m8flow-docker-compose.yml

name: m8flow

services:
  m8flow-db:
    image: postgres:15
    env_file: ../.env
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-postgres}"]
      interval: 5s
      timeout: 5s
      retries: 5
    ports:
      - "1111:5432"
    volumes:
      - db-data:/var/lib/postgresql/data

  keycloak-db:
    image: postgres:15
    env_file: ../.env
    environment:
      POSTGRES_DB: ${KEYCLOAK_DB_NAME:-keycloak}
      POSTGRES_USER: ${KEYCLOAK_DB_USER:-keycloak}
      POSTGRES_PASSWORD: ${KEYCLOAK_DB_PASSWORD:-keycloak}
    volumes:
      - keycloak-db-data:/var/lib/postgresql/data

  keycloak:
    build:
      context: ..
      dockerfile: docker/m8flow.keycloak.Dockerfile
    image: m8flow-keycloak
    env_file: ../.env
    command: ["start-dev", "--import-realm", "--spi-theme-static-max-age=-1", "--spi-theme-cache-themes=false", "--spi-theme-cache-templates=false"]
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_ADMIN:-admin}
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://keycloak-db:5432/${KEYCLOAK_DB_NAME:-keycloak}
      KC_DB_USERNAME: ${KEYCLOAK_DB_USER:-keycloak}
      KC_DB_PASSWORD: ${KEYCLOAK_DB_PASSWORD:-keycloak}
      KC_HTTP_PORT: ${KC_HTTP_PORT:-8080}
      KC_HOSTNAME_STRICT: ${KC_HOSTNAME_STRICT:-false}
      KC_PROXY_HEADERS: ${KC_PROXY_HEADERS:-xforwarded}
      KC_HOSTNAME: ${KEYCLOAK_HOSTNAME_HOST:-localhost}
      KC_HOSTNAME_URL: ${KEYCLOAK_HOSTNAME:-http://localhost:7002}
    ports:
      - "7009:9000"
    healthcheck:
      test: ["CMD-SHELL", "/opt/keycloak/bin/kcadm.sh config credentials --server \"http://127.0.0.1:$${KC_HTTP_PORT:-8080}$${KC_HTTP_RELATIVE_PATH:-}\" --realm master --user \"$${KC_BOOTSTRAP_ADMIN_USERNAME:-admin}\" --password \"$${KC_BOOTSTRAP_ADMIN_PASSWORD:-admin}\" >/dev/null 2>&1"]
      interval: 10s
      timeout: 5s
      retries: 10
    depends_on:
      - keycloak-db

  keycloak-proxy:
    image: nginx:alpine
    ports:
      - "7002:7002"
    volumes:
      - ./nginx-keycloak-proxy.conf:/etc/nginx/conf.d/default.conf:ro
    depends_on:
      - keycloak
  keycloak-master-admin-init:
    build:
      context: ..
      dockerfile: docker/m8flow.keycloak.Dockerfile
    env_file: ../.env
    environment:
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-admin}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
      KEYCLOAK_SUPER_ADMIN_USER: ${KEYCLOAK_SUPER_ADMIN_USER:-super-admin}
      KEYCLOAK_SUPER_ADMIN_PASSWORD: ${KEYCLOAK_SUPER_ADMIN_PASSWORD:-super-admin}
    depends_on:
      keycloak:
        condition: service_healthy
    volumes:
      - ../extensions/m8flow-backend/bin/ensure_keycloak_master_super_admin.sh:/ensure_keycloak_master_super_admin.sh:ro
    entrypoint: ["/bin/sh", "/ensure_keycloak_master_super_admin.sh"]
    restart: "no"

  redis:
    image: redis:6-alpine
    command: ["redis-server", "--save", "20", "1", "--loglevel", "warning"]
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data

  nats:
    profiles: ["nats"]
    container_name: m8flow-nats
    image: nats:2.10-alpine
    command: ["-js", "--store_dir=/data/nats", "-m", "8222"]
    ports:
      - "${M8FLOW_NATS_PORT:-4222}:4222/tcp" # client
      - "8222:8222/tcp" # monitoring HTTP (optional)
    volumes:
      - nats_data:/data/nats
    healthcheck:
      test: "wget -qO- http://localhost:8222/healthz || exit 1"
      interval: 5s
      timeout: 3s
      retries: 10
    restart: unless-stopped

  m8flow-nats-consumer:
    profiles: ["nats"]
    container_name: m8flow-nats-consumer
    build:
      context: ..
      dockerfile: docker/m8flow.backend.Dockerfile
    user: "0"
    command:
      - "sh"
      - "-c"
      - |
        PYTHONPATH=/app:/app/extensions/m8flow-backend/src:/app/spiffworkflow-backend/src \
        exec python m8flow-nats-consumer/consumer.py
    env_file: ../.env
    depends_on:
      nats:
        condition: service_healthy
        required: false
      m8flow-backend:
        condition: service_started
    environment:
      M8FLOW_NATS_ENABLED: "${M8FLOW_NATS_ENABLED:-false}"
      M8FLOW_NATS_URL: "nats://nats:4222"
      M8FLOW_BACKEND_DATABASE_URI: "postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@m8flow-db:5432/${POSTGRES_DB:-postgres}"
      SPIFFWORKFLOW_BACKEND_DATABASE_URI: "postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@m8flow-db:5432/${POSTGRES_DB:-postgres}"
      M8FLOW_BACKEND_UPGRADE_DB: "false"
      M8FLOW_BACKEND_SW_UPGRADE_DB: "false"
    volumes:
      - process_models_cache:/app/process_models
      - ../data/m8flow_nats_consumer:/app/data/m8flow_nats_consumer
    restart: unless-stopped

  minio:
    image: minio/minio:RELEASE.2025-01-20T14-49-07Z
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
    ports:
      - "9000:9000"
      - "9001:9001"
    volumes:
      - minio_data:/data

  minio-mc-init:
    profiles: ["init"]
    image: minio/mc:RELEASE.2025-02-21T16-00-46Z
    depends_on:
      - minio
    entrypoint: ["/bin/sh", "/minio_mc_init.sh"]
    volumes:
      - ./minio_mc_init.sh:/minio_mc_init.sh:ro
    restart: "no"

  process-models-sync:
    profiles: ["init"]
    image: rclone/rclone:1.66.0
    depends_on:
      - minio-mc-init
    volumes:
      - process_models_cache:/cache
      - ../rclone.conf:/config/rclone/rclone.conf:ro
      - ../extensions/m8flow-backend/bin/process_models_sync.sh:/process_models_sync.sh:ro
    entrypoint: ["/bin/sh", "/process_models_sync.sh"]
    restart: "no"

  templates-sync:
    profiles: ["init"]
    image: rclone/rclone:1.66.0
    depends_on:
      - minio-mc-init
    volumes:
      - templates_cache:/cache
      - ../rclone.conf:/config/rclone/rclone.conf:ro
      - ../extensions/m8flow-backend/bin/templates_sync.sh:/templates_sync.sh:ro
    entrypoint: ["/bin/sh", "/templates_sync.sh"]
    restart: "no"

  smtp-attachments-sync:
    profiles: ["init"]
    image: alpine:3.20
    entrypoint:
      - /bin/sh
      - /smtp_attachments_sync.sh
      - ${M8FLOW_CONNECTOR_SMTP_ATTACHMENTS_USER_ACCESS_DIR:-/email_attachments}
    volumes:
      - smtp_attachments:${M8FLOW_CONNECTOR_SMTP_ATTACHMENTS_USER_ACCESS_DIR:-/email_attachments}
      - ${M8FLOW_CONNECTOR_SMTP_ATTACHMENTS_DIR:-../email_attachments}:/host_attachments:ro
      - ../extensions/m8flow-backend/bin/smtp_attachments_sync.sh:/smtp_attachments_sync.sh:ro
    restart: "no"

  slack-attachments-sync:
    profiles: ["init"]
    image: alpine:3.20
    entrypoint:
      - /bin/sh
      - /slack_attachments_sync.sh
      - ${M8FLOW_CONNECTOR_SLACK_ATTACHMENTS_USER_ACCESS_DIR:-/slack_attachments}
    volumes:
      - slack_attachments:${M8FLOW_CONNECTOR_SLACK_ATTACHMENTS_USER_ACCESS_DIR:-/slack_attachments}
      - ${M8FLOW_CONNECTOR_SLACK_ATTACHMENTS_DIR:-../slack_attachments}:/host_attachments:ro
      - ../extensions/m8flow-backend/bin/slack_attachments_sync.sh:/slack_attachments_sync.sh:ro
    restart: "no"

  # -------------------------
  # APP SERVICES
  # -------------------------

  m8flow-backend:
    build:
      context: ..
      dockerfile: docker/m8flow.backend.Dockerfile
    user: "0"
    env_file: ../.env
    environment:
      M8FLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR: "${M8FLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR:-/app/process_models}"
      M8FLOW_BACKEND_DATABASE_URI: "postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@m8flow-db:5432/${POSTGRES_DB:-postgres}"
      M8FLOW_BACKEND_UPGRADE_DB: "${M8FLOW_BACKEND_UPGRADE_DB:-true}"
      KEYCLOAK_URL: "http://keycloak-proxy:7002"
      M8FLOW_KEYCLOAK_URL: "http://keycloak-proxy:7002"
      KEYCLOAK_HOSTNAME: "${KEYCLOAK_HOSTNAME:-http://localhost:7002}"
      SPIFFWORKFLOW_BACKEND_AUTH_CONFIGS__0__uri: "${KEYCLOAK_HOSTNAME:-http://localhost:7002}/realms/spiffworkflow-local"
      SPIFFWORKFLOW_BACKEND_AUTH_CONFIGS__0__internal_uri: "http://keycloak-proxy:7002/realms/spiffworkflow-local"
      SPIFFWORKFLOW_BACKEND_AUTH_CONFIGS__1__uri: "${KEYCLOAK_HOSTNAME:-http://localhost:7002}/realms/master"
      SPIFFWORKFLOW_BACKEND_AUTH_CONFIGS__1__internal_uri: "http://keycloak-proxy:7002/realms/master"
      SPIFFWORKFLOW_BACKEND_URL: "${SPIFFWORKFLOW_BACKEND_URL:-http://localhost:7000}"
      M8FLOW_BACKEND_URL_FOR_FRONTEND: "${M8FLOW_BACKEND_URL_FOR_FRONTEND:-http://localhost:7001}"
      M8FLOW_BACKEND_CELERY_BROKER_URL: "${M8FLOW_BACKEND_CELERY_BROKER_URL:-redis://redis:6379/0}"
      M8FLOW_BACKEND_CELERY_RESULT_BACKEND: "${M8FLOW_BACKEND_CELERY_RESULT_BACKEND:-redis://redis:6379/0}"
      M8FLOW_NATS_ENABLED: "${M8FLOW_NATS_ENABLED:-false}"
      M8FLOW_NATS_URL: "nats://nats:4222"
    ports:
      - "${M8FLOW_BACKEND_PORT:-7000}:8000"
    volumes:
      - process_models_cache:/app/process_models
      - templates_cache:/app/templates
    depends_on:
      m8flow-db:
        condition: service_healthy
      keycloak-proxy:
        condition: service_started
      keycloak:
        condition: service_healthy
      keycloak-master-admin-init:
        condition: service_completed_successfully
      redis:
        condition: service_started
      minio:
        condition: service_started
      nats:
        condition: service_healthy
        required: false      

  m8flow-celery-worker:
    build:
      context: ..
      dockerfile: docker/m8flow.backend.Dockerfile
    user: "0"
    command: ["bash", "./extensions/m8flow-backend/bin/run_m8flow_celery_worker.sh"]
    env_file: ../.env
    environment:
      M8FLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR: "${M8FLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR:-/app/process_models}"
      M8FLOW_BACKEND_DATABASE_URI: "postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@m8flow-db:5432/${POSTGRES_DB:-postgres}"
      M8FLOW_BACKEND_CELERY_BROKER_URL: "${M8FLOW_BACKEND_CELERY_BROKER_URL:-redis://redis:6379/0}"
      M8FLOW_BACKEND_CELERY_RESULT_BACKEND: "${M8FLOW_BACKEND_CELERY_RESULT_BACKEND:-redis://redis:6379/0}"
      M8FLOW_BACKEND_RUNNING_IN_CELERY_WORKER: "true"
      M8FLOW_BACKEND_RUN_BACKGROUND_SCHEDULER_IN_CREATE_APP: "false"
      M8FLOW_BACKEND_UPGRADE_DB: "false"
      M8FLOW_BACKEND_SW_UPGRADE_DB: "false"
    volumes:
      - ${M8FLOW_BACKEND_CELERY_PROCESS_MODELS_MOUNT_SOURCE:-process_models_cache}:/app/process_models
    depends_on:
      m8flow-db:
        condition: service_started
      keycloak:
        condition: service_started
      keycloak-master-admin-init:
        condition: service_completed_successfully
      redis:
        condition: service_started
      minio:
        condition: service_started

  m8flow-celery-flower:
    build:
      context: ..
      dockerfile: docker/m8flow.backend.Dockerfile
    user: "0"
    command: ["bash", "./extensions/m8flow-backend/bin/run_m8flow_celery_worker.sh", "flower"]
    env_file: ../.env
    environment:
      M8FLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR: "${M8FLOW_BACKEND_BPMN_SPEC_ABSOLUTE_DIR:-/app/process_models}"
      M8FLOW_BACKEND_DATABASE_URI: "postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@m8flow-db:5432/${POSTGRES_DB:-postgres}"
      M8FLOW_BACKEND_CELERY_BROKER_URL: "${M8FLOW_BACKEND_CELERY_BROKER_URL:-redis://redis:6379/0}"
      M8FLOW_BACKEND_CELERY_RESULT_BACKEND: "${M8FLOW_BACKEND_CELERY_RESULT_BACKEND:-redis://redis:6379/0}"
      M8FLOW_BACKEND_RUNNING_IN_CELERY_WORKER: "false"
      M8FLOW_BACKEND_RUN_BACKGROUND_SCHEDULER_IN_CREATE_APP: "false"
      M8FLOW_BACKEND_UPGRADE_DB: "false"
      M8FLOW_BACKEND_SW_UPGRADE_DB: "false"
    ports:
      - "5555:5555"
    depends_on:
      m8flow-db:
        condition: service_started
      keycloak:
        condition: service_started
      keycloak-master-admin-init:
        condition: service_completed_successfully
      redis:
        condition: service_started
      minio:
        condition: service_started

  m8flow-frontend:
    build:
      context: ..
      dockerfile: docker/m8flow.frontend.Dockerfile
    env_file: ../.env
    environment:
      SPIFFWORKFLOW_FRONTEND_INTERNAL_PORT: "8080"
      BACKEND_BASE_URL: "${M8FLOW_FRONTEND_BACKEND_BASE_URL:-http://localhost:7000}"
    ports:
      - "${M8FLOW_FRONTEND_PORT:-7001}:8080"
    depends_on:
      - m8flow-backend

  m8flow-connector-proxy:
    container_name: m8flow-connector-proxy
    image: m8flow/m8flow-connector-proxy
    build:
      context: ../m8flow-connector-proxy
    env_file: ../.env
    ports:
      - "${CONNECTOR_PROXY_PORT:-8004}:${CONNECTOR_PROXY_PORT:-8004}/tcp"
    volumes:
      - type: volume
        source: "smtp_attachments"
        target: "${M8FLOW_CONNECTOR_SMTP_ATTACHMENTS_USER_ACCESS_DIR:-/email_attachments}"
        read_only: true
      - type: volume
        source: "slack_attachments"
        target: "${M8FLOW_CONNECTOR_SLACK_ATTACHMENTS_USER_ACCESS_DIR:-/slack_attachments}"
        read_only: true
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fsS http://localhost:${CONNECTOR_PROXY_PORT:-8004}/liveness || exit 1",
        ]
      interval: 10s
      timeout: 5s
      retries: 20

volumes:
  db-data:
    driver: local
  keycloak-db-data:
    driver: local
  redis-data:
    driver: local
  process_models_cache:
    driver: local
  templates_cache:
    driver: local
  minio_data:
    driver: local
  smtp_attachments:
    driver: local
  slack_attachments:
    driver: local
  nats_data:
    driver: local