docker-compose.yml

version: '3'
services:

  satosa-mongo:
    image: mongo
    container_name: satosa-mongo
    environment:
      MONGO_INITDB_DATABASE: 'oidcop'
      MONGO_INITDB_ROOT_USERNAME: 'satosa'
      MONGO_INITDB_ROOT_PASSWORD: 'Password'
    volumes:
      - ./mongo/init-mongo.sh:/docker-entrypoint-initdb.d/init-mongo.sh
      - ./mongo/mongo.json:/docker-entrypoint-initdb.d/mongo.json
    expose:
      - '27017-27019'
    networks:
      satosa:

  satosa-saml2spid:
    image: ghcr.io/italia/satosa-saml2spid:latest
    deploy:
      mode: replicated
      replicas: 1
    depends_on:
      - satosa-mongo
    environment:
      - SATOSA_BY_DOCKER=1

      - SATOSA_BASE=https://satosa-cp1.labwsgarr23.aai-test.garr.it
      - SATOSA_CONTACT_PERSON_EMAIL_ADDRESS=email@satosa-cp1.labwsgarr23.aai-test.garr.it
      - SATOSA_CONTACT_PERSON_FISCALCODE=10125211002
      - SATOSA_CONTACT_PERSON_GIVEN_NAME=AAI-TEST
      - SATOSA_CONTACT_PERSON_TELEPHONE_NUMBER=+390612345678
      - SATOSA_CONTACT_PERSON_IPA_CODE=aai_rm
      - SATOSA_CONTACT_PERSON_MUNICIPALITY=H5012662488311
      - SATOSA_DISCO_SRV=https://satosa-cp1.labwsgarr23.aai-test.garr.it/static/disco.html
      - SATOSA_ENCRYPTION_KEY=Password
      - MONGODB_PASSWORD=Password
      - MONGODB_USERNAME=satosa
      - SATOSA_ORGANIZATION_DISPLAY_NAME_EN=AAI Test
      - SATOSA_ORGANIZATION_DISPLAY_NAME_IT=AAI Test
      - SATOSA_ORGANIZATION_NAME_EN=Lab OIDC SP
      - SATOSA_ORGANIZATION_NAME_IT=Lab OIDC SP
      - SATOSA_ORGANIZATION_URL_EN=https://satosa-cp1.labwsgarr23.aai-test.garr.it
      - SATOSA_ORGANIZATION_URL_IT=https://satosa-cp1.labwsgarr23.aai-test.garr.it
      - SATOSA_SALT=68c12a161ea426afc44b28ad41598f92c5fbafd445ab4d0ea3ce43885e9a02b1
      - SATOSA_STATE_ENCRYPTION_KEY=Password
      - SATOSA_UI_DESCRIPTION_EN=AAI Test Identity proxy
      - SATOSA_UI_DESCRIPTION_IT=AAI Test Identity proxy
      - SATOSA_UI_DISPLAY_NAME_EN=Lab OIDC SP
      - SATOSA_UI_DISPLAY_NAME_IT=Lab OIDC SP
      - SATOSA_UI_INFORMATION_URL_EN=https://satosa-cp1.labwsgarr23.aai-test.garr.it
      - SATOSA_UI_INFORMATION_URL_IT=https://satosa-cp1.labwsgarr23.aai-test.garr.it
      - SATOSA_UI_LOGO_HEIGHT=60
      - SATOSA_UI_LOGO_URL=https://www.idem.garr.it/images/logoIDEM_colore.svg
      - SATOSA_UI_LOGO_WIDTH=80
      - SATOSA_UI_PRIVACY_URL_EN=https://satosa-cp1.labwsgarr23.aai-test.garr.it
      - SATOSA_UI_PRIVACY_URL_IT=https://satosa-cp1.labwsgarr23.aai-test.garr.it
      - SATOSA_UNKNOW_ERROR_REDIRECT_PAGE=https://satosa-cp1.labwsgarr23.aai-test.garr.it/static/error_page.html
      - SATOSA_USER_ID_HASH_SALT=68c12a161ea426afc44b28ad41598f92c5fbafd445ab4d0ea3ce43885e9a02b1
    expose:
      - 10000
      - 9999
    volumes:
       - ./satosa/metadata:/satosa_proxy/metadata:ro
       - ./satosa/pki:/satosa_proxy/pki:ro
       - ./satosa/plugins/backends/saml2_backend.yaml:/satosa_proxy/plugins/backends/saml2_backend.yaml
       - ./satosa/plugins/frontends/oidcop_frontend.yaml:/satosa_proxy/plugins/frontends/oidcop_frontend.yaml
    networks:
      satosa:

  satosa-nginx:
    image: nginx:alpine
    container_name: satosa-nginx
    depends_on:
      - satosa-saml2spid
      - gitlab
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/conf.d/satosa.conf:/etc/nginx/conf.d/satosa.conf:ro
      - ./nginx/conf.d/gitlab.conf:/etc/nginx/conf.d/gitlab.conf:ro
      - ./nginx/certs:/etc/nginx/certs:ro
      - ./nginx/static:/var/www/html:ro
    networks:
      satosa:
        aliases:
          - satosa-cp1.labwsgarr23.aai-test.garr.it

  gitlab:
    image: 'gitlab/gitlab-ee:latest'
    hostname: 'gitlab-cp1.labwsgarr23.aai-test.garr.it'
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://gitlab-cp1.labwsgarr23.aai-test.garr.it:443'
        # Add any other gitlab.rb configuration here, each on its own line
        gitlab_rails['omniauth_allow_single_sign_on'] = ['openid_connect']
        gitlab_rails['omniauth_block_auto_created_users'] = false
        gitlab_rails['omniauth_providers'] = [
          {
            name: "openid_connect",
            label: "WSGARR23", # optional label for login button, defaults to "Openid Connect"
            icon: "",
            args: {
              name: "openid_connect",
              issuer: "https://satosa-cp1.labwsgarr23.aai-test.garr.it",
              discovery: true,
              scope: ["openid","profile","email"],
              response_type: "code",
              client_auth_method: "query",
              send_scope_to_token_endpoint: "false",
              pkce: true,   
              client_options: {
                identifier: "gitlab",
                secret: "57af39b70d0108f630e52f72f7a3bd37ba4e11678ad3e7434d9816b9",
                redirect_uri: "https://gitlab-cp1.labwsgarr23.aai-test.garr.it/users/auth/openid_connect/callback",
              }
            }
          }
        ]
    ports:
      - '22:22'
      #volumes:
      #- './gitlab/config:/etc/gitlab'
      #- './gitlab/logs:/var/log/gitlab'
      #- './gitlab/data:/var/opt/gitlab'
    shm_size: '256m'
    networks:
      satosa:
        aliases:
          - gitlab-cp1.labwsgarr23.aai-test.garr.it
networks:
  satosa: