firezone/docker-compose.yml

version: '3.7'

services:
  caddy:
    image: caddy:2
    volumes:
      - ./priv/Caddyfile:/etc/caddy/Caddyfile
      - ./priv/pki:/data/caddy/pki
    ports:
      - 80:80
      - 443:443
    networks:
      app:
        ipv4_address: 172.28.0.99
        ipv6_address: 2001:3990:3990::99

  firezone:
    build:
      context: .
      dockerfile: Dockerfile.dev
      args:
        DATABASE_HOST: postgres
        DATABASE_PORT: 5432
        DATABASE_NAME: firezone_dev
        DATABASE_USER: postgres
        DATABASE_PASSWORD: postgres
    image: firezone_dev
    volumes:
      - ./priv:/var/app/priv
      - ./apps:/var/app/apps
      - ./config:/var/app/config
      - ./mix.exs:/var/app/mix.exs
      - ./mix.lock:/var/app/mix.lock
      # Mask the following build directories to keep compiled binaries isolated
      # from the local project. This is needed when the Docker Host platform
      # doesn't match the platform under which Docker Engine is running. e.g.
      # WSL, Docker for Mac, etc.
      - /var/app/apps/fz_http/assets/node_modules
    ports:
      - 51820:51820/udp
    environment:
      EXTERNAL_URL: ${EXTERNAL_URL:-https://localhost}
      LOCAL_AUTH_ENABLED: 'true'
      FZ_WALL_CLI_MODULE: FzWall.CLI.Live
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv4.ip_forward=1
      - net.ipv6.conf.all.forwarding=1
    depends_on:
      postgres:
        condition: 'service_healthy'
    networks:
      - app
      - isolation

  postgres:
    image: postgres:15
    volumes:
      - postgres-data:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: firezone_dev
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    ports:
      - 5432:5432
    networks:
      - app

  # Vault can act as an OIDC IdP as well
  vault:
    image: vault
    environment:
      VAULT_ADDR: 'http://127.0.0.1:8200'
      VAULT_DEV_ROOT_TOKEN_ID: 'firezone'
    ports:
      - 8200:8200/tcp
    cap_add:
      - IPC_LOCK
    networks:
      - app

  saml-idp:
    # This is a container with this PR merged: https://github.com/kristophjunge/docker-test-saml-idp/pull/27
    image: vihangk1/docker-test-saml-idp:latest
    environment:
      SIMPLESAMLPHP_SP_ENTITY_ID: 'urn:firezone.dev:firezone-app'
      SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE: 'http://localhost:13000/auth/saml/sp/consume/mysamlidp'
      SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE: 'http://localhost:13000/auth/saml/sp/logout/mysamlidp'
      SIMPLESAMLPHP_SP_NAME_ID_FORMAT: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
      SIMPLESAMLPHP_SP_NAME_ID_ATTRIBUTE: 'email'
      SIMPLESAMLPHP_IDP_AUTH: 'example-userpass'
    ports:
      - 8400:8080/tcp
      - 8443:8443/tcp
    networks:
      - app

  # Unfortunately the Linux VM kernel for Docker Desktop is not compiled with
  # Dynamic Debug enabled, so we're unable to enable WireGuard debug logging.
  # Since WireGuard is designed to be silent by default, this basically does
  # nothing.
  # wireguard-log:
  #   image: ubuntu:jammy
  #   # cap SYSLOG was enough for reading but privilege is required for tailing
  #   privileged: true
  #   command: >
  #     bash -c '
  #     mount -t debugfs none /sys/kernel/debug
  #     && echo module wireguard +p > /sys/kernel/debug/dynamic_debug/control
  #     && dmesg -wT | grep wireguard:'

  client:
    depends_on:
      - firezone
    image: linuxserver/wireguard:latest
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=UTC
      - ALLOWEDIPS="0.0.0.0/0,::/0"
    volumes:
      - ./priv/wg0.client.conf:/config/wg0.conf
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv4.conf.all.src_valid_mark=1
    networks:
      - isolation

volumes:
  postgres-data:
  # Disabled due to Authentik being disabled
  # redis-data:

networks:
  app:
    enable_ipv6: true
    ipam:
      config:
        - subnet: 172.28.0.0/16
        - subnet: 2001:3990:3990::/64
  isolation: