docker-compose.yaml

version: '3'

services:

  issuer:
    # from .. run
    # DOCKER_DEFAULT_PLATFORM=linux/amd64 docker build -f ./docker/Dockerfile --tag oid4vci .
    image: oid4vc
    build:
      dockerfile: docker/Dockerfile
      context: ../
    ports:
      - "3000:3000"
      - "3001:3001"
      - "8082:8082"
    volumes:
      - ../docker/entrypoint.sh:/entrypoint.sh:ro,z
    environment:
      RUST_LOG: warn
      TUNNEL_ENDPOINT: http://ngrok:4040
      OID4VCI_HOST: 0.0.0.0
      OID4VCI_PORT: 8082
      OID4VCI_STATUS_HANDLER: status_list.v1_0.status_handler
      STATUS_LIST_SIZE: 131072
      STATUS_LIST_SHARD_SIZE: 131072
      #STATUS_LIST_PUBLIC_URI: https://localhost:8082/tenant/{tenant_id}/status/{list_number} Set in entrypoint.sh
      #STATUS_LIST_FILE_PATH: /tmp/bitstring/{tenant_id}/{list_number}
    entrypoint: >
      /bin/sh -c '/entrypoint.sh aca-py "$$@"' --
    # Note: --no-transport should be added to start but currently blocks webhooks - fix in ACA-Py main.
    # A nice feature would be to have common sets to --block-plugin.
    command: >
      start
        --inbound-transport http 0.0.0.0 3000
        --outbound-transport http
        --endpoint http://issuer:3000
        --admin 0.0.0.0 3001
        --admin-insecure-mode
        --webhook-url http://demo-app:3000/webhook
        --webhook-url http://webhook-listener:8080
        --no-ledger
        --wallet-type askar
        --emit-new-didcomm-prefix
        --wallet-storage-type default
        --wallet-name issuer
        --wallet-key insecure
        --auto-provision
        --log-level DEBUG
        --debug-webhooks
        --plugin oid4vc
        --plugin jwt_vc_json
        --plugin sd_jwt_vc
        --plugin mso_mdoc
        --plugin status_list.v1_0
        --multitenant
        --multitenant-admin
        --jwt-secret insecure
        --log-level INFO
        --multitenancy-config wallet_type=single-wallet-askar key_derivation_method=RAW
        --block-plugin acapy_agent.anoncreds
        --block-plugin acapy_agent.ledger
        --block-plugin acapy_agent.revocation
        --block-plugin acapy_agent.messaging.schemas
        --block-plugin acapy_agent.messaging.credential_definitions
        --block-plugin acapy_agent.revocation_anoncreds
        --block-plugin acapy_agent.anoncreds.default.did_indy
        --block-plugin acapy_agent.anoncreds.default.did_web
        --block-plugin acapy_agent.anoncreds.default.legacy_indy
        --block-plugin acapy_agent.vc
        --block-plugin acapy_agent.vc.data_integrity
        --block-plugin acapy_agent.messaging.jsonld
        --block-plugin acapy_agent.anoncreds.revocation
        --block-plugin acapy_agent.connections
        --block-plugin acapy_agent.did.indy
        --block-plugin acapy_agent.holder
        --block-plugin acapy_agent.protocols.actionmenu
        --block-plugin acapy_agent.protocols.basicmessage
        --block-plugin acapy_agent.protocols.coordinate_mediation
        --block-plugin acapy_agent.protocols.didexchange
        --block-plugin acapy_agent.protocols.discovery
        --block-plugin acapy_agent.protocols.endorse_transaction
        --block-plugin acapy_agent.protocols.introduction
        --block-plugin acapy_agent.protocols.issue_credential
        --block-plugin acapy_agent.protocols.notification
        --block-plugin acapy_agent.protocols.out_of_band
        --block-plugin acapy_agent.protocols.present_proof
        --block-plugin acapy_agent.protocols.problem_report
        --block-plugin acapy_agent.protocols.revocation_notification
        --block-plugin acapy_agent.protocols.routing
        --block-plugin acapy_agent.protocols.trustping
        --block-plugin acapy_agent.resolver
    healthcheck:
      test: curl -s -o /dev/null -w '%{http_code}' "http://localhost:3001/status/live" | grep "200" > /dev/null
      start_period: 30s
      interval: 7s
      timeout: 5s
      retries: 5
    depends_on:
      webhook-listener:
        condition: service_started
      auth-server:
        condition: service_healthy

  webhook-listener:
    image: mendhak/http-https-echo:18
    environment:
      - HTTP_PORT=8080

 #removed the healthcheck as it is unreliable. Authserver and issuer check for tunnels before starting.
  ngrok:
    image: ngrok/ngrok
    restart: unless-stopped
    hostname: ngrok
    ports:
      - "4040:4040"
    volumes:
      - ./ngrok.yml:/etc/ngrok.yml:ro
    environment:
      - NGROK_AUTHTOKEN=${NGROK_AUTHTOKEN}
    command: ["start", "--all", "--config", "/etc/ngrok.yml"]

  demo-app:
    build:
      context: ./frontend
    ports:
      - "3002:3000"
    volumes:
      - ./frontend/index.js:/app/index.js:z
      - ./frontend/templates:/app/templates:z
    environment:
      NODE_ENV: development # Set NODE_ENV to 'development'
      WDS_SOCKET_PORT: 0
      API_BASE_URL: http://issuer:3001
      FORCE_COLOR: 3
      ADMIN_MANAGE_AUTH_TOKEN: $ADMIN_MANAGE_AUTH_TOKEN
      AUTHSERVER_NGROK_URL: $AUTHSERVER_NGROK_URL
      TENANT_SECRET: tenantsecrettoken #Used by the issuer introspect tokens on auth server.
    depends_on:
      issuer:
        condition: service_healthy

  #setup Auth Server. 
  #ADMIN_MANAGE_AUTH_TOKEN is sourced from the .env as it is shared with demo-app.
  #Other environment variables are set explicitly here to show a working configuration.
  #Admin full list: https://github.com/openwallet-foundation/acapy-plugins/blob/main/oid4vc/auth_server/admin/config.py
  #Tenant full list:https://github.com/openwallet-foundation/acapy-plugins/blob/main/oid4vc/auth_server/tenant/config.py
  auth-server:
    build:
      dockerfile: docker/Dockerfile
      context: ../auth_server
    ports:
      - "9000:9000"
      - "9001:9001"
    environment:
      ADMIN_DB_HOST: db
      ADMIN_DB_USER: auth_server_admin
      ADMIN_DB_PASSWORD: postgres
      ADMIN_DB_NAME: auth_server_admin
      ADMIN_DB_PORT: 5432
      ADMIN_DB_SCHEMA: admin
      ADMIN_APP_TITLE: OAuth 2.0 Authorization Server Admin API
      ADMIN_APP_VERSION: 0.2.0
      ADMIN_APP_ROOT_PATH: /
      ADMIN_MANAGE_AUTH_TOKEN: $ADMIN_MANAGE_AUTH_TOKEN # Access the admin API with this token
      ADMIN_INTERNAL_AUTH_TOKEN: $ADMIN_INTERNAL_AUTH_TOKEN # Admin API request to admin API
      ADMIN_TENANT_DB_NAME: auth_server_tenant
      ADMIN_TENANT_DB_SCHEMA: auth
      TENANT_INTERNAL_BASE_URL: http://auth-server:9000/internal
      TENANT_INTERNAL_AUTH_TOKEN: $TENANT_INTERNAL_AUTH_TOKEN # match ADMIN_INTERNAL_AUTH_TOKEN
      TENANT_APP_ROOT_PATH: /
      TENANT_DB_HOST: db
      TENANT_DB_PORT: 5432
      TENANT_PROXY_TRUSTED_HOSTS: "*"
      TENANT_INCLUDE_NONCE: "false"
      #TENANT_ISSUER_BASE_URL: Set in entrypoint.sh
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: >
        curl -s -o /dev/null -w '%{http_code}' "http://localhost:9000/healthz" | grep "200" > /dev/null &&
        curl -s -o /dev/null -w '%{http_code}' "http://localhost:9001/healthz" | grep "200" > /dev/null
      start_period: 30s
      interval: 7s
      timeout: 5s
      retries: 5
  db:
    image: postgres:15
    environment:
      POSTGRES_PASSWORD: postgres
      POSTGRES_USER: postgres
      POSTGRES_DB: postgres
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s