docker-compose.yaml

services:

  dozzle: # Web-based UI for browsing container logs
    image: amir20/dozzle:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      default:
        aliases:
          - dozzle.localhost
    ports:
      - '11080:8080'
    restart: unless-stopped

  siga-demo-application:
    image: ${SIGA_DEMO_DOCKER_REGISTRY}${SIGA_DEMO_PROJECT}siga-demo-application:latest
    environment:
      - server.port=9443
      - server.ssl.enabled=true
      - server.ssl.key-store=/etc/siga-demo/siga-demo.localhost.keystore.p12
      - server.ssl.key-store-password=changeit
      - server.ssl.key-alias=siga-demo.localhost
      - siga.api.uri=https://siga.localhost:8443
      - siga.api.trust-store=file:/etc/siga-demo/siga-demo.truststore.p12
      - siga.api.trust-store-password=changeit
      - siga.client.hmac.service-uuid=a7fd7728-a3ea-4975-bfab-f240a67e894f
      - siga.client.hmac.shared-signing-key=746573745365637265744b6579303031
    ports:
      - "9443:9443"
    networks:
      default:
        aliases:
          - siga-demo.localhost
    volumes:
      - ./docker/tls/siga-demo/siga-demo.localhost.keystore.p12:/etc/siga-demo/siga-demo.localhost.keystore.p12
      - ./docker/tls/siga-demo/siga-demo.truststore.p12:/etc/siga-demo/siga-demo.truststore.p12

  siga:
    image: nginx:latest
    ports:
      - "8443:8443"
    networks:
      default:
        aliases:
          - siga.localhost
    volumes:
      - ./docker/tls/siga/siga.localhost.key:/var/certs/siga.localhost.key
      - ./docker/tls/siga/siga.localhost.crt:/var/certs/siga.localhost.crt
      - ./docker/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - siga-01
      - siga-02

  siga-01:
    image: ${SIGA_DOCKER_REGISTRY}${SIGA_PROJECT}siga-webapp:latest
    environment:
      - server.port=7443
      - server.ssl.key-alias=siga-01.localhost
      - siga.session-storage.type=${SIGA_SESSION_STORAGE_TYPE:-redis}
      - BPL_DEBUG_ENABLED=true
      - BPL_DEBUG_PORT=7000
      # Logs directory
      - BUILD_FOLDER=/tmp/logs
      - IGNITE_WORK_DIR=/tmp/ignite
      - SPRING_CONFIG_ADDITIONAL_LOCATION=file:/etc/siga/application.yml
      - JAVA_TOOL_OPTIONS=-Dfile.encoding=UTF8 -XX:MaxDirectMemorySize=256M
      # The '--add-opens' below is required for running Apache Ignite with JDK 17
      - JAVA_OPTS=
        -Djava.net.preferIPv4Stack=true
        --add-opens=jdk.management/com.sun.management.internal=ALL-UNNAMED
        --add-opens=java.base/jdk.internal.misc=ALL-UNNAMED
        --add-opens=java.base/sun.nio.ch=ALL-UNNAMED
        --add-opens=java.management/com.sun.jmx.mbeanserver=ALL-UNNAMED
        --add-opens=java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED
        --add-opens=java.base/java.io=ALL-UNNAMED
        --add-opens=java.base/java.nio=ALL-UNNAMED
        --add-opens=java.base/java.util=ALL-UNNAMED
        --add-opens=java.base/java.util.concurrent=ALL-UNNAMED
        --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED
        --add-opens=java.base/java.util.concurrent.locks=ALL-UNNAMED
        --add-opens=java.base/java.lang=ALL-UNNAMED
        --add-opens=java.base/java.time=ALL-UNNAMED
        --add-opens=java.base/sun.security.x509=ALL-UNNAMED
        --add-opens=java.base/java.security.cert=ALL-UNNAMED
    ports:
      - "7443:7443"
      - "7000:7000"
    networks:
      default:
        aliases:
          - siga-01.localhost
    volumes:
      - ./docker/tls/siga-01/siga-01.localhost.keystore.p12:/etc/siga/siga.localhost.keystore.p12
      - ./docker/tls/mid/mid.truststore.p12:/etc/siga/mid.truststore.p12
      - ./docker/tls/sid/sid.truststore.p12:/etc/siga/sid.truststore.p12
      - ./docker/tls/siva/siva.truststore.p12:/etc/siga/siva.truststore.p12
      - ./docker/siga-ignite/ignite-configuration.xml:/etc/siga/ignite-configuration.xml
      - ./docker/siga-webapp/application.yml:/etc/siga/application.yml
      - ./docker/siga-webapp/logback.xml:/etc/siga/logback.xml
    depends_on:
      siga-db:
        condition: service_started

  siga-02:
    image: ${SIGA_DOCKER_REGISTRY}${SIGA_PROJECT}siga-webapp:latest
    environment:
      - server.port=6443
      - server.ssl.key-alias=siga-02.localhost
      - spring.liquibase.enabled=false
      - siga.session-storage.type=${SIGA_SESSION_STORAGE_TYPE:-redis}
      - BPL_DEBUG_ENABLED=true
      - BPL_DEBUG_PORT=6000
      # Logs directory
      - BUILD_FOLDER=/tmp/logs
      - IGNITE_WORK_DIR=/tmp/ignite
      - SPRING_CONFIG_ADDITIONAL_LOCATION=file:/etc/siga/application.yml
      - JAVA_TOOL_OPTIONS=-Dfile.encoding=UTF8 -XX:MaxDirectMemorySize=256M
      # The '--add-opens' below is required for running Apache Ignite with JDK 17
      - JAVA_OPTS=
        -Djava.net.preferIPv4Stack=true
        --add-opens=jdk.management/com.sun.management.internal=ALL-UNNAMED
        --add-opens=java.base/jdk.internal.misc=ALL-UNNAMED
        --add-opens=java.base/sun.nio.ch=ALL-UNNAMED
        --add-opens=java.management/com.sun.jmx.mbeanserver=ALL-UNNAMED
        --add-opens=java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED
        --add-opens=java.base/java.io=ALL-UNNAMED
        --add-opens=java.base/java.nio=ALL-UNNAMED
        --add-opens=java.base/java.util=ALL-UNNAMED
        --add-opens=java.base/java.util.concurrent=ALL-UNNAMED
        --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED
        --add-opens=java.base/java.util.concurrent.locks=ALL-UNNAMED
        --add-opens=java.base/java.lang=ALL-UNNAMED
        --add-opens=java.base/java.time=ALL-UNNAMED
        --add-opens=java.base/sun.security.x509=ALL-UNNAMED
        --add-opens=java.base/java.security.cert=ALL-UNNAMED
    ports:
      - "6443:6443"
      - "6000:6000"
    networks:
      default:
        aliases:
          - siga-02.localhost
    volumes:
      - ./docker/tls/siga-02/siga-02.localhost.keystore.p12:/etc/siga/siga.localhost.keystore.p12
      - ./docker/tls/mid/mid.truststore.p12:/etc/siga/mid.truststore.p12
      - ./docker/tls/sid/sid.truststore.p12:/etc/siga/sid.truststore.p12
      - ./docker/tls/siva/siva.truststore.p12:/etc/siga/siva.truststore.p12
      - ./docker/siga-ignite/ignite-configuration.xml:/etc/siga/ignite-configuration.xml
      - ./docker/siga-webapp/application.yml:/etc/siga/application.yml
      - ./docker/siga-webapp/logback.xml:/etc/siga/logback.xml
    depends_on:
      siga-db:
        condition: service_started

  siga-db:
    image: postgres:13
    restart: always
    environment:
      - POSTGRES_DB=siga_db
      - POSTGRES_USER=sa
      - POSTGRES_PASSWORD=
      - POSTGRES_HOST_AUTH_METHOD=trust
    ports:
      - "5432:5432"
    volumes:
      - ./docker/siga-db/install-extensions.sql:/docker-entrypoint-initdb.d/install-extensions.sql

  siga-admin:
    image: ${SIGA_ADMIN_DOCKER_REGISTRY}${SIGA_ADMIN_PROJECT}siga-admin-webapp:latest
    profiles:
      - siga-admin
    environment:
      - siga.admin.esteid-ldap.tls-truststore-path=file:/etc/siga-admin/tls.esteid-ldap.truststore.p12
      - siga.admin.esteid-ldap.tls-truststore-password=changeit
      - siga.admin.relying-party.sk-relying-party-name=DEMO
      - siga.admin.relying-party.sk-relying-party-uuid=00000000-0000-0000-0000-000000000000
      - siga.admin.relying-party.smart-id-relying-party-name=DEMO
      - siga.admin.relying-party.smart-id-relying-party-uuid=00000000-0000-0000-0000-000000000000
      - siga.admin.auth.in-memory-authority=authority
      - siga.admin.auth.in-memory-password=admin
      - siga.admin.auth.in-memory-username=admin
      - siga.admin.auth.siga-admin-authority-name=authority
      - siga.admin.cdoc.encrypted-file-name=parooliymbrik.txt
      - siga.admin.csp.report-url=https://example.com
      - siga.admin.email.attachment-file-name=parooliymbrik.cdoc
      - siga.admin.email.from.email=test@email.com
      - siga.admin.email.from.name=Allkirjastamisteenus
      - siga.admin.email.subject=Allkirjastamisteenuse kasutamiseks vajalikud andmed
      - siga.admin.esteid-ldap-url=esteid.ldap.sk.ee
      - siga.security.jasypt.encryption-algo=PBEWITHSHA-256AND256BITAES-CBC-BC
      - siga.security.jasypt.encryption-key=encryptorKey
      - server.port=4443
      - server.ssl.enabled=true
      - server.ssl.key-store-type=PKCS12
      - server.ssl.key-store-password=changeit
      - server.ssl.key-store=/etc/siga-admin/siga-admin.localhost.keystore.p12
      - server.ssl.key-alias=siga-admin.localhost
      - spring.datasource.url=jdbc:postgresql://siga-db:5432/siga_db
      - spring.datasource.username=sa
      - spring.datasource.password=
      - spring.profiles.active=inMemoryAuth
      - spring.mail.host=siga-admin-smtp.localhost
      - spring.mail.port=25
      - spring.mail.properties.mail.smtp.auth=false
      - spring.mail.properties.mail.smtp.starttls.enable=true
      - spring.mail.properties.mail.smtp.starttls.required=true
      - logging.config=/etc/siga-admin/logback.xml
      # When esteid.ldap.sk.ee starts supporting other ciphers, like ECDHE, remove this workaround.
      - ALLOW_INSECURE_TLS_RSA_KEY_EXCHANGE=true
      - BUILD_FOLDER=/tmp/logs
      - BPL_DEBUG_ENABLED=true
      - BPL_DEBUG_PORT=4000
      - JAVA_OPTS=
        -Djavax.net.ssl.trustStore=/etc/siga-admin/smtp.truststore.p12
        -Djavax.net.ssl.trustStorePassword='changeit'
        -Djavax.net.ssl.trustStoreType=pkcs12
        -Djavax.net.ssl.keyStore=/etc/siga-admin/siga-admin.localhost.keystore.p12
        -Djavax.net.ssl.keyStorePassword=changeit
        -Djavax.net.ssl.keyStoreType=pkcs12
    ports:
      - "4443:4443"
      - "4000:4000"
    networks:
      default:
        aliases:
          - siga-admin.localhost
    volumes:
      - ./docker/siga-admin/logback.xml:/etc/siga-admin/logback.xml
      - ./docker/tls/siga-admin/siga-admin.localhost.keystore.p12:/etc/siga-admin/siga-admin.localhost.keystore.p12
      - ./docker/tls/esteid-ldap/esteid-ldap.truststore.p12:/etc/siga-admin/tls.esteid-ldap.truststore.p12
      - ./docker/tls/siga-admin-smtp/siga-admin-smtp.truststore.p12:/etc/siga-admin/smtp.truststore.p12

  siga-admin-smtp:
    image: rnwood/smtp4dev:3.2.0-ci20221023104
    profiles:
      - siga-admin
    environment:
      - ServerOptions__TlsMode=StartTls
      - ServerOptions__TlsCertificatePassword=changeit
      - ServerOptions__TlsCertificate=/siga-admin-smtp.localhost.keystore.p12
    ports:
      - "2525:25"
      - "3000:80"
    networks:
      default:
        aliases:
          - siga-admin-smtp.localhost
    volumes:
      # The directory where smtp4dev will store the e-mail database.
      - ./docker/siga-admin-smtp/:/smtp4dev
      # TLS keystore
      - ./docker/tls/siga-admin-smtp/siga-admin-smtp.localhost.keystore.p12:/siga-admin-smtp.localhost.keystore.p12

  siga-redis-1:
    image: valkey/valkey:7.2.6-alpine
    profiles: [ "redis" ]
    restart: unless-stopped
    command: >
      valkey-server
      --port 6379
      --cluster-enabled yes
      --cluster-config-file nodes.conf
      --cluster-node-timeout 5000
      --cluster-announce-hostname siga-redis-1
      --cluster-announce-port 6379
      --cluster-announce-bus-port 16379
      --cluster-preferred-endpoint-type hostname
      --notify-keyspace-events Ex
      --appendonly no
    ports:
      - "6379:6379"
      - "16379:16379"
    networks:
      default:
        aliases:
          - siga-redis-1.localhost

  siga-redis-2:
    image: valkey/valkey:7.2.6-alpine
    profiles: [ "redis" ]
    restart: unless-stopped
    command: >
      valkey-server
      --port 6380
      --cluster-enabled yes
      --cluster-config-file nodes.conf
      --cluster-node-timeout 5000
      --cluster-announce-hostname siga-redis-2
      --cluster-announce-port 6380
      --cluster-announce-bus-port 16380
      --cluster-preferred-endpoint-type hostname
      --notify-keyspace-events Ex
      --appendonly no
    ports:
      - "6380:6380"
      - "16380:16380"
    networks:
      default:
        aliases:
          - siga-redis-2.localhost

  siga-redis-3:
    image: valkey/valkey:7.2.6-alpine
    profiles: [ "redis" ]
    restart: unless-stopped
    command: >
      valkey-server
      --port 6381
      --cluster-enabled yes
      --cluster-config-file nodes.conf
      --cluster-node-timeout 5000
      --cluster-announce-hostname siga-redis-3
      --cluster-announce-port 6381
      --cluster-announce-bus-port 16381
      --cluster-preferred-endpoint-type hostname
      --notify-keyspace-events Ex
      --appendonly no
    ports:
      - "6381:6381"
      - "16381:16381"
    networks:
      default:
        aliases:
          - siga-redis-3.localhost

  siga-redis-init:
    image: valkey/valkey:7.2.6-alpine
    profiles: [ "redis" ]
    restart: "no"
    depends_on:
      - siga-redis-1
      - siga-redis-2
      - siga-redis-3
    networks:
      - default
    entrypoint:
      - sh
      - -c
      - |
        set -e
        for entry in siga-redis-1:6379 siga-redis-2:6380 siga-redis-3:6381; do
          host=$${entry%:*}
          port=$${entry#*:}
          until valkey-cli -h $$host -p $$port ping 2>/dev/null | grep -q PONG; do
            echo "Waiting for $$host:$$port..."
            sleep 1
          done
        done
        if valkey-cli -h siga-redis-1 -p 6379 cluster info | grep -q "cluster_state:ok"; then
          echo "Cluster already formed, skipping create"
          exit 0
        fi
        valkey-cli --cluster create \
          siga-redis-1:6379 siga-redis-2:6380 siga-redis-3:6381 \
          --cluster-replicas 0 --cluster-yes
        echo "Cluster created"

  ignite-01:
    profiles: [ "ignite" ]
    # TODO: Use pre-built image when an official Ignite image is released for JDK17.
    #       '--build' argument in README.md can also be removed after that.
    #image: apacheignite/ignite:2.18.0
    build: docker/siga-ignite
    environment:
      - CONFIG_URI=/etc/ignite/ignite-configuration.xml
      - JVM_OPTS=
        -Xms512m -Xmx512m -server -XX:+UseG1GC -XX:+DisableExplicitGC
        -Djava.net.preferIPv4Stack=true
    networks:
      default:
        aliases:
          - ignite-01.localhost
    volumes:
      - ./docker/siga-ignite/ignite-configuration.xml:/etc/ignite/ignite-configuration.xml
      - ./docker/siga-ignite/run.sh:/opt/ignite/apache-ignite-2.18.0-bin/run.sh

  ignite-02:
    profiles: [ "ignite" ]
    # TODO: Use pre-built image when an official Ignite image is released for JDK17.
    #       '--build' argument in README.md can also be removed after that.
    #image: apacheignite/ignite:2.18.0
    build: docker/siga-ignite
    environment:
      - CONFIG_URI=/etc/ignite/ignite-configuration.xml
      - JVM_OPTS=
        -Xms512m -Xmx512m -server -XX:+UseG1GC -XX:+DisableExplicitGC
        -Djava.net.preferIPv4Stack=true
    networks:
      default:
        aliases:
          - ignite-02.localhost
    volumes:
      - ./docker/siga-ignite/ignite-configuration.xml:/etc/ignite/ignite-configuration.xml
      - ./docker/siga-ignite/run.sh:/opt/ignite/apache-ignite-2.18.0-bin/run.sh