docker-compose.yml

name: hasura-backendless

x-hasura-env: &hasura-env
  HASURA_GRAPHQL_METADATA_DATABASE_URL: postgres://${POSTGRES_METADATA_USER:-${POSTGRES_USER:-hasura}}:${POSTGRES_METADATA_PASSWORD:-${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}}@postgres:5432/${POSTGRES_METADATA_DB:-${POSTGRES_DB:-app}}
  HASURA_GRAPHQL_DATABASE_URL: postgres://${POSTGRES_USER:-hasura}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-app}

  HASURA_GRAPHQL_ADMIN_SECRET: ${HASURA_GRAPHQL_ADMIN_SECRET:?Set HASURA_GRAPHQL_ADMIN_SECRET}
  HASURA_GRAPHQL_ENABLE_TELEMETRY: "false"
  HASURA_GRAPHQL_ENABLED_LOG_TYPES: startup,http-log,webhook-log,websocket-log,query-log

  HASURA_GRAPHQL_CORS_DOMAIN: ${HASURA_GRAPHQL_CORS_DOMAIN:-http://localhost:3000,http://127.0.0.1:3000,http://127.0.0.1:9695}
  HASURA_GRAPHQL_ENABLE_ALLOWLIST: ${HASURA_GRAPHQL_ENABLE_ALLOWLIST:-false}

  HASURA_GRAPHQL_JWT_SECRET: >-
    {"type":"RS256","jwk_url":"http://keycloak:8080/realms/${KEYCLOAK_REALM:-hasura}/protocol/openid-connect/certs","issuer":"${KEYCLOAK_PUBLIC_URL:-http://127.0.0.1:8082}/realms/${KEYCLOAK_REALM:-hasura}","claims_namespace_path":"$"}

services:
  postgres:
    image: postgres:18.3-bookworm
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-hasura}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB:-app}
      POSTGRES_INITDB_ARGS: "--auth-host=scram-sha-256 --data-checksums"
    volumes:
      - pg_data:/var/lib/postgresql
    networks:
      - backend_net
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 10

  hasura-api:
    image: hasura/graphql-engine:v2.48.16.ubi
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      - "127.0.0.1:${HASURA_API_PORT:-8080}:8080"
    environment:
      <<: *hasura-env
      HASURA_GRAPHQL_ENABLED_APIS: graphql
      HASURA_GRAPHQL_ENABLE_CONSOLE: "false"
      HASURA_GRAPHQL_DEV_MODE: "false"
      HASURA_GRAPHQL_ADMIN_INTERNAL_ERRORS: "false"
    networks:
      - backend_net
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/healthz >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 20

  hasura-admin:
    image: hasura/graphql-engine:v2.48.16.ubi
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      - "127.0.0.1:${HASURA_ADMIN_PORT:-8081}:8080"
    environment:
      <<: *hasura-env
      HASURA_GRAPHQL_CONSOLE_ASSETS_DIR: /srv/console-assets
      HASURA_GRAPHQL_ENABLED_APIS: metadata,graphql,config,pgdump
      HASURA_GRAPHQL_ENABLE_CONSOLE: "true"
      HASURA_GRAPHQL_DEV_MODE: "true"
    networks:
      - backend_net
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/healthz >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 20

  hasura-cli:
    image: hasura/graphql-engine:v2.48.16.cli-migrations-v3
    profiles:
      - tools
    depends_on:
      hasura-admin:
        condition: service_healthy
    working_dir: /hasura
    volumes:
      - ./hasura:/hasura
    environment:
      <<: *hasura-env    
      HASURA_GRAPHQL_ENDPOINT: http://hasura-admin:8080
    entrypoint: ["/bin/hasura-cli"]
    networks:
      - backend_net

  keycloak:
    image: quay.io/keycloak/keycloak:26.6.1
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    command: ["start"]
    ports:
      - "127.0.0.1:${KEYCLOAK_PORT:-8082}:8080"
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_ADMIN_USERNAME:-admin}
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:?Set KEYCLOAK_ADMIN_PASSWORD}

      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/${KEYCLOAK_DB_DATABASE:-${POSTGRES_DB:-app}}
      KC_DB_USERNAME: ${KEYCLOAK_DB_USER:-${POSTGRES_USER:-hasura}}
      KC_DB_PASSWORD: ${KEYCLOAK_DB_PASSWORD:-${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}}

      KC_HOSTNAME: ${KEYCLOAK_PUBLIC_URL:-http://127.0.0.1:8082}
      KC_HOSTNAME_ADMIN: ${KEYCLOAK_ADMIN_URL:-http://127.0.0.1:8082}

      KC_HTTP_ENABLED: "true"
      KC_PROXY_HEADERS: ${KEYCLOAK_PROXY_HEADERS:-xforwarded}

      KC_HEALTH_ENABLED: "true"
      KC_METRICS_ENABLED: ${KEYCLOAK_METRICS_ENABLED:-false}

      JAVA_OPTS_APPEND: "-XX:MaxRAMPercentage=70 -XX:InitialRAMPercentage=50"
    networks:
      - backend_net
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    mem_limit: ${KEYCLOAK_MEMORY_LIMIT:-2g}
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "bash -ec 'exec 3<>/dev/tcp/127.0.0.1/9000; printf \"GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n\" >&3; grep -q \"200\" <&3'"
        ]
      interval: 10s
      timeout: 5s
      retries: 30

networks:
  backend_net:
    driver: bridge

volumes:
  pg_data: