docker-compose.base.yaml

# MoltNet Docker Compose — Base Service Templates
#
# Pure service definitions. No volumes, no depends_on, no profiles.
# Extended by docker-compose.yaml (dev) and docker-compose.e2e.yaml (e2e).

services:
  app-db:
    image: pgvector/pgvector:pg16
    ports:
      - '5433:5432'
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-moltnet}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-moltnet_secret}
      POSTGRES_DB: ${POSTGRES_DB:-moltnet}
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER:-moltnet}']
      interval: 5s
      timeout: 3s
      retries: 5

  app-db-migrate:
    build:
      context: .
      dockerfile: libs/database/Dockerfile.migrate
    environment:
      DATABASE_URL: postgresql://${POSTGRES_USER:-moltnet}:${POSTGRES_PASSWORD:-moltnet_secret}@app-db:5432/${POSTGRES_DB:-moltnet}

  kratos-postgres:
    image: postgres:16
    environment:
      POSTGRES_USER: kratos
      POSTGRES_PASSWORD: kratos_secret
      POSTGRES_DB: kratosdb
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U kratos']
      interval: 5s
      timeout: 3s
      retries: 5

  kratos-migrate:
    image: oryd/kratos:v25.4.0
    command: migrate sql -e --yes
    environment:
      DSN: postgres://kratos:kratos_secret@kratos-postgres:5432/kratosdb?sslmode=disable

  kratos:
    image: oryd/kratos:v25.4.0
    command: serve --config /etc/config/kratos/kratos.yaml --dev --watch-courier
    ports:
      - '4433:4433'
      - '4434:4434'
    environment:
      DSN: postgres://kratos:kratos_secret@kratos-postgres:5432/kratosdb?sslmode=disable
    volumes:
      - ./infra/ory/kratos/kratos.yaml:/etc/config/kratos/kratos.yaml:ro
      - ./infra/ory/identity-schema.json:/etc/config/kratos/identity-schema.json:ro
      - ./infra/ory/human-identity-schema.json:/etc/config/kratos/human-identity-schema.json:ro
    healthcheck:
      test:
        ['CMD', 'wget', '--spider', '-q', 'http://localhost:4433/health/alive']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  # Reference self-service UI for Kratos flows (registration, login, recovery,
  # settings, error). Kratos delegates form rendering to an external app; this
  # is the official Node.js reference implementation. Used by both dev and e2e
  # so browser-based cookie auth (issue #753) works out of the box. Served on
  # port 4455 — kratos.yaml points flow ui_url values here.
  kratos-selfservice-ui-node:
    image: oryd/kratos-selfservice-ui-node:v25.4.0
    ports:
      - '4455:4455'
    environment:
      PORT: '4455'
      SECURITY_MODE: 'standalone'
      # Server-side URL used by the UI container when it fetches flow state.
      # This must use the Docker service name, not localhost.
      KRATOS_PUBLIC_URL: http://kratos:4433/
      # Admin URL used for server-side flow calls from inside the container.
      KRATOS_ADMIN_URL: http://kratos:4434/
      # Browser-facing URL used in redirects and links rendered into the page.
      KRATOS_BROWSER_URL: http://localhost:4433/
      COOKIE_SECRET: ${KRATOS_UI_COOKIE_SECRET:-local-dev-cookie-secret-not-for-production}
      CSRF_COOKIE_NAME: ory_csrf_ui
      CSRF_COOKIE_SECRET: ${KRATOS_UI_CSRF_SECRET:-local-dev-csrf-secret-not-for-production}
    healthcheck:
      test:
        ['CMD', 'wget', '--spider', '-q', 'http://localhost:4455/health/alive']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s

  hydra-postgres:
    image: postgres:16
    environment:
      POSTGRES_USER: hydra
      POSTGRES_PASSWORD: hydra_secret
      POSTGRES_DB: hydradb
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U hydra']
      interval: 5s
      timeout: 3s
      retries: 5

  hydra-migrate:
    image: oryd/hydra:v25.4.0
    command: migrate sql up -e --yes
    environment:
      DSN: postgres://hydra:hydra_secret@hydra-postgres:5432/hydradb?sslmode=disable

  hydra:
    image: oryd/hydra:v25.4.0
    command: serve all --config /etc/config/hydra/hydra.yaml --dev
    ports:
      - '4444:4444'
      - '4445:4445'
    environment:
      DSN: postgres://hydra:hydra_secret@hydra-postgres:5432/hydradb?sslmode=disable
      SECRETS_SYSTEM: ${HYDRA_SECRETS_SYSTEM:-a-very-insecure-secret-for-local-dev-only!!}
      OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT: ${OIDC_PAIRWISE_SALT:-local-dev-salt-not-for-production}
    volumes:
      - ./infra/ory/hydra/hydra.yaml:/etc/config/hydra/hydra.yaml:ro
    healthcheck:
      test:
        ['CMD', 'wget', '--spider', '-q', 'http://localhost:4444/health/alive']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  keto-postgres:
    image: postgres:16
    environment:
      POSTGRES_USER: keto
      POSTGRES_PASSWORD: keto_secret
      POSTGRES_DB: ketodb
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U keto']
      interval: 5s
      timeout: 3s
      retries: 5

  keto-migrate:
    image: oryd/keto:v25.4.0
    command: migrate up --yes --config /etc/config/keto/keto.yaml
    environment:
      DSN: postgres://keto:keto_secret@keto-postgres:5432/ketodb?sslmode=disable
    volumes:
      - ./infra/ory/keto/keto.yaml:/etc/config/keto/keto.yaml:ro
      - ./infra/ory/permissions.ts:/etc/config/keto/permissions.ts:ro

  keto:
    image: oryd/keto:v25.4.0
    command: serve --config /etc/config/keto/keto.yaml
    ports:
      - '4466:4466'
      - '4467:4467'
    environment:
      DSN: postgres://keto:keto_secret@keto-postgres:5432/ketodb?sslmode=disable
    volumes:
      - ./infra/ory/keto/keto.yaml:/etc/config/keto/keto.yaml:ro
      - ./infra/ory/permissions.ts:/etc/config/keto/permissions.ts:ro
    healthcheck:
      test:
        ['CMD', 'wget', '--spider', '-q', 'http://localhost:4466/health/alive']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  otel-collector:
    # Custom collector image that bundles the Ory-introspection auth
    # extension (see infra/otel/custom-collector/). The stock
    # otel/opentelemetry-collector-contrib only ships `oidcauthextension`,
    # which can't validate Ory Network's opaque access tokens.
    build:
      context: ./infra/otel/custom-collector
      dockerfile: Dockerfile
    image: moltnet-otelcol:dev
    command: ['--config=/etc/otelcol/config.yaml']
    ports:
      - '4317:4317' # internal OTLP gRPC (unauthenticated, service mesh)
      - '4318:4318' # internal OTLP HTTP (unauthenticated, service mesh)
      - '4319:4319' # public OTLP HTTP (authenticated via Ory introspection)
      - '13133:13133'
    volumes:
      - ./infra/otel/collector-config.dev.yaml:/etc/otelcol/config.yaml:ro
    depends_on:
      hydra:
        condition: service_healthy

  mailslurper:
    image: oryd/mailslurper:latest-smtps
    ports:
      - '1025:1025'
      - '4436:4436'
      - '4437:4437'