docker-compose.yml

#
# Container names have a domain-like naming scheme to facilitate dnsmasq usage.
# By ending in .doc, which is not a valid TLD, we can easily configure dnsmasq
# to resolve these names to the docker machine. This allows the containers to
# use the same names to refer to each other as the host does when resolving the
# container names.
#
name: p4as
services:
  auth-svc1.doc:
    build:
      context: .
      dockerfile: containers/auth-svc/Dockerfile
    image: auth-svc:latest
    container_name: auth-svc1.doc
    environment:
      DEBUG: "1"
      DEBUG_PROXY: "1"
      SVC_BASE_URI: "https://authen.doc"
      PORT: 3001
      PROTOCOL: "http"
      TRUST_PROXY: 'true'
      CLIENT_CERT_HEADER: 'X-SSL-Client-Cert'
      CLIENT_CERT_FP: '39:65:C1:9A:2F:9A:66:B6:57:54:F5:05:8D:F4:2F:3B:53:BB:7D:3E:C6:C0:36:D4:10:4D:F8:A4:0C:8B:56:9E'
      REDIS_URL: 'rediss://rediss.doc:6389'
      OIDC_CLIENT_ID: client_id
      OIDC_CLIENT_SECRET: client_secret
      OIDC_ISSUER_URI: "https://oidc.doc:8843"
      DEFAULT_PROTOCOL: "saml"
      # allow the self-signed certs installed on shibboleth container
      NODE_TLS_REJECT_UNAUTHORIZED: "0"
      SAML_IDP_METADATA_URL: "https://shibboleth.doc:4443/idp/shibboleth"
      SAML_NAMEID_FORMAT: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
      SAML_SP_ENTITY_ID: "urn:example:sp"
      OAUTH_JWKS_URI: 'http://jwt.doc:3000/.well-known/jwks.json'
      OAUTH_AUDIENCE: 'api://25b17cdb-4c8d-434c-9a21-86d67ac501d1'
      OAUTH_ISSUER: 'http://jwt.doc:3000/'
      OAUTH_ALGORITHM: 'RS256'
      OAUTH_TENANT_ID: '719d88f3-f957-44cf-9aa5-0a1a3a44f7b9'
    networks:
      - authen
    ports:
      - "3001:3001"
    depends_on:
      redis.doc:
        condition: service_started
      shibboleth.doc:
        condition: service_healthy
  auth-svc2.doc:
    image: auth-svc:latest
    container_name: auth-svc2.doc
    environment:
      DEBUG: "1"
      DEBUG_PROXY: "1"
      SVC_BASE_URI: "https://authen.doc"
      PORT: 3002
      PROTOCOL: "http"
      TRUST_PROXY: 'true'
      CLIENT_CERT_HEADER: 'X-SSL-Client-Cert'
      CLIENT_CERT_FP: '39:65:C1:9A:2F:9A:66:B6:57:54:F5:05:8D:F4:2F:3B:53:BB:7D:3E:C6:C0:36:D4:10:4D:F8:A4:0C:8B:56:9E'
      REDIS_URL: 'rediss://rediss.doc:6389'
      OIDC_CLIENT_ID: client_id
      OIDC_CLIENT_SECRET: client_secret
      OIDC_ISSUER_URI: "https://oidc.doc:8843"
      DEFAULT_PROTOCOL: "saml"
      # allow the self-signed certs installed on shibboleth container
      NODE_TLS_REJECT_UNAUTHORIZED: "0"
      SAML_IDP_METADATA_URL: "https://shibboleth.doc:4443/idp/shibboleth"
      SAML_NAMEID_FORMAT: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
      SAML_SP_ENTITY_ID: "urn:example:sp"
      OAUTH_JWKS_URI: 'http://jwt.doc:3000/.well-known/jwks.json'
      OAUTH_AUDIENCE: 'api://25b17cdb-4c8d-434c-9a21-86d67ac501d1'
      OAUTH_ISSUER: 'http://jwt.doc:3000/'
      OAUTH_ALGORITHM: 'RS256'
      OAUTH_TENANT_ID: '719d88f3-f957-44cf-9aa5-0a1a3a44f7b9'
    networks:
      - authen
    ports:
      - "3002:3002"
    depends_on:
      auth-svc1.doc:
        condition: service_healthy
  ldap.doc:
    build:
      context: containers/ldap
    container_name: ldap.doc
    networks:
      - authen
    ports:
      - "389:389"
      - "636:636"
  authen.doc:
    build:
      context: .
      dockerfile: containers/haproxy/Dockerfile
    container_name: authen.doc
    networks:
      - authen
    ports:
      - "443:443"
    depends_on:
      auth-svc1.doc:
        condition: service_healthy
      auth-svc2.doc:
        condition: service_healthy
  jwt.doc:
    # https://github.com/foobert/jwtdummy
    #
    # This container issues and validates RFC 7519 JSON Web Tokens which are
    # used for testing the "client-sso" feature of the extension and service.
    #
    # visit http://jwt.doc:3000 for usage instructions
    #
    # This image only knows how to bind to port 3000, changing this would
    # require forking the repo and fixing it.
    image: foobert/jwtdummy
    container_name: jwt.doc
    networks:
      - authen
    ports:
      - "3000:3000"
  oidc.doc:
    build:
      context: containers/oidc
    container_name: oidc.doc
    environment:
      ASPNETCORE_ENVIRONMENT: Development
      ASPNETCORE_URLS: https://+:8843;http://+:80
      ASPNETCORE_Kestrel__Certificates__Default__Password: oidc-server-mock-pwd
      ASPNETCORE_Kestrel__Certificates__Default__Path: /https/aspnetapp.pfx
      API_RESOURCES_INLINE: |
        []
      USERS_CONFIGURATION_INLINE: |
        [
          {
            "SubjectId": "408616",
            "Username": "janedoe",
            "Password": "Passw0rd!",
            "Claims": [
              { "Type": "name", "Value": "Jane Doe" },
              { "Type": "given_name", "Value": "Jane" },
              { "Type": "family_name", "Value": "Doe" },
              { "Type": "email", "Value": "janedoe@example.com" },
              { "Type": "email_verified", "Value": "true" }
            ]
          },
          {
            "SubjectId": "408727",
            "Username": "johndoe",
            "Password": "Passw0rd!",
            "Claims": [
              { "Type": "name", "Value": "John Doe" },
              { "Type": "given_name", "Value": "John" },
              { "Type": "family_name", "Value": "Doe" },
              { "Type": "email", "Value": "johndoe@example.com" },
              { "Type": "email_verified", "Value": "true" }
            ]
          }
        ]
      CLIENTS_CONFIGURATION_INLINE: |
        [
          {
            "ClientId": "client_id",
            "ClientSecrets": [ "client_secret" ],
            "Description": "Client for client credentials flow",
            "AllowedGrantTypes": [ "authorization_code" ],
            "AllowAccessTokensViaBrowser": true,
            "RedirectUris": [
              "https://authen.doc/oidc/callback",
              "https://authen.doc"
            ],
            "AllowedScopes": [ "openid", "profile", "email" ],
            "IdentityTokenLifetime": 3600,
            "AccessTokenLifetime": 3600
          }
        ]
    networks:
      - authen
    ports:
      - "8843:8843"
  # p4d.doc is in the extension repository
  redis.doc:
    image: valkey/valkey:unstable
    container_name: redis.doc
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
    networks:
      - authen
    ports:
      - "6379:6379"
  rediss.doc:
    build:
      context: containers/redis
    container_name: rediss.doc
    networks:
      - authen
    ports:
      - "6389:6389"
  shibboleth.doc:
    build:
      context: containers/shibboleth
    container_name: shibboleth.doc
    depends_on:
      ldap.doc:
        condition: service_healthy
    networks:
      - authen
    ports:
      - "4443:4443"

networks:
  authen:
    name: auth-service
    # Shared with the Helix Authentication Extension containers for manual
    # testing, so the network is managed outside of any single compose project
    # (create it once with `docker network create auth-service`). This avoids
    # the "network ... exists but was not created for project" warning that
    # occurs when two projects both try to own a network of the same name.
    external: true