kafka-dev/docker-compose.yml at master · gnlabrie/kafka-dev · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
services:
  kafka:
    image: confluentinc/cp-kafka:${CONFLUENT_VERSION:-7.9.5}
    hostname: kafka
    container_name: kafka-dev

    ports:
      # Kafka access from Windows:
      # PLAINTEXT  bootstrap.servers=localhost:9092
      # SSL        bootstrap.servers=localhost:9093  (no mTLS)
      # MTLS       bootstrap.servers=localhost:9094  (client cert required)
      - "9092:9092"
      - "9093:9093"
      - "9094:9094"

    environment:
      # ----------------------------------------------------------------
      # KRaft identity
      # ----------------------------------------------------------------
      KAFKA_NODE_ID: 1
      CLUSTER_ID: "MkU3OEVBNTcwNTJENDM2Qk"

      # Combined broker/controller mode.
      # Suitable for a single-node development environment only.
      KAFKA_PROCESS_ROLES: "broker,controller"

      # ----------------------------------------------------------------
      # KRaft controller configuration
      # ----------------------------------------------------------------
      KAFKA_CONTROLLER_QUORUM_VOTERS: "1@kafka:29093"
      KAFKA_CONTROLLER_LISTENER_NAMES: "CONTROLLER"

      # ----------------------------------------------------------------
      # Listener configuration
      #
      # INTERNAL:
      #   Used by applications running in the Docker Compose network.
      #   bootstrap.servers=kafka:29092
      #
      # EXTERNAL:
      #   Used by applications running directly on Windows.
      #   bootstrap.servers=localhost:9092
      #
      # SSL:
      #   TLS encryption, no client certificate required.
      #   bootstrap.servers=localhost:9093
      #
      # MTLS:
      #   TLS encryption + mutual TLS (client certificate required).
      #   bootstrap.servers=localhost:9094
      #
      # CONTROLLER:
      #   Used internally by the KRaft controller.
      # ----------------------------------------------------------------
      KAFKA_LISTENERS: >-
        INTERNAL://0.0.0.0:29092,
        EXTERNAL://0.0.0.0:9092,
        SSL://0.0.0.0:9093,
        MTLS://0.0.0.0:9094,
        CONTROLLER://0.0.0.0:29093

      KAFKA_ADVERTISED_LISTENERS: >-
        INTERNAL://kafka:29092,
        EXTERNAL://localhost:9092,
        SSL://localhost:9093,
        MTLS://localhost:9094

      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: >-
        INTERNAL:PLAINTEXT,
        EXTERNAL:PLAINTEXT,
        SSL:SSL,
        MTLS:SSL,
        CONTROLLER:PLAINTEXT

      KAFKA_INTER_BROKER_LISTENER_NAME: "INTERNAL"

      # ----------------------------------------------------------------
      # SSL / TLS (shared keystore + truststore for both SSL listeners)
      # Confluent expects filenames + password files under /etc/kafka/secrets.
      # Regenerate with: powershell -File .\scripts\generate-certs.ps1
      # ----------------------------------------------------------------
      KAFKA_SSL_KEYSTORE_FILENAME: kafka.keystore.jks
      KAFKA_SSL_KEYSTORE_CREDENTIALS: keystore_creds
      KAFKA_SSL_KEY_CREDENTIALS: key_creds
      KAFKA_SSL_TRUSTSTORE_FILENAME: kafka.truststore.jks
      KAFKA_SSL_TRUSTSTORE_CREDENTIALS: truststore_creds
      KAFKA_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM: ""

      # Required so Confluent's configure script mounts the truststore
      # (needed to validate client certs on MTLS). Per-listener
      # overrides below control actual client-auth behavior.
      KAFKA_SSL_CLIENT_AUTH: required

      # SSL listener: encryption only (no client cert)
      KAFKA_LISTENER_NAME_SSL_SSL_CLIENT_AUTH: none

      # MTLS listener: require and validate client certificate
      # → listener.name.mtls.ssl.client.auth=required
      KAFKA_LISTENER_NAME_MTLS_SSL_CLIENT_AUTH: required

      # ----------------------------------------------------------------
      # Single-broker settings
      # Internal topics cannot use the normal replication factor of 3.
      # ----------------------------------------------------------------
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_OFFSETS_TOPIC_NUM_PARTITIONS: 1

      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1

      KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: 0

      # Reasonable DEV defaults
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "true"
      KAFKA_NUM_PARTITIONS: 3
      KAFKA_DEFAULT_REPLICATION_FACTOR: 1
      KAFKA_MIN_INSYNC_REPLICAS: 1

      # Keep the container reasonably small for laptop use
      KAFKA_HEAP_OPTS: "-Xms512M -Xmx1G"

      # Reduce noisy logs
      KAFKA_LOG4J_ROOT_LOGLEVEL: "INFO"

    volumes:
      - ./kafka-data:/var/lib/kafka/data
      - ./secrets:/etc/kafka/secrets:ro

    healthcheck:
      test:
        [
          "CMD-SHELL",
          "kafka-topics --bootstrap-server localhost:29092 --list >/dev/null 2>&1"
        ]
      interval: 10s
      timeout: 10s
      retries: 12
      start_period: 30s

    restart: unless-stopped

volumes:
  kafka-data:
    name: kafka-dev-data