docker-compose.yml

services:
  # docker compose up --force-recreate
  # To show variables
  # docker compose config > compose_config.yml
  traefik:
    image: traefik:v3.0
    container_name: traefik
    restart: unless-stopped
    # https://github.com/heyvaldemar/keycloak-traefik-letsencrypt-docker-compose/blob/main/keycloak-traefik-letsencrypt-docker-compose.yml
    command:
      - --log.level=ERROR
      #      - --accesslog=true
      # *** Remove api.insecure for production ***
      # Use port redirection, e.g. to 8081, to access dashboard
      - --api.insecure
      - --ping=true
      - --ping.entrypoint=ping
      - --entryPoints.ping.address=:8082

      - --providers.docker=true
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443

      - --certificatesresolvers.hrmresolver.acme.httpchallenge=true
      # *** For testing use caserver; comment for default
      # This will generate STAGING (=invalid) certificates for Wannabe Watercress or similar
      #- --certificatesresolvers.hrmresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
      - --certificatesresolvers.hrmresolver.acme.email=dieter.menne@menne-biomed.de
      - --certificatesresolvers.hrmresolver.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.hrmresolver.acme.httpchallenge.entryPoint=web
      - --global.checkNewVersion=true
      - --global.sendAnonymousUsage=false
      - --log.filePath=/log/traefik.log
    networks:
      - anomanor-net
    ports:
      - 80:80
      - 443:443
      # The Web UI (enabled by --api.insecure=true)
      - 8083:8080
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "http://localhost:8082/ping",
          "--spider"
        ]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
    labels:
      # global redirect to https
      - traefik.enable=true
      - traefik.docker.network=anomanor-net
      - traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)
      - traefik.http.routers.http-catchall.entrypoints=websecure
      - traefik.http.routers.http-catchall.middlewares=redirect-to-https
      - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
      - traefik.http.middlewares.https-redirect.headers.customrequestheaders.X-Forwarded-Proto=https

    volumes:
      # To view this file, might require:
      # sudo chown hrmconsensus:hrmconsensus letsencrypt/acme.json
      # see chown_docker_sock.sh
      - ./letsencrypt:/letsencrypt
      - ./log:/log
      - /var/run/docker.sock:/var/run/docker.sock

  keycloak:
    # Keycloak
    # https://keycloak.discourse.group/t/keycloak-behind-traefik/1832/3
    # To use smtp.gmail.com, get an app password from google
    # https://support.google.com/accounts/answer/185833?hl=en
    build:
      context: .
      dockerfile: Dockerfile_keycloak
    container_name: keycloak
    depends_on:
      - traefik
      - postgres
    labels:
      - traefik.enable=true
      - traefik.http.routers.keycloak.rule=Host(`${KEYCLOAK_SITE}`)
      - traefik.http.routers.keycloak.service=keycloak
      - traefik.http.routers.keycloak.entrypoints=websecure

      - traefik.http.services.keycloak.loadbalancer.server.port=8080
      - traefik.http.routers.keycloak.tls=true
      - traefik.http.routers.keycloak.tls.certresolver=hrmresolver
      - traefik.http.services.keycloak.loadbalancer.passhostheader=true
      - traefik.http.routers.keycloak.middlewares=compresstraefik
      - traefik.http.middlewares.compresstraefik.compress=true
      - traefik.docker.network=anomanor_net
    restart: unless-stopped
    ports:
      # nc -zv smtp.gmail.com 587
      - 8010:8080
    networks:
      - anomanor-net
    healthcheck:
      test: timeout 10s bash -c ':> /dev/tcp/127.0.0.1/8080' || exit 1
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 90s
    volumes:
      # to import a realm, inside the container:
      # /opt/keycloak/bin/kc.sh import --file /opt/jboss/keycloak/standalone/data/realm-export.json
      - /home/hrmconsensus/anomanor_data/keycloak:/opt/jboss/keycloak/standalone/data
    environment:
      # https://conciso.de/durchstarten-keycloak-docker/
      #      - KC_LOG_LEVEL=ALL
      - KC_HOSTNAME=${KEYCLOAK_SITE}
      - KC_HOSTNAME_STRICT=false
      - KEYCLOAK_ADMIN=${MASTER_ADMIN_USERNAME}
      - KEYCLOAK_ADMIN_PASSWORD=${MASTER_ADMIN_PASSWORD}
      # KC_PROXY is deprecated
      - KC_PROXY_HEADERS=xforwarded
      - KC_HTTP_ENABLED=true
      - TZ=Europe/Berlin
      # Do not use KC_DB! It will be inserted to URL_HOST
      - KC_DB_URL=jdbc:postgresql://postgres:5432/keycloak
      - KC_DB_SCHEMA=public
      - KC_DB_USERNAME=${ANOMANOR_ADMIN_USERNAME}
      - KC_DB_PASSWORD=${ANOMANOR_ADMIN_PASSWORD}
    # https://stackoverflow.com/questions/75082054/keycloak-does-not-use-postgres-database-and-tries-to-connect-h2-database
    # If in doubt, remove --optimized
    command: [ "start", "--optimized", "--verbose" ]
    # log level: https://www.keycloak.org/server/logging
    #command: [ "start" ]
    # The following has rarely an effect with Docker containers
    #command: ["start", "--verbose","--spi-theme-static-max-age=-1","--spi-theme-cache-themes=false","--spi-theme-cache-templates=false"]

  postgres:
    image: postgres:16
    container_name: postgres
    volumes:
      - /home/hrmconsensus/anomanor_data/postgres:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: ${ANOMANOR_ADMIN_USERNAME}
      POSTGRES_PASSWORD: ${ANOMANOR_ADMIN_PASSWORD}
    networks:
      - anomanor-net
    ports:
      - 5432:5432
    healthcheck:
      test:
        [
          "CMD",
          "pg_isready",
          "-q",
          "-d",
          "keycloak",
          "-U",
          "${ANOMANOR_ADMIN_USERNAME}"
        ]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s
    restart: unless-stopped

  shinyproxy:
    #profiles: [ "with_shiny_proxy" ]
    build:
      context: .
      dockerfile: Dockerfile_shinyproxy
    container_name: shinyproxy
    depends_on:
      - traefik
      - keycloak
    restart: unless-stopped
    labels:
      - traefik.http.routers.shinyproxy.rule=Host(`hrmconsensus.org`)
      - traefik.http.routers.shinyproxy.entrypoints=websecure
      - traefik.http.routers.shinyproxy.tls=true
      - traefik.http.routers.shinyproxy.tls.certresolver=hrmresolver

    environment:
      # Defaults only used for compose down
      - KEYCLOAK_IP=${KEYCLOAK_IP:-0.0.0.0}
      - ANOMANOR_DATA=${ANOMANOR_DATA:-/root/anomanor_data/anomanor}
      - ANOMANOR_SECRET=$ANOMANOR_SECRET
    ports:
      - 8020:8080
    networks:
      - anomanor-net
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  portainer:
    image: portainer/portainer-ce
    container_name: portainer
    restart: unless-stopped
    depends_on:
      - traefik
    labels:
      - traefik.http.routers.portainer.rule=Host(`portainer.hrmconsensus.org`)
      - traefik.http.routers.portainer.entrypoints=websecure
      - traefik.http.routers.portainer.tls=true
      - traefik.http.routers.portainer.tls.certresolver=hrmresolver
      - traefik.http.services.portainer.loadbalancer.server.port=9000 # required
    networks:
      - anomanor-net
    ports:
      - 9000:9000
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer:/data

  sqlpad:
    image: sqlpad/sqlpad:latest
    depends_on:
      - traefik
    restart: unless-stopped
    container_name: sqlpad
    labels:
      - traefik.http.routers.sqlpad.rule=Host(`sqlpad.hrmconsensus.org`)
      - traefik.http.routers.sqlpad.entrypoints=websecure
      - traefik.http.routers.sqlpad.tls.certresolver=hrmresolver
    ports:
      - 3000:3000
    networks:
      - anomanor-net
    environment:
      # Defaults are set to avoid warning on docker compose down
      - SQLPAD_ADMIN=${SQLPAD_ADMIN_USERNAME:-sqlpad_admin}
      - SQLPAD_ADMIN_PASSWORD=${SQLPAD_ADMIN_PASSWORD:-sqlpad_admin_password}
    volumes:
      - sqlpad_data:/var/lib/sqlpad
      # Use/root/anomanor_data/anomanor/db/anomanor.sqlite as Filename/path in sqlpad connection
      - /home/hrmconsensus/anomanor_data/anomanor/db:${ANOMANOR_DATA:-/root/anomanor_data/anomanor}/db

volumes:
  portainer:
  sqlpad_data:


networks:
  anomanor-net:
    name: anomanor-net
    driver: bridge