docker-compose.yml

services:
  pg:
    image: postgres:15
    environment:
      # To avoid the following error:
      #
      #   Error: Database is uninitialized and superuser password is not
      #   specified.  You must specify POSTGRES_PASSWORD for the superuser. Use
      #   "-e POSTGRES_PASSWORD=password" to set it in "docker run".
      #
      #   You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all
      #   connections without a password. This is *not* recommended. See
      #   PostgreSQL documentation about "trust"
      POSTGRES_HOST_AUTH_METHOD: trust

  pg2:
    image: postgres:15
    environment:
      # To avoid the following error:
      #
      #   Error: Database is uninitialized and superuser password is not
      #   specified.  You must specify POSTGRES_PASSWORD for the superuser. Use
      #   "-e POSTGRES_PASSWORD=password" to set it in "docker run".
      #
      #   You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all
      #   connections without a password. This is *not* recommended. See
      #   PostgreSQL documentation about "trust"
      POSTGRES_HOST_AUTH_METHOD: trust

  audit:
    image: postgres:15
    environment:
      # See description on `pg` service for use of POSTGRES_HOST_AUTH_METHOD
      POSTGRES_HOST_AUTH_METHOD: trust

  testdb:
    image: postgres:15
    environment:
      # To avoid the following error:
      #
      #   Error: Database is uninitialized and superuser password is not
      #   specified.  You must specify POSTGRES_PASSWORD for the superuser. Use
      #   "-e POSTGRES_PASSWORD=password" to set it in "docker run".
      #
      #   You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all
      #   connections without a password. This is *not* recommended. See
      #   PostgreSQL documentation about "trust"
      POSTGRES_HOST_AUTH_METHOD: trust

  testdb2:
    image: postgres:15
    environment:
      # To avoid the following error:
      #
      #   Error: Database is uninitialized and superuser password is not
      #   specified.  You must specify POSTGRES_PASSWORD for the superuser. Use
      #   "-e POSTGRES_PASSWORD=password" to set it in "docker run".
      #
      #   You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all
      #   connections without a password. This is *not* recommended. See
      #   PostgreSQL documentation about "trust"
      POSTGRES_HOST_AUTH_METHOD: trust

  conjur:
    image: "conjur-test:${TAG}"
    environment:
      DATABASE_URL: postgres://postgres@pg/postgres
      CONJUR_ADMIN_PASSWORD: ADmin123!!!!
      CONJUR_ACCOUNT: cucumber
      CONJUR_DATA_KEY:
      RAILS_ENV: development
      REQUIRE_SIMPLECOV: "true"
      CONJUR_LOG_LEVEL: debug
      CONJUR_AUTHENTICATORS: authn,authn-ldap/test,authn-ldap/secure,authn-oidc/keycloak,authn-oidc,authn-k8s/test,authn-azure/prod,authn-gcp,authn-jwt/raw,authn-jwt/keycloak,authn-oidc/keycloak2,authn-oidc/okta-2,authn-oidc/okta,authn-oidc/keycloak2-long-lived,authn-oidc/identity
      LDAP_URI: ldap://ldap-server:389
      LDAP_BASE: dc=conjur,dc=net
      LDAP_FILTER: '(uid=%s)'
      LDAP_BINDDN: cn=admin,dc=conjur,dc=net
      LDAP_BINDPW: ldapsecret
      WEB_CONCURRENCY: 0
      RAILS_MAX_THREADS: 10
      HTTPS_PROXY: ${HTTPS_PROXY:-}
      https_proxy: ${https_proxy:-}
    command: server
    volumes:
      - authn-local:/run/authn-local
      # TODO: authenticators_oidc/test has a dep on this
      - ./oauth/keycloak:/oauth/keycloak/scripts
      - ./ldap-certs:/ldap-certs:ro
      - log-volume:/opt/conjur-server/log
      - ../coverage:/opt/conjur-server/coverage
    expose:
      - "80"
    links:
      - pg
      - ldap-server
      - keycloak
      - tinyproxy

  conjur2:
    image: "conjur-test:${TAG}"
    environment:
      DATABASE_URL: postgres://postgres@pg2/postgres
      CONJUR_ADMIN_PASSWORD: ADmin123!!!!
      CONJUR_ACCOUNT: cucumber
      CONJUR_DATA_KEY:
      RAILS_ENV: development
      REQUIRE_SIMPLECOV: "true"
      CONJUR_LOG_LEVEL: debug
      CONJUR_AUTHENTICATORS: authn-ldap/test,authn-ldap/secure,authn-oidc/keycloak,authn-oidc,authn-k8s/test,authn-azure/prod,authn-gcp,authn-jwt/raw,authn-jwt/keycloak,authn-oidc/keycloak2,authn-oidc/okta-2,authn-oidc/okta,authn-oidc/keycloak2-long-lived,authn-oidc/identity
      LDAP_URI: ldap://ldap-server:389
      LDAP_BASE: dc=conjur,dc=net
      LDAP_FILTER: '(uid=%s)'
      LDAP_BINDDN: cn=admin,dc=conjur,dc=net
      LDAP_BINDPW: ldapsecret
      WEB_CONCURRENCY: 0
      RAILS_MAX_THREADS: 10
      HTTPS_PROXY: ${HTTPS_PROXY:-}
      https_proxy: ${https_proxy:-}
    command: server
    volumes:
      # TODO: authenticators_oidc/test has a dep on this
      - authn-local2:/run/authn-local
      - ./oauth/keycloak:/oauth/keycloak/scripts
      - ./ldap-certs:/ldap-certs:ro
      - log-volume:/opt/conjur-server/log
      - ../coverage:/opt/conjur-server/coverage
    expose:
      - "80"
    links:
      - pg2
      - ldap-server
      - keycloak
      - tinyproxy

  cucumber:
    image: conjur-test:$TAG
    entrypoint: bash
    working_dir: /src/conjur-server
    environment:
      CONJUR_ACCOUNT: cucumber
      AUDIT_DATABASE_URL:
      RAILS_ENV: test
      CONJUR_LOG_LEVEL: debug
      CONJUR_DATA_KEY:
      REPORT_ROOT:
      CUCUMBER_NETWORK:
      INFRAPOOL_CUCUMBER_FILTER_TAGS:
      # TODO: Where should we be running rspec tests from, ideally?
      # See https://github.com/DatabaseCleaner/database_cleaner#safeguards
      DATABASE_CLEANER_ALLOW_REMOTE_DATABASE_URL: "true"
    volumes:
      - ..:/src/conjur-server
      - authn-local:/run/authn-local
      - authn-local2:/run/authn-local2
      - ./ldap-certs:/ldap-certs:ro
      - log-volume:/src/conjur-server/log
      - jwks-volume:/var/jwks
      - ./oauth/keycloak:/oauth/keycloak/scripts
    links:
      - conjur
      - conjur2
      - pg
      - pg2
      - testdb
      - testdb2
      - keycloak

  ldap-server:
    image: osixia/openldap
    command: --copy-service --loglevel debug
    hostname: ldap-server
    environment:
      LDAP_ORGANISATION: CyberArk
      LDAP_DOMAIN: conjur.net
      LDAP_ADMIN_PASSWORD: ldapsecret
      LDAP_TLS_DH_PARAM_FILENAME: "dhparam.pem"
      LDAP_TLS_CA_CRT_FILENAME: "ca-chain.cert.pem"
      LDAP_TLS_CRT_FILENAME: "ldap-server.cert.pem"
      LDAP_TLS_KEY_FILENAME: "ldap-server.key.pem"
      LDAP_TLS_VERIFY_CLIENT: try
    volumes:
      - ./test_suites/authenticators_ldap/ldap-data:/container/service/slapd/assets/config/bootstrap/ldif/custom
      - ./ldap-certs:/container/service/slapd/assets/certs:ro

  keycloak:
    image: registry.tld/jboss/keycloak:4.3.0.Final
    ulimits:
      nofile:
        soft: 6114
        hard: 6114
    environment:
      - KEYCLOAK_USER=admin
      - KEYCLOAK_PASSWORD=admin
      - KEYCLOAK_APP_USER=alice
      - KEYCLOAK_APP_USER_PASSWORD=alice
      - KEYCLOAK_APP_USER_EMAIL=alice@conjur.net
      - KEYCLOAK_SECOND_APP_USER=bob.somebody
      - KEYCLOAK_SECOND_APP_USER_PASSWORD=bob
      - KEYCLOAK_SECOND_APP_USER_EMAIL=bob@conjur.net
      - KEYCLOAK_NON_CONJUR_APP_USER=not_in_conjur
      - KEYCLOAK_NON_CONJUR_APP_USER_PASSWORD=not_in_conjur
      - KEYCLOAK_NON_CONJUR_APP_USER_EMAIL=not_in_conjur
      - DB_VENDOR=H2
      - KEYCLOAK_CLIENT_ID=conjurClient
      - KEYCLOAK_REDIRECT_URI=http://conjur:3000/authn-oidc/keycloak2/cucumber/authenticate
      - KEYCLOAK_CLIENT_SECRET=1234
      - KEYCLOAK_SCOPE=openid
    volumes:
      # TODO: authenticators_oidc/test has a dep on this
      - ./oauth/keycloak:/scripts
      - ./oauth/keycloak/standalone.xml:/opt/jboss/keycloak/standalone/configuration/standalone.xml

  tinyproxy:
    image: travix/tinyproxy
    volumes:
      - ./test_suites/proxy/config/tinyproxy.conf:/etc/tinyproxy.conf

  jwks:
    image: nginx
    networks:
      default:
        aliases:
          - chained.mycompany.local
    volumes:
      - jwks-volume:/usr/share/nginx/html
      - ./oauth/jwks/nginx.conf:/etc/nginx/conf.d/default.conf
      - ./oauth/jwks:/tmp
    entrypoint: sleep
    command: infinity

  jwks_py:
    image: python:3
    ports:
      - 8090:8090
    entrypoint:
      - bash
      - -c
    command:
      - |
        pip install -r /usr/src/jwks/requirements.txt
        python /usr/src/jwks/jwks_server.py -p 8090
    volumes:
      - ./jwt/:/usr/src/jwks/


  # The following services are used to test IPv6 scenarios using 'host' network mode
  pg_ipv6:
    image: postgres:15
    network_mode: host
    environment:
      # To avoid the following error:
      #
      #   Error: Database is uninitialized and superuser password is not
      #   specified.  You must specify POSTGRES_PASSWORD for the superuser. Use
      #   "-e POSTGRES_PASSWORD=password" to set it in "docker run".
      #
      #   You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all
      #   connections without a password. This is *not* recommended. See
      #   PostgreSQL documentation about "trust"
      POSTGRES_HOST_AUTH_METHOD: trust

  conjur_ipv6:
    image: "conjur-test:${TAG}"
    network_mode: host
    extra_hosts:
      - keycloak_ipv6:${HOST_IPV6:-[::1]}
      - pg:${HOST_IPV6:-[::1]}
      - jwks_py:${HOST_IPV6:-[::1]}
    environment:
      DATABASE_URL: postgres://postgres@pg/postgres
      CONJUR_ADMIN_PASSWORD: ADmin123!!!!
      CONJUR_ACCOUNT: cucumber
      CONJUR_DATA_KEY:
      RAILS_ENV: development
      REQUIRE_SIMPLECOV: "true"
      CONJUR_LOG_LEVEL: debug
      CONJUR_AUTHENTICATORS: authn,authn-oidc/keycloak,authn-oidc,authn-k8s/test,authn-jwt/raw,authn-jwt/keycloak,authn-oidc/keycloak2
      WEB_CONCURRENCY: 0
      RAILS_MAX_THREADS: 10
    command: server
    volumes:
      - ..:/src/conjur-server
      - authn-local:/run/authn-local
      - jwks-volume:/var/jwks
      - ./oauth/keycloak:/oauth/keycloak/scripts
      - log-volume:/opt/conjur-server/log
    depends_on:
      - pg_ipv6

  cucumber_ipv6:
    image: conjur-test:$TAG
    network_mode: host
    extra_hosts:
      - keycloak_ipv6:${HOST_IPV6:-[::1]}
      - pg:${HOST_IPV6:-[::1]}
      - conjur:127.0.0.1
      - jwks_py:${HOST_IPV6:-[::1]}
    entrypoint: bash
    working_dir: /src/conjur-server
    environment:
      CONJUR_ACCOUNT: cucumber
      RAILS_ENV: test
      CONJUR_LOG_LEVEL: debug
      CONJUR_DATA_KEY:
      INFRAPOOL_CUCUMBER_FILTER_TAGS:
      DATABASE_CLEANER_ALLOW_REMOTE_DATABASE_URL: true
      IPV6_ENABLED: true
    volumes:
      - ..:/src/conjur-server
      - authn-local:/run/authn-local
      - log-volume:/src/conjur-server/log
      - ./oauth/keycloak:/oauth/keycloak/scripts
    depends_on:
      - conjur_ipv6

  keycloak_ipv6:
    image: registry.tld/jboss/keycloak:4.3.0.Final
    network_mode: host
    extra_hosts:
      - conjur:127.0.0.1
    ulimits:
      nofile:
        soft: 6114
        hard: 6114
    environment:
      - KEYCLOAK_USER=admin
      - KEYCLOAK_PASSWORD=admin
      - KEYCLOAK_APP_USER=alice
      - KEYCLOAK_APP_USER_PASSWORD=alice
      - KEYCLOAK_APP_USER_EMAIL=alice@conjur.net
      - KEYCLOAK_SECOND_APP_USER=bob.somebody
      - KEYCLOAK_SECOND_APP_USER_PASSWORD=bob
      - KEYCLOAK_SECOND_APP_USER_EMAIL=bob@conjur.net
      - KEYCLOAK_NON_CONJUR_APP_USER=not_in_conjur
      - KEYCLOAK_NON_CONJUR_APP_USER_PASSWORD=not_in_conjur
      - KEYCLOAK_NON_CONJUR_APP_USER_EMAIL=not_in_conjur
      - DB_VENDOR=H2
      - KEYCLOAK_CLIENT_ID=conjurClient
      - KEYCLOAK_REDIRECT_URI=http://conjur:3000/authn-oidc/keycloak2/cucumber/authenticate
      - KEYCLOAK_CLIENT_SECRET=1234
      - KEYCLOAK_SCOPE=openid
      - JAVA_OPTS=-server -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true -Djava.net.preferIPv4Stack=false
    volumes:
      - ./oauth/keycloak:/scripts
      - ./oauth/keycloak/standalone_ipv6.xml:/opt/jboss/keycloak/standalone/configuration/standalone.xml

  jwks_py_ipv6:
    image: python:3
    network_mode: host
    entrypoint:
      - bash
      - -c
    command:
      - |
        pip install -r /usr/src/jwks/requirements.txt
        python /usr/src/jwks/jwks_server.py -p 8090
    volumes:
      - ./jwt/:/usr/src/jwks/

  curl_ipv6:
    image: curlimages/curl:latest
    network_mode: host
    extra_hosts:
      - jwks_py:${HOST_IPV6:-[::1]}

volumes:
  authn-local:
  authn-local2:
  log-volume:
  jwks-volume: