Skip to content

Commit f4d6651

Browse files
b-longb-long
committed
move docker-compose content to external file
1 parent c072d69 commit f4d6651

File tree

2 files changed

+286
-282
lines changed

2 files changed

+286
-282
lines changed

‎docs/getting-started/docker-compose.yaml‎

Lines changed: 281 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,281 @@
1+
name: opentdf
2+
volumes:
3+
configs:
4+
keys:
5+
caddy_data:
6+
configs:
7+
caddy_config:
8+
content: |
9+
{
10+
log {
11+
level INFO
12+
output stdout
13+
}
14+
}
15+
https://keycloak.opentdf.local:9443 {
16+
tls internal
17+
reverse_proxy keycloak:8888
18+
}
19+
https://platform.opentdf.local:8443 {
20+
tls internal
21+
reverse_proxy {
22+
to h2c://platform:8080
23+
transport http {
24+
versions h2c 2 1.1 # Enable gRPC proxying
25+
}
26+
}
27+
28+
}
29+
services:
30+
caddy:
31+
image: caddy:alpine
32+
command: ['caddy','run', '--config', '/etc/caddy/Caddyfile']
33+
configs:
34+
- source: caddy_config
35+
target: /etc/caddy/Caddyfile
36+
ports:
37+
- '9443:9443'
38+
- '8443:8443'
39+
volumes:
40+
- caddy_data:/data
41+
restart: unless-stopped
42+
healthcheck:
43+
test: ["CMD-SHELL", "wget -q --server-response --tries=1 http://127.0.0.1:2019/metrics 2>&1 | awk '/^ HTTP/{print $2}' | grep -q '200'"]
44+
interval: 5s
45+
timeout: 5s
46+
retries: 3
47+
check-certs:
48+
image: bash:latest
49+
volumes:
50+
- type: volume
51+
source: caddy_data
52+
target: /etc/ssl/certs
53+
volume:
54+
subpath: caddy/certificates/local/keycloak.opentdf.local/
55+
command:
56+
- bash
57+
- -c
58+
- |
59+
echo "Checking certificates"
60+
ls -alh /etc/ssl/certs
61+
cat /etc/ssl/certs/keycloak.opentdf.local.crt
62+
depends_on:
63+
caddy:
64+
condition: service_healthy
65+
ensure-permissions:
66+
condition: service_completed_successfully
67+
ensure-permissions:
68+
image: alpine
69+
command:
70+
- 'sh'
71+
- '-c'
72+
- |
73+
chmod -R 777 /configs
74+
ls -alh /configs
75+
chmod -R 777 /keys
76+
ls -alh /keys
77+
chmod -R 777 /data
78+
ls -alh /data
79+
volumes:
80+
- configs:/configs
81+
- keys:/keys
82+
- caddy_data:/data
83+
84+
#================================================================
85+
86+
# Start Keycloak
87+
88+
#----------------------------------------------------------------
89+
keycloak:
90+
image: keycloak/keycloak:25.0
91+
restart: unless-stopped
92+
command: ['start-dev']
93+
environment:
94+
KC_DB: postgres
95+
KC_DB_URL_HOST: keycloak-db
96+
KC_DB_URL_PORT: 5432
97+
KC_DB_URL_DATABASE: keycloak
98+
KC_DB_USERNAME: postgres
99+
KC_DB_PASSWORD: changeme
100+
KC_HOSTNAME: 'https://keycloak.opentdf.local:9443'
101+
KC_HOSTNAME_ADMIN: 'https://keycloak.opentdf.local:9443'
102+
KC_HTTP_ENABLED: 'true'
103+
KC_HTTP_PORT: 8888
104+
KEYCLOAK_ADMIN: admin
105+
KEYCLOAK_ADMIN_PASSWORD: changeme
106+
KC_FEATURES: 'preview,token-exchange'
107+
KC_HEALTH_ENABLED: 'true'
108+
JAVA_OPTS_APPEND: '${JAVA_OPTS_APPEND:-}'
109+
healthcheck:
110+
test: ['CMD-SHELL', '[ -f /tmp/HealthCheck.java ] || echo "public class HealthCheck { public static void main(String[] args) throws java.lang.Throwable { System.exit(java.net.HttpURLConnection.HTTP_OK == ((java.net.HttpURLConnection)new java.net.URL(args[0]).openConnection()).getResponseCode() ? 0 : 1); } }" > /tmp/HealthCheck.java && java ${JAVA_OPTS_APPEND} /tmp/HealthCheck.java http://localhost:9000/health/ready']
111+
interval: 5s
112+
timeout: 10s
113+
retries: 3
114+
start_period: 5m
115+
depends_on:
116+
keycloak-db:
117+
condition: service_healthy
118+
restart: true
119+
keycloak-db:
120+
image: postgres:15-alpine
121+
restart: unless-stopped
122+
environment:
123+
POSTGRES_PASSWORD: changeme
124+
POSTGRES_USER: postgres
125+
POSTGRES_DB: keycloak
126+
healthcheck:
127+
test: ["CMD-SHELL", "pg_isready -U postgres"]
128+
interval: 5s
129+
timeout: 5s
130+
retries: 10
131+
start_period: 2m
132+
download-keycloak-config:
133+
image: curlimages/curl:latest
134+
volumes:
135+
- configs:/configs
136+
command: ['-o', '/configs/keycloak-config.yaml', 'https://raw.githubusercontent.com/opentdf/platform/main/service/cmd/keycloak_data.yaml']
137+
depends_on:
138+
ensure-permissions:
139+
condition: service_completed_successfully
140+
#================================================================
141+
142+
# Provisioning Keycloak with expected realm, clients, and users
143+
144+
#----------------------------------------------------------------
145+
keycloak-provisioning:
146+
image: registry.opentdf.io/platform:nightly
147+
volumes:
148+
- configs:/configs
149+
command:
150+
[
151+
'provision',
152+
'keycloak',
153+
'-e',
154+
'http://keycloak:8888',
155+
'-f',
156+
'/configs/keycloak-config.yaml',
157+
]
158+
depends_on:
159+
keycloak:
160+
condition: service_healthy
161+
restart: true
162+
download-keycloak-config:
163+
condition: service_completed_successfully
164+
restart: true
165+
#================================================================
166+
167+
# Start the OpenTDF service
168+
169+
#----------------------------------------------------------------
170+
download-platform-config:
171+
image: curlimages/curl:latest
172+
volumes:
173+
- configs:/configs
174+
command: ['-o', '/configs/.opentdf.yaml', 'https://raw.githubusercontent.com/opentdf/platform/main/opentdf-dev.yaml']
175+
depends_on:
176+
ensure-permissions:
177+
condition: service_completed_successfully
178+
modify-platform-config:
179+
image: bash:latest
180+
volumes:
181+
- configs:/configs
182+
command:
183+
- bash
184+
- -c
185+
- |
186+
echo "Modifying /configs/.opentdf.yaml"
187+
echo "$(</configs/.opentdf.yaml )"
188+
sed -i 's|kas-private.pem|/keys/kas-private.pem|g' /configs/.opentdf.yaml
189+
sed -i 's|kas-cert.pem|/keys/kas-cert.pem|g' /configs/.opentdf.yaml
190+
sed -i 's|kas-ec-private.pem|/keys/kas-ec-private.pem|g' /configs/.opentdf.yaml
191+
sed -i 's|kas-ec-cert.pem|/keys/kas-ec-cert.pem|g' /configs/.opentdf.yaml
192+
sed -i 's|# db:|db: |g' /configs/.opentdf.yaml
193+
sed -i 's|# host: localhost| host: |g' /configs/.opentdf.yaml
194+
sed -i 's|issuer: http://localhost:8888/auth/realms/opentdf|issuer: http://keycloak:8888/realms/opentdf|g' /configs/.opentdf.yaml
195+
sed -i 's|tokenendpoint: http://localhost:8888/auth/realms/opentdf/protocol/openid-connect/token|tokenendpoint: http://keycloak:8888/realms/opentdf/protocol/openid-connect/token|g' /configs/.opentdf.yaml
196+
sed -i 's|url: http://localhost:8888/auth|url: http://keycloak:8888|g' /configs/.opentdf.yaml
197+
echo "$(</configs/.opentdf.yaml )"
198+
depends_on:
199+
download-platform-config:
200+
condition: service_completed_successfully
201+
generate-kas-rsa-keys:
202+
image: alpine/openssl
203+
volumes:
204+
- keys:/keys
205+
entrypoint: ["/bin/sh", "-c"]
206+
command:
207+
- |
208+
echo "Generating RSA keys"
209+
openssl req -x509 -nodes -newkey RSA:2048 -subj "/CN=kas" -keyout /keys/kas-private.pem -out /keys/kas-cert.pem -days 365
210+
chmod 444 /keys/kas-private.pem
211+
chmod 444 /keys/kas-cert.pem
212+
depends_on:
213+
ensure-permissions:
214+
condition: service_completed_successfully
215+
generate-kas-ec-keys:
216+
image: alpine/openssl
217+
volumes:
218+
- keys:/keys
219+
entrypoint: ["/bin/sh", "-c"]
220+
command:
221+
- |
222+
echo "Generating EC keys"
223+
openssl ecparam -name secp256r1 -out /keys/secp256r1.pem && \
224+
openssl req -x509 -nodes -newkey ec:/keys/secp256r1.pem -subj "/CN=kas" -keyout /keys/kas-ec-private.pem -out /keys/kas-ec-cert.pem -days 365
225+
chmod 444 /keys/kas-ec-private.pem
226+
chmod 444 /keys/kas-ec-cert.pem
227+
depends_on:
228+
ensure-permissions:
229+
condition: service_completed_successfully
230+
platform:
231+
image: registry.opentdf.io/platform:nightly
232+
volumes:
233+
- configs:/configs
234+
- keys:/keys
235+
- type: volume
236+
source: caddy_data
237+
target: /etc/ssl/certs
238+
volume:
239+
subpath: caddy/certificates/local/keycloak.opentdf.local
240+
extra_hosts:
241+
- "keycloak.opentdf.local:host-gateway"
242+
command: ['start','--config-file','/configs/.opentdf.yaml','--config-key','opentdf']
243+
restart: always
244+
environment:
245+
OPENTDF_DB_HOST: platform-db
246+
OPENTDF_DB_USER: postgres
247+
OPENTDF_DB_PASSWORD: changeme
248+
depends_on:
249+
keycloak:
250+
condition: service_healthy
251+
restart: true
252+
keycloak-provisioning:
253+
condition: service_completed_successfully
254+
platform-db:
255+
condition: service_healthy
256+
restart: true
257+
download-platform-config:
258+
condition: service_completed_successfully
259+
generate-kas-rsa-keys:
260+
condition: service_completed_successfully
261+
generate-kas-ec-keys:
262+
condition: service_completed_successfully
263+
modify-platform-config:
264+
condition: service_completed_successfully
265+
caddy:
266+
condition: service_healthy
267+
check-certs:
268+
condition: service_completed_successfully
269+
platform-db:
270+
image: postgres:15-alpine
271+
restart: unless-stopped
272+
environment:
273+
POSTGRES_USER: postgres
274+
POSTGRES_PASSWORD: changeme
275+
POSTGRES_DB: opentdf
276+
healthcheck:
277+
test: ["CMD-SHELL", "pg_isready -U postgres"]
278+
interval: 5s
279+
timeout: 5s
280+
retries: 10
281+

0 commit comments

Comments
 (0)