docker-compose.yml

version: '3'

volumes:
  kong_data: {}
  kong_prefix_vol:
    driver_opts:
     type: tmpfs
     device: tmpfs
  kong_tmp_vol:
    driver_opts:
     type: tmpfs
     device: tmpfs

networks:
  kong-net:
    external: false

services:
  kong-migrations:
    image: "${KONG_DOCKER_TAG:-kong:latest}"
    command: kong migrations bootstrap
    depends_on:
      - db
    environment:
      KONG_DATABASE: postgres
      KONG_PG_DATABASE: ${KONG_PG_DATABASE:-kong}
      KONG_PG_HOST: db
      KONG_PG_USER: ${KONG_PG_USER:-kong}
      KONG_PG_PASSWORD_FILE: /run/secrets/kong_postgres_password
    secrets:
      - kong_postgres_password
    networks:
      - kong-net
    restart: on-failure
    deploy:
      restart_policy:
        condition: on-failure

  kong-migrations-up:
    image: "${KONG_DOCKER_TAG:-kong:latest}"
    command: kong migrations up && kong migrations finish
    depends_on:
      - db
    environment:
      KONG_DATABASE: postgres
      KONG_PG_DATABASE: ${KONG_PG_DATABASE:-kong}
      KONG_PG_HOST: db
      KONG_PG_USER: ${KONG_PG_USER:-kong}
      KONG_PG_PASSWORD_FILE: /run/secrets/kong_postgres_password
    secrets:
      - kong_postgres_password
    networks:
      - kong-net
    restart: on-failure
    deploy:
      restart_policy:
        condition: on-failure

  kong:
    # image: "${KONG_DOCKER_TAG:-kong:latest}"
    build: 
      context: .
    container_name: kong
    user: "${KONG_USER:-root}"
    depends_on:
      - db
    environment:
      KONG_ADMIN_ACCESS_LOG: /dev/stdout
      KONG_ADMIN_ERROR_LOG: /dev/stderr
      KONG_PROXY_LISTEN: "${KONG_PROXY_LISTEN:-0.0.0.0:8000}"
      KONG_ADMIN_LISTEN: "${KONG_ADMIN_LISTEN:-0.0.0.0:8001}"
      KONG_CASSANDRA_CONTACT_POINTS: db
      KONG_DATABASE: postgres
      KONG_PG_DATABASE: ${KONG_PG_DATABASE:-kong}
      KONG_PG_HOST: db
      KONG_PG_USER: ${KONG_PG_USER:-kong}
      KONG_PROXY_ACCESS_LOG: /dev/stdout
      KONG_PROXY_ERROR_LOG: /dev/stderr
      KONG_PG_PASSWORD_FILE: /run/secrets/kong_postgres_password
      KONG_PREFIX: ${KONG_PREFIX:-/var/run/kong}
      KONG_PLUGINS: bundled,rbac
      KONG_LOG_LEVEL: info
      KONG_HEADERS: server_tokens,latency_tokens
      KONG_PLUGINSERVER_NAMES: rbac
      KONG_PLUGINSERVER_RBAC_SOCKET: /var/run/kong/rbac.socket
      KONG_PLUGINSERVER_RBAC_START_CMD: /usr/local/bin/rbac -kong-prefix /var/run/kong
      KONG_PLUGINSERVER_RBAC_QUERY_CMD: /usr/local/bin/rbac -dump
      # KONG_PLUGINSERVER_GO_SOCKET: /var/run/kong/go_pluginserver.sock
      # KONG_PLUGINSERVER_GO_START_CMD: /etc/kong/go-pluginserver -kong-prefix /var/run/kong -plugins-directory /etc/kong/go_plugins
      # KONG_PLUGINSERVER_GO_QUERY_CMD: /etc/kong/go-pluginserver -dump-all-plugins -plugins-directory /etc/kong/go_plugins
      # KONG_GO_PLUGINS_DIR: /etc/kong/go_plugins
    secrets:
      - kong_postgres_password
    networks:
      - kong-net
    ports:
      # The following two environment variables default to an insecure value (0.0.0.0)
      # according to the CIS Security test.
      - "${KONG_INBOUND_PROXY_LISTEN:-0.0.0.0}:8000:8000/tcp"
      - "${KONG_INBOUND_SSL_PROXY_LISTEN:-0.0.0.0}:8443:8443/tcp"
      # Making them mandatory but undefined, like so would be backwards-breaking:
      # - "${KONG_INBOUND_PROXY_LISTEN?Missing inbound proxy host}:8000:8000/tcp"
      # - "${KONG_INBOUND_SSL_PROXY_LISTEN?Missing inbound proxy ssl host}:8443:8443/tcp"
      # Alternative is deactivating check 5.13 in the security bench, if we consider Kong's own config to be enough security here

      - "0.0.0.0:8001:8001/tcp"
      - "0.0.0.0:8444:8444/tcp"
    healthcheck:
      test: ["CMD", "kong", "health"]
      interval: 10s
      timeout: 10s
      retries: 10
    restart: on-failure:5
    read_only: true
    volumes:
      # - kong_prefix_vol:${KONG_PREFIX:-/var/run/kong}
      - kong_tmp_vol:/tmp
      - ./kong:/etc/kong:rw
      - ./kong/run:${KONG_PREFIX:-/var/run/kong}:rw
    deploy:
      restart_policy:
        delay: 50s
        condition: on-failure
        max_attempts: 5
        window: 10s
      resources:
        limits:
          cpus: "${KONG_CPU_LIMIT:-2}"
          memory: ${KONG_MEMORY_LIMIT:-2g}
    security_opt:
      - no-new-privileges

  db:
    image: postgres:9.5
    environment:
      POSTGRES_DB: ${KONG_PG_DATABASE:-kong}
      POSTGRES_USER: ${KONG_PG_USER:-kong}
      POSTGRES_PASSWORD_FILE: /run/secrets/kong_postgres_password
    secrets:
      - kong_postgres_password
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "${KONG_PG_USER:-kong}"]
      interval: 30s
      timeout: 30s
      retries: 3
    restart: on-failure
    deploy:
      restart_policy:
        condition: on-failure
    stdin_open: true
    ports: 
      - 5432:5432
    tty: true
    networks:
      - kong-net
    volumes:
      - ./data:/var/lib/postgresql/data

  dashboard:
    image: pantsel/konga
    container_name: dashboard
    environment: 
      TOKEN_SECRET: kong
      DB_ADAPTER: postgres
      DB_USER: kong
      DB_HOST: db
      DB_DATABASE: konga
      DB_PASSWORD: kong
      NODE_ENV: development
    depends_on:
      - kong
    networks:
      - kong-net
    ports: 
      - "1337:1337"

secrets:
  kong_postgres_password:
    file: ./POSTGRES_PASSWORD