docker-compose-idp.yml

version: "3.3"

services:
    flow:
      image: docker.io/hazelcast/hazelcast-flow:${FLOW_VERSION:-latest}
      healthcheck:
        test: curl --fail http://localhost:9021/api/actuator/health || exit 1
        interval: 30s
        timeout: 5s
        retries: 3
      environment:
         FLOW_SECURITY_OPENIDP_SCOPE: "openid email profile"
         MC_LICENSE: "${MC_LICENSE}"
         JAVA_OPTS: >-
            -Xms256m
            -Xmx1024m
         OPTIONS: >-
            --flow.analytics.persistRemoteCallResponses=true
            --flow.analytics.persistResults=true
            --flow.db.database=flow
            --flow.db.username=flow
            --flow.db.password=changeme
            --flow.db.host=postgres
            --flow.security.openIdp.enabled=true
            --flow.security.openIdp.jwks-uri=http://management-center:8080/oauth2/jwks
            --flow.security.openIdp.issuerUrl=http://localhost:8080
            --flow.security.openIdp.clientId=flow-client
            --flow.security.openIdp.require-https=false
            --flow.security.openIdp.roles.format=path
            --flow.security.openIdp.roles.path=roles
            --flow.security.openIdp.refreshTokensDisabled=true
            --flow.security.openIdp.executorRoleClientId=application-client
            --flow.security.openIdp.executorRoleClientSecret=${MC_APPLICATION_CLIENT_SECRET}
            --flow.security.openIdp.executorRoleTokenUrl=http://management-center:8080/oauth2/token
            --flow.security.openIdp.executorRoleAuthenticationType=ClientSecretBasic
            --flow.security.openIdp.executorRoleScopes=openid email profile flow:Admin
            --flow.config.custom.managementCenterUrl=http://localhost:8080
            --flow.workspace.project-file=/opt/service/workspace/taxi.conf
#            If you're using a workspace, rather than a single-project config,
#           use this option.
#            --flow.workspace.config-file=/opt/service/workspace/workspace.conf
      ports:
         - "9021:9021"
      expose:
         - 9021
      volumes:
         - ~/.hazelcast/flow/license/:/opt/var/flow/license/
         - ./workspace:/opt/service/workspace
      depends_on:
         - postgres
      deploy:
         resources:        
            limits:
               memory: 1024M
            reservations:
               cpus: '2'
               memory: 1024M

    management-center:
      image: docker.io/hazelcast/management-center-flow:${MC_VERSION:-latest}
      ports:
        - "8080:8080"
      healthcheck:
        test: curl --fail http://localhost:8080/health || exit 1
        interval: 30s
        timeout: 5s
        retries: 3
      environment:
        - JAVA_OPTS=-Dhazelcast.mc.flow.addresses=http://localhost:9021 -Dhazelcast.mc.flow.internalAddress=http://flow:9021
        - MC_DEFAULT_CLUSTER=flow
        - MC_DEFAULT_CLUSTER_MEMBERS=flow:25701
        - MC_LICENSE=${MC_LICENSE}
        - MC_APPLICATION_CLIENT_SECRET=${MC_APPLICATION_CLIENT_SECRET}
        - MC_INIT_CMD=./bin/mc-conf.sh security reset

    postgres:
      image: postgres:15
      expose:
         - 5432
      ports:
         - "25432:5432"
      environment:
         POSTGRES_DB: flow
         POSTGRES_USER: flow
         POSTGRES_PASSWORD: changeme
      volumes:
         - postgres_data:/var/lib/postgresql/data

volumes:
   postgres_data: