wehub-resource-sync
135 lines
4.6 KiB
YAML
135 lines
4.6 KiB
YAML
services:
|
|
keycloak-mcp-db:
|
|
container_name: stirling-keycloak-mcp-db
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_DB: keycloak
|
|
POSTGRES_USER: keycloak
|
|
POSTGRES_PASSWORD: keycloak
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U keycloak"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
networks:
|
|
- stirling-mcp-test
|
|
|
|
keycloak-mcp:
|
|
container_name: stirling-keycloak-mcp
|
|
image: quay.io/keycloak/keycloak:24.0
|
|
command:
|
|
- start-dev
|
|
- --import-realm
|
|
environment:
|
|
KC_DB: postgres
|
|
KC_DB_URL: jdbc:postgresql://keycloak-mcp-db:5432/keycloak
|
|
KC_DB_USERNAME: keycloak
|
|
KC_DB_PASSWORD: keycloak
|
|
KEYCLOAK_ADMIN: admin
|
|
KEYCLOAK_ADMIN_PASSWORD: admin
|
|
# Issuer hostname must resolve identically from host and Stirling container (see start-mcp-test.sh preflight).
|
|
KC_HOSTNAME: "${KEYCLOAK_HOST:-kubernetes.docker.internal}"
|
|
KC_HOSTNAME_PORT: 9080
|
|
KC_HOSTNAME_STRICT: "false"
|
|
KC_HTTP_ENABLED: "true"
|
|
ports:
|
|
- "9080:8080"
|
|
volumes:
|
|
- ./keycloak-realm-mcp.json:/opt/keycloak/data/import/realm-export.json:ro
|
|
depends_on:
|
|
keycloak-mcp-db:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/8080 && echo -e 'GET /realms/stirling-mcp HTTP/1.1\\nHost: localhost\\nConnection: close\\n\\n' >&3 && timeout 2 cat <&3 | head -n 1 | grep -q '200'"]
|
|
interval: 10s
|
|
timeout: 10s
|
|
retries: 30
|
|
start_period: 60s
|
|
networks:
|
|
- stirling-mcp-test
|
|
|
|
stirling-pdf-mcp:
|
|
container_name: stirling-pdf-mcp-test
|
|
image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest
|
|
build:
|
|
context: ../..
|
|
dockerfile: docker/embedded/Dockerfile
|
|
extra_hosts:
|
|
localhost: host-gateway
|
|
kubernetes.docker.internal: host-gateway
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "curl -f http://localhost:8080$${SYSTEM_ROOTURIPATH:-''}/api/v1/info/status | grep -q 'UP'"]
|
|
interval: 5s
|
|
timeout: 10s
|
|
retries: 30
|
|
ports:
|
|
- "8080:8080"
|
|
volumes:
|
|
- ../../../stirling/keycloak-mcp-test/data:/usr/share/tessdata:rw
|
|
- ../../../stirling/keycloak-mcp-test/config:/configs:rw
|
|
- ../../../stirling/keycloak-mcp-test/logs:/logs:rw
|
|
environment:
|
|
# Security/login on so we have real Stirling accounts to bind to.
|
|
DOCKER_ENABLE_SECURITY: "true"
|
|
SECURITY_ENABLELOGIN: "true"
|
|
SECURITY_LOGINMETHOD: "normal"
|
|
SYSTEM_DEFAULTLOCALE: en-US
|
|
SYSTEM_BACKENDURL: "http://localhost:8080"
|
|
PREMIUM_KEY: "${PREMIUM_KEY:-00000000-0000-0000-0000-000000000000}"
|
|
PREMIUM_ENABLED: "true"
|
|
UI_APPNAME: Stirling-PDF MCP Test
|
|
UI_HOMEDESCRIPTION: Keycloak MCP (OAuth resource server) Test Instance
|
|
UI_APPNAMENAVBAR: Stirling-PDF MCP
|
|
SYSTEM_MAXFILESIZE: "100"
|
|
|
|
# Seed the Stirling account the Keycloak "email" claim binds to (proves account-binding).
|
|
SECURITY_INITIALLOGIN_USERNAME: "mcpuser@stirling.local"
|
|
SECURITY_INITIALLOGIN_PASSWORD: "mcppassword"
|
|
|
|
# MCP server: OAuth2 resource-server mode (validates Keycloak tokens at /mcp, no web SSO).
|
|
MCP_ENABLED: "true"
|
|
MCP_AUTH_MODE: "${MCP_AUTH_MODE:-oauth}"
|
|
# Lowered so the oversized-body 413 check stays fast; production default is 10MB.
|
|
MCP_MAXREQUESTBYTES: "262144"
|
|
# Must match the token "iss" exactly.
|
|
MCP_AUTH_ISSUERURI: "http://${KEYCLOAK_HOST:-kubernetes.docker.internal}:9080/realms/stirling-mcp"
|
|
# RFC 8707 audience - must equal the "aud" the realm's mapper injects.
|
|
MCP_AUTH_RESOURCEID: "http://localhost:8080/mcp"
|
|
# Bind the JWT to a Stirling user by the "email" claim.
|
|
MCP_AUTH_USERNAMECLAIM: "email"
|
|
MCP_AUTH_REQUIREEXISTINGACCOUNT: "true"
|
|
|
|
# Resource server only - disable the web SSO client paths.
|
|
SECURITY_OAUTH2_ENABLED: "false"
|
|
SECURITY_SAML2_ENABLED: "false"
|
|
|
|
# Debug logging
|
|
LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_SECURITY_OAUTH2: DEBUG
|
|
LOGGING_LEVEL_STIRLING_SOFTWARE_PROPRIETARY_MCP: DEBUG
|
|
|
|
# LibreOffice settings
|
|
PROCESS_EXECUTOR_AUTO_UNO_SERVER: "true"
|
|
PROCESS_EXECUTOR_SESSION_LIMIT_LIBRE_OFFICE_SESSION_LIMIT: "1"
|
|
|
|
# Permissions
|
|
PUID: 1002
|
|
PGID: 1002
|
|
UMASK: "022"
|
|
|
|
# Features
|
|
DISABLE_ADDITIONAL_FEATURES: "false"
|
|
METRICS_ENABLED: "true"
|
|
SYSTEM_GOOGLEVISIBILITY: "false"
|
|
SHOW_SURVEY: "false"
|
|
|
|
depends_on:
|
|
keycloak-mcp:
|
|
condition: service_healthy
|
|
networks:
|
|
- stirling-mcp-test
|
|
restart: on-failure:5
|
|
|
|
networks:
|
|
stirling-mcp-test:
|
|
driver: bridge
|