AuthService/compose.yml at main · shenxianovo/AuthService · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
services:
  db:
    image: postgres:18.4-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: authservice
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: authservice
    volumes:
      - db-data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U authservice"]
      interval: 5s
      timeout: 3s
      retries: 5
    networks:
      - backend

  backend:
    image: ghcr.io/shenxianovo/authservice-backend:latest
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      # Connection string — Docker's DNS resolves "db" to the db container
      ConnectionStrings__DefaultConnection: "Host=db;Port=5432;Database=authservice;Username=authservice;Password=${DB_PASSWORD}"
      # RSA keys are mounted as docker secrets at /run/secrets/<name>
      Jwt__PrivateKeyPath: /run/secrets/jwt_private
      Jwt__PublicKeyPath: /run/secrets/jwt_public
      Jwt__Issuer: ${JWT_ISSUER:-https://auth.shenxianovo.com}
      Jwt__Audience: ${JWT_AUDIENCE:-https://auth.shenxianovo.com}
      # OAuth providers
      GithubOAuth__ClientId: ${GITHUB_OAUTH_CLIENT_ID}
      GithubOAuth__ClientSecret: ${GITHUB_OAUTH_CLIENT_SECRET}
      GoogleOAuth__ClientId: ${GOOGLE_OAUTH_CLIENT_ID}
      GoogleOAuth__ClientSecret: ${GOOGLE_OAUTH_CLIENT_SECRET}
      # Resend email
      Resend__ApiKey: ${RESEND_API_KEY}
      # OIDC provider (OpenIddict) — clients are managed in the admin UI
      Oidc__EncryptionKey: ${OIDC_ENCRYPTION_KEY}
      # Bootstrap admin (promoted idempotently at startup)
      Admin__BootstrapUsername: ${ADMIN_BOOTSTRAP_USERNAME}
    secrets:
      - jwt_private
      - jwt_public
    networks:
      - backend

  frontend:
    image: ghcr.io/shenxianovo/authservice-frontend:latest
    restart: unless-stopped
    depends_on:
      - backend
    ports:
      - "127.0.0.1:8080:8080"
    networks:
      - backend

volumes:
  db-data:

secrets:
  jwt_private:
    file: ./secrets/jwt_private.pem
  jwt_public:
    file: ./secrets/jwt_public.pem

networks:
  backend:
    driver: bridge