people-api/compose-dev.yaml at master · mcqueide/people-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
name: people-dev

networks:
  backend:
    driver: bridge

services:
  db:
    image: postgres:18-alpine3.22
    restart: always
    user: postgres

    secrets:
      - db-password
      - keycloak-db-password
      - api-db-password

    volumes:
      - db-data:/var/lib/postgresql/data
      - ./postgres/init:/docker-entrypoint-initdb.d:ro  # Initialization scripts

    environment:
      POSTGRES_DB: postgres
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD_FILE: /run/secrets/db-password

    ports:
      - "5432:5432"

    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-postgres}" ]
      interval: 10s
      timeout: 5s
      retries: 3

    networks:
      - backend

    env_file:
      - env_files/.env.db

  keycloak:
    image: quay.io/keycloak/keycloak:26.4
    container_name: keycloak

    command: start-dev

    # Run import
    # command: start-dev --import-realm  # Add --import-realm flag to import on startup

    volumes:
      - keycloak-conf:/opt/keycloak/conf
      - keycloak-lib:/opt/keycloak/lib/quarkus/
      - ./keycloak/export:/opt/keycloak/data/import

    depends_on:
      db:
        condition: service_healthy

    ports:
      - "8080:8080"
      - "9000:9000"  # Admin health endpoint

    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://db:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: keycloak
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: admin
      KC_HOSTNAME: keycloak
      # KC_HOSTNAME: localhost # If Keycloak is accessed only locally
      KC_PROXY_HEADERS: xforwarded
      KC_HOSTNAME_STRICT: false # To allow access via HTTP instead of HTTPS, not recommended for production.
      KC_HTTP_ENABLED: true
      KC_HEALTH_ENABLED: true
      KC_METRICS_ENABLED: true
      KC_HTTP_RELATIVE_PATH: /auth

    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/keycloak/9000 && echo -e 'GET /auth/health/ready HTTP/1.1\r\nHost: keycloak\r\nConnection: close\r\n\r\n' >&3 && cat <&3 | grep -q '200 OK'"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 90s  # Keycloak takes time to initialize

    networks:
      - backend

  api:
    build:
      context: .
      dockerfile: Dockerfile-dev

    working_dir: /app

    #command: .mvnw -q spring-boot:run

    depends_on:
      db:
        condition: service_healthy
      keycloak:
        condition: service_healthy

    environment:
      MAVEN_OPTS: -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005
      SPRING_DATASOURCE_URL: jdbc:postgresql://db:5432/people
      SPRING_DATASOURCE_USERNAME: people
      SPRING_DATASOURCE_PASSWORD: people
      CORS_ALLOWED_ORIGINS: http://localhost:3000,http://localhost:4200,http://app:3000
      CORS_ALLOWCREDENTIALS: true
      KEYCLOAK_ISSUER_URI: http://keycloak:8080/auth/realms/people-realm
      KEYCLOAK_CLIENT_SECRET:  # Empty for public client with PKCE

    ports:
      - "8081:8081"
      - "5005:5005"

    volumes:
#      - ./:/app
      - ~/.m2:/root/.m2

    develop:
      watch:
        - action: sync+restart
          path: .
          target: /app

    tty: true

    networks:
      - backend

volumes:
  db-data:
  keycloak-conf:
  keycloak-lib:

secrets:
  db-password:
    file: ./secrets/db-password.txt
  api-db-password:
    file: ./secrets/api-db-password.txt
  keycloak-db-password:
    file: ./secrets/keycloak-db-password.txt