docker-compose.dev.yml

services:
  traefik:
    image: "traefik:v3.6.1"
    container_name: traefik
    networks:
      md_net:
    restart: unless-stopped
    command:
      # - --metrics
      # - --metrics.prometheus.buckets=0.1,0.3,1.2,5.0
      - "--providers.file.filename=/traefik.yml"
      # - --accesslog=true
      # - --accesslog.filepath=/var/log/traefik/access.log
    ports:
      - "80:80"
      - "8080:8080"
      - "443:443"
      - "389:389"
      - "389:389/udp"
      - "3268:3268"
      - "3269:3269"
      - "636:636"
      - "749:749"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - ./certs:/letsencrypt
      - ".package/traefik.yml:/traefik.yml"

    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 128M
        reservations:
          cpus: '0.25'
          memory: 32M
    healthcheck:
      test: traefik traefik healthcheck --ping
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 3s

  traefik_certs_dumper:
    image: multidirectory
    container_name: traefik_certs_dumper
    networks:
      md_net:
    restart: "on-failure"
    volumes:
      - ./certs:/certs
      - ".package/traefik.yml:/traefik.yml"
    command: python multidirectory.py --certs_dumper
    env_file:
      local.env
    depends_on:
      - traefik

  interface:
    container_name: multidirectory_interface
    networks:
      md_net:
    # image: ghcr.io/multidirectorylab/multidirectory-web-admin::beta
    restart: unless-stopped
    build:
      context: ./interface
      dockerfile: configurations/docker/Dockerfile
      args:
        API_URL: https://${DOMAIN}/api
    environment:
      - HUSKY=0
      - API_URL=https://${DOMAIN}/api
      - NODE_ENV=development
    working_dir: /app
    env_file:
      local.env
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.interface.rule=Host(`${DOMAIN}`)'
      - "traefik.http.routers.interface.entrypoints=websecure"
      - "traefik.http.routers.interface.tls=true"
      - "traefik.http.routers.interface.tls.certresolver=md-resolver"
      - "traefik.http.services.interface.loadbalancer.server.port=80"

  cert_check:
    image: multidirectory
    container_name: multidirectory_certs_check
    networks:
      md_net:
    restart: "no"
    volumes:
      - ./certs:/certs
      - ./app:/app
    command: ./extra/generate_cert.sh

  cldap_server:
    build:
      context: .
      dockerfile: ./.docker/dev.Dockerfile
      args:
        DOCKER_BUILDKIT: 1
      target: runtime
    image: multidirectory
    networks:
      md_net:
    restart: unless-stopped
    environment:
      - SERVICE_NAME=cldap_server
    # container_name: multidirectory
    volumes:
      - ./app:/app
      - ./certs:/certs
      - ldap_keytab:/LDAP_keytab/
    env_file: local.env
    command: python -OO multidirectory.py --cldap
    tty: true
    depends_on:
      migrations:
        condition: service_completed_successfully
      cert_local_check:
        condition: service_completed_successfully
    deploy:
      resources:
        reservations:
          cpus: "0.25"
          memory: 100M
    labels:
      - traefik.enable=true

      - traefik.udp.routers.cldap.entrypoints=cldap
      - traefik.udp.routers.cldap.service=cldap
      - traefik.udp.services.cldap.loadbalancer.server.port=389

  global_ldap_server:
    build:
      context: .
      dockerfile: ./.docker/dev.Dockerfile
      args:
        DOCKER_BUILDKIT: 1
      target: runtime
    image: multidirectory
    networks:
      md_net:
    restart: unless-stopped
    deploy:
      mode: replicated
      replicas: 2
      endpoint_mode: dnsrr
      resources:
        reservations:
          cpus: "0.25"
          memory: 100M
    environment:
      - SERVICE_NAME=global_ldap_server
    volumes:
      - ./app:/app
      - ./certs:/certs
      - ./logs:/app/logs
      - ldap_keytab:/LDAP_keytab/
    env_file: local.env
    command: python -OO multidirectory.py --global_ldap_server
    tty: true
    depends_on:
      migrations:
        condition: service_completed_successfully
      cert_local_check:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD-SHELL", "nc -zv 127.0.0.1 3268 3269"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 3s
    labels:
      - traefik.enable=true

      - traefik.tcp.routers.global_ldap.rule=HostSNI(`*`)
      - traefik.tcp.routers.global_ldap.entrypoints=global_ldap
      - traefik.tcp.routers.global_ldap.service=global_ldap
      - traefik.tcp.services.global_ldap.loadbalancer.server.port=3268
      - traefik.tcp.services.global_ldap.loadbalancer.serversTransport=ldap_transport@file

      - traefik.tcp.routers.global_ldap_tls.rule=HostSNI(`*`)
      - traefik.tcp.routers.global_ldap_tls.entrypoints=global_ldap_tls
      - traefik.tcp.routers.global_ldap_tls.service=global_ldap_tls
      - traefik.tcp.routers.global_ldap_tls.tls=true
      - traefik.tcp.routers.global_ldap_tls.tls.certresolver=md-resolver
      - traefik.tcp.services.global_ldap_tls.loadbalancer.server.port=3269
      - traefik.tcp.services.global_ldap_tls.loadbalancer.serversTransport=ldap_transport@file

  cert_local_check:
    image: multidirectory
    container_name: multidirectory_local_certs_check
    networks:
      md_net:
    restart: "no"
    volumes:
      - ./certs:/certs
    command: sh -c "test -f /certs/cert.pem && echo 'CERT EXISTS, SKIPPING...' || openssl req -nodes -new -x509 -keyout /certs/privkey.pem -out /certs/cert.pem -subj '/C=RU/ST=Moscow/L=Moscow/O=Global Security/OU=Multifactor/CN=md.multifactor.dev'";

  migrations:
    image: multidirectory
    container_name: multidirectory_migrations
    networks:
      md_net:
    restart: "no"
    command: python multidirectory.py --migrate
    env_file:
      local.env
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - ./app:/app


  ldap_server:
    build:
      context: .
      dockerfile: .docker/Dockerfile
      args:
        DOCKER_BUILDKIT: 1
      target: runtime
    image: multidirectory
    networks:
      md_net:
    restart: unless-stopped
    hostname: multidirectory
    volumes:
      - ./app:/app
      - ./certs:/certs
      - ./logs:/app/logs
      - ldap_keytab:/LDAP_keytab/
    command: python multidirectory.py --ldap
    tty: true
    env_file:
      local.env
    environment:
      SERVICE_NAME: ldap_server
    depends_on:
      migrations:
        condition: service_completed_successfully
    deploy:
      mode: replicated
      replicas: 1
      endpoint_mode: dnsrr
      resources:
        reservations:
          cpus: '0.25'
          memory: 500M
    labels:
      - traefik.enable=true

      - traefik.tcp.routers.ldap.rule=HostSNI(`*`)
      - traefik.tcp.routers.ldap.entrypoints=ldap
      - traefik.tcp.routers.ldap.service=ldap
      - traefik.tcp.services.ldap.loadbalancer.server.port=389
      - traefik.tcp.services.ldap.loadbalancer.serversTransport=ldap_transport@file

      - traefik.tcp.routers.ldaps.rule=HostSNI(`*`)
      - traefik.tcp.routers.ldaps.entrypoints=ldaps
      - traefik.tcp.routers.ldaps.service=ldaps
      - traefik.tcp.routers.ldaps.tls=true
      - traefik.tcp.routers.ldaps.tls.certresolver=md-resolver
      - traefik.tcp.services.ldaps.loadbalancer.server.port=636
      - traefik.tcp.services.ldaps.loadbalancer.serversTransport=ldap_transport@file
    healthcheck:
      test: ["CMD-SHELL", "nc -zv 127.0.0.1 389 636"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 3s

  api_server:
    image: multidirectory
    container_name: multidirectory_api
    restart: unless-stopped
    environment:
      USE_CORE_TLS: 1
      SERVICE_NAME: multidirectory_api
      KRB5_LDAP_URI: ldap://ldap_server
    networks:
      md_net:
    hostname: api_server
    env_file:
      local.env
    volumes:
      - ./app:/app
      - ./certs:/certs
      - dns_server_file:/DNS_server_file/
      - dns_server_config:/DNS_server_configs/
      - ldap_keytab:/LDAP_keytab/
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`${DOMAIN}`) && PathPrefix(`/api`)"
      - "traefik.http.routers.api.tls.certresolver=md-resolver"
      - "traefik.http.routers.api.entrypoints=websecure"
      - "traefik.http.services.api.loadbalancer.server.port=8000"
      - "traefik.http.routers.api.service=api"
      - "traefik.http.routers.api.middlewares=api_strip"
      - "traefik.http.middlewares.api_strip.stripprefix.prefixes=/api"
      - "traefik.http.middlewares.api_strip.stripprefix.forceslash=false"

    command:  python multidirectory.py --http
    depends_on:
      migrations:
        condition: service_completed_successfully

  shadow_api:
    image: multidirectory
    container_name: shadow_api
    networks:
      md_net:
    restart: unless-stopped
    tty: true
    depends_on:
      migrations:
        condition: service_completed_successfully
      ldap_server:
        condition: service_healthy
        restart: true
    environment:
      - SERVICE_NAME=shadow_api
    volumes:
      - ./app:/app
      - ./certs:/certs
    env_file:
      local.env
    command: python multidirectory.py --shadow

  maintence:
    image: multidirectory
    container_name: md_maintence
    networks:
      md_net:
    restart: unless-stopped
    volumes:
      - ./certs:/certs
      - ./app:/app
      - ldap_keytab:/LDAP_keytab/
      - kdc:/etc/krb5kdc/
    env_file:
      local.env
    command: python multidirectory.py --scheduler
    tty: true
    depends_on:
      migrations:
        condition: service_completed_successfully
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 500M
        reservations:
          cpus: '0.1'
          memory: 6M

  postgres:
    container_name: MD-postgres
    networks:
      md_net:
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_USER: user1
      POSTGRES_PASSWORD: password123
      PGDATA: /data/postgres
    volumes:
       - postgres:/data/postgres
    ports:
      - 5432:5432
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d postgres -U user"]
      interval: 1s
      timeout: 15s
      retries: 10
      start_period: 3s

  kdc:
    build:
      context: .
      dockerfile: ./.docker/krb.Dockerfile
      args:
        VERSION: beta
    container_name: kdc
    networks:
      md_net:
    restart: unless-stopped
    hostname: kerberos
    volumes:
      - kdc:/etc
    image: krb5md
    tty: true
    depends_on:
      ldap_server:
        condition: service_healthy
        restart: true
    command: krb5kdc -n

    ports:
      - "88:88"
      - "88:88/udp"

  kadmin_api:
    image: krb5md
    container_name: kadmin-api
    networks:
      md_net:
    restart: unless-stopped
    volumes:
      - ./certs:/certs
      - .kerberos/:/server/
      - ./certs:/certs
      - kdc:/etc
    tty: true
    depends_on:
      ldap_server:
        condition: service_healthy
        restart: true
      cert_check:
        condition: service_completed_successfully
      kdc:
        condition: service_started
    working_dir: /server
    command: ./entrypoint.sh

  kadmind:
    container_name: kadmind
    networks:
      md_net:
    restart: unless-stopped
    hostname: kerberos
    volumes:
      - kdc:/etc
    image: krb5md
    tty: true
    depends_on:
      - ldap_server
      - kdc
    command: kadmind -nofork
    labels:
      - traefik.enable=true
      - traefik.tcp.routers.kadmind.rule=HostSNI(`*`)
      - traefik.tcp.routers.kadmind.entrypoints=kadmind
      - traefik.tcp.routers.kadmind.service=kadmind
      - traefik.tcp.services.kadmind.loadbalancer.server.port=749

      - traefik.tcp.routers.kpasswd.rule=HostSNI(`*`)
      - traefik.tcp.routers.kpasswd.entrypoints=kpasswd
      - traefik.tcp.routers.kpasswd.service=kpasswd
      - traefik.tcp.services.kpasswd.loadbalancer.server.port=464


  dragonfly:
    image: 'docker.dragonflydb.io/dragonflydb/dragonfly'
    container_name: dragonfly
    networks:
      md_net:
    restart: always
    expose:
      - 6379
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1.5GiB
        reservations:
          cpus: '0.25'
          memory: 0.5GiB

  kea_dhcp4:
    image: kea_image:0.1
    network_mode: host
    cap_add:
      - NET_ADMIN
    build:
      context: .
      dockerfile: ./.docker/kea.Dockerfile
    container_name: kea_dhcp4
    tty: true
    restart: unless-stopped
    command: -c /kea/config/kea-dhcp4.conf
    volumes:
      - dhcp:/kea/config
      - sockets:/kea/sockets
      - leases:/kea/leases

  kea_ctrl_agent:
    image: jonasal/kea-ctrl-agent:3.1.2-alpine
    container_name: kea_ctrl_agent
    networks:
      md_net:
    restart: unless-stopped
    command: -c /kea/config/kea-ctrl-agent.conf
    tty: true
    depends_on:
      kea_dhcp4:
        condition: service_started
    volumes:
      - ./.package/kea-ctrl-agent.conf:/kea/config/kea-ctrl-agent.conf
      - sockets:/kea/sockets
      - leases:/kea/leases

  pdns_auth:
    build:
      context: .
      dockerfile: ./.docker/pdns_auth.Dockerfile
      args:
        DOCKER_BUILDKIT: 1
    image: pdns_auth_md
    container_name: pdns_auth
    networks:
      default:
      md_net:
        ipv4_address: 172.20.0.202
    expose:
      - 8082
      - 53/udp
      - 53/tcp
    volumes:
      - dns_lmdb:/var/lib/pdns-lmdb
      - dns_config:/etc/powerdns


  pdnsdist:
    image: powerdns/dnsdist-19:1.9.11
    container_name: pdnsdist
    networks:
      default:
      md_net:
        ipv4_address: 172.20.0.201
    expose:
      - 8084
    ports:
      - "53:53/tcp"
      - "53:53/udp"
    volumes:
      - ./dnsdist.conf:/etc/dnsdist/dnsdist.conf
      - dnsdist_confd:/etc/dnsdist/conf.d


  pdns_recursor:
    image: powerdns/pdns-recursor-51:5.1.7
    container_name: pdns_recursor
    networks:
      default:
      md_net:
        ipv4_address: 172.20.0.200
    expose:
      - 8083
      - 53/udp
      - 53/tcp
    volumes:
      - ./.package/recursor.conf:/etc/powerdns/recursor.conf
      - forward_zones:/etc/powerdns/recursor.d/

  event_handler:
    image: multidirectory
    container_name: event_handler
    restart: unless-stopped
    tty: true
    env_file:
      local.env
    volumes:
      - ./app:/app
    command: python multidirectory.py --event_handler
    environment:
      EVENT_CONSUMER_NAME: event_handler-1
    depends_on:
      migrations:
        condition: service_completed_successfully

  event_sender:
    image: multidirectory
    container_name: event_sender
    restart: unless-stopped
    tty: true
    depends_on:
      migrations:
        condition: service_completed_successfully
    volumes:
      - ./app:/app
      - ./audit:/audit
    env_file:
      local.env
    command: python multidirectory.py --event_sender
    environment:
      HANDLER_NAME: event_sender-1

networks:
  md_net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/24
          gateway: 172.20.0.1

volumes:
  postgres:
  pgadmin:
  wireshark:
  kdc:
  dns_server_file:
  dns_server_config:
  kea_ctrl_agent:
  ldap_keytab:
  dragonflydata:
  dnsdist_confd:
  dns_lmdb:
  dns_config:
  dhcp:
  sockets:
  leases:
  forward_zones: