docker-compose.dev.yml

services:
  traefik:
    image: traefik:v2.10
    container_name: traefik
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.file.filename=/etc/traefik/login-ui-routes.yml"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./docker/traefik:/etc/traefik
    networks:
      - intranet
  kratos-migrate:
    image: ghcr.io/canonical/kratos:25.4.0
    environment:
      - DSN=postgres://kratos:kratos@postgres/kratos?sslmode=disable
    volumes:
      - type: volume
        source: kratos-sqlite
        target: /var/lib/sqlite
        read_only: false
      - type: bind
        source: ./docker/kratos
        target: /etc/config/kratos
    command: exec kratos -c /etc/config/kratos/kratos.yml migrate sql -e --yes
    restart: on-failure
    networks:
      - intranet
    labels:
      - "traefik.enable=false"
  kratos:
    depends_on:
      - kratos-migrate
    image: ghcr.io/canonical/kratos:25.4.0
    container_name: kratos
    ports:
      - '4433:4433' # public
      - '4434:4434' # admin
    restart: unless-stopped
    environment:
      - DSN=postgres://kratos:kratos@postgres/kratos?sslmode=disable
      - LOG_LEVEL=trace
      - SELFSERVICE_METHODS_OIDC_CONFIG_PROVIDERS_0_CLIENT_ID=${CLIENT_ID}
      - SELFSERVICE_METHODS_OIDC_CONFIG_PROVIDERS_0_CLIENT_SECRET=${CLIENT_SECRET}
    command: exec kratos serve -c /etc/config/kratos/kratos.yml --dev --watch-courier
    volumes:
      - type: volume
        source: kratos-sqlite
        target: /var/lib/sqlite
        read_only: false
      - type: bind
        source: ./docker/kratos
        target: /etc/config/kratos
    networks:
      - intranet
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.kratos-public.loadbalancer.server.port=4433"
      - "traefik.http.services.kratos-admin.loadbalancer.server.port=4434"

      # Middleware to rewrite the webauthn.js path
      - "traefik.http.middlewares.replace-webauthn-path.replacePath.path=/.well-known/ory/webauthn.js"
      
      # Route: Serve /.well-known/webauthn.js
      - "traefik.http.routers.kratos-well-known.rule=Path(`/.well-known/webauthn.js`)"
      - "traefik.http.routers.kratos-well-known.entryPoints=web"
      - "traefik.http.routers.kratos-well-known.middlewares=replace-webauthn-path"
      - "traefik.http.routers.kratos-well-known.service=kratos-public"

      # Public routes
      - "traefik.http.routers.kratos-oidc-callback.rule=PathPrefix(`/self-service/methods/oidc/callback`)"
      - "traefik.http.routers.kratos-oidc-callback.entryPoints=web"
      - "traefik.http.routers.kratos-oidc-callback.service=kratos-public"

      - "traefik.http.routers.kratos-schemas.rule=PathPrefix(`/schemas`)"
      - "traefik.http.routers.kratos-schemas.entryPoints=web"
      - "traefik.http.routers.kratos-schemas.service=kratos-public"

      # Admin routes
      - "traefik.http.routers.kratos-admin-identities.rule=PathPrefix(`/admin/identities`)"
      - "traefik.http.routers.kratos-admin-identities.entryPoints=web"
      - "traefik.http.routers.kratos-admin-identities.service=kratos-admin"

      - "traefik.http.routers.kratos-admin-recovery.rule=PathPrefix(`/admin/recovery`)"
      - "traefik.http.routers.kratos-admin-recovery.entryPoints=web"
      - "traefik.http.routers.kratos-admin-recovery.service=kratos-admin"

      - "traefik.http.routers.kratos-admin-sessions.rule=PathPrefix(`/admin/sessions`)"
      - "traefik.http.routers.kratos-admin-sessions.entryPoints=web"
      - "traefik.http.routers.kratos-admin-sessions.service=kratos-admin"

  kratos-setup:
    image: ghcr.io/canonical/kratos:25.4.0
    depends_on:
      - kratos
    restart: "no"
    volumes:
      - type: volume
        source: kratos-sqlite
        target: /var/lib/sqlite
        read_only: false
      - type: bind
        source: ./docker/kratos
        target: /etc/config/kratos
    command: exec kratos import identities /etc/config/kratos/identity.json --endpoint http://kratos:4434
    networks:
      - intranet
    labels:
      - "traefik.enable=false"
  hydra:
    image: ghcr.io/canonical/hydra:25.4.0
    ports:
      - "4444:4444" # Public port
      - "4445:4445" # Admin port
    command: exec hydra serve -c /etc/config/hydra/hydra.yml all --dev
    volumes:
      - type: bind
        source: ./docker/hydra
        target: /etc/config/hydra
    environment:
      - DSN=postgres://hydra:hydra@postgres/hydra?sslmode=disable
      - CORS_DEBUG=1
    restart: unless-stopped
    depends_on:
      - hydra-migrate
    networks:
      - intranet
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.hydra-public.loadbalancer.server.port=4444"
      - "traefik.http.services.hydra-admin.loadbalancer.server.port=4445"

      # Public API routes
      - "traefik.http.routers.hydra-public-oauth2.rule=PathPrefix(`/oauth2`)"
      - "traefik.http.routers.hydra-public-oauth2.entryPoints=web"
      - "traefik.http.routers.hydra-public-oauth2.service=hydra-public"

      - "traefik.http.routers.hydra-public-well-known-jwks.rule=Path(`/.well-known/jwks.json`)"
      - "traefik.http.routers.hydra-public-well-known-jwks.entryPoints=web"
      - "traefik.http.routers.hydra-public-well-known-jwks.service=hydra-public"

      - "traefik.http.routers.hydra-public-well-known-openid.rule=Path(`/.well-known/openid-configuration`)"
      - "traefik.http.routers.hydra-public-well-known-openid.entryPoints=web"
      - "traefik.http.routers.hydra-public-well-known-openid.service=hydra-public"

      - "traefik.http.routers.hydra-public-userinfo.rule=Path(`/userinfo`)"
      - "traefik.http.routers.hydra-public-userinfo.entryPoints=web"
      - "traefik.http.routers.hydra-public-userinfo.service=hydra-public"

      # Admin API routes
      - "traefik.http.routers.hydra-admin-oauth2.rule=PathPrefix(`/admin/oauth2`)"
      - "traefik.http.routers.hydra-admin-oauth2.entryPoints=web"
      - "traefik.http.routers.hydra-admin-oauth2.service=hydra-admin"

      - "traefik.http.routers.hydra-admin-clients.rule=PathPrefix(`/admin/clients`)"
      - "traefik.http.routers.hydra-admin-clients.entryPoints=web"
      - "traefik.http.routers.hydra-admin-clients.service=hydra-admin"

      - "traefik.http.routers.hydra-admin-trust.rule=PathPrefix(`/admin/trust`)"
      - "traefik.http.routers.hydra-admin-trust.entryPoints=web"
      - "traefik.http.routers.hydra-admin-trust.service=hydra-admin"

      - "traefik.http.routers.hydra-admin-keys.rule=PathPrefix(`/admin/keys`)"
      - "traefik.http.routers.hydra-admin-keys.entryPoints=web"
      - "traefik.http.routers.hydra-admin-keys.service=hydra-admin"

  hydra-migrate:
    image: ghcr.io/canonical/hydra:25.4.0
    environment:
      - DSN=postgres://hydra:hydra@postgres/hydra?sslmode=disable
    command: exec hydra migrate -c /etc/config/hydra/hydra.yml sql -e --yes
    volumes:
      - type: bind
        source: ./docker/hydra
        target: /etc/config/hydra
    restart: on-failure
    networks:
      - intranet
    labels:
      - "traefik.enable=false"
  mailslurper:
    image: oryd/mailslurper:latest-smtps
    ports:
      - '4436:4436'
      - '4437:4437'
    networks:
      - intranet
    labels:
      - "traefik.enable=false"
  postgres:
    image: postgres
    container_name: postgres
    restart: always
    ports:
      - 5432:5432
    volumes:
      - ./docker/postgres/init-database.sql:/docker-entrypoint-initdb.d/init-database.sql
    environment:
      POSTGRES_USER: openfga
      POSTGRES_PASSWORD: openfga
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U openfga" ]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - intranet
    labels:
      - "traefik.enable=false"
  migrateopenfga:
    image: openfga/openfga:v1.9.0
    container_name: migrateopenfga
    command: migrate --datastore-engine postgres --datastore-uri 'postgresql://openfga:openfga@postgres/openfga?sslmode=disable'
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - intranet
    labels:
      - "traefik.enable=false"
  insert-hardcoded-store:
    image: governmentpaas/psql
    container_name: insert-hardcoded-store
    command: psql -Atx postgresql://openfga:openfga@postgres/openfga?sslmode=disable -c "INSERT INTO store (id,name,created_at,updated_at) VALUES ('01GP1254CHWJC1MNGVB0WDG1T0','login-ui',NOW(),NOW()) ON CONFLICT DO NOTHING;"
    depends_on:
      migrateopenfga:
        condition: service_completed_successfully
    networks:
      - intranet
    labels:
      - "traefik.enable=false"
  openfga:
    image: openfga/openfga:v1.9.0
    environment:
      OPENFGA_DATASTORE_ENGINE: "postgres"
      OPENFGA_DATASTORE_URI: "postgresql://openfga:openfga@postgres/openfga?sslmode=disable"
      OPENFGA_AUTHN_PRESHARED_KEYS: "42"
    command: run
    ports:
      - 8080:8080
      - 8081:8081
      - 3000:3000
    depends_on:
      migrateopenfga:
        condition: service_completed_successfully
      insert-hardcoded-store:
        condition: service_completed_successfully
    networks:
      - intranet
    labels:
      - "traefik.enable=false"
networks:
  intranet:
volumes:
  kratos-sqlite: