codingjoe/test:124

services:
  dozzle:
    container_name: dozzle
    image: amir20/dozzle:v8.14.6
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - app
    environment:
      DOZZLE_AUTH_PROVIDER: forward-proxy
    deploy:
      mode: global
    healthcheck:
      test: ["CMD", "/dozzle", "healthcheck"]
      interval: 3s
      timeout: 30s
      retries: 5
      start_period: 30s
    labels:
      dev.dozzle.group: PaaS
  caddy:
    container_name: caddy
    image: caddy:2.10.2-alpine
    build:
      context: ../..
      dockerfile: containers/paas/Containerfile
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - caddy_data:/data
      - caddy_config:/config
    configs:
      - source: caddyfile
        target: /etc/caddy/Caddyfile
    networks:
      - app
      - wan
    environment:
      HOSTNAME: ${HOSTNAME}
      CADDY_OAUTH_CLIENT_ID: ${CADDY_OAUTH_CLIENT_ID}
      CADDY_OAUTH_CLIENT_SECRET: ${CADDY_OAUTH_CLIENT_SECRET}
    healthcheck:
      test: ["CMD-SHELL", "caddy validate --config /etc/caddy/Caddyfile"]
    deploy:
      mode: global
    labels:
      dev.dozzle.group: PaaS
networks:
  app:
    name: app
    driver: bridge
    internal: true
  wan:
    name: wan
    driver: bridge
volumes:
  caddy_data:
  caddy_config:
configs:
    caddyfile:
      content: |
        {
            order authenticate before respond
            order authorize before basicauth
            security {
                oauth identity provider github {$$CADDY_OAUTH_CLIENT_ID} {$$CADDY_OAUTH_CLIENT_SECRET}
                authentication portal githubPortal {
                    crypto default token lifetime 86400 # 24 hours
                    enable identity provider github
                    cookie domain .{$$HOSTNAME}

                    ui {
                        theme basic
                        links {
                            "App" https://{$$HOSTNAME}/ icon "las la-rocket"
                            "Logs" https://logs.{$$HOSTNAME}/ icon "las la-terminal"
                            "My Identity" "/whoami" icon "las la-user"
                        }
                    }

                    transform user {
                        match realm github
                        action add role authp/user
                    }
                }
                authorization policy paasPolicy {
                    set auth url https://auth.{$$HOSTNAME}/oauth2/github
                    allow roles authp/user
                    inject headers with claims
                    inject header "Remote-Name" from "name"
                    inject header "Remote-User" from "sub"
                }
            }
        }

        {$$HOSTNAME} {
            reverse_proxy http://web:8000

            log {
                output stdout
                format json
            }
        }

        auth.{$$HOSTNAME} {
            authenticate with githubPortal
            tls {
                protocols tls1.3
            }
        }

        logs.{$$HOSTNAME} {
            @local host logs.localhost
            @not-local not host logs.localhost
            authorize @not-local with paasPolicy
            request_header @local "Remote-Name" "Local User"
            request_header @local "Remote-User" "dev"
            reverse_proxy http://dozzle:8080

            tls {
                protocols tls1.3
            }
        }