88 lines
3.1 KiB
YAML
88 lines
3.1 KiB
YAML
# Base / production config. Run alone with: docker compose -f compose.yml up
|
|
# Plain `docker compose up` also merges compose.override.yml for development.
|
|
services:
|
|
web:
|
|
build: .
|
|
ports:
|
|
- "3000:3000"
|
|
# Explicit behaviour toggles (the app is environment-agnostic — see AGENTS.md).
|
|
# Supply COOKIE_SECRET / CSRF_SECRET via env; REQUIRE_SECURE_SECRETS refuses dev throwaways.
|
|
environment:
|
|
CACHE_TEMPLATES: "true"
|
|
REQUIRE_SECURE_SECRETS: "true"
|
|
restart: unless-stopped
|
|
|
|
# Ory's storage only (Kratos/Keto/Hydra) — the web app never connects here.
|
|
# init/init.sql creates one database per service. Dev defaults below; supply
|
|
# POSTGRES_USER/PASSWORD via env in production.
|
|
postgres:
|
|
image: postgres:18.4-alpine3.23
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-ory}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-ory}
|
|
POSTGRES_DB: ory
|
|
volumes:
|
|
- ./ory/postgres/init:/docker-entrypoint-initdb.d:ro
|
|
- pgdata:/var/lib/postgresql # PG18+: mount the parent, not /data (version-subdir layout)
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-ory} -d ory"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
restart: unless-stopped
|
|
|
|
# Ory Kratos — identity & self-service auth. Config + identity schema in ory/kratos/.
|
|
# DSN is the per-service `kratos` DB (init.sql); supply POSTGRES_* via env in prod.
|
|
kratos-migrate:
|
|
image: oryd/kratos:v26.2.0
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
DSN: postgres://${POSTGRES_USER:-ory}:${POSTGRES_PASSWORD:-ory}@postgres:5432/kratos?sslmode=disable
|
|
volumes:
|
|
- ./ory/kratos:/etc/config/kratos:ro
|
|
command: -c /etc/config/kratos/kratos.yml migrate sql -e --yes
|
|
restart: on-failure
|
|
|
|
kratos:
|
|
image: oryd/kratos:v26.2.0
|
|
depends_on:
|
|
kratos-migrate:
|
|
condition: service_completed_successfully
|
|
environment:
|
|
DSN: postgres://${POSTGRES_USER:-ory}:${POSTGRES_PASSWORD:-ory}@postgres:5432/kratos?sslmode=disable
|
|
volumes:
|
|
- ./ory/kratos:/etc/config/kratos:ro
|
|
command: serve -c /etc/config/kratos/kratos.yml --watch-courier
|
|
restart: unless-stopped
|
|
|
|
# Ory Keto — authorization (ReBAC). Permission model in ory/keto/namespaces.keto.ts (OPL).
|
|
# DSN is the per-service `keto` DB (init.sql). The web app calls its read/write APIs (config.ts).
|
|
keto-migrate:
|
|
image: oryd/keto:v26.2.0
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
DSN: postgres://${POSTGRES_USER:-ory}:${POSTGRES_PASSWORD:-ory}@postgres:5432/keto?sslmode=disable
|
|
volumes:
|
|
- ./ory/keto:/etc/config/keto:ro
|
|
command: -c /etc/config/keto/keto.yml migrate up -y
|
|
restart: on-failure
|
|
|
|
keto:
|
|
image: oryd/keto:v26.2.0
|
|
depends_on:
|
|
keto-migrate:
|
|
condition: service_completed_successfully
|
|
environment:
|
|
DSN: postgres://${POSTGRES_USER:-ory}:${POSTGRES_PASSWORD:-ory}@postgres:5432/keto?sslmode=disable
|
|
volumes:
|
|
- ./ory/keto:/etc/config/keto:ro
|
|
command: serve -c /etc/config/keto/keto.yml
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
pgdata:
|