compose.base.yml

name: openuem

services:
  db:
    container_name: openuem-db
    image: postgres:17
    restart: always
    command: -p $DATABASE_PORT
    environment:
      - POSTGRES_USER=${DATABASE_USER:?DATABASE_USER env variable needs to be set!}
      - POSTGRES_PASSWORD=${DATABASE_PASSWORD:?DATABASE_PASSWORD env variable needs to be set!}
      - POSTGRES_DB=${DATABASE_DB_NAME:?DATABASE_DB_NAME env variable needs to be set!}
      - POSTGRES_PORT=${DATABASE_PORT:?DATABASE_PORT env variable needs to be set!}
    expose:
      - $DATABASE_PORT
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U $DATABASE_USER -p $DATABASE_PORT" ]
      interval: 1s
      timeout: 5s
      retries: 10
    networks:
      - openuem

  openuem-certs:
    container_name: openuem-certs
    image: openuem/openuem-cert-manager
    entrypoint:
      - /bin/configure.sh
    environment:
      - ORGNAME=${OPENUEM_ORGNAME?OPENUEM_ORGNAME env variable needs to be set!}
      - ORGPROVINCE=${OPENUEM_ORGPROVINCE?OPENUEM_ORGPROVINCE env variable needs to be set!}
      - ORGLOCALITY=${OPENUEM_ORGLOCALITY?OPENUEM_ORGLOCALITY env variable needs to be set!}
      - ORGADDRESS=${OPENUEM_ORGADDRESS?OPENUEM_ORGADDRESS env variable needs to be set!}
      - COUNTRY=${OPENUEM_ORGCOUNTRY?OPENUEM_ORGCOUNTRY env variable needs to be set!}
      - DOMAIN=${OPENUEM_DOMAIN:?OPENUEM_DOMAIN env variable needs to be set!}
      - OCSP=${OCSP_URL:?OCSP_URL env variable needs to be set!}
      - DATABASE_URL=${OPENUEM_DATABASE_URL:?OPENUEM_DATABASE_URL env variable needs to be set!}
      - SERVER_NAME=${CONSOLE_HOST:?CONSOLE_HOST env variable needs to be set!}
      - REVERSE_PROXY_SERVER=${REVERSE_PROXY_HOST}
      # - NATS_DEBUG=${NATS_DEBUG}
      - NATS_SERVER=${NATS_HOST:?NATS_HOST env variable needs to be set!}
      - NATS_PORT=${NATS_PORT:?NATS_PORT env variable needs to be set!}
      # - NATS_WEBSOCKETPORT=${NATS_WEBSOCKETPORT}
    volumes:
      - "./certificates:/certificates:z"
      - "./nats:/etc/nats:z"
    depends_on:
      db:
        condition: service_healthy
    networks:
      - openuem

  ocsp-responder:
    container_name: openuem-ocsp-responder
    image: openuem/openuem-ocsp-responder
    pull_policy: always
    command: "start"
    restart: always
    environment:
      - OCSP_PORT=${OCSP_PORT:?OCSP_PORT env variable needs to be set!}
      - DATABASE_URL=${OPENUEM_DATABASE_URL:?OPENUEM_DATABASE_URL env variable needs to be set!}
    ports:
      - $OCSP_PORT:$OCSP_PORT
    volumes:
      - "./certificates/ocsp/ocsp.cer:/usr/bin/certificates/ocsp.cer"
      - "./certificates/ocsp/ocsp.key:/usr/bin/certificates/ocsp.key"
      - "./certificates/ca/ca.cer:/usr/bin/certificates/ca.cer"
    # while the docker image contains a HEALTHCHECK definition, podman seems to be ignoring this under certain
    # circumstances. To allow podman to run this stack as well, the healthcheck definitions are duplicated and set below
    # as well. See https://github.com/containers/podman/issues/18904 for more details
    healthcheck:
      test: curl -f http://localhost:${OCSP_PORT}/health || exit 1
      interval: 30s
      timeout: 5s
      start_period: 30s
      retries: 3
    depends_on:
      openuem-certs:
        condition: service_completed_successfully
      db:
        condition: service_healthy
    networks:
      openuem:
        aliases:
          - ocsp.openuem.example

  nats-server:
    container_name: openuem-nats-server
    image: nats:latest
    environment:
      - NATS_SERVER=${NATS_HOST:?NATS_HOST env variable needs to be set!}
      - NATS_PORT=${NATS_PORT:?NATS_PORT env variable needs to be set!}
      - ORGNAME=${OPENUEM_ORGNAME?OPENUEM_ORGNAME env variable needs to be set!}
      - ORGPROVINCE=${OPENUEM_ORGPROVINCE?OPENUEM_ORGPROVINCE env variable needs to be set!}
      - ORGLOCALITY=${OPENUEM_ORGLOCALITY?OPENUEM_ORGLOCALITY env variable needs to be set!}
      - ORGADDRESS=${OPENUEM_ORGADDRESS?OPENUEM_ORGADDRESS env variable needs to be set!}
      - COUNTRY=${OPENUEM_ORGCOUNTRY?OPENUEM_ORGCOUNTRY env variable needs to be set!}
    ports:
      - $NATS_PORT:${NATS_PORT:?NATS_PORT env variable needs to be set!}
      # - $NATS_WEBSOCKETPORT:${NATS_WEBSOCKETPORT}
    restart: always
    command: "-c /etc/nats.cfg"
    volumes:      
      - "./certificates/nats/nats.cer:/etc/nats-certificates/nats.cer:z"
      - "./certificates/nats/nats.key:/etc/nats-certificates/nats.key:z"
      - "./certificates/ca/ca.cer:/etc/nats-certificates/ca.cer:z"
      - "./nats/nats.cfg:/etc/nats.cfg:z"
      - jetstream:/var/lib/jetstream/data
    depends_on:
      openuem-certs:
        condition: service_completed_successfully
      db:
        condition: service_healthy
      ocsp-responder:
        condition: service_healthy
    networks:
      openuem:
        aliases:
          - nats.openuem.example


  notification-worker:
    container_name: openuem-notification-worker
    image: openuem/openuem-worker
    pull_policy: always
    command: "notifications start"
    restart: always
    environment:
      - NATS_SERVERS=${OPENUEM_NATS_SERVERS:?OPENUEM_NATS_SERVERS env variable needs to be set!}
      - DATABASE_URL=${OPENUEM_DATABASE_URL:?OPENUEM_DATABASE_URL env variable needs to be set!}
    volumes:
      - "./certificates/notification-worker/worker.cer:/tmp/certificates/worker.cer:z"
      - "./certificates/notification-worker/worker.key:/tmp/certificates/worker.key:z"
      - "./certificates/ca/ca.cer:/tmp/certificates/ca.cer:z"
    depends_on:
      openuem-certs:
        condition: service_completed_successfully
      db:
        condition: service_healthy
      nats-server:
        condition: service_started
    networks:
      - openuem

  cert-manager-worker:
    container_name: openuem-cert-manager-worker
    image: openuem/openuem-worker
    pull_policy: always
    command: "cert-manager start"
    restart: always
    environment:
      - OCSP=${OCSP_URL:?OCSP_URL env variable needs to be set!}
      - NATS_SERVERS=${OPENUEM_NATS_SERVERS:?OPENUEM_NATS_SERVERS env variable needs to be set!}
      - DATABASE_URL=${OPENUEM_DATABASE_URL:?OPENUEM_DATABASE_URL env variable needs to be set!}
    volumes:
      - "./certificates/cert-manager-worker/worker.cer:/tmp/certificates/worker.cer:z"
      - "./certificates/cert-manager-worker/worker.key:/tmp/certificates/worker.key:z"
      - "./certificates/ca/ca.cer:/tmp/certificates/ca.cer:z"
      - "./certificates/ca/ca.key:/tmp/certificates/ca.key:z"
    depends_on:
      openuem-certs:
        condition: service_completed_successfully
      db:
        condition: service_healthy
      nats-server:
        condition: service_started
    networks:
      - openuem

  agents-worker:
    container_name: openuem-agents-worker
    image: openuem/openuem-worker
    pull_policy: always
    command: "agents start"
    restart: always
    environment:
      - NATS_SERVERS=${OPENUEM_NATS_SERVERS:?OPENUEM_NATS_SERVERS env variable needs to be set!}
      - DATABASE_URL=${OPENUEM_DATABASE_URL:?OPENUEM_DATABASE_URL env variable needs to be set!}
    volumes:
      - "./certificates/agents-worker/worker.cer:/tmp/certificates/worker.cer:z"
      - "./certificates/agents-worker/worker.key:/tmp/certificates/worker.key:z"
      - "./certificates/ca/ca.cer:/tmp/certificates/ca.cer:z"
    depends_on:
      openuem-certs:
        condition: service_completed_successfully
      db:
        condition: service_healthy
      nats-server:
        condition: service_started
    networks:
      - openuem

  console:
    container_name: openuem-console
    image: openuem/openuem-console
    restart: always
    pull_policy: always
    command: "start"
    environment:
      - NATS_SERVERS=${OPENUEM_NATS_SERVERS:?OPENUEM_NATS_SERVERS env variable needs to be set!}
      - DATABASE_URL=${OPENUEM_DATABASE_URL:?OPENUEM_DATABASE_URL env variable needs to be set!}
      - JWT_KEY=${CONSOLE_JWT_KEY:?CONSOLE_JWT_KEY env variable needs to be set!}
      - SERVER_NAME=${CONSOLE_HOST:?CONSOLE_HOST env variable needs to be set!}
      - CONSOLE_PORT=${CONSOLE_PORT:?CONSOLE_PORT env variable needs to be set!}
      - AUTH_PORT=${CONSOLE_AUTH_PORT:?CONSOLE_AUTH_PORT env variable needs to be set!}
      - DOMAIN=${OPENUEM_DOMAIN:?OPENUEM_DOMAIN env variable needs to be set!}
      - ORGNAME=${OPENUEM_ORGNAME?OPENUEM_ORGNAME env variable needs to be set!}
      - ORGPROVINCE=${OPENUEM_ORGPROVINCE?OPENUEM_ORGPROVINCE env variable needs to be set!}
      - ORGLOCALITY=${OPENUEM_ORGLOCALITY?OPENUEM_ORGLOCALITY env variable needs to be set!}
      - ORGADDRESS=${OPENUEM_ORGADDRESS?OPENUEM_ORGADDRESS env variable needs to be set!}
      - COUNTRY=${OPENUEM_ORGCOUNTRY:?OPENUEM_ORGCOUNTRY env variable needs to be set!}
      - REVERSE_PROXY_AUTH_PORT=${REVERSE_PROXY_AUTH_PORT}
      - REVERSE_PROXY_SERVER=${REVERSE_PROXY_HOST}
      - RE_ENABLE_CERTIFICATES_AUTH=${CONSOLE_RE_ENABLE_CERTIFICATES_AUTH}
      - RE_ENABLE_PASSWD_AUTH=${CONSOLE_RE_ENABLE_PASSWD_AUTH}
      - RESET_OPENUEM_USER=${CONSOLE_RESET_OPENUEM_USER}
    ports:
      - $CONSOLE_PORT:$CONSOLE_PORT
      - $CONSOLE_AUTH_PORT:$CONSOLE_AUTH_PORT
    volumes:
      - "./certificates/console/console.cer:/bin/certificates/console.cer:z"
      - "./certificates/console/console.key:/bin/certificates/console.key:z"
      - "./certificates/console/sftp.key:/bin/certificates/sftp.key:z"
      - "./certificates/ca/ca.cer:/bin/certificates/ca.cer:z"
    depends_on:
      openuem-certs:
        condition: service_completed_successfully
      db:
        condition: service_healthy
      nats-server:
        condition: service_started
    networks:
      openuem:
        aliases:
          - console.openuem.example

networks:
  openuem:

volumes:
  pgdata:
    driver: local
  jetstream:
    driver: local