docker-compose.yml

version: "3.8"

services:
  traefik:
    image: traefik
    restart: unless-stopped
    networks:
      - traefik-public
      - intranet
    labels: &labels
      - traefik.enable=true
      - traefik.docker.network=traefik-public

      - traefik.http.routers.traefik.rule=Host(`traefik.ory.localhost`)
      - traefik.http.routers.traefik.entrypoints=https
      - traefik.http.routers.traefik.tls=true
      - traefik.http.routers.traefik.service=api@internal

      - traefik.http.routers.traefik-metrics.rule=(Host(`traefik.ory.localhost`) || Host(`traefik`)) && Path(`/metrics`)
      - traefik.http.routers.traefik-metrics.entrypoints=https
      - traefik.http.routers.traefik-metrics.tls=true
      - traefik.http.routers.traefik-metrics.service=prometheus@internal

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - target: 443
        published: 443
        mode: host
      - target: 50000
        published: 50000
        mode: host
    command:
      - --global.sendAnonymousUsage=false
      - --serverstransport.insecureskipverify=true
      - --providers.docker
      - --providers.docker.exposedbydefault=false
      - --entrypoints.https.address=:443
      - --entrypoints.spicedb.address=:50000

      - --accesslog
      - --log
      - --log.level=debug
      - --api
      - --api.dashboard
      - --metrics.prometheus
      - --metrics.prometheus.entrypoint=http
      - --metrics.prometheus.manualrouting

  prometheus:
    image: quay.io/prometheus/prometheus
    restart: unless-stopped
    networks:
      - traefik-public
      - intranet
    volumes:
      - ./config/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - prometheus_data:/prometheus
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-public
      - traefik.http.routers.prometheus.rule=Host(`prometheus.ory.localhost`)
      - traefik.http.routers.prometheus.entrypoints=https
      - traefik.http.routers.prometheus.tls=true

  grafana:
    image: grafana/grafana
    restart: unless-stopped
    networks:
      - traefik-public
    volumes:
      - grafana_data:/var/lib/grafana
      - ./config/grafana/provisioning/:/etc/grafana/provisioning/
    labels:
      - traefik.enable=true
      - traefik.http.routers.grafana.rule=Host(`grafana.ory.localhost`)
      - traefik.http.routers.grafana.entrypoints=https
      - traefik.http.routers.grafana.tls=true
  whoami:
    image: traefik/whoami
    networks:
      - traefik-public
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-public
      - traefik.http.routers.whoami.rule=Host(`whoami.ory.localhost`)
      - traefik.http.routers.whoami.entrypoints=https
      - traefik.http.routers.whoami.tls=true
      - traefik.http.routers.whoami.middlewares=oathkeeper

  postgres-kratos:
    image: postgres:9.6
    environment:
      - POSTGRES_USER=kratos
      - POSTGRES_PASSWORD=secret
      - POSTGRES_DB=kratos
    networks:
      - intranet

  kratos-migrate:
    image: oryd/kratos:v0.9.0-alpha.3
    links:
      - postgres-kratos:postgres-kratos
    environment:
      - DSN=postgres://kratos:secret@postgres-kratos:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
    networks:
      - intranet
    volumes:
      - ./config/kratos:/etc/config/kratos
    command: -c /etc/config/kratos/kratos.yml migrate sql -e --yes

  kratos:
    image: oryd/kratos:v0.9.0-alpha.3
    depends_on:
      - kratos-migrate
    links:
      - postgres-kratos:postgres-kratos
    volumes:
      - ./config/kratos:/etc/config/kratos
    networks:
      - intranet
      - traefik-public
    command: serve -c /etc/config/kratos/kratos.yml --watch-courier
    environment:
      - DSN=postgres://kratos:secret@postgres-kratos:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
      - LOG_LEVEL=trace
      - SERVE_PUBLIC_BASE_URL=https://kratos.ory.localhost/
#      - SERVE_PUBLIC_BASE_URL=http://kratos.ory.localhost:9000/
#      - SERVE_PUBLIC_BASE_URL=http://ui.ory.localhost:9000/.ory/kratos/public/
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-public
      - traefik.http.routers.kratos.rule=Host(`kratos.ory.localhost`) || (Host(`ui.ory.localhost`) && PathPrefix(`/.ory/kratos/public/`))
      - traefik.http.middlewares.kratos-strip.stripprefix.prefixes=/.ory/kratos/public/

      - traefik.http.routers.kratos.entrypoints=https
      - traefik.http.routers.kratos.tls=true
#      - traefik.http.routers.kratos.middlewares=oathkeeper,kratos-strip
      - traefik.http.routers.kratos.service=kratos
      - traefik.http.services.kratos.loadbalancer.server.port=4433

      - traefik.http.routers.kratos-admin.rule=Host(`kratos-admin.ory.localhost`)
      - traefik.http.routers.kratos-admin.entrypoints=https
      - traefik.http.routers.kratos-admin.tls=true
      - traefik.http.routers.kratos-admin.service=kratos-admin
      - traefik.http.routers.kratos-admin.middlewares=oathkeeper
      - traefik.http.services.kratos-admin.loadbalancer.server.port=4434

  ui:
    environment:
#      - SECURITY_MODE=jwks
#      - JWKS_URL=http://oathkeeper:4456/.well-known/jwks.json
      - KRATOS_BROWSER_URL=https://kratos.ory.localhost/
#      - KRATOS_BROWSER_URL=http://kratos.ory.localhost:9000/
#      - KRATOS_BROWSER_URL=http://ui.ory.localhost:9000/.ory/kratos/public
      - KRATOS_PUBLIC_URL=http://kratos:4433/
    image: oryd/kratos-selfservice-ui-node:v0.9.0-alpha.3
    networks:
      - intranet
      - traefik-public
    restart: on-failure
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-public
      - traefik.http.routers.ui.rule=Host(`ui.ory.localhost`) && !PathPrefix(`/.ory/kratos/public/`)
      - traefik.http.routers.ui.entrypoints=https
      - traefik.http.routers.ui.tls=true
      - traefik.http.routers.ui.middlewares=oathkeeper

  oathkeeper:
    image: oryd/oathkeeper:v0.38
    depends_on:
      - kratos
    command:
      serve proxy -c "/etc/config/oathkeeper/oathkeeper.yml"
    environment:
      - LOG_LEVEL=debug
    restart: on-failure
    networks:
      - intranet
      - traefik-public
    volumes:
      - ./config/oathkeeper:/etc/config/oathkeeper
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-public
      - traefik.http.routers.oathkeeper-proxy.rule=Host(`oathkeeper-proxy.ory.localhost`)
      - traefik.http.routers.oathkeeper-proxy.entrypoints=https
      - traefik.http.routers.oathkeeper-proxy.tls=true
      - traefik.http.routers.oathkeeper-proxy.service=oathkeeper-proxy
      - traefik.http.services.oathkeeper-proxy.loadbalancer.server.port=4455

      - traefik.http.routers.oathkeeper-api.rule=Host(`oathkeeper-api.ory.localhost`)
      - traefik.http.routers.oathkeeper-api.entrypoints=https
      - traefik.http.routers.oathkeeper-api.tls=true
      - traefik.http.routers.oathkeeper-api.service=oathkeeper-api
      - traefik.http.services.oathkeeper-api.loadbalancer.server.port=4456

      - traefik.http.middlewares.oathkeeper.forwardauth.address=http://oathkeeper:4456/decisions
  #      - traefik.http.middlewares.oathkeeper.forwardauth.authResponseHeadersRegex=^X-
      - traefik.http.middlewares.oathkeeper.forwardauth.authResponseHeaders=X-User,X-Email

  mailslurper:
    image: oryd/mailslurper:latest-smtps
#    ports:
#      - '4436:4436'
#      - '4437:4437'
    networks:
      - intranet

  postgres-keto:
    image: postgres:9.6
    environment:
      - POSTGRES_USER=keto
      - POSTGRES_PASSWORD=secret
      - POSTGRES_DB=keto
    networks:
      - intranet

  keto-migrate:
    image: oryd/keto:v0.8
    volumes:
      - ./config/keto:/home/ory
    environment:
      - LOG_LEVEL=debug
      - DSN=postgres://keto:secret@postgres-keto:5432/keto?sslmode=disable&max_conns=20&max_idle_conns=4
    command: ["migrate", "up", "-y"]
    restart: on-failure
    depends_on:
      - postgres-kratos
    networks:
      - intranet

  keto-perms:
    image: oryd/keto:v0.8
    volumes:
      - ./config/keto:/home/ory
    environment:
      - KETO_WRITE_REMOTE=keto:4467
      - KETO_READ_REMOTE=keto:4466
      - LOG_LEVEL=debug
      - DSN=postgres://keto:secret@postgres-keto:5432/keto?sslmode=disable&max_conns=20&max_idle_conns=4
    depends_on:
      - postgres-kratos
    networks:
      - intranet

  keto:
    image: oryd/keto:v0.8
    volumes:
      - ./config/keto:/home/ory
    depends_on:
      - keto-migrate
    environment:
      - DSN=postgres://keto:secret@postgres-keto:5432/keto?sslmode=disable&max_conns=20&max_idle_conns=4
    networks:
      - intranet
      - traefik-public
    command: serve
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-public
      - traefik.http.routers.keto-read.rule=Host(`keto-read.ory.localhost`)
      - traefik.http.routers.keto-read.entrypoints=https
      - traefik.http.routers.keto-read.tls=true
      - traefik.http.routers.keto-read.service=keto-read
      - traefik.http.services.keto-read.loadbalancer.server.port=4466

      - traefik.http.routers.keto-write.rule=Host(`keto-write.ory.localhost`)
      - traefik.http.routers.keto-write.entrypoints=https
      - traefik.http.routers.keto-write.tls=true
      - traefik.http.routers.keto-write.service=keto-write
      - traefik.http.services.keto-write.loadbalancer.server.port=4467

  spicedb:
    image: authzed/spicedb
    networks:
      - intranet
      - traefik-public
    command: serve --grpc-preshared-key "blah" --http-enabled
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-public
      - traefik.tcp.routers.spicedb-grpc
      - traefik.tcp.routers.spicedb-grpc.rule=HostSNI(`*`)
      - traefik.tcp.routers.spicedb-grpc.entrypoints=spicedb
      - traefik.tcp.routers.spicedb-grpc.service=spicedb-grpc
      - traefik.tcp.services.spicedb-grpc.loadbalancer.server.port=50051

      - traefik.http.routers.spicedb-http.rule=Host(`spicedb-http.ory.localhost`)
      - traefik.http.routers.spicedb-http.entrypoints=https
      - traefik.http.routers.spicedb-http.tls=true
      - traefik.http.routers.spicedb-http.service=spicedb-http
      - traefik.http.services.spicedb-http.loadbalancer.server.port=8443

      - traefik.http.routers.spicedb-dashboard.rule=Host(`spicedb-dashboard.ory.localhost`)
      - traefik.http.routers.spicedb-dashboard.entrypoints=https
      - traefik.http.routers.spicedb-dashboard.tls=true
      - traefik.http.routers.spicedb-dashboard.service=spicedb-dashboard
      - traefik.http.services.spicedb-dashboard.loadbalancer.server.port=8080

      - traefik.http.routers.spicedb-metrics.rule=Host(`spicedb-metrics.ory.localhost`)
      - traefik.http.routers.spicedb-metrics.entrypoints=https
      - traefik.http.routers.spicedb-metrics.tls=true
      - traefik.http.routers.spicedb-metrics.service=spicedb-metrics
      - traefik.http.services.spicedb-metrics.loadbalancer.server.port=9090


#  postgres-shorts:
#    image: postgres:9.6
#    ports:
#      - "5432:5432"
#    environment:
#      - POSTGRES_USER=shorts
#      - POSTGRES_PASSWORD=notsecureatall
#      - POSTGRES_DB=shorts
#    networks:
#      - intranet
#
#  shorts:
#    build:
#      context: .
#    env_file: .env
#
#    networks:
#      - intranet


volumes:
#  kratos-sqlite:
  grafana_data: {}
  prometheus_data: {}

networks:
  intranet: {}
  traefik-public: {}