compose.yaml

services:
  php:
    image: ${IMAGES_PREFIX:-}app-php
    depends_on:
      database:
        condition: service_healthy
      pwa:
        condition: service_healthy
      keycloak:
        condition: service_healthy
    restart: unless-stopped
    environment:
      PWA_UPSTREAM: pwa:3000
      OIDC_UPSTREAM: keycloak:8080
      SERVER_NAME: ${SERVER_NAME:-localhost}, php:80
      MERCURE_PUBLISHER_JWT_KEY: ${CADDY_MERCURE_JWT_SECRET:-!ChangeThisMercureHubJWTSecretKey!}
      MERCURE_SUBSCRIBER_JWT_KEY: ${CADDY_MERCURE_JWT_SECRET:-!ChangeThisMercureHubJWTSecretKey!}
      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}
      TRUSTED_HOSTS: ^${SERVER_NAME:-example\.com|localhost}|php$$
      DATABASE_URL: postgresql://${POSTGRES_USER:-app}:${POSTGRES_PASSWORD:-!ChangeMe!}@database:5432/${POSTGRES_DB:-app}?serverVersion=${POSTGRES_VERSION:-16}&charset=${POSTGRES_CHARSET:-utf8}
      MERCURE_URL: ${CADDY_MERCURE_URL:-http://php/.well-known/mercure}
      MERCURE_PUBLIC_URL: https://${SERVER_NAME:-localhost}/.well-known/mercure
      MERCURE_JWT_SECRET: ${CADDY_MERCURE_JWT_SECRET:-!ChangeThisMercureHubJWTSecretKey!}
      OIDC_SERVER_URL: ${OIDC_SERVER_URL:-https://localhost/oidc/realms/demo}
      OIDC_SERVER_URL_INTERNAL: ${OIDC_SERVER_URL_INTERNAL:-http://keycloak:8080/oidc/realms/demo}
    ports:
      # HTTP
      - target: 80
        published: ${HTTP_PORT:-80}
        protocol: tcp
      # HTTPS
      - target: 443
        published: ${HTTPS_PORT:-443}
        protocol: tcp
      # HTTP/3
      - target: 443
        published: ${HTTP3_PORT:-443}
        protocol: udp

  pwa:
    image: ${IMAGES_PREFIX:-}app-pwa
    environment:
      NEXT_PUBLIC_ENTRYPOINT: http://php
      NEXT_PUBLIC_OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-api-platform-pwa}
      NEXT_PUBLIC_OIDC_SERVER_URL: ${OIDC_SERVER_URL:-https://localhost/oidc/realms/demo}
      NEXT_PUBLIC_OIDC_SERVER_URL_INTERNAL: ${OIDC_SERVER_URL_INTERNAL:-http://keycloak:8080/oidc/realms/demo}
      NEXT_PUBLIC_OIDC_AUTHORIZATION_CLIENT_ID: ${OIDC_AUTHORIZATION_CLIENT_ID:-api-platform-api}
      AUTH_SECRET: ${AUTH_SECRET:-!ChangeThisNextAuthSecret!}
      AUTH_URL: ${AUTH_URL:-https://localhost/api/auth}
      NEXT_SHARP_PATH: /srv/app/node_modules/sharp

###> doctrine/doctrine-bundle ###
  database:
    image: postgres:${POSTGRES_VERSION:-16}-alpine
    environment:
      - POSTGRES_DB=${POSTGRES_DB:-app}
      # You should definitely change the password in production
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-!ChangeMe!}
      - POSTGRES_USER=${POSTGRES_USER:-app}
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-app}" ]
      start_period: 1s
      interval: 5s
      timeout: 3s
      retries: 3
    volumes:
      - db_data:/var/lib/postgresql/data
      # you may use a bind-mounted host directory instead, so that it is harder to accidentally remove the volume and lose all your data!
      # - ./api/docker/db/data:/var/lib/postgresql/data
###< doctrine/doctrine-bundle ###

# Mercure is installed as a Caddy module, prevent the Flex recipe from installing another service
###> symfony/mercure-bundle ###
###< symfony/mercure-bundle ###

  keycloak-database:
    image: postgres:${KEYCLOAK_POSTGRES_VERSION:-16}-alpine
    environment:
      POSTGRES_DB: ${KEYCLOAK_POSTGRES_DB:-keycloak}
      # You should definitely change the password in production
      POSTGRES_PASSWORD: ${KEYCLOAK_POSTGRES_PASSWORD:-!ChangeMe!}
      POSTGRES_USER: ${KEYCLOAK_POSTGRES_USER:-keycloak}
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U ${KEYCLOAK_POSTGRES_USER:-keycloak}" ]
      start_period: 1s
      interval: 5s
      timeout: 3s
      retries: 3
    volumes:
      - keycloak_db_data:/var/lib/postgresql/data

  keycloak:
    image: app_keycloak
    environment:
      KEYCLOAK_DATABASE_HOST: keycloak-database
      KEYCLOAK_DATABASE_NAME: ${KEYCLOAK_POSTGRES_DB:-keycloak}
      KEYCLOAK_DATABASE_USER: ${KEYCLOAK_POSTGRES_USER:-keycloak}
      KEYCLOAK_DATABASE_PASSWORD: ${KEYCLOAK_POSTGRES_PASSWORD:-!ChangeMe!}
      KEYCLOAK_ADMIN_USER: ${KEYCLOAK_ADMIN_USER:-admin}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-!ChangeMe!}
      # Must finish with a trailing slash (https://github.com/bitnami/charts/issues/10885#issuecomment-1414279144)
      KEYCLOAK_HTTP_RELATIVE_PATH: /oidc/
      # https://www.keycloak.org/server/hostname
      KC_HOSTNAME_URL: https://${SERVER_NAME:-localhost}/oidc/
      KC_HOSTNAME_ADMIN_URL: https://${SERVER_NAME:-localhost}/oidc/
      # https://www.keycloak.org/server/features
      KC_FEATURES: "scripts"
      # https://github.com/bitnami/containers/pull/40893
      KEYCLOAK_ENABLE_HEALTH_ENDPOINTS: "true"
    # https://www.keycloak.org/server/all-config#category-health
    healthcheck:
      test: [ "CMD-SHELL", "curl http://127.0.0.1:8080/oidc/health || exit 1"]
      start_period: 15s
      interval: 5s
      timeout: 3s
      retries: 15
    depends_on:
      keycloak-database:
        condition: service_healthy
    ports:
      - target: 8080
        published: 8080
        protocol: tcp

volumes:
  caddy_data:
  caddy_config:
###> doctrine/doctrine-bundle ###
  db_data:
###< doctrine/doctrine-bundle ###
###> symfony/mercure-bundle ###
###< symfony/mercure-bundle ###
  keycloak_db_data: