OneRing-Admin/docker-compose.yml at master · Spookymic/OneRing-Admin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
services:
  migrate:
    build:
      context: .
      target: builder
    working_dir: /app
    command: sh docker-entrypoint.sh
    environment:
      DATABASE_URL: postgresql://m365admin:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD doit etre defini dans .env}@postgres:5432/m365admin
    depends_on:
      postgres:
        condition: service_healthy
    restart: "no"

  app:
    build:
      context: .
      target: runner
    # Pas de port publie : Caddy (HTTPS) relaie vers app:3000 sur le reseau interne.
    # Pour un acces direct de debug, decommenter : ports: ["127.0.0.1:3001:3000"]
    environment:
      DATABASE_URL: postgresql://m365admin:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD doit etre defini dans .env}@postgres:5432/m365admin
      NEXTAUTH_URL: ${NEXTAUTH_URL:-https://${APP_DOMAIN}}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
      # Optionnel : cle dediee de chiffrement des secrets TOTP (sinon NEXTAUTH_SECRET est utilise)
      TOTP_ENCRYPTION_KEY: ${TOTP_ENCRYPTION_KEY:-}
      AZURE_AD_CLIENT_ID: ${AZURE_AD_CLIENT_ID}
      AZURE_AD_CLIENT_SECRET: ${AZURE_AD_CLIENT_SECRET}
      AZURE_AD_TENANT_ID: ${AZURE_AD_TENANT_ID}
      EXO_BRIDGE_URL: http://exo-bridge:8080
      EXO_BRIDGE_SECRET: ${EXO_BRIDGE_SECRET}
    depends_on:
      migrate:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      exo-bridge:
        condition: service_started
    restart: unless-stopped

  # Pont Exchange Online (cmdlets non couvertes par Graph) — voir docs/ADR-001-pont-exchange.md
  # Aucun port publie : accessible uniquement par 'app' sur le reseau Docker interne.
  exo-bridge:
    build:
      context: ./exo-bridge
    environment:
      EXO_APP_ID: ${EXO_APP_ID}
      EXO_ORG: ${EXO_ORG}
      EXO_CERT_PATH: /certs/onering-exo.pfx
      EXO_CERT_PASSWORD: ${EXO_CERT_PASSWORD}
      EXO_BRIDGE_SECRET: ${EXO_BRIDGE_SECRET}
      # Optionnel : URL admin SharePoint (déduite de EXO_ORG si absente : https://<tenant>-admin.sharepoint.com)
      SPO_ADMIN_URL: ${SPO_ADMIN_URL:-}
    volumes:
      - ./exo-bridge/secrets:/certs:ro
    restart: unless-stopped

  # Reverse proxy HTTPS — point d'entree unique sur le domaine APP_DOMAIN.
  # tls internal : certificat signe par la CA interne de Caddy (voir docs/Deploiement-domaine.md).
  caddy:
    image: caddy:2-alpine
    ports:
      - "80:80"
      - "443:443"
    environment:
      APP_DOMAIN: ${APP_DOMAIN}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      app:
        condition: service_started
    restart: unless-stopped

  postgres:
    image: postgres:16-alpine
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: m365admin
      POSTGRES_USER: m365admin
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD doit etre defini dans .env}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U m365admin"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

volumes:
  postgres_data:
  caddy_data:
  caddy_config: