - catalyst-frontend
    ports:
      # public port
      - "4444:4444"
      # admin port
      - "4445:4445"
      # port for hydra token user
      - "5555:5555"
      # forge token port
      - "9010:9010"
    command: serve all --dangerous-force-http
    env_file: docker-compose.env
    environment:
      - DSN=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgresd:5432/${HYDRA_POSTGRES_DB}?sslmode=disable&max_conns=20&max_idle_conns=4
      - LOG_LEVEL=debug
      - URLS_SELF_ISSUER=https://trust.${HOST_NAME}
      - OAUTH2_CONSENT_URL=https://${HOST_NAME}/consent
      - OAUTH2_LOGIN_URL=https://${HOST_NAME}/login
      - SECRETS_SYSTEM=youReallyNeedToChangeThis
      - OAUTH2_EXPOSE_INTERNAL_ERRORS=1
      - OIDC_SUBJECT_IDENTIFIERS_SUPPORTED_TYPES=public,pairwise
      - OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT=youReallyNeedToChangeThis
      - TRACING_PROVIDER=jaeger
      - TRACING_PROVIDER_JAEGER_SAMPLING_SERVER_URL=http://jaeger:5778/sampling
      - TRACING_PROVIDER_JAEGER_LOCAL_AGENT_HOST_PORT=jaeger:6831
      - TRACING_OMIT_SQL_ARGUMENTS_FROM_SPANS=false
    restart: on-failure
    labels:
      - "traefik.enable=true"
      - "traefik.hydra.backend=oauth"
      - "traefik.hydra.port=4444" # callback
      - "traefik.hydra.frontend.rule=Host:trust.${HOST_NAME}"

  keto-migrate:
    image: oryd/keto:${KETO_VERSION}
    networks:
      - catalyst-backend
    links:
      - postgresd:postgresd
    environment:
      - LOG_LEVEL=debug
    command: migrate sql postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgresd:5432/${KETO_POSTGRES_DB}?sslmode=disable&max_conns=20&max_idle_conns=4
    restart: on-failure

  keto:
    image: oryd/keto:${KETO_VERSION}
    container_name: keto
    networks:
      - catalyst-backend
    ports:
      - "4466:4466"
    command: serve
    links:
      - postgresd:postgresd
    depends_on:
      - keto-migrate
    environment:
      - LOG_LEVEL=debug
      - PORT=4466
      - DSN=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgresd:5432/${KETO_POSTGRES_DB}?sslmode=disable
    restart: on-failure

  configurator:
    build:
      context: ./configurator
      dockerfile: Dockerfile
      args:
        - HYDRA_VERSION=$HYDRA_VERSION
        - KETO_VERSION=$KETO_VERSION
        - OATHKEEPER_VERSION=$OATHKEEPER_VERSION
    depends_on:
      - hydra
      - keto
      # - oathkeeper-api Omit until oauthkeeper is needed
    networks:
      - catalyst-backend
    environment:
      - HOST_NAME=${HOST_NAME}

      # All of these URLs MUST NOT end with a trailing slash. This is very important!
      - HYDRA_URL=http://hydra:4444
      - HYDRA_ADMIN_URL=http://hydra:4445
      - KETO_URL=http://keto:4466
      # - RESOURCE_SERVER_URL=http://resource-server:4478 Omit until oauthkeeper is needed

      # This sets the prefix for all resource, action, and subject names. Be aware that this prefix is automatically
      # applied to all OAuth2 Clients as well.
      - "HYDRA_SUBJECT_PREFIX=subjects:hydra:"
      - "HYDRA_RESOURCE_PREFIX=resources:hydra:"
      - "HYDRA_ACTION_PREFIX=actions:hydra:"

      - "OATHKEEPER_RESOURCE_PREFIX=resources:oathkeeper:"
      - "OATHKEEPER_ACTION_PREFIX=actions:oathkeeper:"

      - "KETO_RESOURCE_PREFIX=resources:${ROOT_ORG_IDENTIFIER}:"
      - "KETO_ACTION_PREFIX=actions:${ROOT_ORG_IDENTIFIER}:"
      - "KETO_SUBJECT_PREFIX=subjects:${ROOT_ORG_IDENTIFIER}:"

      - ADMIN_OAUTH2_CLIENT_ID=${ADMIN_OAUTH2_CLIENT_ID}
      - ADMIN_OAUTH2_CLIENT_SECRET=${ADMIN_OAUTH2_CLIENT_SECRET}

      - PLATFORM_OAUTH2_CLIENT_ID=${PLATFORM_OAUTH2_CLIENT_ID}
      - PLATFORM_OAUTH2_CLIENT_SECRET=${PLATFORM_OAUTH2_CLIENT_SECRET}

      - OATHKEEPER_HYDRA_JWK_SET_ID=jwk:oathkeeper
      - OATHKEEPER_HYDRA_CLIENT_ID=clients:oathkeeper-client
      - OATHKEEPER_HYDRA_CLIENT_SECRET=dummy-oathkeeper-secret
    restart: on-failure

  # tracing container for all tracing reporting
  # includes hydra and microservices
  jaeger:
    networks:
      - catalyst-frontend
      - catalyst-backend
    image: jaegertracing/all-in-one:latest
    container_name: jaeger
    ports:
      - "5775:5775/udp"
      - "6831:6831/udp"
      - "6832:6832/udp"
      - "5778:5778"
      - "16686:16686"
      - "14268:14268"
      - "9411:9411"
    depends_on:
      - traefik
    environment:
      - QUERY_BASE_PATH=/jaeger
    labels:
      - "traefik.enable=true"
      - "traefik.jaeger.frontend=jaeger"
      - "traefik.jaeger.port=16686"
      - 'traefik.jaeger.frontend.rule=Host:${HOST_NAME};PathPrefix:/jaeger/'
  
  prometheus:
    image: prom/prometheus:v2.1.0
    container_name: prometheus
    volumes:
      - ./prometheus/:/etc/prometheus/
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
      - '--web.console.templates=/usr/share/prometheus/consoles'
    ports:
      - 9090:9090
    links:
      - cadvisor:cadvisor
      - alertmanager:alertmanager
      - user
      - verification_code
      - api
      - email
    depends_on:
      - cadvisor
    networks:
      - catalyst-backend
    restart: always

  node-exporter:
    image: prom/node-exporter
    container_name: node-exporter
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command: 
      - '--path.procfs=/host/proc' 
      - '--path.sysfs=/host/sys'
      - --collector.filesystem.ignored-mount-points
      - "^/(sys|proc|dev|host|etc|rootfs/var/lib/docker/containers|rootfs/var/lib/docker/overlay2|rootfs/run/docker/netns|rootfs/var/lib/docker/aufs)($$|/)"
    ports:
      - 9100:9100
    networks:
      - catalyst-backend
    restart: always

  alertmanager:
    image: prom/alertmanager
    container_name: alertmanager
    ports:
      - 9093:9093
    volumes:
      - ./alertmanager/:/etc/alertmanager/
    networks:
      - catalyst-backend
    restart: always
    command:
      - '--config.file=/etc/alertmanager/config.yml'
      - '--storage.path=/alertmanager'

  cadvisor:
    image: google/cadvisor
    container_name: cadvisor
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:rw
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
    ports:
      - 8085:8080
    networks:
      - catalyst-backend
    restart: always

  grafana:
    image: grafana/grafana
    container_name: grafana
    user: "104"
    depends_on:
      - prometheus
      - traefik
    ports:
      - 3005:3000
    volumes:
      - grafana_data:/var/lib/grafana
      - ./grafana/provisioning/:/etc/grafana/provisioning/
    env_file:
      - ./grafana.env
    links:
      - prometheus:prometheus
    networks:
      - catalyst-backend
      - catalyst-frontend
    restart: always
    environment:
      - GF_SERVER_ROOT_URL=%(protocol)s://%(domain)s/grafana
    labels:
      - "traefik.enable=true"
      - "traefik.frontend.rule=Path:/grafana/"
      - "traefik.port=3000"
      - "traefik.frontend.rule=Host:${HOST_NAME};PathPrefixStrip:/grafana"
      - 'traefik.frontend.redirect.entryPoint=https'

  # router for microservices
  traefik:
    image: traefik:alpine
    container_name: traefik
    command:
      - --configFile=/traefik.toml
      - --web
      - --logLevel=INFO
    ports:
      - "80:80"
      - "8080:8080"
      - "443:443"
    networks:
      - catalyst-backend
      - catalyst-frontend
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik/traefik.toml:/traefik.toml
      - ./traefik/acme.json:/acme.json

volumes:
  verification_code_vol:
    driver: local
  client_vol:
    driver: local
  email_vol:
    driver: local
  admin_vol:
    driver: local
  redis-data:
    driver: local
  api_vol:
    driver: local
  user_vol:
    driver: local
  prometheus_data:
    driver: local
  grafana_data:
    driver: local

networks:
  catalyst-backend:
    driver: bridge
  catalyst-frontend:
    driver: bridge