docker-compose.yaml

# Passbolt Pro with Traefik reverse proxy
# Use: docker compose up -d

services:
  db:
    image: mariadb:latest
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: "rootpassword"
      MYSQL_DATABASE: "passbolt"
      MYSQL_USER: "passbolt"
      MYSQL_PASSWORD: "P4ssb0lt"
    volumes:
      - database_volume:/var/lib/mysql
      - ./config/db/init-keycloak-db.sql:/docker-entrypoint-initdb.d/init-keycloak-db.sql

  smtp4dev:
    image: rnwood/smtp4dev:v3
    container_name: smtp4dev
    restart: unless-stopped
    ports:
      - '465:25'     # Implicit TLS SMTP
    volumes:
      - ./smtp4dev/certs:/certs:ro
      - smtp4dev_data:/smtp4dev
    environment:
      - ServerOptions__Urls=http://*:80
      - ServerOptions__HostName=smtp.local
      - ServerOptions__TlsMode=ImplicitTls
      - ServerOptions__TlsCertificate=/certs/tls.pfx
      - ServerOptions__TlsCertificatePassword=changeme
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.smtp.rule=Host(`smtp.local`)"
      - "traefik.http.routers.smtp.ruleSyntax=v3"
      - "traefik.http.routers.smtp.entrypoints=websecure"
      - "traefik.http.routers.smtp.tls=true"
      - "traefik.http.services.smtp.loadbalancer.server.port=80"
    networks:
      default:
        aliases:
          - smtp.local

  keycloak:
    image: quay.io/keycloak/keycloak:latest
    container_name: keycloak
    restart: unless-stopped
    depends_on:
      - db
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_HOSTNAME: keycloak.local
      KC_HTTP_ENABLED: "true"
      KC_HOSTNAME_STRICT: "false"
      KC_HOSTNAME_STRICT_HTTPS: "false"
      KC_HTTPS_CERTIFICATE_FILE: /opt/keycloak/conf/server.crt.pem
      KC_HTTPS_CERTIFICATE_KEY_FILE: /opt/keycloak/conf/server.key.pem
      KC_DB: mariadb
      KC_DB_URL: jdbc:mariadb://db:3306/keycloak
      KC_DB_USERNAME: root
      KC_DB_PASSWORD: rootpassword
    volumes:
      - ./keys/keycloak.crt:/opt/keycloak/conf/server.crt.pem:ro
      - ./keys/keycloak.key:/opt/keycloak/conf/server.key.pem:ro
    command: ["start-dev"]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.keycloak.rule=Host(`keycloak.local`)"
      - "traefik.http.routers.keycloak.ruleSyntax=v3"
      - "traefik.http.routers.keycloak.entrypoints=websecure"
      - "traefik.http.routers.keycloak.tls=true"
      - "traefik.http.services.keycloak.loadbalancer.server.port=8443"
      - "traefik.http.services.keycloak.loadbalancer.server.scheme=https"
      - "traefik.http.services.keycloak.loadbalancer.serversTransport=passbolt-transport@file"
      - "traefik.http.routers.keycloak.middlewares=security-headers@file"
    networks:
      default:
        aliases:
          - keycloak.local

  valkey:
    image: valkey/valkey:latest
    container_name: valkey
    restart: unless-stopped
    ports:
      - "6379:6379"
    volumes:
      - valkey_data:/data
    command: valkey-server --appendonly yes

  passbolt:
    image: passbolt/passbolt:latest-pro
    restart: unless-stopped
    depends_on:
      - db
      - valkey
      - ldap1
      - ldap2
    extra_hosts:
      - "keycloak.local:172.19.0.1"
    environment:
      APP_FULL_BASE_URL: https://passbolt.local
      DATASOURCES_DEFAULT_HOST: "db"
      DATASOURCES_DEFAULT_USERNAME: "passbolt"
      DATASOURCES_DEFAULT_PASSWORD: "P4ssb0lt"
      DATASOURCES_DEFAULT_DATABASE: "passbolt"
      
      EMAIL_TRANSPORT_DEFAULT_HOST: "ssl://smtp.local"
      EMAIL_TRANSPORT_DEFAULT_PORT: 25
      EMAIL_TRANSPORT_DEFAULT_USERNAME: ""
      EMAIL_TRANSPORT_DEFAULT_PASSWORD: ""
      EMAIL_DEFAULT_FROM: "admin@passbolt.com"
      
      PASSBOLT_PLUGINS_SMTP_SETTINGS_SECURITY_SSL_VERIFY_PEER: true
      PASSBOLT_PLUGINS_SMTP_SETTINGS_SECURITY_SSL_VERIFY_PEER_NAME: true
      PASSBOLT_PLUGINS_SMTP_SETTINGS_SECURITY_SSL_ALLOW_SELF_SIGNED: true
      PASSBOLT_PLUGINS_SMTP_SETTINGS_SECURITY_SSL_CAFILE: "/etc/ssl/certs/smtp_local.crt"
      
      PASSBOLT_PLUGINS_DIRECTORY_SYNC_ENABLED: "true"
      PASSBOLT_PLUGINS_DIRECTORY_SYNC_SECURITY_SSL_CUSTOM_OPTIONS_ENABLED: "true"
      PASSBOLT_PLUGINS_DIRECTORY_SYNC_SECURITY_SSL_CUSTOM_OPTIONS_VERIFY_PEER: "true"
      PASSBOLT_PLUGINS_DIRECTORY_SYNC_SECURITY_SSL_CUSTOM_OPTIONS_CAFILE: "/etc/ssl/certs/ldaps_bundle.crt"
      
      PASSBOLT_PLUGINS_SSO_ENABLED: "true"
      PASSBOLT_PLUGINS_SSO_PROVIDER_OAUTH2_ENABLED: "true"
      PASSBOLT_SECURITY_SSO_SSL_VERIFY: "false"
      
      # Audit logging: file and syslog (both can use any strategy)
      LOG_ACTION_LOGS_ON_FILE_ENABLED: "true"
      LOG_ACTION_LOGS_ON_FILE_PATH: "/var/log/passbolt/"  # trailing slash required on macOS binds or CakePHP concatenates filename incorrectly
      LOG_ACTION_LOGS_ON_FILE_FILE: "action-logs.log"
      LOG_ACTION_LOGS_ON_FILE_STRATEGY: 'Passbolt\Log\Strategy\ActionLogsDefaultQueryStrategy'
      
      # Syslog audit logging (can run alongside file logging)
      # Note: requires syslog daemon in container or sidecar - file logging works without it
      LOG_ACTION_LOGS_ON_SYSLOG_ENABLED: "true"
      LOG_ACTION_LOGS_ON_SYSLOG_STRATEGY: 'Passbolt\Log\Strategy\ActionLogsUsernameQueryStrategy'
      LOG_ACTION_LOGS_ON_SYSLOG_PREFIX: 'passbolt-audit:'
      # LOG_ACTION_LOGS_ON_SYSLOG_FACILITY: 1  # omit to use default LOG_USER (env vars are strings, would need casting)

      PASSBOLT_PLUGINS_JWT_AUTHENTICATION_ENABLED: "true"
        #      PASSBOLT_SECURITY_SMTP_SETTINGS_ENDPOINTS_DISABLED: "true"
      PASSBOLT_SECURITY_DIRECTORY_SYNC_ENDPOINTS_DISABLED: "false"
      PASSBOLT_PLUGINS_SELF_REGISTRATION_ENABLED: "false"

      PASSBOLT_SSL_FORCE: "true"

      CACHE_CAKECORE_CLASSNAME: Cake\Cache\Engine\RedisEngine
      CACHE_CAKECORE_HOST: valkey
      CACHE_CAKECORE_PORT: 6379
      CACHE_CAKECORE_PASSWORD: ""
      CACHE_CAKECORE_DATABASE: 0
      SESSION_DEFAULTS: cache

    volumes:
      - gpg_volume:/etc/passbolt/gpg
      - jwt_volume:/etc/passbolt/jwt
      - ./config/php/www.conf:/etc/php-fpm.d/www.conf
      - ./config/php/ssl.ini:/etc/php/8.2/cli/conf.d/99-ssl.ini
      - ./config/nginx/nginx-passbolt.conf:/etc/nginx/sites-enabled/nginx-passbolt.conf
      - ./keys/ca.crt:/usr/local/share/ca-certificates/keycloak.crt
      - ./keys/passbolt.crt:/etc/ssl/certs/certificate.crt:ro
      - ./keys/passbolt.key:/etc/ssl/certs/certificate.key:ro
      - ./smtp4dev/certs/tls.crt:/etc/ssl/certs/smtp_local.crt:ro
      - ./certs/ldaps_bundle.crt:/etc/ssl/certs/ldaps_bundle.crt:ro
      - ./certs/ldaps_bundle.crt:/usr/local/share/ca-certificates/ldap-ca.crt:ro
      # LDAPS certificate mounts for secure LDAP connections
      - ./keys/ldap1-ca.crt:/etc/ssl/certs/ldap1-ca.crt:ro
      - ./keys/ldap1-ca.crt:/usr/local/share/ca-certificates/ldap1-ca.crt:ro
      - ./keys/ldap2-ca.crt:/etc/ssl/certs/ldap2-ca.crt:ro
      - ./keys/ldap2-ca.crt:/usr/local/share/ca-certificates/ldap2-ca.crt:ro
      - ./subscription_key.txt:/etc/passbolt/subscription_key.txt:ro
      # persistent storage for SIEM logs
      - ./logs/passbolt:/var/log/passbolt

    command:
      - /bin/bash
      - -ceu
      - |
        update-ca-certificates

        # Fix JWT directory permissions
        chown -Rf root:www-data /etc/passbolt/jwt/
        chmod 750 /etc/passbolt/jwt/
        if [ ! -f /etc/passbolt/jwt/jwt.key ] || [ ! -f /etc/passbolt/jwt/jwt.pem ]; then
          chmod 770 /etc/passbolt/jwt/
          su -s /bin/bash -c "/usr/share/php/passbolt/bin/cake passbolt create_jwt_keys" www-data
          chmod 750 /etc/passbolt/jwt/
        fi
        [ -f /etc/passbolt/jwt/jwt.key ] && chmod 640 /etc/passbolt/jwt/jwt.key || true
        [ -f /etc/passbolt/jwt/jwt.pem ] && chmod 640 /etc/passbolt/jwt/jwt.pem || true

        # Import GPG server key if present (for restored instances)
        if [ -f /etc/passbolt/gpg/serverkey_private.asc ]; then
          echo "Importing GPG server key..."
          su -s /bin/bash -c "gpg --home /var/lib/passbolt/.gnupg --batch --import /etc/passbolt/gpg/serverkey_private.asc" www-data 2>&1 || true
        fi

        # Uncomment the below two lines if you are using ldap sync. Change '* * * * *' to your preferred sync schedule. More info: https://en.wikipedia.org/wiki/Cron
        # touch /var/log/cron.log && chown www-data:www-data /var/log/cron.log
        # echo '* * * * * www-data exec /bin/bash -c "source /etc/environment && /usr/share/php/passbolt/bin/cake directory_sync all --persist" >> /var/log/cron.log 2>&1' >> /etc/cron.d/passbolt-pro-server

        /usr/bin/wait-for.sh -t 0 db:3306 -- /docker-entrypoint.sh

    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.passbolt.rule=Host(`passbolt.local`)"
      - "traefik.http.routers.passbolt.ruleSyntax=v3"
      - "traefik.http.routers.passbolt.entrypoints=websecure"
      - "traefik.http.routers.passbolt.tls=true"
      - "traefik.http.services.passbolt.loadbalancer.server.port=443"
      - "traefik.http.services.passbolt.loadbalancer.server.scheme=https"
      - "traefik.http.services.passbolt.loadbalancer.serversTransport=passbolt-transport@file"
      - "traefik.http.routers.passbolt.middlewares=security-headers@file"
    networks:
      default:
        aliases:
          - passbolt.local

  # LDAP Server 1 - Passbolt Inc. (Historical Computing Pioneers)
  # Contains: Ada, Betty, Carol, Dame, Edith with @passbolt.com emails
  ldap1:
    image: osixia/openldap:1.5.0
    container_name: ldap1
    hostname: ldap1.local
    restart: unless-stopped
    environment:
      LDAP_ORGANISATION: "Passbolt"
      LDAP_DOMAIN: "passbolt.local"
      LDAP_ADMIN_PASSWORD: "P4ssb0lt"
      LDAP_CONFIG_PASSWORD: "P4ssb0lt"
      LDAP_READONLY_USER: "true"
      LDAP_READONLY_USER_USERNAME: "readonly"
      LDAP_READONLY_USER_PASSWORD: "readonly"
      LDAP_TLS: "true"
      LDAP_TLS_VERIFY_CLIENT: "never"
      LDAP_BASE_DN: "dc=passbolt,dc=local"
      LDAP_USERS_DN: "ou=users,dc=passbolt,dc=local"
      LDAP_GROUPS_DN: "ou=groups,dc=passbolt,dc=local"
    volumes:
      - ldap1_data:/var/lib/ldap
      - ldap1_config:/etc/ldap/slapd.d
      - ldap1_certs:/container/service/slapd/assets/certs
    networks:
      default:
        aliases:
          - ldap1.local

  # LDAP Server 2 - Example Corp (Modern Tech Professionals)
  # Contains: John, Sarah, Michael, Lisa with @example.com emails
  ldap2:
    image: osixia/openldap:1.5.0
    container_name: ldap2
    hostname: ldap2.local
    restart: unless-stopped
    environment:
      LDAP_ORGANISATION: "Example Corp"
      LDAP_DOMAIN: "example.com"
      LDAP_ADMIN_PASSWORD: "Ex4mple123"
      LDAP_CONFIG_PASSWORD: "Ex4mple123"
      LDAP_READONLY_USER: "true"
      LDAP_READONLY_USER_USERNAME: "reader"
      LDAP_READONLY_USER_PASSWORD: "reader123"
      LDAP_TLS: "true"
      LDAP_TLS_VERIFY_CLIENT: "never"
      LDAP_BASE_DN: "dc=example,dc=com"
      LDAP_USERS_DN: "ou=people,dc=example,dc=com"
      LDAP_GROUPS_DN: "ou=teams,dc=example,dc=com"
    volumes:
      - ldap2_data:/var/lib/ldap
      - ldap2_config:/etc/ldap/slapd.d
      - ldap2_certs:/container/service/slapd/assets/certs
    networks:
      default:
        aliases:
          - ldap2.local

  # LDAP Meta Backend - Aggregation Proxy
  # Provides unified LDAP interface for Passbolt synchronization
  # Aggregates results from ldap1 and ldap2 into unified namespace
  ldap-meta:
    build:
      context: .
      dockerfile: Dockerfile.ldap-meta
    container_name: ldap-meta
    hostname: ldap-meta.local
    restart: unless-stopped
    depends_on:
      - ldap1
      - ldap2
    ports:
      - "3389:389"   # LDAP
      - "3636:636"    # LDAPS
    volumes:
      - ldap_meta_data:/var/lib/ldap
      - ldap_meta_config:/etc/ldap/slapd.d
    networks:
      default:
        aliases:
          - ldap-meta.local

  # Rsyslog sidecar for syslog audit logging (optional)
  # Start with: docker compose --profile audit up -d
  # Or: ENABLE_RSYSLOG=true ./scripts/setup.sh
  # Documentation: https://github.com/rsyslog/rsyslog/tree/main/packaging/docker
  rsyslog:
    profiles: ["audit"]
    image: rsyslog/rsyslog:latest
    platform: linux/amd64  # Explicit platform to suppress warning (image works via emulation on arm64)
    container_name: rsyslog
    restart: unless-stopped
    volumes:
      - ./config/rsyslog/rsyslog.conf:/etc/rsyslog.conf:ro
      - ./logs/passbolt:/var/log/passbolt
      - syslog_socket:/var/run/syslog-socket  # Socket directory shared with Passbolt
    command: ["rsyslogd", "-n", "-f", "/etc/rsyslog.conf"]
    networks:
      default:

  # Claude Code devcontainer for support work
  # Shares the stack network so Claude can reach all services by hostname
  devcontainer:
    image: mcr.microsoft.com/devcontainers/base:ubuntu
    container_name: passbolt-support
    working_dir: /workspaces/gareth-passbolt
    stdin_open: true
    tty: true
    volumes:
      - ${HOME}/code:/workspaces:cached
      - ${HOME}/.claude:/home/vscode/.claude:cached
      # Override plugins/ with a container-local named volume so install records
      # reference container paths (/home/vscode/...) instead of the host's
      # (/Users/gareth/...). Host-side plugin state is left untouched.
      - claude_plugins:/home/vscode/.claude/plugins
      - ${HOME}/.claude.json:/home/vscode/.claude.json:cached
      - ${HOME}/passbolt_responses:/home/vscode/passbolt_responses:cached
    environment:
      CLAUDE_NO_TELEMETRY: "true"
      CLAUDE_CONFIG_DIR: /home/vscode/.claude
    restart: unless-stopped
    entrypoint: /workspaces/gareth-passbolt/.devcontainer/entrypoint.sh
    networks:
      default:

  # Qdrant vector database for MCP memory service
  # Start with: docker compose --profile memory up -d
  qdrant:
    profiles: ["memory"]
    image: qdrant/qdrant:latest
    container_name: qdrant
    restart: unless-stopped
    volumes:
      - qdrant_data:/qdrant/storage
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/localhost/6333'"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s
    networks:
      default:

  # MCP memory service - persistent semantic memory for Claude
  # Requires: git clone https://github.com/27b-io/mcp-memory-service ~/code/mcp-memory-service
  # Start with: docker compose --profile memory up -d
  mcp-memory:
    profiles: ["memory"]
    build:
      context: ${HOME}/code/mcp-memory-service
      dockerfile: Dockerfile
    container_name: mcp-memory
    restart: unless-stopped
    depends_on:
      qdrant:
        condition: service_healthy
    environment:
      MCP_TRANSPORT_MODE: streamable-http
      MCP_SERVER_PORT: "8001"
      MCP_QDRANT_URL: http://qdrant:6333
      MCP_FALKORDB_ENABLED: "false"
    volumes:
      - memory_data:/app/data
    networks:
      default:

  traefik:
    image: traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    depends_on:
      - passbolt
      - keycloak
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./config/traefik/traefik.yaml:/traefik.yaml:ro
      - ./config/traefik/conf.d:/etc/traefik/conf.d:ro
      - ./keys:/certs:ro
    networks:
      default:

volumes:
  database_volume:
    name: ${COMPOSE_PROJECT_NAME}_database_volume
  gpg_volume:
    name: ${COMPOSE_PROJECT_NAME}_gpg_volume
  jwt_volume:
    name: ${COMPOSE_PROJECT_NAME}_jwt_volume
  smtp4dev_data:
    name: ${COMPOSE_PROJECT_NAME}_smtp4dev_data
  valkey_data:
    name: ${COMPOSE_PROJECT_NAME}_valkey_data
  syslog_socket:
    name: ${COMPOSE_PROJECT_NAME}_syslog_socket
  ldap1_data:
    name: ${COMPOSE_PROJECT_NAME}_ldap1_data
  ldap1_config:
    name: ${COMPOSE_PROJECT_NAME}_ldap1_config
  ldap1_certs:
    name: ${COMPOSE_PROJECT_NAME}_ldap1_certs
  ldap2_data:
    name: ${COMPOSE_PROJECT_NAME}_ldap2_data
  ldap2_config:
    name: ${COMPOSE_PROJECT_NAME}_ldap2_config
  ldap2_certs:
    name: ${COMPOSE_PROJECT_NAME}_ldap2_certs
  ldap_meta_data:
    name: ${COMPOSE_PROJECT_NAME}_ldap_meta_data
  ldap_meta_config:
    name: ${COMPOSE_PROJECT_NAME}_ldap_meta_config
  ldap_meta_certs:
    name: ${COMPOSE_PROJECT_NAME}_ldap_meta_certs
  qdrant_data:
    name: ${COMPOSE_PROJECT_NAME}_qdrant_data
  memory_data:
    name: ${COMPOSE_PROJECT_NAME}_memory_data
  claude_plugins:
    name: ${COMPOSE_PROJECT_NAME}_claude_plugins