automated-office/docker/docker-compose.yml

version: '3.9'

services:
  keycloak:
    build:
      context: .
      dockerfile: keycloak.Containerfile
      args:
        KC_DB_USERNAME: ${KC_DB_USERNAME}
        KC_DB_PASSWORD: ${KC_DB_PASSWORD}
    container_name: keycloak
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://keycloak-db:5432/keycloak
      KC_DB_USERNAME: ${KC_DB_USERNAME}
      KC_DB_PASSWORD: ${KC_DB_PASSWORD}
      KC_PROXY_HEADERS: xforwarded
      KC_PROXY_ADDRESS_FORWARDING: "true"
      KC_HTTP_ENABLED: "true"
      KC_HOSTNAME_STRICT: "false"
      KC_PROXY: edge
      KC_FEATURES: "token-exchange,scripts,preview,admin-api"
      KC_HEALTH_ENABLED: "true"
      KC_METRICS_ENABLED: "true"
      KC_HOSTNAME: https://auth.mrx8086.com
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
    command: ["start-dev"]  # Für Entwicklung; entferne "-dev" für Produktion
    ports:
      - "8080:8080"
    volumes:
      - ../config/keycloak/themes:/opt/keycloak/themes:ro
    networks:
      - keycloak-network
    depends_on:
      - keycloak-db
    extra_hosts:
      - "cloud.mrx8086.com:172.23.171.133"         
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  keycloak-db:
    image: postgres:15
    container_name: keycloak-db
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: ${KC_DB_USERNAME}
      POSTGRES_PASSWORD: ${KC_DB_PASSWORD}
    volumes:
      - ../data/keycloak-db:/var/lib/postgresql/data
    networks:
      - keycloak-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${KC_DB_USERNAME} -d keycloak"]
      interval: 10s
      timeout: 5s
      retries: 5

# In docker-compose.yml ergänzen:
  nextcloud:
    image: nextcloud:latest
    container_name: nextcloud
    restart: unless-stopped
    ports:
        - "8081:80"
    volumes:
      - ../data/nextcloud:/var/www/html
      - ../config/nextcloud/config:/var/www/html/config
      - ../config/nextcloud/custom_apps:/var/www/html/custom_apps
      - ../data/nextcloud-db:/var/lib/mysql
    environment:
      - MYSQL_HOST=nextcloud-db
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=${NEXTCLOUD_DB_USER}
      - MYSQL_PASSWORD=${NEXTCLOUD_DB_PASSWORD}
      - NEXTCLOUD_ADMIN_USER=${NEXTCLOUD_ADMIN_USER}
      - NEXTCLOUD_ADMIN_PASSWORD=${NEXTCLOUD_ADMIN_PASSWORD}
      - NEXTCLOUD_TRUSTED_DOMAINS=cloud.mrx8086.com
      - OVERWRITEPROTOCOL=https
      - OVERWRITEHOST=cloud.mrx8086.com
      - OVERWRITEWEBROOT=/
      - TRUSTED_PROXIES=172.19.0.0/16
      - NEXTCLOUD_URL=https://cloud.mrx8086.com
      - NEXTCLOUD_DEBUG=1
      - NEXTCLOUD_CONFIG_CUSTOM_SCOPE="openid profile groups-nextcloud"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:80/"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - nextcloud-network
    depends_on:
      - nextcloud-db
    extra_hosts:
      - "auth.mrx8086.com:172.23.171.133"      
    dns:
      - 8.8.8.8
      - 8.8.4.4

  nextcloud-db:
    image: mariadb:10.6
    container_name: nextcloud-db
    restart: unless-stopped
    command: --transaction-isolation=READ-COMMITTED --log-bin=ROW
    environment:
      - MYSQL_ROOT_PASSWORD=${NEXTCLOUD_DB_ROOT_PASSWORD}
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=${NEXTCLOUD_DB_USER}
      - MYSQL_PASSWORD=${NEXTCLOUD_DB_PASSWORD}
    volumes:
      - ../data/nextcloud-db:/var/lib/mysql
    networks:
      - nextcloud-network

  paperless:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    container_name: paperless
    restart: unless-stopped
    ports:
      - "8000:8000"
    volumes:
      - ../data/paperless:/usr/src/paperless/data
      - ../config/paperless/media:/usr/src/paperless/media
      - ../config/paperless/export:/usr/src/paperless/export
      - ../config/paperless/consume:/usr/src/paperless/consume
    environment:
      # Basis-Konfiguration
      - PAPERLESS_ADMIN_USER=${PAPERLESS_ADMIN_USER}
      - PAPERLESS_ADMIN_PASSWORD=${PAPERLESS_ADMIN_PASSWORD}
      - PAPERLESS_SECRET_KEY=${PAPERLESS_SECRET_KEY}
      - PAPERLESS_URL=https://docs.mrx8086.com
      - PAPERLESS_ALLOWED_HOSTS=docs.mrx8086.com
      - PAPERLESS_REDIS=redis://paperless-redis:6379
      - PAPERLESS_LOGGING_DIR=/dev/stdout
      - PAPERLESS_LOGGING_LEVEL=DEBUG
      - DJANGO_LOG_LEVEL=DEBUG
      
      # OIDC Basis-Einstellungen
      - PAPERLESS_ENABLE_OIDC=true
      - PAPERLESS_OIDC_RP_PROVIDER_URL=https://auth.mrx8086.com/realms/office-automation
      - PAPERLESS_OIDC_RP_CLIENT_ID=paperless
      - PAPERLESS_OIDC_RP_CLIENT_SECRET=${PAPERLESS_CLIENT_SECRET}
      
      # OIDC Endpoints
      - PAPERLESS_OIDC_AUTH_ENDPOINT=https://auth.mrx8086.com/realms/office-automation/protocol/openid-connect/auth
      - PAPERLESS_OIDC_TOKEN_ENDPOINT=https://auth.mrx8086.com/realms/office-automation/protocol/openid-connect/token
      - PAPERLESS_OIDC_USERINFO_ENDPOINT=https://auth.mrx8086.com/realms/office-automation/protocol/openid-connect/userinfo
      - PAPERLESS_OIDC_JWKS_ENDPOINT=https://auth.mrx8086.com/realms/office-automation/protocol/openid-connect/certs
      
      # OIDC Claims und Scopes
      - PAPERLESS_OIDC_RP_SCOPE=openid profile email
      - PAPERLESS_OIDC_RP_USERNAME_CLAIM=preferred_username
      - PAPERLESS_OIDC_RP_NAME_CLAIM=name
      - PAPERLESS_OIDC_RP_EMAIL_CLAIM=email
      
      # OIDC Sicherheitseinstellungen
      - PAPERLESS_OIDC_RP_SIGN_ALGO=RS256
      - PAPERLESS_OIDC_RP_VERIFY_SSL=false
      - PAPERLESS_OIDC_USE_PKCE=true
      
      # OIDC Token-Management
      - PAPERLESS_OIDC_RP_RENEW_TOKEN_BEFORE_EXPIRY=true
    
    depends_on:
      - paperless-db
      - paperless-redis
    networks:
      - paperless-network
    extra_hosts:
      - "auth.mrx8086.com:172.23.171.133"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/"]
      interval: 30s
      timeout: 10s
      retries: 3

  paperless-db:
    image: postgres:15
    container_name: paperless-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${PAPERLESS_DB_USER}
      POSTGRES_PASSWORD: ${PAPERLESS_DB_PASSWORD}
      POSTGRES_DB: paperless
    volumes:
      - ../data/paperless-db:/var/lib/postgresql/data
    networks:
      - paperless-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${PAPERLESS_DB_USER} -d paperless"]
      interval: 10s
      timeout: 5s
      retries: 5
  
  paperless-redis:
    image: redis:7
    container_name: paperless-redis
    restart: unless-stopped
    networks:
      - paperless-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

networks:
  keycloak-network:
    driver: bridge
  nextcloud-network:
    driver: bridge
  paperless-network:
    driver: bridge