firezone/docker-compose.yml

version: '3.8'

services:
  # Dependencies
  postgres:
    image: postgres:15
    volumes:
      - postgres-data:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: firezone_dev
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"
        ]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    ports:
      - 5432:5432
    networks:
      - app

  vault:
    image: vault
    environment:
      VAULT_ADDR: 'http://127.0.0.1:8200'
      VAULT_DEV_ROOT_TOKEN_ID: 'firezone'
    ports:
      - 8200:8200/tcp
    cap_add:
      - IPC_LOCK
    networks:
      - app

  # Firezone Components
  web:
    build:
      context: elixir
      args:
        APPLICATION_NAME: web
    image: firezone_web_dev
    hostname: web.cluster.local
    ports:
      - 8080:8080/tcp
    environment:
      # Web Server
      EXTERNAL_URL: http://localhost:8080/
      PHOENIX_HTTP_WEB_PORT: "8080"
      PHOENIX_SECURE_COOKIES: false
      # Erlang
      ERLANG_DISTRIBUTION_PORT: 9000
      ERLANG_CLUSTER_ADAPTER: "Elixir.Cluster.Strategy.Epmd"
      ERLANG_CLUSTER_ADAPTER_CONFIG: '{"hosts":["api@api.cluster.local","web@web.cluster.local"]}'
      RELEASE_COOKIE: "NksuBhJFBhjHD1uUa9mDOHV"
      RELEASE_HOSTNAME: "web.cluster.local"
      RELEASE_NAME: "web"
      # Database
      DATABASE_HOST: postgres
      DATABASE_PORT: 5432
      DATABASE_NAME: firezone_dev
      DATABASE_USER: postgres
      DATABASE_PASSWORD: postgres
      # Auth
      AUTH_PROVIDER_ADAPTERS: "email,openid_connect,userpass,token"
      # Secrets
      AUTH_TOKEN_KEY_BASE: "5OVYJ83AcoQcPmdKNksuBhJFBhjHD1uUa9mDOHV/6EIdBQ6pXksIhkVeWIzFk5S2"
      AUTH_TOKEN_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      RELAYS_AUTH_TOKEN_KEY_BASE: "5OVYJ83AcoQcPmdKNksuBhJFBhjHD1uUa9mDOHV/6EIdBQ6pXksIhkVeWIzFk5S2"
      RELAYS_AUTH_TOKEN_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      GATEWAYS_AUTH_TOKEN_KEY_BASE: "5OVYJ83AcoQcPmdKNksuBhJFBhjHD1uUa9mDOHV/6EIdBQ6pXksIhkVeWIzFk5S2"
      GATEWAYS_AUTH_TOKEN_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      SECRET_KEY_BASE: "5OVYJ83AcoQcPmdKNksuBhJFBhjHD1uUa9mDOHV/6EIdBQ6pXksIhkVeWIzFk5S2"
      LIVE_VIEW_SIGNING_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      COOKIE_SIGNING_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      COOKIE_ENCRYPTION_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      # Telemetry
      TELEMETRY_ENABLED: "false"
      # Debugging
      LOG_LEVEL: "debug"
      # Emails
      OUTBOUND_EMAIL_FROM: "public-noreply@firez.one"
      OUTBOUND_EMAIL_ADAPTER: "Elixir.Swoosh.Adapters.Postmark"
      ## Warning: The token is for the blackhole Postmark server created in a separate isolated account,
      ## that WILL NOT send any actual emails, but you can see and debug them in the Postmark dashboard.
      OUTBOUND_EMAIL_ADAPTER_OPTS: "{\"api_key\":\"7da7d1cd-111c-44a7-b5ac-4027b9d230e5\"}"
    depends_on:
      postgres:
        condition: 'service_healthy'
    networks:
      - app

  api:
    build:
      context: elixir
      args:
        APPLICATION_NAME: api
    image: firezone_api_dev
    hostname: api.cluster.local
    ports:
      - 8081:8081/tcp
    environment:
      # Web Server
      EXTERNAL_URL: http://localhost:8081/
      PHOENIX_HTTP_API_PORT: "8081"
      PHOENIX_SECURE_COOKIES: false
      # Erlang
      ERLANG_DISTRIBUTION_PORT: 9000
      ERLANG_CLUSTER_ADAPTER: "Elixir.Cluster.Strategy.Epmd"
      ERLANG_CLUSTER_ADAPTER_CONFIG: '{"hosts":["api@api.cluster.local","web@web.cluster.local"]}'
      RELEASE_COOKIE: "NksuBhJFBhjHD1uUa9mDOHV"
      RELEASE_HOSTNAME: "api.cluster.local"
      RELEASE_NAME: "api"
      # Database
      DATABASE_HOST: postgres
      DATABASE_PORT: 5432
      DATABASE_NAME: firezone_dev
      DATABASE_USER: postgres
      DATABASE_PASSWORD: postgres
      # Auth
      AUTH_PROVIDER_ADAPTERS: "email,openid_connect,userpass,token"
      # Secrets
      AUTH_TOKEN_KEY_BASE: "5OVYJ83AcoQcPmdKNksuBhJFBhjHD1uUa9mDOHV/6EIdBQ6pXksIhkVeWIzFk5S2"
      AUTH_TOKEN_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      RELAYS_AUTH_TOKEN_KEY_BASE: "5OVYJ83AcoQcPmdKNksuBhJFBhjHD1uUa9mDOHV/6EIdBQ6pXksIhkVeWIzFk5S2"
      RELAYS_AUTH_TOKEN_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      GATEWAYS_AUTH_TOKEN_KEY_BASE: "5OVYJ83AcoQcPmdKNksuBhJFBhjHD1uUa9mDOHV/6EIdBQ6pXksIhkVeWIzFk5S2"
      GATEWAYS_AUTH_TOKEN_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      SECRET_KEY_BASE: "5OVYJ83AcoQcPmdKNksuBhJFBhjHD1uUa9mDOHV/6EIdBQ6pXksIhkVeWIzFk5S2"
      LIVE_VIEW_SIGNING_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      COOKIE_SIGNING_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      COOKIE_ENCRYPTION_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      # Telemetry
      TELEMETRY_ENABLED: "false"
      # Debugging
      LOG_LEVEL: "debug"
      # Emails
      OUTBOUND_EMAIL_FROM: "public-noreply@firez.one"
      OUTBOUND_EMAIL_ADAPTER: "Elixir.Swoosh.Adapters.Postmark"
      ## Warning: The token is for the blackhole Postmark server created in a separate isolated account,
      ## that WILL NOT send any actual emails, but you can see and debug them in the Postmark dashboard.
      OUTBOUND_EMAIL_ADAPTER_OPTS: "{\"api_key\":\"7da7d1cd-111c-44a7-b5ac-4027b9d230e5\"}"
    depends_on:
      postgres:
        condition: 'service_healthy'
    networks:
      - app

  # This is a service container which allows to run mix tasks for local development
  # without having to install Elixir and Erlang on the host machine.
  elixir:
    build:
      context: elixir
      target: builder
      args:
        APPLICATION_NAME: api
    image: firezone_local_dev
    hostname: elixir
    volumes:
      - elixir-build-cache:/app/_build
      - ./elixir/apps:/app/apps
      - ./elixir/config:/app/config
      - ./elixir/priv:/app/priv
      - ./elixir/rel:/app/rel
      - ./elixir/mix.exs:/app/mix.exs
      - ./elixir/mix.lock:/app/mix.lock
      - assets-build-cache:/app/apps/web/assets/node_modules
    environment:
      # Web Server
      EXTERNAL_URL: http://localhost:8081/
      # Erlang
      ERLANG_DISTRIBUTION_PORT: 9000
      ERLANG_CLUSTER_ADAPTER: "Elixir.Domain.Cluster.Local"
      ERLANG_CLUSTER_ADAPTER_CONFIG: '{}'
      RELEASE_COOKIE: "NksuBhJFBhjHD1uUa9mDOHV"
      RELEASE_HOSTNAME: "mix.cluster.local"
      RELEASE_NAME: "mix"
      # Database
      DATABASE_HOST: postgres
      DATABASE_PORT: 5432
      DATABASE_NAME: firezone_dev
      DATABASE_USER: postgres
      DATABASE_PASSWORD: postgres
      # Auth
      AUTH_PROVIDER_ADAPTERS: "email,openid_connect,userpass,token"
      # Secrets
      AUTH_TOKEN_KEY_BASE: "5OVYJ83AcoQcPmdKNksuBhJFBhjHD1uUa9mDOHV/6EIdBQ6pXksIhkVeWIzFk5S2"
      AUTH_TOKEN_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      RELAYS_AUTH_TOKEN_KEY_BASE: "5OVYJ83AcoQcPmdKNksuBhJFBhjHD1uUa9mDOHV/6EIdBQ6pXksIhkVeWIzFk5S2"
      RELAYS_AUTH_TOKEN_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      GATEWAYS_AUTH_TOKEN_KEY_BASE: "5OVYJ83AcoQcPmdKNksuBhJFBhjHD1uUa9mDOHV/6EIdBQ6pXksIhkVeWIzFk5S2"
      GATEWAYS_AUTH_TOKEN_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      SECRET_KEY_BASE: "5OVYJ83AcoQcPmdKNksuBhJFBhjHD1uUa9mDOHV/6EIdBQ6pXksIhkVeWIzFk5S2"
      LIVE_VIEW_SIGNING_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      COOKIE_SIGNING_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      COOKIE_ENCRYPTION_SALT: "t01wa0K4lUd7mKa0HAtZdE+jFOPDDej2"
      # Telemetry
      TELEMETRY_ENABLED: "false"
      # Higher log level not to make seeds output too verbose
      LOG_LEVEL: "info"
      # Emails
      OUTBOUND_EMAIL_FROM: "public-noreply@firez.one"
      OUTBOUND_EMAIL_ADAPTER: "Elixir.Swoosh.Adapters.Postmark"
      ## Warning: The token is for the blackhole Postmark server created in a separate isolated account,
      ## that WILL NOT send any actual emails, but you can see and debug them in the Postmark dashboard.
      OUTBOUND_EMAIL_ADAPTER_OPTS: "{\"api_key\":\"7da7d1cd-111c-44a7-b5ac-4027b9d230e5\"}"
      # Mix env should be set to prod to use secrets declared above,
      # otherwise seeds will generate invalid tokens
      MIX_ENV: "prod"
    depends_on:
      postgres:
        condition: 'service_healthy'
    networks:
      - app

networks:
  app:
    enable_ipv6: true
    ipam:
      config:
        - subnet: 172.28.0.0/16
        - subnet: 2001:3990:3990::/64

volumes:
  postgres-data:
  elixir-build-cache:
  assets-build-cache: