version: '3.4'

services:
  mongo:
    image: 'mongo:latest'
    networks: 
      - oc
    ports:
      - 27017:27017
    container_name: mongo
    volumes: 
      - oc-data:/data/db
      - oc-data:/data/configdb
  
  mongo-express:
    image: "mongo-express:latest"
    restart: always
    depends_on: 
      - mongo
    networks: 
      - oc
    ports:
      - 8081:8081
    environment:
      - ME_CONFIG_BASICAUTH_USERNAME=test
      - ME_CONFIG_BASICAUTH_PASSWORD=test
  nats:
    image: 'nats:latest'
    container_name: nats
    ports:
      - 4222:4222
    command:
      - "--debug"
    networks: 
      - oc
  loki:
    image: 'grafana/loki'
    container_name: loki
    labels:
        - "traefik.enable=true"
        - "traefik.http.routers.loki.entrypoints=web"
        - "traefik.http.routers.loki.rule=PathPrefix(`/tools/loki`)"
        - "traefik.http.services.loki.loadbalancer.server.port=3100"
        - "traefik.http.middlewares.loki-stripprefix.stripprefix.prefixes=/tools/loki"
        - "traefik.http.routers.loki.middlewares=loki-stripprefix"
        - "traefik.http.middlewares.loki.forwardauth.address=http://oc-auth:8080/oc/forward"
    ports : 
      - "3100:3100"
    networks:
      - oc
  grafana:
    image: 'grafana/grafana'
    container_name: grafana
    ports:
      - '3000:3000'
    labels:
        - "traefik.enable=true"
        - "traefik.http.routers.grafana.entrypoints=web"
        - "traefik.http.routers.grafana.rule=PathPrefix(`/tools/grafana`)"
        - "traefik.http.services.grafana.loadbalancer.server.port=3000"
        - "traefik.http.middlewares.grafana-stripprefix.stripprefix.prefixes=/tools/grafana"
        - "traefik.http.routers.grafana.middlewares=grafana-stripprefix"
        - "traefik.http.middlewares.grafana.forwardauth.address=http://oc-auth:8080/oc/forward"
    networks:
      - oc
    volumes:
      - ./conf/grafana_data_source.yml:/etc/grafana/provisioning/datasources/datasource.yml
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=pfnirt                   # Change this to anything but admin to not have a password change page at startup
      - GF_SECURITY_ADMIN_USER=admin
      - GF_SECURITY_DISABLE_INITIAL_ADMIN_PASSWORD_CHANGE=true
  hydra-client: 
        image: oryd/hydra:v2.2.0
        container_name: hydra-client
        environment:
            HYDRA_ADMIN_URL: http://hydra:4445
            ORY_SDK_URL: http://hydra:4445
        command:
            - create
            - oauth2-client
            - --skip-tls-verify
            - --name
            - test-client
            - --secret
            - oc-auth-got-secret
            - --response-type
            - id_token,token,code
            - --grant-type
            - implicit,refresh_token,authorization_code,client_credentials
            - --scope
            - openid,profile,email,roles
            - --token-endpoint-auth-method
            - client_secret_post
            - --redirect-uri
            - http://localhost:3000

        networks:
            - oc
        deploy:
            restart_policy:
                condition: none
        depends_on:
            - hydra
        healthcheck:
            test: ["CMD", "curl", "-f", "http://hydra:4445"]
            interval: 10s
            timeout: 10s
            retries: 10
  hydra:
      container_name: hydra
      image: oryd/hydra:v2.2.0
      environment:
        SECRETS_SYSTEM: oc-auth-got-secret
        LOG_LEAK_SENSITIVE_VALUES: true
        # OAUTH2_TOKEN_HOOK_URL: http://oc-auth:8080/oc/claims
        URLS_SELF_ISSUER: http://hydra:4444
        URLS_SELF_PUBLIC: http://hydra:4444
        WEBFINGER_OIDC_DISCOVERY_SUPPORTED_SCOPES: profile,email,phone,roles
        WEBFINGER_OIDC_DISCOVERY_SUPPORTED_CLAIMS: name,family_name,given_name,nickname,email,phone_number
        DSN: memory
      command: serve all --dev
      networks:
        - oc
      ports:
        - "4444:4444"
        - "4445:4445"
      deploy:
        restart_policy:
          condition: on-failure
  ldap:
    image: pgarrett/ldap-alpine
    container_name: ldap
    volumes:  
      - "./ldap.ldif:/ldif/ldap.ldif"
    networks:
      - oc
    ports:
      - "390:389"
    deploy:
      restart_policy:
        condition: on-failure
  keto:
    image: oryd/keto:v0.7.0-alpha.1-sqlite
    ports:
      - "4466:4466"
      - "4467:4467"
    command: serve -c /home/ory/keto.yml
    restart: on-failure
    volumes:
      - type: bind
        source: .
        target: /home/ory
    container_name: keto
    networks: 
      - oc

volumes:
  oc-data:

networks: 
  oc:
    external: true