docker-compose.yml

# This file is part of Edgehog.
#
# Copyright 2021-2026 SECO Mind Srl
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0

services:
  postgres:
    image: postgres:18.3
    environment:
      POSTGRES_USER: edgehog
      POSTGRES_PASSWORD: edgehog
    volumes:
      - postgres-data:/var/lib/postgresql

  pgadmin:
    image: dpage/pgadmin4:9.12.0
    environment:
      PGADMIN_DEFAULT_EMAIL: admin@admin.com
      PGADMIN_DEFAULT_PASSWORD: admin
      MASTER_PASSWORD_REQUIRED: "False"
      PGADMIN_CONFIG_SERVER_MODE: "False"
    volumes:
      - pgadmin-data:/var/lib/pgadmin
    configs:
      - source: pgadmin_servers.json
        target: /pgadmin4/servers.json
    depends_on:
      - postgres
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.edgehog-pgadmin.rule=Host(`pgadmin.${DOCKER_COMPOSE_EDGEHOG_BASE_DOMAIN}`)"
      - "traefik.http.routers.edgehog-pgadmin.entrypoints=web"
      - "traefik.http.routers.edgehog-pgadmin.service=pgadmin"
      - "traefik.http.services.pgadmin.loadbalancer.server.port=80"

  edgehog-backend:
    image: edgehogdevicemanager/edgehog-backend:0.12.1
    build:
      context: backend
    env_file: .env
    environment:
      DATABASE_USERNAME: edgehog
      DATABASE_PASSWORD: edgehog
      DATABASE_HOSTNAME: postgres
      DATABASE_NAME: postgres
      SECRET_KEY_BASE: KKtB6BEPk1NVk6EmBfQCafphxLj7EW1M+BGPIFCT8X2LTywTFuGC6lM3yc8e3VKH
      SEEDS_REALM_PRIVATE_KEY_FILE: /keys/realm_private.pem
      SEEDS_TENANT_PRIVATE_KEY_FILE: /keys/tenant_private.pem
      SEEDS_REALM_ORIGINAL_FILE: ${SEEDS_REALM_PRIVATE_KEY_FILE}
      SEEDS_TENANT_ORIGINAL_FILE: ${SEEDS_TENANT_PRIVATE_KEY_FILE}
      URL_HOST: edgehog-backend
      URL_PORT: 4000
      URL_SCHEME: http
      EDGEHOG_FORWARDER_HOSTNAME: device-forwarder.${DOCKER_COMPOSE_EDGEHOG_BASE_DOMAIN}
      EDGEHOG_FORWARDER_PORT: 80
      EDGEHOG_FORWARDER_SECURE_SESSIONS: "false"
      ADMIN_JWT_PUBLIC_KEY_PATH: /keys/admin_public.pem
    restart: on-failure
    volumes:
      - ./backend/priv/repo/seeds/keys/admin_public.pem:/keys/admin_public.pem:z
      - ${SEEDS_TENANT_PRIVATE_KEY_FILE}:/keys/tenant_private.pem:z
      - ${SEEDS_REALM_PRIVATE_KEY_FILE}:/keys/realm_private.pem:z
    depends_on:
      - postgres
      - rustfs
      - rustfs-init
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.edgehog-backend.rule=Host(`api.${DOCKER_COMPOSE_EDGEHOG_BASE_DOMAIN}`)"
      - "traefik.http.routers.edgehog-backend.entrypoints=web"
      - "traefik.http.routers.edgehog-backend.service=edgehog-backend"
      - "traefik.http.services.edgehog-backend.loadbalancer.server.port=4000"

  edgehog-frontend:
    image: edgehogdevicemanager/edgehog-frontend:0.12.1
    build:
      context: frontend
    environment:
      BACKEND_URL: http://api.${DOCKER_COMPOSE_EDGEHOG_BASE_DOMAIN}/
    restart: on-failure
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.edgehog-frontend.rule=Host(`${DOCKER_COMPOSE_EDGEHOG_BASE_DOMAIN}`)"
      - "traefik.http.routers.edgehog-frontend.entrypoints=web"
      - "traefik.http.routers.edgehog-frontend.service=edgehog-frontend"
      - "traefik.http.services.edgehog-frontend.loadbalancer.server.port=80"

  edgehog-device-forwarder:
    image: edgehogdevicemanager/edgehog-device-forwarder:0.1.0
    environment:
      RELEASE_NAME: edgehog-device-forwarder
      SECRET_KEY_BASE: fXzwqLnU1V1bhfOwMRdm3tiGHRlfSpqmrw2aONac2QU4T9iwh3vjSIaweH1n0ZWg
      PORT: 4001
      PHX_HOST: device-forwarder.${DOCKER_COMPOSE_EDGEHOG_BASE_DOMAIN}
    restart: on-failure
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.edgehog-device-forwarder.rule=Host(`device-forwarder.${DOCKER_COMPOSE_EDGEHOG_BASE_DOMAIN}`)"
      - "traefik.http.routers.edgehog-device-forwarder.entrypoints=web"
      - "traefik.http.routers.edgehog-device-forwarder.service=edgehog-device-forwarder"
      - "traefik.http.services.edgehog-device-forwarder.loadbalancer.server.port=4001"

  rustfs:
    image: rustfs/rustfs:latest
    volumes:
      - "rustfs-data-v2:/data"
    environment:
      RUSTFS_ACCESS_KEY: "rustfsadmin"
      RUSTFS_SECRET_KEY: "rustfsadmin"
      RUSTFS_CONSOLE_ENABLE: true
    command: /data
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.edgehog-rustfs-storage.rule=Host(`rustfs-storage.${DOCKER_COMPOSE_EDGEHOG_BASE_DOMAIN}`)"
      - "traefik.http.routers.edgehog-rustfs-storage.entrypoints=web"
      - "traefik.http.routers.edgehog-rustfs-storage.service=edgehog-rustfs-storage"
      - "traefik.http.services.edgehog-rustfs-storage.loadbalancer.server.port=9000"
      - "traefik.http.routers.edgehog-rustfs-console.rule=Host(`rustfs.${DOCKER_COMPOSE_EDGEHOG_BASE_DOMAIN}`)"
      - "traefik.http.routers.edgehog-rustfs-console.entrypoints=web"
      - "traefik.http.routers.edgehog-rustfs-console.service=edgehog-rustfs-console"
      - "traefik.http.services.edgehog-rustfs-console.loadbalancer.server.port=9001"

  rustfs-init:
    image: minio/mc:RELEASE.2023-01-11T03-14-16Z
    depends_on:
      - rustfs
    entrypoint: |
      /bin/sh -c "
      while ! curl -s http://rustfs:9000 >/dev/null; do sleep 0.1; done;
      /usr/bin/mc alias set rustfs http://rustfs:9000 rustfsadmin rustfsadmin;
      /usr/bin/mc mb rustfs/edgehog;
      /usr/bin/mc anonymous set download rustfs/edgehog;
      exit 0;
      "

  registry:
    image: registry:3
    restart: on-failure
    environment:
      REGISTRY_AUTH: htpasswdocker run minio/mc ls playd
      REGISTRY_AUTH_HTPASSWD_REALM: Registry-Realm
      REGISTRY_AUTH_HTPASSWD_PATH: /auth/registry.passwd
      REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data
    volumes:
      - registry-auth:/auth
      - registry-data:/var/lib/registry
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.edgehog-registry.rule=Host(`registry.${DOCKER_COMPOSE_EDGEHOG_BASE_DOMAIN}`)"
      - "traefik.http.routers.edgehog-registry.entrypoints=web"
      - "traefik.http.routers.edgehog-registry.service=edgehog-registry"
      - "traefik.http.services.edgehog-registry.loadbalancer.server.port=5000"

  registry-auth:
    image: httpd:2.4
    depends_on:
      - registry
    entrypoint: ["/bin/sh", "-c"]
    command: >
      "htpasswd -Bbn admin admin > /auth/registry.passwd"
    volumes:
      - registry-auth:/auth

  registry-init:
    image: docker:29.2.1-dind
    depends_on:
      - registry
    privileged: true
    entrypoint: ["/bin/sh", "-c"]
    command: [
      "
      dockerd --insecure-registry registry:5000 &
      echo 'Waiting for Docker daemon to be ready...' &&
      until docker info >/dev/null 2>&1; do sleep 1; done &&
      echo 'Docker daemon ready, signing in with registry...' &&
      echo 'admin' | docker login registry:5000 -u admin --password-stdin &&
      echo 'Signed in with registry, pulling sample images...' &&
      docker pull hashicorp/http-echo &&
      echo 'Tagging sample images...' &&
      docker tag hashicorp/http-echo registry:5000/test/http-echo &&
      echo 'Pushing sample images...' &&
      docker push registry:5000/test/http-echo &&
      echo 'Images preloaded.'",
    ]

configs:
  pgadmin_servers.json:
    content: |
      {
        "Servers": {
          "1": {
            "Name": "Edgehog",
            "Group": "Servers",
            "Host": "postgres",
            "Port": 5432,
            "MaintenanceDB": "postgres",
            "Username": "edgehog",
            "PasswordExecCommand": "echo 'edgehog'",
            "SSLMode": "prefer"
          }
        }
      }

volumes:
  postgres-data:
  pgadmin-data:
  rustfs-data-v2:
    driver: local
  registry-auth:
  registry-data:

networks:
  default:
    name: astarte
    external: true