docker-compose.yml

version: '3.8'

services:
  # init:
  #   build: ./init
  #   container_name: init
  #   hostname: init.example.com
  #   volumes:
  #     - /var/run/podman/podman.sock:/var/run/podman/podman.sock
  #     # - /var/run/podman-helper-erich.birngruber.socket:/run/podman/podman.sock
  #     # - /var/run/docker.sock:/var/run/docker.sock
  #   #environment:
  #   #  - DOCKER_HOST=/var/run/docker.sock
  #   networks:
  #     - ssh-network
  #   restart: "no"

  dnsmasq:
    image: jpillora/dnsmasq:latest
    container_name: dnsmasq
    hostname: dns.example.com
    networks:
      ssh-network:
        ipv4_address: 172.20.0.53
    ports:
      # - "53:53/udp"
      # - "53:53/tcp"
      - "8053:8080"
    environment:
      - HTTP_USER=demo
      - HTTP_PASS=demo
      - DNS1=172.20.0.1
      # - DNS1=192.168.127.1
      # - DNS2=9.9.9.9
    cap_add:
      - NET_ADMIN
    command: --log-queries --cache-size=1000 --conf-dir=/etc/dnsmasq.d
      # --no-resolv  --server=127.0.0.11
    volumes:
      - ./dnsmasq/dnsmasq.conf:/etc/dnsmasq.conf
      - ./dnsmasq/dnsmasq.d:/etc/dnsmasq.d
    healthcheck:
      test: ["CMD-SHELL", "test $(netstat -tlpn | grep dnsmasq | grep ':53' | wc -l ) -eq 2"]
      interval: 5s
      # timeout: 3s
      # retries: 5
      # start_interval: 1s
      start_period: 3s

  # kanidm
  idm:
    build: ./idm
    container_name: idm
    hostname: idm.example.com
    environment:
      - KANIDM_DOMAIN=idm.example.com
      - KANIDM_ORIGIN=https://idm.example.com:8443
      - KANIDM_URL=https://idm.example.com:8443
      - KANIDM_CA_PATH=/certs/root.pem
      - KANIDM_NAME=idm_admin
      - KANIDM_CONFIG=/config/server.toml
      - HOME=/data
    volumes:
      - ./idm/data:/data
      - ./idm/config:/config:ro
      # allow write for init container inject
      - ./idm/certs/:/certs
      # - ./idm/init.sh:/init.sh:ro
    secrets:
      - capassword
    networks:
      ssh-network:
        ipv4_address: 172.20.0.2
    dns:
      - 172.20.0.53
    ports:
      - "8443:8443"
    # depends_on:
    #   - dnsmasq
    healthcheck:
      test: ["CMD", "/usr/bin/kanidmd", "healthcheck"]
      interval: 10s
      start_period: 5s
      start_interval: 5s
    restart: on-failure

  ca:
    image: smallstep/step-ca:latest
    container_name: ca
    hostname: ca.example.com
    environment:
      - DOCKER_STEPCA_INIT_NAME=FOSDEM26 Demo CA
      - DOCKER_STEPCA_INIT_DNS_NAMES=ca.example.com,localhost
      - DOCKER_STEPCA_INIT_PROVISIONER_NAME=demo
      - DOCKER_STEPCA_INIT_PASSWORD=demo
      - DOCKER_STEPCA_INIT_ACME=true
      - DOCKER_STEPCA_INIT_SSH=true
    volumes:
      - ./ca/data:/home/step
    networks:
      ssh-network:
        ipv4_address: 172.20.0.3
    dns:
      - 172.20.0.53
    ports:
      - "9000:9000"
    secrets:
      - capassword
    depends_on:
      - idm
      #  condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "test $(curl -sk https://ca.example.com:9000/health | jq -r .status) = 'ok'"]
      interval: 10s
      start_period: 10s

  ssh-client:
    build: ./client
    container_name: ssh-client
    hostname: client.example.com
    command: sleep infinity
    volumes:
      - ./client/config/nginx.conf:/etc/nginx/http.d/default.conf:ro
    #  - ./client/config/home:/home
    networks:
      ssh-network:
        ipv4_address: 172.20.0.4
    dns:
      - 172.20.0.53
    depends_on:
      - ca
    #  - kanidm
    ports:
      # OPK SSH
      - "127.0.0.1:3000:3000"
      #- "127.0.0.1:10000:10000"
      #- "127.0.0.1:10001:10001"
      # for step ssh client
      - "127.0.0.1:5000:5000"
    environment:
      - 'PS1=[\u@\h \W]\$ '
    healthcheck:
      test: ["CMD", "/bin/true"]

  ssh-server:
    build: ./server
    container_name: ssh-server
    hostname: server.example.com
    volumes:
      - ./server/config/kanidm/:/etc/kanidm/:ro
      - ./server/config/sshd_config.d/:/etc/ssh/sshd_config.d:ro
      - ./server/config/opk:/etc/opk:ro
      - ./server/config/motd:/etc/motd:ro
    secrets:
      - capassword
    networks:
      ssh-network:
        ipv4_address: 172.20.0.5
    dns:
      - 172.20.0.53
    depends_on:
      - ca
    ports:
      - "2222:22"
    environment:
      - 'PS1=[\A \u@\h \W]\$ '
    healthcheck:
      test: ["CMD-SHELL", "test $(netstat -tlpn | grep sshd | grep ':22' | wc -l ) -ge 1"]


networks:
  ssh-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/24

secrets:
  capassword:
    file: ./ca/secrets/password.txt

# volumes: