--- version: "3.7" services: traefik: image: traefik:v3.6.7 networks: ocis-net: aliases: - ${OCIS_DOMAIN:-ocis.owncloud.test} - ${OCIS_OCM_DOMAIN:-ocis.ocm.owncloud.test} - ${KEYCLOAK_DOMAIN:-keycloak.owncloud.test} command: - "--log.level=${TRAEFIK_LOG_LEVEL:-ERROR}" # letsencrypt configuration - "--certificatesResolvers.http.acme.email=${TRAEFIK_ACME_MAIL:-example@example.org}" - "--certificatesResolvers.http.acme.storage=/certs/acme.json" - "--certificatesResolvers.http.acme.httpChallenge.entryPoint=http" # enable dashboard - "--api.dashboard=true" # define entrypoints - "--entryPoints.http.address=:80" - "--entryPoints.http.http.redirections.entryPoint.to=https" - "--entryPoints.http.http.redirections.entryPoint.scheme=https" - "--entryPoints.https.address=:443" # docker provider (get configuration from container labels) - "--providers.docker.endpoint=unix:///var/run/docker.sock" - "--providers.docker.exposedByDefault=false" # access log - "--accessLog=true" - "--accessLog.format=json" - "--accessLog.fields.headers.names.X-Request-Id=keep" ports: - "80:80" - "443:443" volumes: - "${DOCKER_SOCKET_PATH:-/var/run/docker.sock}:/var/run/docker.sock:ro" - "certs:/certs" labels: - "traefik.enable=${TRAEFIK_DASHBOARD:-false}" - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_BASIC_AUTH_USERS:-admin:$$apr1$$4vqie50r$$YQAmQdtmz5n9rEALhxJ4l.}" # defaults to admin:admin - "traefik.http.routers.traefik.entrypoints=https" - "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN:-traefik.owncloud.test}`)" - "traefik.http.routers.traefik.middlewares=traefik-auth" - "traefik.http.routers.traefik.tls.certresolver=http" - "traefik.http.routers.traefik.service=api@internal" logging: driver: ${LOG_DRIVER:-local} restart: always ocis: image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis}:${OCIS_DOCKER_TAG:-latest} networks: ocis-net: entrypoint: - /bin/sh # run ocis init to initialize a configuration file with random secrets # it will fail on subsequent runs, because the config file already exists # therefore we ignore the error and then start the ocis server command: [ "-c", "ocis init || true; exec ocis server" ] environment: # Keycloak IDP specific configuration PROXY_AUTOPROVISION_ACCOUNTS: "true" PROXY_ROLE_ASSIGNMENT_DRIVER: "oidc" OCIS_OIDC_ISSUER: https://${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}/realms/${KEYCLOAK_REALM:-oCIS} PROXY_OIDC_REWRITE_WELLKNOWN: "true" WEB_OIDC_CLIENT_ID: ${OCIS_OIDC_CLIENT_ID:-web} KEYCLOAK_DOMAIN: ${KEYCLOAK_DOMAIN:-keycloak.owncloud.test} # general config OCIS_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test} OCIS_LOG_LEVEL: ${OCIS_LOG_LEVEL:-info} OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}" PROXY_TLS: "false" # do not use SSL between Traefik and oCIS PROXY_USER_OIDC_CLAIM: "preferred_username" PROXY_USER_CS3_CLAIM: "username" # INSECURE: needed if oCIS / Traefik is using self generated certificates OCIS_INSECURE: "${INSECURE:-true}" OCIS_EXCLUDE_RUN_SERVICES: "idp,idm" GRAPH_ASSIGN_DEFAULT_USER_ROLE: "false" GRAPH_USERNAME_MATCH: "none" # password policies # OCIS_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: "banned-password-list.txt" PROXY_CSP_CONFIG_FILE_LOCATION: /etc/ocis/csp.yaml OCIS_MFA_ENABLED: ${OCIS_MFA_ENABLED:-false} WEB_OIDC_SCOPE: "openid profile email acr" # LDAP OCIS_LDAP_URI: ldap://ldap-server:389 OCIS_LDAP_INSECURE: "true" OCIS_LDAP_BIND_DN: "cn=admin,dc=owncloud,dc=com" OCIS_LDAP_BIND_PASSWORD: ${LDAP_ADMIN_PASSWORD:-admin} OCIS_LDAP_GROUP_BASE_DN: "ou=groups,dc=owncloud,dc=com" GRAPH_LDAP_GROUP_CREATE_BASE_DN: "ou=groups-ec730a6c-1b63-4b45-b83b-9e2311afdf85,ou=groups,dc=owncloud,dc=com" OCIS_LDAP_GROUP_OBJECTCLASS: "owncloudGroup" OCIS_LDAP_USER_BASE_DN: "ou=users,dc=owncloud,dc=com" OCIS_LDAP_USER_OBJECTCLASS: "inetOrgPerson" LDAP_LOGIN_ATTRIBUTES: "uid" OCIS_ADMIN_USER_ID: "ddc2004c-0977-11eb-9d3f-a793888cd0f8" IDP_LDAP_LOGIN_ATTRIBUTE: "uid" IDP_LDAP_UUID_ATTRIBUTE: "ownclouduuid" IDP_LDAP_UUID_ATTRIBUTE_TYPE: binary GRAPH_LDAP_SERVER_WRITE_ENABLED: "true" # assuming the external ldap is writable GRAPH_LDAP_REFINT_ENABLED: "true" # osixia has refint enabled. # Multi-Instance Configuration OCIS_MULTI_INSTANCE_ENABLED: true OCIS_MULTI_INSTANCE_INSTANCEID: "ec730a6c-1b63-4b45-b83b-9e2311afdf85" OCIS_LDAP_USER_FILTER: "(&(objectclass=owncloud)(|(ownCloudMemberOf=ec730a6c-1b63-4b45-b83b-9e2311afdf85)(ownCloudGuestOf=ec730a6c-1b63-4b45-b83b-9e2311afdf85)))" OCIS_LDAP_GROUP_FILTER: "(&(objectclass=owncloud)(ownCloudMemberOf=ec730a6c-1b63-4b45-b83b-9e2311afdf85))" OCIS_LDAP_USER_MEMBER_ATTRIBUTE: "owncloudMemberOf" OCIS_LDAP_USER_GUEST_ATTRIBUTE: "ownCloudGuestOf" OCIS_LDAP_GROUP_AFFILIATION_ATTRIBUTE: "owncloudMemberOf" OCIS_LDAP_PRECISE_SEARCH_ATTRIBUTE: "cn" OCIS_LDAP_INSTANCE_MAPPER_ENABLED: true OCIS_LDAP_INSTANCE_MAPPER_BASE_DN: "dc=owncloud,dc=com" OCIS_LDAP_INSTANCE_MAPPER_NAME_ATTRIBUTE: "description" OCIS_LDAP_INSTANCE_MAPPER_ID_ATTRIBUTE: "cn" OCIS_MULTI_INSTANCE_QUERY_TEMPLATE: "([^@]+)@(.+).owncloud.test" OCIS_MULTI_INSTANCE_MEMBER_CLAIM: "memberOf" OCIS_MULTI_INSTANCE_GUEST_CLAIM: "guestOf" OCIS_MULTI_INSTANCE_GUEST_ROLE: "user-light" OCIS_LDAP_CROSS_INSTANCE_REFERENCE_TEMPLATE: "{{.Username}}@{{.Instancename}}.owncloud.test" OCIS_LDAP_INSTANCE_URL_TEMPLATE: "https://{{.Instancename}}.owncloud.test" # FIXME: sync groups properly to keycloak and remove the next line PROXY_AUTOPROVISION_CLAIM_GROUPS: "" # specific for deployment example PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM: ownCloudRole volumes: - ./config/ocis/banned-password-list.txt:/etc/ocis/banned-password-list.txt - ./config/ocis/csp.yaml:/etc/ocis/csp.yaml - ocis-config:/etc/ocis - ocis-data:/var/lib/ocis labels: - "traefik.enable=true" - "traefik.http.routers.ocis.entrypoints=https" - "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN:-ocis.owncloud.test}`)" - "traefik.http.routers.ocis.tls.certresolver=http" - "traefik.http.routers.ocis.service=ocis" - "traefik.http.services.ocis.loadbalancer.server.port=9200" logging: driver: ${LOG_DRIVER:-local} restart: always ocis-ocm: image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis}:${OCIS_DOCKER_TAG:-latest} networks: ocis-net: entrypoint: - /bin/sh # run ocis init to initialize a configuration file with random secrets # it will fail on subsequent runs, because the config file already exists # therefore we ignore the error and then start the ocis server command: ["-c", "ocis init || true; ocis server"] environment: # Keycloak IDP specific configuration PROXY_AUTOPROVISION_ACCOUNTS: "true" PROXY_ROLE_ASSIGNMENT_DRIVER: "oidc" OCIS_OIDC_ISSUER: https://${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}/realms/${KEYCLOAK_REALM:-oCIS} PROXY_OIDC_REWRITE_WELLKNOWN: "true" WEB_OIDC_CLIENT_ID: ${OCIS_OIDC_CLIENT_ID:-web} KEYCLOAK_DOMAIN: ${KEYCLOAK_DOMAIN:-keycloak.owncloud.test} # basic config OCIS_URL: https://${OCIS_OCM_DOMAIN:-ocis.ocm.owncloud.test} OCIS_LOG_LEVEL: ${LOG_LEVEL:-info} OCIS_LOG_COLOR: "${LOG_PRETTY:-false}" OCIS_LOG_PRETTY: "${LOG_PRETTY:-false}" PROXY_TLS: "false" # do not use SSL between Traefik and oCIS PROXY_USER_OIDC_CLAIM: "preferred_username" PROXY_USER_CS3_CLAIM: "username" # ?? OCIS_INSECURE: "${INSECURE:-true}" OCIS_EXCLUDE_RUN_SERVICES: "idp,idm" GRAPH_ASSIGN_DEFAULT_USER_ROLE: "false" GRAPH_USERNAME_MATCH: "none" # CSP PROXY_CSP_CONFIG_FILE_LOCATION: /etc/ocis/csp-ocm.yaml OCIS_MFA_ENABLED: ${OCIS_MFA_ENABLED:-false} WEB_OIDC_SCOPE: "openid profile email acr" # make the REVA gateway accessible to the app drivers GATEWAY_GRPC_ADDR: 0.0.0.0:9142 # make the registry available to the app provider containers MICRO_REGISTRY_ADDRESS: 127.0.0.1:9233 NATS_NATS_HOST: 0.0.0.0 NATS_NATS_PORT: 9233 #keycloak WEB_UI_CONFIG_FILE: /etc/ocis/ocis.ocm.web.config.json # LDAP OCIS_LDAP_URI: ldap://ldap-server:389 OCIS_LDAP_INSECURE: "true" OCIS_LDAP_BIND_DN: "cn=admin,dc=owncloud,dc=com" OCIS_LDAP_BIND_PASSWORD: ${LDAP_ADMIN_PASSWORD:-admin} OCIS_LDAP_GROUP_BASE_DN: "ou=groups,dc=owncloud,dc=com" OCIS_LDAP_GROUP_OBJECTCLASS: "groupOfNames" OCIS_LDAP_USER_BASE_DN: "ou=users,dc=owncloud,dc=com" OCIS_LDAP_USER_OBJECTCLASS: "inetOrgPerson" LDAP_LOGIN_ATTRIBUTES: "uid" OCIS_ADMIN_USER_ID: "ddc2004c-0977-11eb-9d3f-a793888cd0f8" IDP_LDAP_LOGIN_ATTRIBUTE: "uid" IDP_LDAP_UUID_ATTRIBUTE: "ownclouduuid" IDP_LDAP_UUID_ATTRIBUTE_TYPE: binary GRAPH_LDAP_SERVER_WRITE_ENABLED: "true" # assuming the external ldap is writable GRAPH_LDAP_REFINT_ENABLED: "true" # osixia has refint enabled. # Multi-Instance OCIS_MULTI_INSTANCE_ENABLED: true OCIS_MULTI_INSTANCE_INSTANCEID: "8d24cb5f-6ee6-4b98-86df-c4c268dddb46" OCIS_LDAP_USER_FILTER: "(&(objectclass=owncloud)(|(ownCloudMemberOf=8d24cb5f-6ee6-4b98-86df-c4c268dddb46)(ownCloudGuestOf=8d24cb5f-6ee6-4b98-86df-c4c268dddb46)))" OCIS_LDAP_GROUP_FILTER: "(&(objectclass=owncloud)(ownCloudMemberOf=8d24cb5f-6ee6-4b98-86df-c4c268dddb46))" OCIS_LDAP_USER_MEMBER_ATTRIBUTE: "owncloudMemberOf" OCIS_LDAP_USER_GUEST_ATTRIBUTE: "ownCloudGuestOf" OCIS_LDAP_PRECISE_SEARCH_ATTRIBUTE: "cn" OCIS_LDAP_INSTANCE_MAPPER_ENABLED: true OCIS_LDAP_INSTANCE_MAPPER_BASE_DN: "dc=owncloud,dc=com" OCIS_LDAP_INSTANCE_MAPPER_NAME_ATTRIBUTE: "description" OCIS_LDAP_INSTANCE_MAPPER_ID_ATTRIBUTE: "cn" OCIS_MULTI_INSTANCE_QUERY_TEMPLATE: "([^@]+)@(.+).owncloud.test" OCIS_MULTI_INSTANCE_MEMBER_CLAIM: "memberOf" OCIS_MULTI_INSTANCE_GUEST_CLAIM: "guestOf" OCIS_MULTI_INSTANCE_GUEST_ROLE: "user-light" OCIS_LDAP_CROSS_INSTANCE_REFERENCE_TEMPLATE: "{{.Username}}@{{.Instancename}}.owncloud.test" OCIS_LDAP_INSTANCE_URL_TEMPLATE: "https://{{.Instancename}}.owncloud.test" # user filter required for multi-instance ocis # Workaround needed to show external users - can be removed once fixed OCIS_USER_SEARCH_DISPLAYED_ATTRIBUTES: mail PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM: ownCloudRole volumes: - ./config/ocis/csp-ocm.yaml:/etc/ocis/csp-ocm.yaml - ./config/ocis/ocis.ocm.web.config.json:/etc/ocis/ocis.ocm.web.config.json:ro # configure the .env file to use own paths instead of docker internal volumes - ${OCIS_OCM_CONFIG_DIR:-ocis-ocm-config}:/etc/ocis - ${OCIS_OCM_DATA_DIR:-ocis-ocm-data}:/var/lib/ocis labels: - "traefik.enable=true" - "traefik.http.routers.ocis-ocm.entrypoints=https" - "traefik.http.routers.ocis-ocm.rule=Host(`${OCIS_OCM_DOMAIN:-ocis.ocm.owncloud.test}`)" - "traefik.http.routers.ocis-ocm.tls.certresolver=http" - "traefik.http.routers.ocis-ocm.service=ocis-ocm" - "traefik.http.services.ocis-ocm.loadbalancer.server.port=9200" logging: driver: ${LOG_DRIVER:-local} restart: always postgres: image: postgres:alpine networks: ocis-net: volumes: - keycloak_postgres_data:/var/lib/postgresql/data environment: POSTGRES_DB: keycloak POSTGRES_USER: keycloak POSTGRES_PASSWORD: keycloak logging: driver: ${LOG_DRIVER:-local} restart: always keycloak: image: quay.io/keycloak/keycloak:26.2.5 networks: ocis-net: command: ["start", "--spi-connections-http-client-default-disable-trust-manager=${INSECURE:-false}", "--import-realm"] entrypoint: ["/bin/sh", "/opt/keycloak/bin/docker-entrypoint-override.sh"] volumes: - "./config/keycloak/docker-entrypoint-override.sh:/opt/keycloak/bin/docker-entrypoint-override.sh" - "./config/keycloak/ocis-realm.dist.json:/opt/keycloak/data/import-dist/ocis-realm.json" environment: OCIS_DOMAIN: ${OCIS_DOMAIN:-ocis.owncloud.test} KC_HOSTNAME: ${KEYCLOAK_DOMAIN:-keycloak.owncloud.test} KC_DB: postgres KC_DB_URL: "jdbc:postgresql://postgres:5432/keycloak" KC_DB_USERNAME: keycloak KC_DB_PASSWORD: keycloak KC_FEATURES: impersonation,opentelemetry KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_ADMIN_USER:-admin} KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin} # as replacement of --proxy=edge KC_PROXY_HEADERS: xforwarded KC_HTTP_ENABLED: true # tracing KC_TRACING_ENABLED: ${KEYCLOAK_TRACING:-false} KC_TRACING_ENDPOINT: http://jaeger:4317 JAVA_OPTS: "-Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true" labels: - "traefik.enable=true" - "traefik.http.routers.keycloak.entrypoints=https" - "traefik.http.routers.keycloak.rule=Host(`${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}`)" - "traefik.http.routers.keycloak.tls.certresolver=http" - "traefik.http.routers.keycloak.service=keycloak" - "traefik.http.services.keycloak.loadbalancer.server.port=8080" depends_on: - postgres logging: driver: ${LOG_DRIVER:-local} restart: always ldap-server: image: osixia/openldap:1.5.0 networks: ocis-net: environment: LDAP_TLS_VERIFY_CLIENT: never LDAP_TLS: false LDAP_ORGANISATION: owncloud LDAP_DOMAIN: owncloud.com LDAP_ROOT: "dc=owncloud,dc=com" LDAP_ADMIN_PASSWORD: ${LDAP_ADMIN_PASSWORD:-admin} LDAP_SEED_INTERNAL_LDIF_PATH: /ldifs LDAP_SEED_INTERNAL_SCHEMA_PATH: /schemas ports: - "127.0.0.1:389:389" - "127.0.0.1:636:636" volumes: - ./config/ldap/ldif:/ldifs - ./config/ldap/schemas:/schemas - ldap-certs:/container/service/slapd/assets/certs - ldap-data:/var/lib/ldap - ldap-config:/etc/ldap/slapd.d logging: driver: ${LOG_DRIVER:-local} restart: always ldap-manager: image: osixia/phpldapadmin:latest networks: ocis-net: environment: PHPLDAPADMIN_LDAP_HOSTS: "#PYTHON2BASH:[{'ldap-server': [{'server': [{'port': 389}]}]}]" PHPLDAPADMIN_HTTPS: "false" labels: - "traefik.enable=true" - "traefik.http.routers.ldap-manager.entrypoints=https" - "traefik.http.routers.ldap-manager.rule=Host(`${LDAP_MANAGER_DOMAIN:-ldap.owncloud.test}`)" - "traefik.http.routers.ldap-manager.tls.certresolver=http" - "traefik.http.routers.ldap-manager.service=ldap-manager" - "traefik.http.services.ldap-manager.loadbalancer.server.port=80" logging: driver: ${LOG_DRIVER:-local} restart: always volumes: certs: ocis-config: ocis-data: keycloak_postgres_data: ocis-ocm-config: ocis-ocm-data: ldap-data: ldap-config: ldap-certs: networks: ocis-net: