kca/docker-compose.yml

services:
  postgres:
    image: postgres:18-alpine
    environment:
      POSTGRES_DB: kca
      POSTGRES_USER: kca
      POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-password}
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U kca"]
      interval: 5s
      timeout: 3s
      retries: 10

  # Mock OIDC provider (navikt/mock-oauth2-server). Interactive login accepts
  # any username; alice, bob, carol and dave carry profile claims.
  # The issuer is http://mockoauth:8180/kca, so both the browser and the app
  # need the /etc/hosts entry documented in README.md.
  mockoauth:
    build: ./server/dev/mockoauth
    environment:
      SERVER_PORT: "8180"
      LOG_LEVEL: INFO
    ports:
      - "8180:8180"

  mockoauth-init:
    image: curlimages/curl
    depends_on:
      - mockoauth
    entrypoint: >
      /bin/sh -c "
      until curl -sf http://mockoauth:8180/kca/.well-known/openid-configuration > /dev/null; do
        echo 'waiting for mockoauth...'; sleep 2;
      done
      "

  redis:
    image: redis:8-alpine
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10

  db-migrate:
    build:
      context: .
      dockerfile: server/Dockerfile
    working_dir: /app
    command: ["aerich", "upgrade"]
    environment:
      DATABASE_ENGINE: postgres
      DATABASE_HOST: postgres
      DATABASE_PORT: "5432"
      DATABASE_NAME: kca
      DATABASE_USER: kca
      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
    depends_on:
      postgres:
        condition: service_healthy

  kca:
    build:
      context: .
      dockerfile: server/Dockerfile
    depends_on:
      postgres:
        condition: service_healthy
      db-migrate:
        condition: service_completed_successfully
      mockoauth-init:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    environment:
      DATABASE_ENGINE: postgres
      DATABASE_HOST: postgres
      DATABASE_PORT: "5432"
      DATABASE_NAME: kca
      DATABASE_USER: kca
      DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
      OIDC_0_PROVIDER: ${OIDC_0_PROVIDER:-default}
      OIDC_0_ISSUER: ${OIDC_0_ISSUER:-http://mockoauth:8180/kca}
      OIDC_0_CLIENT_ID: ${OIDC_0_CLIENT_ID:-kca}
      OIDC_0_CLIENT_SECRET: ${OIDC_0_CLIENT_SECRET:-dev-secret}
      OIDC_0_REDIRECT_URI: ${OIDC_0_REDIRECT_URI:-http://localhost:8080/auth/default/callback}
      OIDC_0_POST_LOGIN_REDIRECT: ${OIDC_0_POST_LOGIN_REDIRECT:-http://localhost:8080/}
      OIDC_0_POST_LOGOUT_REDIRECT: ${OIDC_0_POST_LOGOUT_REDIRECT:-http://localhost:8080/}
      REDIS_URL: redis://redis:6379/0
      # Development master key. Override for any real deployment:
      #   openssl rand -base64 32
      KCA_MASTER_KEY: ${KCA_MASTER_KEY:-MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=}
      MAX_UPLOAD_BYTES: ${MAX_UPLOAD_BYTES:-20971520}
      # Optional OpenTelemetry export (OTLP/HTTP). Set OTEL_ENABLED=1 and
      # point OTEL_EXPORTER_OTLP_ENDPOINT at a collector, e.g.
      # http://otel-collector:4318
      OTEL_ENABLED: ${OTEL_ENABLED:-false}
      OTEL_SERVICE_NAME: ${OTEL_SERVICE_NAME:-kca}
      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
      OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
      OTEL_EXCLUDED_PATHS: ${OTEL_EXCLUDED_PATHS:-/api/health}
      # OCSP status publisher (optional). The bucket must be writable by
      # KCA; the responder later reads the same prefix with read-only access.
      KCA_OCSP_S3_BUCKET: ${KCA_OCSP_S3_BUCKET:-}
      KCA_OCSP_S3_PREFIX: ${KCA_OCSP_S3_PREFIX:-ocsp}
      KCA_OCSP_S3_REGION: ${KCA_OCSP_S3_REGION:-}
      KCA_OCSP_S3_ENDPOINT: ${KCA_OCSP_S3_ENDPOINT:-}
      KCA_OCSP_S3_FORCE_PATH_STYLE: ${KCA_OCSP_S3_FORCE_PATH_STYLE:-false}
      KCA_OCSP_PUBLISH_INTERVAL_SECONDS: ${KCA_OCSP_PUBLISH_INTERVAL_SECONDS:-1}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
      AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN:-}
      AWS_REGION: ${AWS_REGION:-}
    ports:
      - "127.0.0.1:${APP_PORT:-8080}:8080"

  # Optional standalone OCSP responder. It deliberately has no database,
  # Redis or KCA master-key environment. Enable with:
  #   docker compose --profile ocsp up --build
  ocsp:
    profiles: ["ocsp"]
    image: gitea.woggioni.net/woggioni/kca-ocsp:${OCSP_IMAGE_TAG:-latest}
    build:
      context: .
      dockerfile: ocsp-responder/Dockerfile
    environment:
      OCSP_CONFIG: /etc/ocsp/responder.yaml
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
      AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN:-}
      AWS_REGION: ${AWS_REGION:-}
    volumes:
      - ${OCSP_CONFIG_FILE:-./ocsp-responder/responder.example.yaml}:/etc/ocsp/responder.yaml:ro
      - ${OCSP_CA_DIR:-./ocsp-responder/ca}:/etc/ocsp/ca:ro
      - ${OCSP_SIGNER_DIR:-./ocsp-responder/signers}:/etc/ocsp/signers:ro
    ports:
      - "127.0.0.1:${OCSP_PORT:-2560}:2560"
    read_only: true
    security_opt:
      - no-new-privileges:true

volumes:
  pgdata: