docker-compose-haproxy-ispn-remote.yml

services:

  acme-ispn-1:
    build: ./ispn
    volumes:
      # relative paths needs to be relative to the docker-compose cwd.
      - ./ispn/conf/infinispan-keycloak.xml:/opt/infinispan/server/conf/infinispan-keycloak.xml:z
      - ./ispn/conf/users.properties:/opt/infinispan/server/conf/users.properties:z
      - ./ispn/ispn-server.jks:/opt/infinispan/server/conf/ispn-server.jks:z
      - ./ispn/data/ispn-1:/opt/infinispan/server/mydata:z
    healthcheck:
      test: ["CMD-SHELL", "curl -k https://$$(ip route get 1.2.3.4 | awk '{print $$7}'):11222"]
      interval: 10s
      timeout: 5s
      retries: 5
    depends_on:
      acme-keycloak-db:
        condition: service_healthy

  acme-ispn-2:
    build: ./ispn
    volumes:
      # relative paths needs to be relative to the docker-compose cwd.
      - ./ispn/conf/infinispan-keycloak.xml:/opt/infinispan/server/conf/infinispan-keycloak.xml:z
      - ./ispn/conf/users.properties:/opt/infinispan/server/conf/users.properties:z
      - ./ispn/ispn-server.jks:/opt/infinispan/server/conf/ispn-server.jks:z
      - ./ispn/data/ispn-2:/opt/infinispan/server/mydata:z
    healthcheck:
      test: ["CMD-SHELL", "curl -k https://$$(ip route get 1.2.3.4 | awk '{print $$7}'):11222"]
      interval: 10s
      timeout: 5s
      retries: 5
    depends_on:
      acme-keycloak-db:
        condition: service_healthy

  acme-keycloak-1:
    extends:
      file: ../docker-compose.yml
      service: acme-keycloak
    env_file:
      - ./haproxy-external-ispn.env
    volumes:
      - ./cli/0100-onstart-setup-remote-caches.cli:/opt/jboss/startup-scripts/0100-onstart-setup-remote-caches.cli:z
      - ./ispn/ispn-truststore.jks:/opt/jboss/keycloak/standalone/configuration/ispn-truststore.jks:z
# Patched wildfly infinispan extension to support connect-timeout on remote-store
#      - ../../../../keycloak/patches/wildfly-clustering-infinispan-extension-patch/target/wildfly-clustering-infinispan-extension-patch.jar:/opt/jboss/keycloak/modules/system/layers/base/org/jboss/as/clustering/infinispan/main/wildfly-clustering-infinispan-extension-23.0.2.Final.jar:z
#      - ./patch/wildfly-clustering-infinispan-extension-patch.jar:/opt/jboss/keycloak/modules/system/layers/base/org/jboss/as/clustering/infinispan/main/wildfly-clustering-infinispan-extension-23.0.2.Final.jar:z
      - ./patch/wildfly-clustering-infinispan-extension-patch-26.0.1.jar:/opt/jboss/keycloak/modules/system/layers/base/org/jboss/as/clustering/infinispan/main/wildfly-clustering-infinispan-extension-26.0.1.Final.jar:z
# Patched cacerts without the expired certificates
      - ./ispn/cacerts:/etc/pki/ca-trust/extracted/java/cacerts:z
    command: [ "--debug", "*:8787", "-Dwildfly.statistics-enabled=true", "-Djboss.site.name=site1" ]
    depends_on:
      acme-ispn-1:
        condition: service_healthy
    ports:
      - "8080"
      - "8443"
      - "9990:9990"
      - "8787:8787"

  acme-keycloak-2:
    extends:
      file: ../docker-compose.yml
      service: acme-keycloak
    env_file:
      - ./haproxy-external-ispn.env
    volumes:
      - ./cli/0100-onstart-setup-remote-caches.cli:/opt/jboss/startup-scripts/0100-onstart-setup-remote-caches.cli:z
      - ./ispn/ispn-truststore.jks:/opt/jboss/keycloak/standalone/configuration/ispn-truststore.jks:z
      # Patched wildfly infinispan extension to support connect-timeout on remote-store
#      - ../../../../keycloak/patches/wildfly-clustering-infinispan-extension-patch/target/wildfly-clustering-infinispan-extension-patch.jar:/opt/jboss/keycloak/modules/system/layers/base/org/jboss/as/clustering/infinispan/main/wildfly-clustering-infinispan-extension-23.0.2.Final.jar:z
#      - ./patch/wildfly-clustering-infinispan-extension-patch.jar:/opt/jboss/keycloak/modules/system/layers/base/org/jboss/as/clustering/infinispan/main/wildfly-clustering-infinispan-extension-23.0.2.Final.jar:z
      - ./patch/wildfly-clustering-infinispan-extension-patch-26.0.1.jar:/opt/jboss/keycloak/modules/system/layers/base/org/jboss/as/clustering/infinispan/main/wildfly-clustering-infinispan-extension-26.0.1.Final.jar:z
# Patched cacerts without the expired certificates
      - ./ispn/cacerts:/etc/pki/ca-trust/extracted/java/cacerts:z
    command: [ "-Dwildfly.statistics-enabled=true", "-Djboss.site.name=site1" ]
    depends_on:
      acme-keycloak-db:
        condition: service_healthy
      acme-ispn-1:
        condition: service_healthy

  acme-keycloak-db:
    extends:
      file: ../docker-compose.yml
      service: acme-keycloak-db

  acme-haproxy-lb:
    build: ../haproxy
    volumes:
      # relative paths needs to be relative to the docker-compose cwd.
      - ../haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:z
    #      - ../../../../config/stage/dev/tls/acme.test+1.pem:/etc/haproxy/haproxy.crt.pem:z
    #      - ../../../../config/stage/dev/tls/acme.test+1-key.pem:/etc/haproxy/haproxy.crt.pem.key:z
    # - ../run/haproxy/run:/var/run:z
    sysctls:
      - net.ipv4.ip_unprivileged_port_start=0
    ports:
      - "1443:1443"
    depends_on:
      - acme-keycloak-1
      - acme-keycloak-2