woggioni
4f3a632f4b
- kaya backend with OIDC sessions, API tokens, Postgres/Tortoise models - AES-256-GCM private key storage and full certificate/CSR/CRL domain logic - Sycamore/WASM SPA for vaults, keys, requests, certificates, CRLs and templates - imports/exports, XCA .xdb migration, Docker Compose stack and tests
105 lines
3.0 KiB
YAML
105 lines
3.0 KiB
YAML
services:
|
|
postgres:
|
|
image: postgres:18-alpine
|
|
environment:
|
|
POSTGRES_DB: kca
|
|
POSTGRES_USER: kca
|
|
POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-password}
|
|
ports:
|
|
- "5432:5432"
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U kca"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
|
|
# Mock OIDC provider (navikt/mock-oauth2-server). Interactive login accepts
|
|
# any username; alice, bob, carol and dave carry profile claims.
|
|
# The issuer is http://mockoauth:8180/kca, so both the browser and the app
|
|
# need the /etc/hosts entry documented in README.md.
|
|
mockoauth:
|
|
build: ./server/dev/mockoauth
|
|
environment:
|
|
SERVER_PORT: "8180"
|
|
LOG_LEVEL: INFO
|
|
ports:
|
|
- "8180:8180"
|
|
|
|
mockoauth-init:
|
|
image: curlimages/curl
|
|
depends_on:
|
|
- mockoauth
|
|
entrypoint: >
|
|
/bin/sh -c "
|
|
until curl -sf http://mockoauth:8180/kca/.well-known/openid-configuration > /dev/null; do
|
|
echo 'waiting for mockoauth...'; sleep 2;
|
|
done
|
|
"
|
|
|
|
redis:
|
|
image: redis:8-alpine
|
|
ports:
|
|
- "6379:6379"
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
|
|
db-migrate:
|
|
build:
|
|
context: .
|
|
dockerfile: server/Dockerfile
|
|
working_dir: /app
|
|
command: ["aerich", "upgrade"]
|
|
environment:
|
|
DATABASE_ENGINE: postgres
|
|
DATABASE_HOST: postgres
|
|
DATABASE_PORT: "5432"
|
|
DATABASE_NAME: kca
|
|
DATABASE_USER: kca
|
|
DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
|
|
kca:
|
|
build:
|
|
context: .
|
|
dockerfile: server/Dockerfile
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
db-migrate:
|
|
condition: service_completed_successfully
|
|
mockoauth-init:
|
|
condition: service_completed_successfully
|
|
redis:
|
|
condition: service_healthy
|
|
environment:
|
|
DATABASE_ENGINE: postgres
|
|
DATABASE_HOST: postgres
|
|
DATABASE_PORT: "5432"
|
|
DATABASE_NAME: kca
|
|
DATABASE_USER: kca
|
|
DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
|
|
OIDC_0_PROVIDER: ${OIDC_0_PROVIDER:-default}
|
|
OIDC_0_ISSUER: ${OIDC_0_ISSUER:-http://mockoauth:8180/kca}
|
|
OIDC_0_CLIENT_ID: ${OIDC_0_CLIENT_ID:-kca}
|
|
OIDC_0_CLIENT_SECRET: ${OIDC_0_CLIENT_SECRET:-dev-secret}
|
|
OIDC_0_REDIRECT_URI: ${OIDC_0_REDIRECT_URI:-http://localhost:8080/auth/default/callback}
|
|
OIDC_0_POST_LOGIN_REDIRECT: ${OIDC_0_POST_LOGIN_REDIRECT:-http://localhost:8080/}
|
|
OIDC_0_POST_LOGOUT_REDIRECT: ${OIDC_0_POST_LOGOUT_REDIRECT:-http://localhost:8080/}
|
|
REDIS_URL: redis://redis:6379/0
|
|
# Development master key. Override for any real deployment:
|
|
# openssl rand -base64 32
|
|
KCA_MASTER_KEY: ${KCA_MASTER_KEY:-MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=}
|
|
MAX_UPLOAD_BYTES: ${MAX_UPLOAD_BYTES:-20971520}
|
|
ports:
|
|
- "127.0.0.1:${APP_PORT:-8080}:8080"
|
|
|
|
volumes:
|
|
pgdata:
|