docker-compose.yml

services:
  # Authly itself
  authly:
    image: protojour/authly:dev
    environment:
      AUTHLY_UID: c865e85720e3c96feabdfe50c33acc75ac2069320de78d0d2c11497b092f1a8c
      AUTHLY_BAO_TOKEN: theenigmaticbaobunofancientsecrets
      AUTHLY_BAO_URL: http://openbao:8200
      AUTHLY_HOSTNAME: authly
      AUTHLY_K8S: 'false'
      AUTHLY_CLUSTER_API_SECRET: ifyougetholdofthisclassifiedpieceofinformationiwillunfortunatelyhavetokillyou
      AUTHLY_CLUSTER_RAFT_SECRET: donttellanybodyabouttheverysecretstring
      AUTHLY_EXPORT_TLS_TO_ETC: 'true'
    ports:
      - 1443:443
    volumes:
      - authly-data:/var/lib/authly/data
      - authly-certs:/etc/authly/certs
      - testservice-identity:/etc/authly/service/s.f3e799137c034e1eb4cd3e4f65705932
      - ../../.local/etc/cluster:/etc/authly/cluster:ro
      - ../../examples/demo:/etc/authly/documents:ro
    command: serve
    healthcheck:
      test: ["CMD", "/authly", "ready"]
      retries: 10
      interval: 2s
    depends_on:
      openbao:
        condition: service_started

  # Example supported secret store
  openbao:
    image: ghcr.io/openbao/openbao
    environment:
      # do not use this approach in production
      BAO_DEV_ROOT_TOKEN_ID: theenigmaticbaobunofancientsecrets
    command: server -dev

  # Example service for verifying connection
  testservice:
    image: protojour/authly-testservice:dev
    ports:
      - 2443:443
    volumes:
      - authly-certs:/etc/authly/certs:ro
      - testservice-identity:/etc/authly/identity:ro
    depends_on:
      authly:
        condition: service_healthy
        restart: true

volumes:
  authly-data:
  authly-certs:
  testservice-identity: