maSSO/docker-compose.yml at main · doyensec/maSSO · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
services:

  # ── OIDC IdP ────────────────────────────────────────────────────────────────
  masso-oidc:
    build: .
    environment:
      # Default 0 (like local runs without --cloudflared); set 1 for in-container Quick Tunnel
      MASSO_CLOUDFLARED: "${MASSO_CLOUDFLARED:-0}"
      # Default 0 (single IdP); set 1 to run two independent IdP instances (--duo)
      MASSO_DUO: "${MASSO_DUO:-0}"
      # OIDC client quick-setup - single mode only. entrypoint.sh omits these
      # flags entirely when MASSO_DUO is set (masso rejects them with --duo);
      # configure each IdP's client from the dashboard's Settings tab instead.
      OIDC_CLIENT_ID: "${OIDC_CLIENT_ID:-web}"
      OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET:-secret}"
      OIDC_REDIRECT_URI: "${OIDC_REDIRECT_URI:-http://localhost:9999/callback}"
    command:
      - oidc
      - --issuer
      - "${MASSO_ISSUER:-http://localhost:8081/}"
    ports:
      - "${MASSO_PORT:-8081}:8081"       # IdP endpoints - expose via tunnel
      - "${MASSO_PORT_B:-8083}:8083"     # IdP B endpoints (duo mode only; unused otherwise)
      - "127.0.0.1:${MASSO_DASH_PORT:-8082}:8082"  # Dashboard - keep local
    volumes:
      - masso-oidc-data:/app/data
    restart: unless-stopped
    profiles:
      - oidc

  # ── SAML 2.0 IdP ────────────────────────────────────────────────────────────
  masso-saml:
    build: .
    environment:
      # Default 0 (like local runs without --cloudflared); set 1 for in-container Quick Tunnel
      MASSO_CLOUDFLARED: "${MASSO_CLOUDFLARED:-0}"
      # Default 0 (single IdP); set 1 to run two independent IdP instances (--duo)
      MASSO_DUO: "${MASSO_DUO:-0}"
      # SAML ACS/audience - single mode only. entrypoint.sh omits these flags
      # entirely when MASSO_DUO is set (masso rejects them with --duo); each
      # IdP falls back to the ACS from the SP's AuthnRequest, or configure it
      # explicitly per instance from the dashboard's Settings tab.
      SAML_ACS_URL: "${SAML_ACS_URL:-}"
      SAML_AUDIENCE: "${SAML_AUDIENCE:-}"
    command:
      - saml
      - --issuer
      - "${MASSO_ISSUER:-http://localhost:8081/}"
    ports:
      - "${MASSO_PORT:-8081}:8081"       # IdP endpoints - expose via tunnel
      - "${MASSO_PORT_B:-8083}:8083"     # IdP B endpoints (duo mode only; unused otherwise)
      - "127.0.0.1:${MASSO_DASH_PORT:-8082}:8082"  # Dashboard - keep local
    volumes:
      - masso-saml-data:/app/data
    restart: unless-stopped
    profiles:
      - saml

volumes:
  masso-oidc-data:
  masso-saml-data: