docker-compose.conformance.yml

# Docker Compose overlay for OpenID Conformance Suite
#
# Usage:
#   docker compose -f docker-compose.test.yml \
#     -f docker-compose.go-trust.yml \
#     -f docker-compose.go-trust-allow.yml \
#     -f docker-compose.conformance.yml \
#     up -d
#
# Or via Makefile:
#   make up-conformance
#
# Prerequisites:
#   - Add to /etc/hosts: 127.0.0.1 localhost.emobix.co.uk
#   - The conformance suite uses self-signed TLS on port 8443
#
# The conformance suite provides:
#   - Web UI: https://localhost.emobix.co.uk:8443/
#   - API:    https://localhost.emobix.co.uk:8443/api/
#
# In devmode, no authentication token is required.

services:
  # Allow wallet-backend to talk to the conformance suite's self-signed HTTPS
  wallet-backend:
    extra_hosts:
      - "localhost.emobix.co.uk:host-gateway"
    environment:
      - WALLET_HTTP_CLIENT_INSECURE_SKIP_VERIFY=true

  # The vc services need no overrides here any more. `make up CONFORMANCE=yes`
  # renders their config from the chart with vc-proxy (below) as the
  # advertised host, so apigw/registry present the https://vc-proxy:8443 /
  # :8445 identity the conformance suite drives them through, while still
  # listening on the same ports as every other mode. Previously this overlay
  # remounted a third copy of the config file and had to undo the local
  # path's port alignment along with it.

  conformance-suite-server:
    image: registry.gitlab.com/openid/conformance-suite:latest
    container_name: conformance-suite-server
    extra_hosts:
      - "localhost.emobix.co.uk:host-gateway"
    environment:
      - BASE_URL=https://localhost.emobix.co.uk:8443
      - MONGODB_HOST=conformance-mongodb
      - SPRING_PROFILES_ACTIVE=
      - FINTECHLABS_DEVMODE=true
      - OIDC_GOOGLE_CLIENTID=google-client
      - OIDC_GOOGLE_SECRET=google-secret
      - OIDC_GITLAB_CLIENTID=gitlab-client
      - OIDC_GITLAB_SECRET=gitlab-secret
    depends_on:
      conformance-suite-mongodb:
        condition: service_started
    networks:
      e2e-test-network:
        aliases:
          - server
    logging:
      driver: "json-file"
      options:
        max-size: "500k"
        max-file: "5"

  conformance-suite-nginx:
    image: registry.gitlab.com/openid/conformance-suite/nginx:latest
    container_name: conformance-suite-nginx
    ports:
      - "8443:8443"
    depends_on:
      - conformance-suite-server
    networks:
      - e2e-test-network
    healthcheck:
      test: ["CMD", "curl", "-fsk", "https://localhost:8443/login.html"]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 60s
    logging:
      driver: "json-file"
      options:
        max-size: "500k"
        max-file: "5"

  conformance-suite-mongodb:
    image: mongo:6
    container_name: conformance-suite-mongodb
    volumes:
      - conformance-suite-mongodb-data:/data/db
    networks:
      e2e-test-network:
        aliases:
          - conformance-mongodb
    logging:
      driver: "json-file"
      options:
        max-size: "500k"
        max-file: "5"

  conformance-runner:
    image: ghcr.io/sirosfoundation/conformance-runner:main
    container_name: conformance-runner
    extra_hosts:
      - "localhost.emobix.co.uk:host-gateway"
    ports:
      - "3001:3001"
    environment:
      - PORT=3001
      - CONFORMANCE_URL=https://conformance-suite-nginx:8443/
      - CONFORMANCE_PUBLIC_URL=https://localhost.emobix.co.uk:8443/
      - ISSUER_CONFORMANCE_URL=https://vc-proxy:8443
      - VERIFIER_CONFORMANCE_URL=https://vc-proxy:8444
      - FRONTEND_URL=http://wallet-frontend:80
      - ADMIN_URL=http://wallet-backend:8081
      - ADMIN_TOKEN=${ADMIN_TOKEN:-}
      # helpers/vc-services.ts's checkVCServicesHealth() (used by the
      # issuer/verifier specs) defaults to host-mapped localhost:900x ports -
      # only reachable from the HOST, not from another container on this
      # network. Override with the real Docker-internal service:port so
      # those specs' beforeAll health check actually succeeds in here.
      - VC_ISSUER_URL=http://vc-issuer:8080
      - VC_VERIFIER_URL=http://vc-verifier:8080
      - VC_APIGW_URL=http://vc-apigw:8080
      - NODE_TLS_REJECT_UNAUTHORIZED=0
    depends_on:
      conformance-suite-nginx:
        condition: service_healthy
      vc-proxy:
        condition: service_started
    networks:
      - e2e-test-network
    healthcheck:
      test: ["CMD", "curl", "-fs", "http://localhost:3001/health"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    logging:
      driver: "json-file"
      options:
        max-size: "500k"
        max-file: "5"

  vc-proxy:
    image: nginx:alpine
    container_name: vc-proxy
    volumes:
      - ./fixtures/vc-proxy.conf:/etc/nginx/nginx.conf:ro
      - ./fixtures/vc-pki/proxy_server.crt:/etc/nginx/certs/proxy_server.crt:ro
      - ./fixtures/vc-pki/proxy_server.key:/etc/nginx/certs/proxy_server.key:ro
    networks:
      - e2e-test-network
    logging:
      driver: "json-file"
      options:
        max-size: "500k"
        max-file: "5"

volumes:
  # Explicit name so `make storage-status`/`storage-clear` and the boot
  # manager find it regardless of the checkout's directory name.
  conformance-suite-mongodb-data:
    name: sirosid-conformance-mongodb-data