docker-compose.yml

version: '2.4'

services:
  es:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.8.23
# Uncomment below lines and create es-data directory to persist elastic search data
#    volumes:
#      - ./${ES_DIR-es-data}:/usr/share/elasticsearch/data
    environment:
      - discovery.type=single-node
      - 'ES_JAVA_OPTS=-Xms512m -Xmx512m'
      - ELASTIC_PASSWORD=${ELASTIC_SEARCH_PASSWORD}
      - xpack.security.enabled=${ELASTIC_SECURITY_ENABLED-false}
    ports:
      - '9200:9200'
      - '9300:9300'
    healthcheck:
      test:
        [
          'CMD',
          'curl',
          '-f',
          'localhost:9200/_cluster/health',
        ]
      interval: 30s
      timeout: 10s
      retries: 4
  db:
    image: postgres
    volumes:
      - ./${DB_DIR-db-data}:/var/lib/postgresql/data
    ports:
      - '5432:5432'
    environment:
      - POSTGRES_DB=registry
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U postgres']
      interval: 10s
      timeout: 5s
      retries: 5
  registry:
    image: ghcr.io/sunbird-rc/sunbird-rc-core:${RELEASE_VERSION}
    volumes:
      - ./${SCHEMA_DIR-java/registry/src/main/resources/public/_schemas}:/home/sunbirdrc/config/public/_schemas
      - ./${VIEW_DIR-java/registry/src/main/resources/views}:/home/sunbirdrc/config/views/
    environment:
      - connectionInfo_uri=jdbc:postgresql://db:5432/registry
      - connectionInfo_username=postgres
      - connectionInfo_password=${POSTGRES_PASSWORD}
      - encryption_enabled=${ENCRYPTION_ENABLED-false}
      - encryption_health_check_url=http://encryption-service:8013/health
      - encryption_uri=http://encryption-service:8013/crypto/v1/_encrypt
      - decryption_uri=http://encryption-service:8013/crypto/v1/_decrypt
      - encryption_batch_uri=http://encryption-service:8013/crypto/v1/_encrypt
      - decryption_batch_uri=http://encryption-service:8013/crypto/v1/_decrypt
      - event_enabled=${EVENT_ENABLED-false}
      - event_topic=events
      - event_providerName=dev.sunbirdrc.registry.service.impl.KafkaEventService
      - elastic_search_connection_url=${ELASTIC_SEARCH_CONNECTION_URL-es:9200}
      - elastic_search_scheme=${ELASTIC_SEARCH_SCHEME-http}
      - elastic_search_auth_enabled=${ELASTIC_SECURITY_ENABLED-false}
      - elastic_search_username=${ELASTIC_SEARCH_USERNAME-elastic}
      - elastic_search_password=${ELASTIC_SEARCH_PASSWORD}
      - search_providerName=${SEARCH_PROVIDER_NAME-dev.sunbirdrc.registry.service.NativeSearchService}
      - sunbird_sso_realm=${KEYCLOAK_REALM-sunbird-rc}
      - sunbird_sso_url=${sunbird_sso_url-http://keycloak:8080/auth}
      - OAUTH2_RESOURCES_0_URI=${oauth2_resource_uri-http://keycloak:8080/auth/realms/sunbird-rc}
      - OAUTH2_RESOURCES_0_PROPERTIES_ROLES_PATH=${oauth2_resource_roles_path-realm_access.roles}
      - identity_provider=${identity_provider-dev.sunbirdrc.auth.keycloak.KeycloakProviderImpl}
      - idgen_enabled=${IDGEN_ENABLED-false}
      - idgen_health_check_url=http://id-gen-service:8088/egov-idgen/health
      - idgen_generate_url=http://id-gen-service:8088/egov-idgen/id/_generate
      - idgen_id_format_url=http://id-gen-service:8088/egov-idgen/id/_format/add
      - sunbird_sso_admin_client_id=${KEYCLOAK_ADMIN_CLIENT_ID-admin-api}
      - sunbird_sso_client_id=${KEYCLOAK_CLIENT_ID-registry-frontend}
      - sunbird_sso_admin_client_secret=${KEYCLOAK_SECRET}
      - claims_enabled=${CLAIMS_ENABLED-false}
      - claims_url=http://claim-ms:8082
      - did_enabled=${DID_ENABLED-false}
      - did_health_check_url=http://identity:3332/health
      - did_generate_url=http://identity:3332/did/generate
      - did_resolve_url=http://identity:3332/did/resolve/{id}
      - signature_enabled=${SIGNATURE_ENABLED-false}
      - signature_provider=${SIGNATURE_PROVIDER-dev.sunbirdrc.registry.service.impl.SignatureV2ServiceImpl}
      - signature_v2_credential_did_method=rcw
      - signature_v2_issuer_did_method=issuer
      - signature_v2_schema_author=Registry
      - signature_v2_schema_author_did_method=author
      - signature_v2_health_check_url=http://credential:3000/health
      - signature_v2_issue_url=http://credential:3000/credentials/issue
      - signature_v2_get_url=http://credential:3000/credentials/{id}
      - signature_v2_delete_url=http://credential:3000/credentials/{id}
      - signature_v2_verify_url=http://credential:3000/credentials/{id}/verify
      - signature_v2_verify_any_url=http://credential:3000/credentials/verify
      - signature_v2_revocation_list_url=http://credential:3000/credentials/revocation-list?issuerId={issuerDid}&page={page}&limit={limit}
      - signature_v2_schema_health_check_url=http://credential-schema:3333/health
      - signature_v2_schema_create_url=http://credential-schema:3333/credential-schema
      - signature_v2_schema_update_url=http://credential-schema:3333/credential-schema/{id}/{version}
      - signature_v2_schema_get_by_id_and_version_url=http://credential-schema:3333/credential-schema/{id}/{version}
      - signature_v2_schema_search_by_tags_url=http://credential-schema:3333/credential-schema?tags={tags}
      - sign_url=http://certificate-signer:8079/sign
      - verify_url=http://certificate-signer:8079/verify
      - sign_health_check_url=http://certificate-signer:8079/health
      - certificate_enabled=${CERTIFICATE_ENABLED-false}
      - pdf_url=http://certificate-api:8078/api/v1/certificatePDF
      - certificate_health_check_url=http://certificate-api:8078/health
      - template_base_url=http://registry:8081/api/v1/templates/ #Looks for certificate templates for pdf copy of the signed certificate
      - sunbird_keycloak_user_set_password=true
      - filestorage_enabled=${FILESSTORAGE_ENABLED-false}
      - filestorage_connection_url=http://file-storage:9000
      - filestorage_access_key=${MINIO_ROOT_USER}
      - filestorage_secret_key=${MINIO_ROOT_PASSWORD}
      - filestorage_bucket_key=issuance
      - registry_base_apis_enable=false
      - sunbird_keycloak_user_password=${KEYCLOAK_DEFAULT_USER_PASSWORD}
      - logging.level.root=INFO
      - enable_external_templates=true
      - async_enabled=${ASYNC_ENABLED-false}
      - authentication_enabled=${AUTHENTICATION_ENABLED-false}
      - kafka_bootstrap_address=kafka:9092
      - webhook_enabled=false
      - webhook_url=http://localhost:5001/api/v1/callback
      - redis_host=redis
      - redis_port=6379
      - manager_type=${MANAGER_TYPE-DefinitionsManager}
      - expand_reference=${EXPAND_REFERENCE-false}
      - swagger_title=${SWAGGER_TITLE-Sunbird Registry and Credential}
      - notification_async_enabled=${NOTIFICATION_ASYNC_ENABLED-false}
      - notification_enabled=${NOTIFICATION_ENABLED-false}
      - notification_url=${NOTIFICATION_URL-http://notification-ms:8765/notification-service/v1/notification}
    ports:
      - '8091:8081'
    depends_on:
      db:
        condition: service_healthy
      keycloak:
        condition: service_healthy
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'wget -nv -t1 --spider http://localhost:8081/health || exit 1',
        ]
      interval: 30s
      timeout: 10s
      retries: 10
  keycloak:
    image: ghcr.io/sunbird-rc/sunbird-rc-keycloak:latest
    volumes:
      - ./${KEYCLOAK_IMPORT_DIR-imports}:/opt/jboss/keycloak/imports
    environment:
      - KEYCLOAK_LOGO=https://svgshare.com/i/hCs.svg
      - DB_VENDOR=postgres
      - DB_ADDR=db
      - DB_PORT=5432
      - DB_DATABASE=registry
      - DB_USER=postgres
      - DB_PASSWORD=${POSTGRES_PASSWORD}
      - KEYCLOAK_USER=${KEYCLOAK_ADMIN_USER}
      - KEYCLOAK_PASSWORD=${KEYCLOAK_ADMIN_PASSWORD}
      - KEYCLOAK_IMPORT=/opt/jboss/keycloak/imports/realm-export.json
      - PROXY_ADDRESS_FORWARDING=true
    healthcheck:
      test: ['CMD-SHELL', 'curl -f http://localhost:9990/ || exit 1']
      interval: 30s
      timeout: 10s
      retries: 10
    ports:
      - '8080:8080'
      - '9990:9990'
    depends_on:
      db:
        condition: service_healthy
  claim-ms:
    image: ghcr.io/sunbird-rc/sunbird-rc-claim-ms:${RELEASE_VERSION}
    environment:
      - connectionInfo_uri=jdbc:postgresql://db:5432/registry
      - connectionInfo_username=postgres
      - connectionInfo_password=${POSTGRES_PASSWORD}
      - sunbirdrc_url=http://registry:8081
    ports:
      - '8082:8082'
    depends_on:
      db:
        condition: service_started
      registry:
        condition: service_started
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'wget -nv -t1 --spider http://localhost:8082/health || exit 1',
        ]
      interval: 30s
      timeout: 10s
      retries: 10
  vault:
    image: vault:1.13.3
    restart: always
    volumes:
      - ./vault.json:/vault/config/vault.json
      - ./vault-data:/vault/file
    environment:
      - VAULT_ADDR=${VAULT_ADDR}
      - VAULT_API_ADDR=${VAULT_API_ADDR}
      - VAULT_ADDRESS=${VAULT_ADDRESS}
    cap_add:
      - IPC_LOCK
    command: vault server -config=/vault/config/vault.json
    ports:
      - 8200:8200
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget --spider http://127.0.0.1:8200/v1/sys/health || exit 1",
        ]
      interval: 10s
      timeout: 5s
      retries: 3
  identity:
    image: ghcr.io/sunbird-rc/sunbird-rc-identity-service:${RELEASE_VERSION}
    ports:
      - "3332:3332"
    depends_on:
      vault:
        condition: service_healthy
      db:
        condition: service_healthy
    environment:
      - DATABASE_URL=postgres://postgres:postgres@db:5432/registry
      - VAULT_ADDR=${VAULT_ADDR}
      - VAULT_TOKEN=${VAULT_TOKEN}
      - VAULT_BASE_URL=${VAULT_BASE_URL}
      - VAULT_ROOT_PATH=${VAULT_ROOT_PATH}
      - VAULT_TIMEOUT=${VAULT_TIMEOUT}
      - VAULT_PROXY=${VAULT_PROXY}
      - SIGNING_ALGORITHM=${SIGNING_ALGORITHM}
      - JWKS_URI=${JWKS_URI}
      - ENABLE_AUTH=${ENABLE_AUTH}
      - WEB_DID_BASE_URL=${WEB_DID_BASE_URL}
    healthcheck:
      test:
        [ "CMD-SHELL", "curl -f http://localhost:3332/health || exit 1" ]
      interval: 10s
      timeout: 5s
      retries: 5
  credential-schema:
    image: ghcr.io/sunbird-rc/sunbird-rc-credential-schema:${RELEASE_VERSION}
    ports:
      - "3333:3333"
    depends_on:
      db:
        condition: service_healthy
      identity:
        condition: service_healthy
    environment:
      - DATABASE_URL=postgres://postgres:postgres@db:5432/registry
      - IDENTITY_BASE_URL=${IDENTITY_BASE_URL}
      - JWKS_URI=${JWKS_URI}
      - ENABLE_AUTH=${ENABLE_AUTH}
    healthcheck:
      test:
        [ "CMD-SHELL", "curl -f http://localhost:3333/health || exit 1" ]
      interval: 10s
      timeout: 5s
      retries: 5
  credential:
    image: ghcr.io/sunbird-rc/sunbird-rc-credentials-service:${RELEASE_VERSION}
    ports:
      - "3000:3000"
    depends_on:
      db:
        condition: service_healthy
      identity:
        condition: service_healthy
      credential-schema:
        condition: service_healthy
    environment:
      - DATABASE_URL=postgres://postgres:postgres@db:5432/registry
      - IDENTITY_BASE_URL=${IDENTITY_BASE_URL}
      - SCHEMA_BASE_URL=${SCHEMA_BASE_URL}
      - CREDENTIAL_SERVICE_BASE_URL=${CREDENTIAL_SERVICE_BASE_URL}
      - JWKS_URI=${JWKS_URI}
      - ENABLE_AUTH=${ENABLE_AUTH}
      - QR_TYPE=${QR_TYPE}
      - STATUS_LIST_ENABLED=${STATUS_LIST_ENABLED-false}
    healthcheck:
      test:
        [ "CMD-SHELL", "curl -f http://localhost:3000/health || exit 1" ]
      interval: 10s
      timeout: 5s
      retries: 5
  # OID4VCI / OID4VP protocol facade (optional; part of the 'oid4vc' profile).
  # Deploying it changes nothing existing — the registry only calls it when
  # oid4vc.enabled=true, and its routes are separate nginx locations.
  oid4vc-service:
    image: ghcr.io/sunbird-rc/sunbird-rc-oid4vc-service:${RELEASE_VERSION}
    build: ./services/oid4vc-service
    profiles: ["oid4vc"]
    ports:
      - "3400:3400"
    depends_on:
      credential:
        condition: service_healthy
      identity:
        condition: service_healthy
      credential-schema:
        condition: service_healthy
    environment:
      - PORT=3400
      - PUBLIC_URL=${OID4VC_PUBLIC_URL-http://localhost:3400}
      # In-network address identity-service uses to dereference this
      # service's ldp_vc @context documents from inside its own container —
      # deliberately NOT PUBLIC_URL, which defaults to localhost and would
      # resolve to identity-service's own loopback instead of back here.
      - INTERNAL_URL=${OID4VC_INTERNAL_URL-http://oid4vc-service:3400}
      - CREDENTIAL_SERVICE_BASE_URL=${CREDENTIAL_SERVICE_BASE_URL-http://credential:3000}
      - IDENTITY_BASE_URL=${IDENTITY_BASE_URL}
      - SCHEMA_BASE_URL=${SCHEMA_BASE_URL}
      - REDIS_URL=${OID4VC_REDIS_URL-redis://redis:6379}
      - SESSION_STORE=${OID4VC_SESSION_STORE-memory}
      - ISSUER_DID=${OID4VC_ISSUER_DID-}
      - OID4VP_ENABLED=${OID4VP_ENABLED-true}
      - DRAFT13_COMPAT_MODE=${OID4VC_DRAFT13_COMPAT-false}
      # OID4VP request-object signing (JAR, draft-23). The service default is
      # ON, but signing needs a VERIFIER_DID that WALLETS can resolve — a
      # did:web. This local stack auto-provisions a did:rcw issuer DID, which
      # only identity-service can resolve, so signing is opted OUT here to
      # keep the out-of-box dev flow working. To exercise the signed path,
      # set OID4VC_VERIFIER_DID to a did:web and OID4VP_SIGN_REQUEST=true.
      - OID4VP_SIGN_REQUEST=${OID4VP_SIGN_REQUEST-false}
      - OID4VP_LEGACY_CLIENT_ID_SCHEME=${OID4VP_LEGACY_CLIENT_ID_SCHEME-false}
      - VERIFIER_DID=${OID4VC_VERIFIER_DID-}
      # Keycloak bearer auth on POST /oid4vc/offer. Same two vars the other
      # node services read; JWKS_URI for this stack is
      # http://keycloak:8080/auth/realms/sunbird-rc/protocol/openid-connect/certs
      #
      # Deliberately NO `depends_on: keycloak`. Keycloak's healthcheck is
      # 30s x 10 against a WildFly image that needs ~a minute, so waiting on it
      # would slow every `--profile oid4vc` start even with auth off. When the
      # flag IS on, the service retries Keycloak for ~60s at boot and exits if
      # it never answers, which covers the ordering without the fixed cost.
      - ENABLE_AUTH=${ENABLE_AUTH-false}
      - JWKS_URI=${JWKS_URI}
      - AUTH_ISSUER=${AUTH_ISSUER-}
    healthcheck:
      test: [ "CMD-SHELL", "curl -f http://localhost:3400/health || exit 1" ]
      interval: 10s
      timeout: 5s
      retries: 5
  file-storage:
    image: quay.io/minio/minio
    volumes:
      - ${HOME}/minio/data:/data
    environment:
      - MINIO_ROOT_USER=${MINIO_ROOT_USER}
      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}
    command: server --address 0.0.0.0:9000 --console-address 0.0.0.0:9001 /data
    ports:
      - '9000:9000'
      - '9001:9001'
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://localhost:9000/minio/health/live']
      interval: 30s
      timeout: 20s
      retries: 10
  notification-ms:
    image: ghcr.io/sunbird-rc/sunbird-rc-notification-service:${RELEASE_VERSION}
    ports:
      - '8765:8765'
    healthcheck:
      test:
        [
          'CMD-SHELL',
          'wget -nv -t1 --spider
          http://localhost:8765/notification-service/v1/health || exit 1',
        ]
      interval: 30s
      timeout: 10s
      retries: 10
    environment:
      - TRACK_NOTIFICATIONS=${TRACK_NOTIFICATIONS-false}
      - KAFKA_BOOTSTRAP_SERVERS=${KAFKA_BOOTSTRAP_SERVERS-kafka:9092}
    depends_on:
      kafka:
        condition: service_started
  zookeeper:
    image: confluentinc/cp-zookeeper:latest
    ports:
      - '2181:2181'
    environment:
      ZOOKEEPER_CLIENT_PORT: '2181'
      ZOOKEEPER_TICK_TIME: '2000'
  kafka:
    image: confluentinc/cp-kafka:latest
    depends_on:
      zookeeper:
        condition: service_started
    ports:
      - '9092:9092'
    environment:
      KAFKA_BROKER_ID: '1'
      KAFKA_ZOOKEEPER_CONNECT: 'zookeeper:2181'
      KAFKA_ADVERTISED_LISTENERS: 'INTERNAL://kafka:9092,OUTSIDE://localhost:9094'
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: 'INTERNAL:PLAINTEXT,OUTSIDE:PLAINTEXT'
      KAFKA_INTER_BROKER_LISTENER_NAME: 'INTERNAL'
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: '1'
    healthcheck:
      test:
        [
          'CMD',
          'kafka-topics',
          '--list',
          '--bootstrap-server',
          'localhost:9092',
        ]
      interval: 30s
      timeout: 10s
      retries: 10
  public-key-service:
    image: ghcr.io/sunbird-rc/sunbird-rc-public-key-service
    environment:
      - CONFIG_BASE_PATH=/etc/keys
    ports:
      - '3300:3300'
    healthcheck:
      test:
        ['CMD', 'curl', '-f', 'localhost:3300/public-key-service/api/v1/health']
      interval: 30s
      timeout: 10s
      retries: 10
    volumes:
      - ./imports:/etc/keys
  context-proxy-service:
    image: ghcr.io/sunbird-rc/sunbird-rc-context-proxy-service
    ports:
      - '4400:4400'
    healthcheck:
      test: ['CMD', 'curl', '-f', 'localhost:4400/health']
      interval: 30s
      timeout: 10s
      retries: 10
  nginx:
    image: ghcr.io/sunbird-rc/sunbird-rc-nginx
    # This mount is load-bearing, not cosmetic: without it, nginx runs
    # entirely off the config baked into the published image, and any
    # local edit to nginx/nginx.conf silently has zero effect.
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
    ports:
      - '80:80'
    depends_on:
      registry:
        condition: service_healthy
      context-proxy-service:
        condition: service_started
      public-key-service:
        condition: service_started
      keycloak:
        condition: service_started
      claim-ms:
        condition: service_started
      file-storage:
        condition: service_started
    healthcheck:
      test: ['CMD', 'curl', '-f', 'localhost:80']
      interval: 30s
      timeout: 10s
      retries: 10
  metrics:
    image: ghcr.io/sunbird-rc/sunbird-rc-metrics
    environment:
      CLICK_HOUSE_URL: clickhouse:9000
      CLICKHOUSE_DATABASE: default
      KAFKA_BOOTSTRAP_SERVERS: kafka:9092
      KAFKA_METRICS_TOPIC: events
      REDIS_URL: redis:6379
    ports:
      - '8070:8070'
    depends_on:
      kafka:
        condition: service_healthy
      registry:
        condition: service_healthy
  redis:
    image: redis:latest
    ports:
      - '6379:6379'
  digilocker-certificate-api:
    image: ghcr.io/sunbird-rc/sunbird-rc-digilocker-certificate-api
    volumes:
      - ./services/digilocker-certificate-api/config/:/go/config/
    ports:
      - '8087:8087'
    environment:
      KEYCLOAK_CLIENT_ID: admin-api
      KEYCLOAK_CLIENT_SECRET: ${KEYCLOAK_SECRET}
      DIGILOCKER_HMAC_AUTHKEY: ${DIGILOCKER_HMAC_AUTHKEY}
      DIGILOCKER_AUTH_KEYNAME: x-digilocker-hmac
      PORT: 8087
  bulk_issuance:
    image: ghcr.io/sunbird-rc/sunbird-rc-bulk-issuance
    ports:
      - '5665:5665'
    environment:
      REGISTRY_BASE_URL: http://registry:8081/
      DATABASE_HOST: db
    depends_on:
      db:
        condition: service_healthy
      keycloak:
        condition: service_healthy
  clickhouse:
    image: clickhouse/clickhouse-server:23.4.2.11-alpine
    ports:
      - '9002:9000'
    healthcheck:
      test:
        wget --no-verbose --tries=1 --spider http://localhost:8123/ping || exit
        1
  id-gen-service:
    image: ghcr.io/sunbird-rc/id-gen-service:${RELEASE_VERSION}
    ports:
      - '8088:8088'
    environment:
      spring.datasource.url: jdbc:postgresql://db:5432/registry
      spring.flyway.baseline-on-migrate: "true"
      autocreate.new.seq: "true"
      idformat.from.mdms: "false"
      egov.mdms.provider: org.egov.id.masterdata.provider.DBMasterDataProvider
    depends_on:
      db:
        condition: service_healthy
  encryption-service:
    image: ghcr.io/sunbird-rc/encryption-service:${RELEASE_VERSION}
    ports:
      - '8013:8013'
    environment:
      server.port: 8013
      server.servlet.context-path: /
      spring.datasource.url: jdbc:postgresql://db:5432/registry
      spring.flyway.url: jdbc:postgresql://db:5432/registry
      egov.mdms.provider: org.egov.enc.masterdata.provider.DBMasterDataProvider
      spring.flyway.baseline-on-migrate: "true"
      management.endpoints.web.base-path: /
    depends_on:
      db:
        condition: service_healthy