03-outline-minio-redis-docker-compose.yml

# Outline with Keycloak and Let's Encrypt Using Docker Compose

# The complete installation guide is available on my website https://www.heyvaldemar.com/install-outline-and-keycloak-using-docker-compose/

# Change variables in the `.env` to meet your requirements.
# Note that the `.env` file should be in the same directory as `01-traefik-outline-letsencrypt-docker-compose.yml`, `02-keycloak-outline-docker-compose.yml`, and `03-outline-minio-redis-docker-compose.yml`.

# The value for the `OUTLINE_OIDC_CLIENT_SECRET` variable can be obtained after installing Keycloak using `02-keycloak-outline-docker-compose.yml`.

# Additionally, you need to specify your values for `OUTLINE_SECRET_KEY` and `OUTLINE_UTILS_SECRET`.
# The values for `OUTLINE_SECRET_KEY` and `OUTLINE_UTILS_SECRET` can be generated using the command:
# `openssl rand -hex 32`

# Create networks for your services before deploying the configuration using the commands:
# `docker network create traefik-network`
# `docker network create keycloak-network`
# `docker network create outline-network`

# Deploy Traefik using Docker Compose:
# `docker compose -f 01-traefik-outline-letsencrypt-docker-compose.yml -p traefik up -d`

# Deploy Keycloak using Docker Compose:
# `docker compose -f 02-keycloak-outline-docker-compose.yml -p keycloak up -d`

# Create a new `Realm` on Keycloak and name it `outline` (case sensitive).

# Create a `Client` in the new realm and configure it:
# 1. Client type: `OpenID Connect`
# 2. Client ID: `outline` (case sensitive)
# 3. Client authentication: `on`
# 4. Authentication flow: uncheck all other options and leave only `Standard flow`
# 5. Set URLs:
# - In the `Root URL` field, enter `https://outline.heyvaldemar.net/`
# - In the `Home URL` field, enter `https://outline.heyvaldemar.net/`
# - In the `Valid redirect URIs` field, enter `https://outline.heyvaldemar.net/*`

# Please note, outline.heyvaldemar.net is the domain name of my service. 
# Accordingly, you need to specify your domain name,
# which points to the IP address of your server with the installed Traefik service,
# which will redirect the request to Outline.

# Get a `Client secret` value on the `Credentials` tab of the `Client` that you created.
# Specify the `OUTLINE_OIDC_CLIENT_SECRET` variable in the `.env`.

# Create a user on Keycloak for Outline.
# Note that you have to specify an email address and a username.
# Set a password for the new user.

# Deploy Keycloak using Docker Compose:
# `docker compose -f 03-outline-minio-redis-docker-compose.yml -p outline up -d`

# Log in to Outline with the Username or Email specified on the Keycloak.

# Backups
# The `backups-keycloak` container in the configuration is responsible for the following:
# 1. **Database Backup**: Creates compressed backups of the PostgreSQL database using pg_dump.
# Customizable backup path, filename pattern, and schedule through variables like `KEYCLOAK_POSTGRES_BACKUPS_PATH`, `KEYCLOAK_POSTGRES_BACKUP_NAME`, and `KEYCLOAK_BACKUP_INTERVAL`.
# 2. **Backup Pruning**: Periodically removes backups exceeding a specified age to manage storage. Customizable pruning schedule and age threshold with `KEYCLOAK_POSTGRES_BACKUP_PRUNE_DAYS`.

# The `backups-outline` container in the configuration is responsible for the following:
# 1. **Application Data Backup**: Compresses and stores backups of the application data on the same schedule. Controlled via variables such as `OUTLINE_DATA_BACKUPS_PATH`, `OUTLINE_DATA_BACKUP_NAME`, and `OUTLINE_BACKUP_INTERVAL`.
# 2. **Backup Pruning**: Periodically removes backups exceeding a specified age to manage storage. Customizable pruning schedule and age threshold with `OUTLINE_DATA_BACKUP_PRUNE_DAYS`.
# By utilizing these containers, consistent and automated backups of the essential components of your instance are ensured.
# Moreover, efficient management of backup storage and tailored backup routines can be achieved through easy and flexible configuration using environment variables.

# # keycloak-restore-database.sh Description
# This script facilitates the restoration of a database backup:
# 1. **Identify Containers**: It first identifies the service and backups containers by name, finding the appropriate container IDs.
# 2. **List Backups**: Displays all available database backups located at the specified backup path.
# 3. **Select Backup**: Prompts the user to copy and paste the desired backup name from the list to restore the database.
# 4. **Stop Service**: Temporarily stops the service to ensure data consistency during restoration.
# 5. **Restore Database**: Executes a sequence of commands to drop the current database, create a new one, and restore it from the selected compressed backup file.
# 6. **Start Service**: Restarts the service after the restoration is completed.
# To make the `keycloak-restore-database.sh` script executable, run the following command:
# `chmod +x keycloak-restore-database.sh`
# Usage of this script ensures a controlled and guided process to restore the database from an existing backup.

# # outline-restore-database.sh Description
# This script facilitates the restoration of a database backup:
# 1. **Identify Containers**: It first identifies the service and backups containers by name, finding the appropriate container IDs.
# 2. **List Backups**: Displays all available database backups located at the specified backup path.
# 3. **Select Backup**: Prompts the user to copy and paste the desired backup name from the list to restore the database.
# 4. **Stop Service**: Temporarily stops the service to ensure data consistency during restoration.
# 5. **Restore Database**: Executes a sequence of commands to drop the current database, create a new one, and restore it from the selected compressed backup file.
# 6. **Start Service**: Restarts the service after the restoration is completed.
# To make the `outline-restore-database.sh` script executable, run the following command:
# `chmod +x outline-restore-database.sh`
# Usage of this script ensures a controlled and guided process to restore the database from an existing backup.

# # outline-restore-application-data.sh Description
# This script is designed to restore the application data:
# 1. **Identify Containers**: Similarly to the database restore script, it identifies the service and backups containers by name.
# 2. **List Application Data Backups**: Displays all available application data backups at the specified backup path.
# 3. **Select Backup**: Asks the user to copy and paste the desired backup name for application data restoration.
# 4. **Stop Service**: Stops the service to prevent any conflicts during the restore process.
# 5. **Restore Application Data**: Removes the current application data and then extracts the selected backup to the appropriate application data path.
# 6. **Start Service**: Restarts the service after the application data has been successfully restored.
# To make the `outline-restore-application-data.sh` script executable, run the following command:
# `chmod +x outline-restore-application-data.sh`
# By utilizing this script, you can efficiently restore application data from an existing backup while ensuring proper coordination with the running service.

# Author
# I’m Vladimir Mikhalev, the Docker Captain, but my friends can call me Valdemar.
# https://www.docker.com/captains/vladimir-mikhalev/

# My website with detailed IT guides: https://www.heyvaldemar.com/
# Follow me on YouTube: https://www.youtube.com/channel/UCf85kQ0u1sYTTTyKVpxrlyQ?sub_confirmation=1
# Follow me on Twitter: https://twitter.com/heyValdemar
# Follow me on Instagram: https://www.instagram.com/heyvaldemar/
# Follow me on Threads: https://www.threads.net/@heyvaldemar
# Follow me on Mastodon: https://mastodon.social/@heyvaldemar
# Follow me on Bluesky: https://bsky.app/profile/heyvaldemar.bsky.social
# Follow me on Facebook: https://www.facebook.com/heyValdemarFB/
# Follow me on TikTok: https://www.tiktok.com/@heyvaldemar
# Follow me on LinkedIn: https://www.linkedin.com/in/heyvaldemar/
# Follow me on GitHub: https://github.com/heyvaldemar

# Communication
# Chat with IT pros on Discord: https://discord.gg/AJQGCCBcqf
# Reach me at ask@sre.gg

# Give Thanks
# Support on GitHub: https://github.com/sponsors/heyValdemar
# Support on Patreon: https://www.patreon.com/heyValdemar
# Support on BuyMeaCoffee: https://www.buymeacoffee.com/heyValdemar
# Support on Ko-fi: https://ko-fi.com/heyValdemar
# Support on PayPal: https://www.paypal.com/paypalme/heyValdemarCOM

networks:
  outline-network:
    external: true
  keycloak-network:
    external: true
  traefik-network:
    external: true

volumes:
  minio-data:
  outline-postgres:
  outline-postgres-backup:
  outline-data-backups:
  outline-database-backups:

services:
  postgres-outline:
    image: ${OUTLINE_POSTGRES_IMAGE_TAG}
    volumes:
      - outline-postgres:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: ${OUTLINE_DB_NAME}
      POSTGRES_USER: ${OUTLINE_DB_USER}
      POSTGRES_PASSWORD: ${OUTLINE_DB_PASSWORD}
    networks:
      - outline-network
    healthcheck:
      test: [ "CMD", "pg_isready", "-q", "-d", "${OUTLINE_DB_NAME}", "-U", "${OUTLINE_DB_USER}" ]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s
    restart: unless-stopped

  redis:
    image: ${OUTLINE_REDIS_IMAGE_TAG}
    networks:
      - outline-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s
    restart: unless-stopped

  minio:
    image: ${OUTLINE_MINIO_IMAGE_TAG}
    entrypoint: /bin/sh
    command:
      - -c
      - |
        minio server /data --console-address :9001 &
        sleep 20
        mc config host add minio http://localhost:9000 ${OUTLINE_MINIO_ADMIN} ${OUTLINE_MINIO_ADMIN_PASSWORD}
        mc mb minio/${OUTLINE_MINIO_BUCKET_NAME}
        mc admin user add minio ${OUTLINE_MINIO_USER} ${OUTLINE_MINIO_USER_PASSWORD}
        cat > outline-policy.json <<-EOF
          {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Action": [
                  "s3:GetBucketLocation",
                  "s3:ListBucket",
                  "s3:ListBucketMultipartUploads"
                ],
                "Resource": [
                  "arn:aws:s3:::${OUTLINE_MINIO_BUCKET_NAME}"
                ]
              },
              {
                "Action": [
                  "s3:AbortMultipartUpload",
                  "s3:DeleteObject",
                  "s3:GetObject",
                  "s3:ListMultipartUploadParts",
                  "s3:PutObject",
                  "s3:GetObject"
                ],
                "Effect": "Allow",
                "Resource": [
                  "arn:aws:s3:::${OUTLINE_MINIO_BUCKET_NAME}/*"
                ],
                "Sid": ""
              }
            ]
          }
        EOF
        cat > data-public.json <<-EOF
          {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Principal": {
                "AWS": [
                  "*"
                ]
              },
                "Action": [
                  "s3:GetObject",
                  "s3:ListMultipartUploadParts"
                ],
                "Resource": [
                  "arn:aws:s3:::data/public/*"
                ]
              }
            ]
          }
        EOF
        mc anonymous set-json data-public.json minio/${OUTLINE_MINIO_BUCKET_NAME}
        mc admin policy create minio OutlineAppFullAccess outline-policy.json
        mc admin policy attach minio OutlineAppFullAccess --user=${OUTLINE_MINIO_USER}
        tail -f /dev/null
    volumes:
      - minio-data:/data
    environment:
      MINIO_ROOT_USER: ${OUTLINE_MINIO_ADMIN}
      MINIO_ROOT_PASSWORD: ${OUTLINE_MINIO_ADMIN_PASSWORD}
      MINIO_BROWSER_REDIRECT_URL: ${OUTLINE_MINIO_CONSOLE_URL}
    networks:
      - outline-network
      - traefik-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.minio-api.rule=Host(`${OUTLINE_MINIO_HOSTNAME}`)"
      - "traefik.http.routers.minio-api.service=minio-api"
      - "traefik.http.routers.minio-api.entrypoints=websecure"
      - "traefik.http.services.minio-api.loadbalancer.server.port=9000"
      - "traefik.http.routers.minio-api.tls=true"
      - "traefik.http.routers.minio-api.tls.certresolver=letsencrypt"
      - "traefik.http.services.minio-api.loadbalancer.passhostheader=true"
      - "traefik.http.routers.minio-api.middlewares=compresstraefik"
      - "traefik.http.routers.minio-console.rule=Host(`${OUTLINE_MINIO_CONSOLE_HOSTNAME}`)"
      - "traefik.http.routers.minio-console.service=minio-console"
      - "traefik.http.routers.minio-console.entrypoints=websecure"
      - "traefik.http.services.minio-console.loadbalancer.server.port=9001"
      - "traefik.http.routers.minio-console.tls=true"
      - "traefik.http.routers.minio-console.tls.certresolver=letsencrypt"
      - "traefik.http.services.minio-console.loadbalancer.passhostheader=true"
      - "traefik.http.routers.minio-console.middlewares=compresstraefik"
      - "traefik.http.middlewares.compresstraefik.compress=true"
      - "traefik.docker.network=traefik-network"
    restart: unless-stopped

  outline:
    image: ${OUTLINE_IMAGE_TAG}
    environment:
      DATABASE_URL: postgres://${OUTLINE_DB_USER}:${OUTLINE_DB_PASSWORD}@postgres-outline:5432/${OUTLINE_DB_NAME}?sslmode=disable&connect_timeout=10
      PGSSLMODE: disable
      REDIS_URL: redis://redis:6379
      URL: ${OUTLINE_URL}
      PORT: 3000
      SECRET_KEY: ${OUTLINE_SECRET_KEY}
      UTILS_SECRET: ${OUTLINE_UTILS_SECRET}
      FORCE_HTTPS: 'false'
      ENABLE_UPDATES: 'true'
      AWS_REGION: eu-east-1
      AWS_ACCESS_KEY_ID: ${OUTLINE_MINIO_USER}
      AWS_SECRET_ACCESS_KEY: ${OUTLINE_MINIO_USER_PASSWORD}
      AWS_S3_UPLOAD_BUCKET_URL: ${OUTLINE_AWS_S3_UPLOAD_BUCKET_URL}
      AWS_S3_ACCELERATE_URL: ${OUTLINE_AWS_S3_UPLOAD_BUCKET_URL}
      AWS_S3_UPLOAD_BUCKET_NAME: ${OUTLINE_MINIO_BUCKET_NAME}
      AWS_S3_UPLOAD_MAX_SIZE: ${OUTLINE_AWS_S3_UPLOAD_MAX_SIZE}
      AWS_S3_FORCE_PATH_STYLE: 'false'
      AWS_S3_ACL: private
      OIDC_CLIENT_ID: outline
      OIDC_CLIENT_SECRET: ${OUTLINE_OIDC_CLIENT_SECRET}
      OIDC_AUTH_URI: ${OUTLINE_OIDC_AUTH_URI}
      OIDC_TOKEN_URI: ${OUTLINE_OIDC_TOKEN_URI}
      OIDC_USERINFO_URI: ${OUTLINE_OIDC_USERINFO_URI}
      OIDC_DISPLAY_NAME: ${OUTLINE_OIDC_DISPLAY_NAME}
      OIDC_USERNAME_CLAIM: ${OUTLINE_OIDC_USERNAME_CLAIM}
      OIDC_SCOPES: ${OUTLINE_OIDC_SCOPES}
    networks:
      - outline-network
      - keycloak-network
      - traefik-network
    healthcheck:
      test: timeout 10s bash -c ':> /dev/tcp/127.0.0.1/3000' || exit 1
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 90s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.outline.rule=Host(`${OUTLINE_HOSTNAME}`)"
      - "traefik.http.routers.outline.service=outline"
      - "traefik.http.routers.outline.entrypoints=websecure"
      - "traefik.http.services.outline.loadbalancer.server.port=3000"
      - "traefik.http.routers.outline.tls=true"
      - "traefik.http.routers.outline.tls.certresolver=letsencrypt"
      - "traefik.http.services.outline.loadbalancer.passhostheader=true"
      - "traefik.http.routers.outline.middlewares=compresstraefik"
      - "traefik.http.middlewares.compresstraefik.compress=true"
      - "traefik.docker.network=traefik-network"
    restart: unless-stopped
    depends_on:
      postgres-outline:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy

  backups-outline:
    image: ${OUTLINE_POSTGRES_IMAGE_TAG}
    command: >-
      sh -c 'sleep $OUTLINE_BACKUP_INIT_SLEEP &&
      while true; do
        pg_dump -h postgres-outline -p 5432 -d $OUTLINE_DB_NAME -U $OUTLINE_DB_USER | gzip > $OUTLINE_POSTGRES_BACKUPS_PATH/$OUTLINE_POSTGRES_BACKUP_NAME-$(date "+%Y-%m-%d_%H-%M").gz &&
        tar -zcpf $OUTLINE_DATA_BACKUPS_PATH/$OUTLINE_DATA_BACKUP_NAME-$(date "+%Y-%m-%d_%H-%M").tar.gz $OUTLINE_DATA_PATH &&
        find $OUTLINE_POSTGRES_BACKUPS_PATH -type f -mtime +$OUTLINE_POSTGRES_BACKUP_PRUNE_DAYS | xargs rm -f &&
        find $OUTLINE_DATA_BACKUPS_PATH -type f -mtime +$OUTLINE_DATA_BACKUP_PRUNE_DAYS | xargs rm -f;
        sleep $OUTLINE_BACKUP_INTERVAL; done'
    volumes:
      - outline-postgres-backup:/var/lib/postgresql/data
      - minio-data:${OUTLINE_DATA_PATH}
      - outline-data-backups:${OUTLINE_DATA_BACKUPS_PATH}
      - outline-database-backups:${OUTLINE_POSTGRES_BACKUPS_PATH}
    environment:
      OUTLINE_DB_NAME: ${OUTLINE_DB_NAME}
      OUTLINE_DB_USER: ${OUTLINE_DB_USER}
      PGPASSWORD: ${OUTLINE_DB_PASSWORD}
      OUTLINE_BACKUP_INIT_SLEEP: ${OUTLINE_BACKUP_INIT_SLEEP}
      OUTLINE_BACKUP_INTERVAL: ${OUTLINE_BACKUP_INTERVAL}
      OUTLINE_POSTGRES_BACKUP_PRUNE_DAYS: ${OUTLINE_POSTGRES_BACKUP_PRUNE_DAYS}
      OUTLINE_DATA_BACKUP_PRUNE_DAYS: ${OUTLINE_DATA_BACKUP_PRUNE_DAYS}
      OUTLINE_POSTGRES_BACKUPS_PATH: ${OUTLINE_POSTGRES_BACKUPS_PATH}
      OUTLINE_DATA_BACKUPS_PATH: ${OUTLINE_DATA_BACKUPS_PATH}
      OUTLINE_DATA_PATH: ${OUTLINE_DATA_PATH}
      OUTLINE_POSTGRES_BACKUP_NAME: ${OUTLINE_POSTGRES_BACKUP_NAME}
      OUTLINE_DATA_BACKUP_NAME: ${OUTLINE_DATA_BACKUP_NAME}
    networks:
      - outline-network
    restart: unless-stopped
    depends_on:
      postgres-outline:
        condition: service_healthy