logto Docker & Self-Hosted Deployment

# Docker Compose configuration for integration tests
services:
  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: p0stgr3s
      POSTGRES_DB: postgres
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d postgres"]
      interval: 3s
      timeout: 3s
      retries: 20

  redis:
    image: redis:6-alpine
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 3s
      timeout: 3s
      retries: 20

  # An S3-compatible storage for the self-hosted Bring your UI tests, configured as the experience
  # blobs provider through `EXPERIENCE_BLOBS_PROVIDER` below.
  s3mock:
    image: adobe/s3mock:4.7.0
    environment:
      COM_ADOBE_TESTING_S3MOCK_STORE_INITIAL_BUCKETS: experience-blobs

  logto:
    stop_signal: SIGINT
    volumes:
      # Mount the temporary directory for storing mock connector records, which will be used by
      # the integration tests.
      - ./.integration-test-tmp:/tmp/logto
      - ./.integration-test-coverage:/coverage
    extra_hosts:
      # Add host.docker.internal for the container to access the host machine, which is required for
      # mock web server to receive webhooks from Logto.
      - "host.docker.internal:host-gateway"
    build:
      context: .
      dockerfile: Dockerfile.integration
      args:
        # Forwarded so `DEV_FEATURES_ENABLED=1 pnpm test:integration api` exercises the dev-feature
        # APIs, matching the flag the test process reads.
        dev_features_enabled: ${DEV_FEATURES_ENABLED:-}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      s3mock:
        condition: service_started
    environment:
      DB_URL: postgres://postgres:p0stgr3s@postgres:5432/postgres
      REDIS_URL: redis://redis:6379
      SECRET_VAULT_KEK: DtPWS09unRXGuRScB60qXqCSsrjd22dUlXt/0oZgxSo=
      STATUS_API_KEY: test-status-api-key
      TRUST_PROXY_HEADER: "1"
      # The public half of the fixture ES256 key pair the self-hosted license tests sign with, so
      # the instance trusts the licenses those tests install. See
      # `packages/integration-tests/src/helpers/license.ts`.
      SELF_HOSTED_LICENSE_PUBLIC_KEY: '{"kty":"EC","crv":"P-256","x":"r79NM6kQhcFX7GZwo6gh0qGMYapn3XkwwkcdW-EWXC4","y":"XElMflsuc4fEc3iUJc-LLuVpaAWfqm-vZEb_JzZEOi8"}'
      # Webhook deliveries target the host through `host.docker.internal`, which resolves to the
      # private bridge gateway. Allow the Docker bridge ranges rather than disabling the SSRF
      # protection. CIMD cannot be enabled while an allowlist is set.
      SSRF_ALLOWED_ADDRESSES: 172.16.0.0/12,192.168.0.0/16,10.0.0.0/8
      # Written to the `systems` table by the bootstrap script before Logto starts, since provider
      # configs are only loaded on startup. See `sign-in-experience.custom-ui-assets.test.ts`.
      EXPERIENCE_BLOBS_PROVIDER: '{"provider":"S3Storage","endpoint":"http://s3mock:9090","bucket":"experience-blobs","forcePathStyle":true,"accessKeyId":"s3mock","accessSecretKey":"s3mock"}'
      COVERAGE: ${COVERAGE:-0}
      COVERAGE_REPORT_DIR: /coverage/report
      COVERAGE_TEMP_DIR: /coverage/raw
    healthcheck:
      test: ["CMD-SHELL", "nc -z localhost 3001 || exit 1"]
      interval: 3s
      timeout: 3s
      retries: 30
    ports:
      - "3001:3001"
      - "3002:3002"