123 lines
4.1 KiB
YAML
123 lines
4.1 KiB
YAML
services:
|
|
db:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
POSTGRES_DB: ${POSTGRES_DB}
|
|
ports:
|
|
- "${POSTGRES_PORT}:5432"
|
|
volumes:
|
|
- scouthub_db_data:/var/lib/postgresql/data
|
|
# Crea anche il DB scouthub_home usato da scouthub-home-be (solo al primo init).
|
|
- ./db-init:/docker-entrypoint-initdb.d:ro
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
attivita-backend:
|
|
build:
|
|
context: ./scouthub-attivita-be
|
|
restart: unless-stopped
|
|
environment:
|
|
PORT: ${ATTIVITA_BACKEND_PORT}
|
|
CORS_ORIGIN: http://localhost:${ATTIVITA_FRONTEND_PORT}
|
|
DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=public
|
|
KEYCLOAK_BASE_URL: http://keycloak:8080
|
|
KEYCLOAK_REALM: scouthub
|
|
ports:
|
|
- "${ATTIVITA_BACKEND_PORT}:${ATTIVITA_BACKEND_PORT}"
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
keycloak:
|
|
condition: service_started
|
|
|
|
attivita-frontend:
|
|
build:
|
|
context: ./scouthub-attivita-fe
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${ATTIVITA_FRONTEND_PORT}:80"
|
|
depends_on:
|
|
- attivita-backend
|
|
|
|
home-backend:
|
|
build:
|
|
context: ./scouthub-home-be
|
|
restart: unless-stopped
|
|
environment:
|
|
PORT: ${HOME_BACKEND_PORT}
|
|
DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/scouthub_home?schema=public
|
|
FRONTEND_BASE_URL: http://localhost:${HOME_FRONTEND_PORT}
|
|
# Rete interna Docker: la validazione del JWT (JWKS) non controlla l'issuer,
|
|
# quindi non serve che coincida con l'hostname visto dal browser (localhost:8081).
|
|
KEYCLOAK_BASE_URL: http://keycloak:8080
|
|
KEYCLOAK_REALM: scouthub
|
|
KEYCLOAK_ORG_SERVICE_CLIENT_ID: scouthub-home-be
|
|
KEYCLOAK_ORG_SERVICE_CLIENT_SECRET: ${KEYCLOAK_ORG_SERVICE_CLIENT_SECRET}
|
|
ports:
|
|
- "${HOME_BACKEND_PORT}:${HOME_BACKEND_PORT}"
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
keycloak:
|
|
condition: service_started
|
|
|
|
home-frontend:
|
|
build:
|
|
context: ./scouthub-home-fe
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${HOME_FRONTEND_PORT}:80"
|
|
depends_on:
|
|
- home-backend
|
|
|
|
keycloak-db:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: keycloak
|
|
POSTGRES_USER: keycloak
|
|
POSTGRES_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
|
|
volumes:
|
|
- scouthub_keycloak_db_data:/var/lib/postgresql/data
|
|
|
|
keycloak:
|
|
image: quay.io/keycloak/keycloak:26.7
|
|
restart: unless-stopped
|
|
# --import-realm importa keycloak/realm-export.json solo se il realm non esiste già
|
|
# NOTA: dopo l'import, assegnare al service account di scouthub-home-be i client role
|
|
# del client 'realm-management': manage-organizations, manage-users, manage-groups,
|
|
# view-users (permessi minimi, non manage-realm). Con Fine-Grained Admin Permissions
|
|
# (26.7+, feature admin-fine-grained-authz:v1) si puo' poi restringere ulteriormente
|
|
# per singola Organization.
|
|
command: start-dev --import-realm
|
|
environment:
|
|
KC_DB: postgres
|
|
KC_DB_URL: jdbc:postgresql://keycloak-db:5432/keycloak
|
|
KC_DB_USERNAME: keycloak
|
|
KC_DB_PASSWORD: ${KEYCLOAK_DB_PASSWORD}
|
|
KEYCLOAK_ADMIN: admin
|
|
KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
|
|
# admin-fine-grained-authz:v1 serve per i permessi granulari sulle Organization (26.7+).
|
|
# Verificare con `kc.sh show-config` che i flag richiesti siano invariati nella versione
|
|
# effettivamente usata: i nomi dei feature flag cambiano tra minor version di Keycloak.
|
|
KC_FEATURES: organization,admin-fine-grained-authz:v1
|
|
KC_HOSTNAME: localhost
|
|
KC_HOSTNAME_PORT: "${KEYCLOAK_PORT}"
|
|
KC_HTTP_ENABLED: "true"
|
|
ports:
|
|
- "${KEYCLOAK_PORT}:8080"
|
|
volumes:
|
|
- ./keycloak/realm-export.json:/opt/keycloak/data/import/realm-export.json:ro
|
|
depends_on:
|
|
- keycloak-db
|
|
|
|
volumes:
|
|
scouthub_db_data:
|
|
scouthub_keycloak_db_data:
|