1 ################################################################################
2 # Copyright 2023 highstreet technologies GmbH
4 # Licensed under the Apache License, Version 2.0 (the "License");
5 # you may not use this file except in compliance with the License.
6 # You may obtain a copy of the License at
8 # http://www.apache.org/licenses/LICENSE-2.0
10 # Unless required by applicable law or agreed to in writing, software
11 # distributed under the License is distributed on an "AS IS" BASIS,
12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 # See the License for the specific language governing permissions and
14 # limitations under the License.
16 # no more versions needed! Compose spec supports all features w/o a version
20 image: ${TRAEFIK_IMAGE}
21 container_name: gateway
39 - --serverstransport.insecureskipverify=true
40 - --log.level=${TRAEFIK_LOG_LEVEL}
41 - --global.sendanonymoususage=false
42 - --global.checkNewVersion=false
44 - --api.dashboard=true
48 - --entrypoints.web.address=:80
49 - --entrypoints.web.http.redirections.entrypoint.to=websecure
50 - --entrypoints.web.http.redirections.entrypoint.scheme=https
51 - --entrypoints.websecure.address=:443
52 - --entrypoints.websecure.http.tls.domains[0].main=gateway.${HTTP_DOMAIN}
53 - --entrypoints.websecure.http.tls.domains[0].sans=*.${HTTP_DOMAIN}
54 - --entrypoints.ssh-netconf-callhome.address=:4334
55 - --entrypoints.tls-netconf-callhome.address=:4335
56 - --providers.docker.endpoint=unix:///var/run/docker.sock
57 - --providers.docker.network=${TRAEFIK_NETWORK_NAME}
58 - --providers.docker.exposedByDefault=false
59 - --providers.docker.watch=true
60 - --providers.file.filename=/middleware.yaml
62 - /var/run/docker.sock:/var/run/docker.sock:ro
63 - ./gateway/conf/middleware.yaml:/middleware.yaml:ro
64 - ./gateway/conf/.htpasswd:/.htpasswd:ro
67 traefik.http.middlewares.traefik-auth.basicauth.usersfile: .htpasswd
68 traefik.http.routers.gateway.rule: Host(`gateway.${HTTP_DOMAIN}`)
69 traefik.http.routers.gateway.entrypoints: websecure
70 traefik.http.routers.gateway.service: api@internal
71 traefik.http.routers.gateway.middlewares: strip
72 traefik.http.middlewares.strip.stripprefix.prefixes: /traefik
73 traefik.http.routers.gateway.tls: true
74 traefik.http.services.gateway.loadbalancer.server.port: 8080
80 image: ${IDENTITYDB_IMAGE}
81 container_name: identitydb
84 - ALLOW_EMPTY_PASSWORD=no
85 - POSTGRESQL_USERNAME=keycloak
86 - POSTGRESQL_DATABASE=keycloak
87 - POSTGRESQL_PASSWORD=keycloak
90 image: ${IDENTITY_IMAGE}
91 container_name: identity
94 - KEYCLOAK_CREATE_ADMIN_USER=true
95 - KEYCLOAK_ADMIN_USER=${ADMIN_USERNAME}
96 - KEYCLOAK_ADMIN_PASSWORD=${ADMIN_PASSWORD}
97 - KEYCLOAK_MANAGEMENT_USER=${IDENTITY_MGMT_USERNAME}
98 - KEYCLOAK_MANAGEMENT_PASSWORD=${IDENTITY_MGMT_PASSWORD}
99 - KEYCLOAK_DATABASE_HOST=identitydb
100 - KEYCLOAK_DATABASE_NAME=keycloak
101 - KEYCLOAK_DATABASE_USER=keycloak
102 - KEYCLOAK_DATABASE_PASSWORD=keycloak
103 - KEYCLOAK_JDBC_PARAMS=sslmode=disable&connectTimeout=30000
104 - KEYCLOAK_PRODUCTION=false
105 - KEYCLOAK_ENABLE_TLS=true
106 - KEYCLOAK_TLS_KEYSTORE_FILE=/opt/bitnami/keycloak/certs/keystore.jks
107 - KEYCLOAK_TLS_TRUSTSTORE_FILE=/opt/bitnami/keycloak/certs/truststore.jks
108 - KEYCLOAK_TLS_KEYSTORE_PASSWORD=password
109 - KEYCLOAK_TLS_TRUSTSTORE_PASSWORD=changeit
110 restart: unless-stopped
112 - /etc/localtime:/etc/localtime:ro
113 - ./identity/standalone.xml:/opt/jboss/keycloak/standalone/configuration/standalone.xml
114 - ./identity/keystore.jks:/opt/bitnami/keycloak/certs/keystore.jks
115 - ./identity/truststoreONAPall.jks:/opt/bitnami/keycloak/certs/truststore.jks
118 traefik.http.routers.identity.entrypoints: websecure
119 traefik.http.routers.identity.rule: Host(`identity.${HTTP_DOMAIN}`)
120 traefik.http.routers.identity.tls: true
121 traefik.http.services.identity.loadbalancer.server.port: 8080
124 condition: service_started
126 condition: service_healthy
132 image: ${PERSISTENCE_IMAGE}
133 container_name: persistence
135 - discovery.type=single-node
138 image: ${ZOOKEEPER_IMAGE}
139 container_name: zookeeper
141 ZOOKEEPER_REPLICAS: 1
142 ZOOKEEPER_TICK_TIME: 2000
143 ZOOKEEPER_SYNC_LIMIT: 5
144 ZOOKEEPER_INIT_LIMIT: 10
145 ZOOKEEPER_MAX_CLIENT_CNXNS: 200
146 ZOOKEEPER_AUTOPURGE_SNAP_RETAIN_COUNT: 3
147 ZOOKEEPER_AUTOPURGE_PURGE_INTERVAL: 24
148 ZOOKEEPER_CLIENT_PORT: 2181
149 KAFKA_OPTS: -Djava.security.auth.login.config=/etc/zookeeper/secrets/jaas/zk_server_jaas.conf -Dzookeeper.kerberos.removeHostFromPrincipal=true -Dzookeeper.kerberos.removeRealmFromPrincipal=true -Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider -Dzookeeper.requireClientAuthScheme=sasl
152 - ./zookeeper/zk_server_jaas.conf:/etc/zookeeper/secrets/jaas/zk_server_jaas.conf
155 image: ${KAFKA_IMAGE}
156 container_name: kafka
159 KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
160 KAFKA_ZOOKEEPER_CONNECTION_TIMEOUT_MS: 40000
161 KAFKA_ZOOKEEPER_SESSION_TIMEOUT_MS: 40000
162 KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: INTERNAL_PLAINTEXT:PLAINTEXT,EXTERNAL_PLAINTEXT:PLAINTEXT
163 KAFKA_ADVERTISED_LISTENERS: INTERNAL_PLAINTEXT://kafka:9092
164 KAFKA_LISTENERS: INTERNAL_PLAINTEXT://0.0.0.0:9092
165 KAFKA_INTER_BROKER_LISTENER_NAME: INTERNAL_PLAINTEXT
166 KAFKA_CONFLUENT_SUPPORT_METRICS_ENABLE: 'false'
167 KAFKA_OPTS: -Djava.security.auth.login.config=/etc/kafka/secrets/jaas/zk_client_jaas.conf
168 KAFKA_ZOOKEEPER_SET_ACL: 'true'
169 KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
170 # Reduced the number of partitions only to avoid the timeout error for the first subscribe call in slow environment
171 KAFKA_OFFSETS_TOPIC_NUM_PARTITIONS: 1
173 - ./kafka/zk_client_jaas.conf:/etc/kafka/secrets/jaas/zk_client_jaas.conf
176 condition: service_started
179 image: ${KAFKA_BRIDGE_IMAGE}
180 container_name: kafka-bridge
181 hostname: kafka-bridge
182 entrypoint: /opt/strimzi/bin/kafka_bridge_run.sh
183 command: --config-file=config/application.properties
185 test: curl http://localhost:8080/healthy || exit 1
191 traefik.http.routers.kafka-bridge.entrypoints: websecure
192 traefik.http.routers.kafka-bridge.rule: Host(`kafka-bridge.${HTTP_DOMAIN}`)
193 traefik.http.routers.kafka-bridge.tls: true
194 traefik.http.services.kafka-bridge.loadbalancer.server.port: 8080
196 - ./kafka-bridge:/opt/strimzi/config
199 condition: service_started
201 condition: service_healthy
207 image: "${O_RAN_SC_TOPOLOGY_IMAGE}"
208 container_name: topology
211 test: curl -u ${ADMIN_USERNAME}:${ADMIN_USERNAME} http://localhost:8181 || exit 1
217 - ./topology/tapi-common-operational.json:/opt/dev/deploy/data/tapi-common-operational.json
218 - ./topology/tapi-common-running.json:/opt/dev/deploy/data/tapi-common-running.json
221 traefik.http.routers.topology.entrypoints: websecure
222 traefik.http.routers.topology.rule: Host(`topology.${HTTP_DOMAIN}`)
223 traefik.http.routers.topology.tls: true
224 traefik.http.services.topology.loadbalancer.server.port: 8181
230 image: ${DMAAP_IMAGE}
231 container_name: messages
236 - ./messages/MsgRtrApi.properties:/appl/dmaapMR1/bundleconfig/etc/appprops/MsgRtrApi.properties
237 - ./messages/logback.xml:/appl/dmaapMR1/bundleconfig/etc/logback.xml
238 - ./messages/cadi.properties:/appl/dmaapMR1/etc/cadi.properties
241 traefik.http.routers.messages.entrypoints: websecure
242 traefik.http.routers.messages.rule: Host(`messages.${HTTP_DOMAIN}`)
243 traefik.http.routers.messages.tls: true
244 traefik.http.services.messages.loadbalancer.server.port: 3904
247 condition: service_started
249 condition: service_healthy
270 - subnet: ${NETWORK_SUBNET_DCN_IPv6}