docker-compose.yml

services:
  sso-db:
    image: postgres:17
    container_name: sso-db
    ports:
      - 5433:5433
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
    command: -p 5433
    volumes:
      - ./local/database-init.sql:/docker-entrypoint-initdb.d/database-init.sql
      - ./.bin/db-setup.sh:/docker-entrypoint-initdb.d/init-user-db.sh
      - sso-requests-data:/var/lib/postgresql/data
    networks:
      - css-net

  sso-requests:
    container_name: sso-requests
    image: sso-requests:latest
    build:
      dockerfile: Dockerfile
      context: .
      args:
        NEXT_PUBLIC_API_URL: http://localhost:3000/api
        NEXT_PUBLIC_SSO_URL: https://dev.loginproxy.gov.bc.ca/auth
        NEXT_PUBLIC_SSO_CLIENT_ID: css-app-in-gold-4128
        NEXT_PUBLIC_SSO_REDIRECT_URI: http://localhost:3000
        NEXT_PUBLIC_SSO_AUTHORIZATION_RESPONSE_TYPE: code
        NEXT_PUBLIC_SSO_AUTHORIZATION_SCOPE: openid
        NEXT_PUBLIC_SSO_TOKEN_GRANT_TYPE: authorization_code
        NEXT_PUBLIC_SSO_IDP_HINT: azureidir
        NEXT_PUBLIC_APP_URL: http://localhost:3000
        NEXT_PUBLIC_INCLUDE_DIGITAL_CREDENTIAL: true
        NEXT_PUBLIC_INCLUDE_BC_SERVICES_CARD: true
        NEXT_PUBLIC_ALLOW_BC_SERVICES_CARD_PROD: true
        NEXT_PUBLIC_INCLUDE_SOCIAL: true
        NEXT_PUBLIC_INCLUDE_OTP: true
        NEXT_PUBLIC_SSO_CONFIGURATION_ENDPOINT: https://dev.loginproxy.gov.bc.ca/auth/realms/standard/.well-known/openid-configuration
        NEXT_PUBLIC_APP_ENV: local
    ports:
      - 3000:3000
    environment:
      NEXT_PUBLIC_API_URL: http://localhost:3000/api
      NEXT_PUBLIC_SSO_URL: https://dev.loginproxy.gov.bc.ca/auth
      NEXT_PUBLIC_SSO_CLIENT_ID: css-app-in-gold-4128
      NEXT_PUBLIC_SSO_REDIRECT_URI: http://localhost:3000
      NEXT_PUBLIC_SSO_AUTHORIZATION_RESPONSE_TYPE: code
      NEXT_PUBLIC_SSO_AUTHORIZATION_SCOPE: openid
      NEXT_PUBLIC_SSO_TOKEN_GRANT_TYPE: authorization_code
      NEXT_PUBLIC_APP_URL: http://localhost:3000
      NEXT_PUBLIC_INCLUDE_DIGITAL_CREDENTIAL: true
      NEXT_PUBLIC_INCLUDE_BC_SERVICES_CARD: true
      NEXT_PUBLIC_ALLOW_BC_SERVICES_CARD_PROD: true
      NEXT_PUBLIC_INCLUDE_SOCIAL: true
      NEXT_PUBLIC_INCLUDE_OTP: true
      NEXT_PUBLIC_SSO_CONFIGURATION_ENDPOINT: https://dev.loginproxy.gov.bc.ca/auth/realms/standard/.well-known/openid-configuration
      NEXT_PUBLIC_APP_ENV: local
      NEXT_PUBLIC_SSO_IDP_HINT: azureidir
      NEXT_PUBLIC_INCLUDE_BCGOVIDIR: true

      MAINTENANCE_MODE_ACTIVE: 'false'
      SSO_REQUESTS_BACKEND_HOSTNAME: sso-requests
      API_AUTH_SECRET: s3cr3t
      NODE_ENV: development
      DATABASE_URL: postgresql://postgres:postgres@sso-db:5433/ssorequests
      KEYCLOAK_V2_DEV_USERNAME: admin
      KEYCLOAK_V2_DEV_PASSWORD: admin
      KEYCLOAK_V2_DEV_URL: http://dev-keycloak:9080
      KEYCLOAK_V2_TEST_USERNAME: admin
      KEYCLOAK_V2_TEST_PASSWORD: admin
      KEYCLOAK_V2_TEST_URL: http://test-keycloak:9081
      KEYCLOAK_V2_PROD_USERNAME: admin
      KEYCLOAK_V2_PROD_PASSWORD: admin
      KEYCLOAK_V2_PROD_URL: http://prod-keycloak:9082
      GH_BRANCH: main
      GH_OWNER: bcgov
      CHES_API_ENDPOINT: https://ches.api.gov.bc.ca/api/v1/email
      CHES_TOKEN_ENDPOINT: https://loginproxy.gov.bc.ca/auth/realms/comsvcauth/protocol/openid-connect/token
      CHES_USERNAME: test
      CHES_PASSWORD: test
      VERIFY_USER_SECRET: s3cr3t
      REALM_REGISTRY_API: https://realm-registry-sandbox.apps.gold.devops.gov.bc.ca/api
      LOCAL_DEV: 'true'
      GRAFANA_API_TOKEN: s3cr3t
      GRAFANA_API_URL: https://sso-grafana-sandbox.apps.gold.devops.gov.bc.ca/api
      GOLD_IP_ADDRESS: '142.34.229.4'
      CYPRESS_RUNNER: 'true'
      BCSC_REGISTRATION_BASE_URL_DEV: https://idsit.gov.bc.ca
      BCSC_REGISTRATION_BASE_URL_TEST: https://idsit.gov.bc.ca
      BCSC_REGISTRATION_BASE_URL_PROD: https://idsit.gov.bc.ca
    depends_on:
      - sso-db
    networks:
      - css-net

  dev-keycloak:
    container_name: dev-keycloak
    image: ghcr.io/bcgov/sso:v26.6.8-build.1

    depends_on:
      - sso-db
    ports:
      - 9080:9080
    command: start-dev --http-port=9080
    environment:
      DB_POSTGRESQL_SERVICE_HOST: postgres
      DB_POSTGRESQL_SERVICE_PORT: 5433
      KC_DB: postgres
      KC_DB_URL_DATABASE: keycloak
      KC_DB_URL: 'jdbc:postgresql://sso-db:5433/keycloak'
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: keycloak
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_HOSTNAME_STRICT_HTTPS: 'false'
      DB_MIN_POOL_SIZE: 1
      DB_MAX_POOL_SIZE: 5
      JGROUPS_CLUSTER_PASSWORD: password
      JAVA_OPTS_APPEND: '-Dkeycloak.profile.feature.impersonation=disabled -Djboss.persistent.log.dir=/var/log/eap -Djgroups.dns.query=disable'
      KC_HTTP_RELATIVE_PATH: /auth

      DB_JNDI: java:jboss/datasources/KeycloakDS
      DB_SERVICE_PREFIX_MAPPING: db-postgresql=DB
      TX_DATABASE_PREFIX_MAPPING: db-postgresql=DB
      # JGROUPS_PING_PROTOCOL: dns.DNS_PING
      TZ: America/Vancouver
    volumes:
      - logs_data:/var/log/eap
    networks:
      css-net:
        aliases: ['dev-keycloak.localtest.me']

  test-keycloak:
    container_name: test-keycloak
    image: ghcr.io/bcgov/sso:v26.6.8-build.1

    depends_on:
      - sso-db
    ports:
      - 9081:9081
    command: start-dev --http-port=9081
    environment:
      DB_POSTGRESQL_SERVICE_HOST: postgres
      DB_POSTGRESQL_SERVICE_PORT: 5433
      KC_DB: postgres
      KC_DB_URL_DATABASE: keycloaktest
      KC_DB_URL: 'jdbc:postgresql://sso-db:5433/keycloaktest'
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: keycloak
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_HOSTNAME_STRICT_HTTPS: 'false'
      DB_MIN_POOL_SIZE: 1
      DB_MAX_POOL_SIZE: 5
      JGROUPS_CLUSTER_PASSWORD: password
      JAVA_OPTS_APPEND: '-Dkeycloak.profile.feature.impersonation=disabled -Djboss.persistent.log.dir=/var/log/eap -Djgroups.dns.query=disable'
      KC_HTTP_RELATIVE_PATH: /auth

      DB_JNDI: java:jboss/datasources/KeycloakDS
      DB_SERVICE_PREFIX_MAPPING: db-postgresql=DB
      TX_DATABASE_PREFIX_MAPPING: db-postgresql=DB
      # JGROUPS_PING_PROTOCOL: dns.DNS_PING
      TZ: America/Vancouver
    volumes:
      - logs_data:/var/log/eap
    networks:
      css-net:
        aliases: ['test-keycloak.localtest.me']

  prod-keycloak:
    container_name: prod-keycloak
    image: ghcr.io/bcgov/sso:v26.6.8-build.1

    depends_on:
      - sso-db
    ports:
      - 9082:9082
    command: start-dev --http-port=9082
    environment:
      DB_POSTGRESQL_SERVICE_HOST: postgres
      DB_POSTGRESQL_SERVICE_PORT: 5433
      KC_DB: postgres
      KC_DB_URL_DATABASE: keycloakprod
      KC_DB_URL: 'jdbc:postgresql://sso-db:5433/keycloakprod'
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: keycloak
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_HOSTNAME_STRICT_HTTPS: 'false'
      DB_MIN_POOL_SIZE: 1
      DB_MAX_POOL_SIZE: 5
      JGROUPS_CLUSTER_PASSWORD: password
      JAVA_OPTS_APPEND: '-Dkeycloak.profile.feature.impersonation=disabled -Djboss.persistent.log.dir=/var/log/eap -Djgroups.dns.query=disable'
      KC_HTTP_RELATIVE_PATH: /auth

      DB_JNDI: java:jboss/datasources/KeycloakDS
      DB_SERVICE_PREFIX_MAPPING: db-postgresql=DB
      TX_DATABASE_PREFIX_MAPPING: db-postgresql=DB
      # JGROUPS_PING_PROTOCOL: dns.DNS_PING
      TZ: America/Vancouver
    volumes:
      - logs_data:/var/log/eap
    networks:
      css-net:
        aliases: ['prod-keycloak.localtest.me']

  dev-kc-migration:
    container_name: dev-kc-migration
    build:
      context: .
      dockerfile: Dockerfile.tf-modules
    depends_on:
      - dev-keycloak
    image: tf-modules-migrator:latest
    environment:
      HEALTH_CHECK_URL: http://dev-keycloak.localtest.me:9080
      TF_VAR_keycloak_url: http://dev-keycloak:9080
      TF_VAR_username: admin
      TF_VAR_password: admin
      KC_ENV: dev
    volumes:
      - sso-kc-terraform-dev:/terraform
    networks:
      - css-net

  test-kc-migration:
    container_name: test-kc-migration
    build:
      context: .
      dockerfile: Dockerfile.tf-modules
    depends_on:
      - test-keycloak
      - dev-kc-migration
    image: tf-modules-migrator:latest
    environment:
      HEALTH_CHECK_URL: http://test-keycloak.localtest.me:9081
      TF_VAR_keycloak_url: http://test-keycloak:9081
      TF_VAR_username: admin
      TF_VAR_password: admin
      KC_ENV: test
    volumes:
      - sso-kc-terraform-test:/terraform
    networks:
      - css-net

  prod-kc-migration:
    container_name: prod-kc-migration
    build:
      context: .
      dockerfile: Dockerfile.tf-modules
    depends_on:
      - prod-keycloak
      - test-kc-migration
    image: tf-modules-migrator:latest
    environment:
      HEALTH_CHECK_URL: http://prod-keycloak.localtest.me:9082
      TF_VAR_keycloak_url: http://prod-keycloak:9082
      TF_VAR_username: admin
      TF_VAR_password: admin
      KC_ENV: prod
    volumes:
      - sso-kc-terraform-prod:/terraform
    networks:
      - css-net

volumes:
  sso-requests-data:
    driver: local
  sso-kc-terraform-dev:
    driver: local
  sso-kc-terraform-test:
    driver: local
  sso-kc-terraform-prod:
    driver: local
  logs_data:
    driver: local
networks:
  css-net: {}