# guacamole-sso/docker-compose.yml

services:
  # --- Reverse Proxy ---
  npm:
    image: 'jc21/nginx-proxy-manager:latest'
    container_name: npm
    restart: unless-stopped
    ports:
      - '80:80'    # Public HTTP Port
      - '443:443'  # Public HTTPS Port
      - '81:81'    # Admin UI
    volumes:
      - npm-data:/data
      - npm-letsencrypt:/etc/letsencrypt
      - ./npm/certs:/data/custom_ssl
    networks:
      - sso-net

  authentik-postgres:
    image: docker.io/library/postgres:16-alpine
    container_name: authentik_postgres_db
    restart: unless-stopped
    volumes:
      - authentik-db:/var/lib/postgresql/data
    env_file: .env
    environment:
      - POSTGRES_PASSWORD=${AUTHENTIK_DB_PASSWORD}
      - POSTGRES_USER=${PG_USER}
      - POSTGRES_DB=${PG_DB}
    networks:
      - sso-net

  authentik-redis:
    image: docker.io/library/redis:alpine
    container_name: authentik_redis_cache
    restart: unless-stopped
    volumes:
      - authentik-redis:/data
    networks:
      - sso-net

  authentik-server:
    image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG}
    container_name: authentik_server
    restart: unless-stopped
    command: server
    env_file: .env
    environment:
      - AUTHENTIK_REDIS__HOST=authentik-redis
      - AUTHENTIK_POSTGRESQL__HOST=authentik-postgres
      - AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_DB_PASSWORD}
    volumes:
      - ./blueprints/guacamole-oidc-blueprint.yaml:/blueprints/guacamole-oidc-blueprint.yaml
    networks:
      - sso-net

  authentik-worker:
    image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG}
    container_name: authentik_worker
    restart: unless-stopped
    command: worker
    env_file: .env
    environment:
      - AUTHENTIK_REDIS__HOST=authentik-redis
      - AUTHENTIK_POSTGRESQL__HOST=authentik-postgres
      - AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_DB_PASSWORD}
    user: root
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./blueprints/guacamole-oidc-blueprint.yaml:/blueprints/guacamole-oidc-blueprint.yaml
    networks:
      - sso-net

  # --- Guacamole Services ---
  guac-postgres:
    image: postgres:16-alpine
    container_name: guac_postgres_db
    restart: unless-stopped
    volumes:
      - guac-db-data:/var/lib/postgresql/data
      - ./guac-init-scripts:/docker-entrypoint-initdb.d
    env_file: .env
    environment:
      - POSTGRES_DB=${GUAC_POSTGRES_DB}
      - POSTGRES_USER=${GUAC_POSTGRES_USER}
      - POSTGRES_PASSWORD=${GUAC_POSTGRES_PASSWORD}
    networks:
      - sso-net

  guacd:
    image: guacamole/guacd:${GUACAMOLE_VERSION}
    container_name: guacd
    restart: unless-stopped
    networks:
      - sso-net

  # This service downloads the OIDC extension.
#  guacamole-setup:
#    image: alpine:latest
#    container_name: guacamole_setup
#    restart: "no"
#    volumes:
#      - guac-extensions:/extensions
#    command: >
#      sh -c "
#        apk --no-cache add wget &&
#        echo '### Downloading OIDC SSO Extension...' &&
#        wget -q -O /tmp/sso.tar.gz 'https://apache.org/dyn/closer.lua/guacamole/${GUACAMOLE_VERSION}/binary/guacamole-auth-sso-${GUACAMOLE_VERSION}.tar.gz?action=download' &&
#        tar -xzf /tmp/sso.tar.gz -C /extensions --strip-components=2 guacamole-auth-sso-${GUACAMOLE_VERSION}/openid/guacamole-auth-sso-openid-${GUACAMOLE_VERSION}.jar &&
#        echo '### Fixing permissions...' &&
#        chown 1000:1000 /extensions/*.jar &&
#        echo '### Setup complete.'
#      "

  guacamole:
    image: guacamole/guacamole:${GUACAMOLE_VERSION}
    container_name: guacamole_webapp
    restart: unless-stopped
    depends_on:
#      guacamole-setup:
#        condition: service_completed_successfully
      guacd:
        condition: service_started
      guac-postgres:
        condition: service_started
    env_file: .env
    environment:
      - GUACAMOLE_EXTENSIONS=openid,postgresql
      - GUACAMOLE_HOME=/etc/guacamole
      - GUACD_HOSTNAME=guacd
      - POSTGRESQL_HOSTNAME=guac-postgres
      - POSTGRESQL_DATABASE=${GUAC_POSTGRES_DB}
      - POSTGRESQL_USER=${GUAC_POSTGRES_USER}
      - POSTGRESQL_PASSWORD=${GUAC_POSTGRES_PASSWORD}
      - JAVA_OPTS=-Dguacamole.frontend-proxy-ssl=true -Dguacamole.home=/etc/guacamole
      - GUACAMOLE_LOG_LEVEL=debug
      - OPENID_AUTHORIZATION_ENDPOINT=${AUTHENTIK_URL}/application/o/authorize/
      - OPENID_JWKS_ENDPOINT=http://authentik-server:9000/application/o/guacamole/jwks/
      - OPENID_ISSUER=${AUTHENTIK_URL}/application/o/guacamole/
      - OPENID_CLIENT_ID=${OIDC_CLIENT_ID}
      - OPENID_REDIRECT_URI=${GUACAMOLE_URL}/guacamole/api/ext/oidc/callback
      - OPENID_USERNAME_CLAIM_TYPE=preferred_username
      - OPENID_SCOPE=openid email profile
      - OPENID_TOKEN_ENDPOINT=http://authentik-server:9000/application/o/token/
    volumes:
      - guac-extensions:/etc/guacamole/extensions
     # - ./guacamole.properties:/etc/guacamole/guacamole.properties
    networks:
      - sso-net

volumes:
  npm-data:
  npm-letsencrypt:
  authentik-db:
  authentik-redis:
  guac-db-data:
  guac-extensions:

networks:
  sso-net:
    driver: bridge
