docker-compose.yml

services:

  #
  # The API gateway that exposes backend components at domain based URLs
  #
  api-gateway:
    image: kong-api-gateway:1.0
    ports:
      - 443:3001
    volumes:
      - ./apigateway/kong.yml:/usr/local/kong/declarative/kong.yml
      - ./apigateway/certs/example.ssl.crt:/usr/local/share/certs/example.ssl.crt
      - ./apigateway/certs/example.ssl.key:/usr/local/share/certs/example.ssl.key
    environment:
      KONG_DATABASE: 'off'
      KONG_DECLARATIVE_CONFIG: '/usr/local/kong/declarative/kong.yml'
      KONG_PROXY_LISTEN: '0.0.0.0:3001 http2 ssl'
      KONG_SSL_CERT: '/usr/local/share/certs/example.ssl.crt'
      KONG_SSL_CERT_KEY: './usr/local/share/certs/example.ssl.key'
      KONG_LOG_LEVEL: 'info'
      KONG_PLUGINS: 'bundled,phantom-token'
      KONG_NGINX_HTTP_LUA_SHARED_DICT: 'phantom-token 10m'

  #
  # The MCP server implements a streamable HTTP transport for MCP clients.
  # The MCP server uses an access token audience different to that of APIs.
  # To call APIs the MCP server uses token exchange to update the access token audience.
  #
  mcp-server:
    image: mcp-server:1.0
    hostname: mcp-server
    environment:
      PORT: '3000'
      EXTERNAL_BASE_URL: 'https://mcp.demo.example'
      AUTHORIZATION_SERVER_BASE_URL: 'https://login.demo.example'
      STOCKS_API_BASE_URL: 'http://stocks-api:3000/'
      JWKS_URI: 'http://idsvr:8443/oauth/v2/oauth-anonymous/jwks'
      REQUIRED_JWT_ALGORITHM: 'PS256'
      REQUIRED_JWT_ISSUER: 'https://login.demo.example/oauth/v2/oauth-anonymous'
      REQUIRED_JWT_AUDIENCE: 'https://mcp.demo.example/'
      REQUIRED_SCOPE: 'stocks/read'
      TOKEN_EXCHANGE_CLIENT_ID: 'mcp-server'
      TOKEN_EXCHANGE_CLIENT_SECRET: 'Password1'
      TOKEN_ENDPOINT: 'http://idsvr:8443/oauth/v2/oauth-token'

  #
  # The stocks API that uses OAuth to secure access to financial data
  #
  stocks-api:
    image: stocks-api:1.0
    hostname: stocks-api
    environment:
      PORT: '3000'
      JWKS_URI: 'http://idsvr:8443/oauth/v2/oauth-anonymous/jwks'
      REQUIRED_JWT_ALGORITHM: 'PS256'
      REQUIRED_JWT_ISSUER: 'https://login.demo.example/oauth/v2/oauth-anonymous'
      REQUIRED_JWT_AUDIENCE: 'https://api.demo.example'
      REQUIRED_SCOPE: 'stocks/read'

  #
  # Clients would publish metadata at external internet endpoints
  # To simplify the example deployment, the client metadata endpoints are deployed to the same Docker backend
  #
  client-metadata:
    image: client-metadata-host:1.0
    hostname: clientmetadata

  #
  # The Curity Identity Server implements security standards and issues access tokens to MCP clients used by AI agents
  #
  authorization-server:
    image: curity.azurecr.io/curity/idsvr:latest
    hostname: idsvr
    extra_hosts:
      - "www.client.example:host-gateway"
    volumes:
      # Current configuration
      - ./idsvr/curity-config.xml:/opt/idsvr/etc/init/curity-config.xml

      # JavaScript custom security logic
      - ./idsvr/pre-processing-procedures/mcp-client-registration-policy.js:/opt/idsvr/etc/init/pre-processing-procedures/mcp-client-registration-policy.js
      - ./idsvr/token-procedures/set-access-token-audience.js:/opt/idsvr/etc/init/token-procedures/oauth-token-authorization-code/set-access-token-audience.js
      - ./idsvr/token-procedures/set-token-exchange-audience.js:/opt/idsvr/etc/init/token-procedures/oauth-token-oauth-token-exchange/set-token-exchange-audience.js
      - ./idsvr/claims-provider-procedures/script-claims-provider-proc.js:/opt/idsvr/etc/init/claims-provider-procedures/script-claims-provider-proc.js

      # Customizations to email user authentication
      - ./idsvr/form-customizations/enter-username.vm:/opt/idsvr/usr/share/templates/overrides/authenticator/email/enter-username/index.vm
      - ./idsvr/form-customizations/enter-username.properties:/opt/idsvr/usr/share/messages/overrides/en/authenticator/email/enter-username.properties

      # Customizations to the user consent screen
      - ./idsvr/form-customizations/consent.vm:/opt/idsvr/usr/share/templates/template-areas/mcp-client/views/oauth/consent.vm
      - ./idsvr/form-customizations/consent.vm:/opt/idsvr/usr/share/templates/overrides/views/oauth/consent.vm
      - ./idsvr/form-customizations/oauth-messages:/opt/idsvr/usr/share/messages/template-areas/mcp-client/en/views/oauth/messages
      - ./idsvr/form-customizations/oauth-messages:/opt/idsvr/usr/share/messages/overrides/en/views/oauth/messages
    environment:
      ADMIN: 'true'
      LICENSE_KEY: "${LICENSE_KEY}"
      LOGGING_LEVEL: 'INFO'
      EXTERNAL_ROOT_CA: "${EXTERNAL_ROOT_CA}"

  #
  # The SQL database used by the Curity Identity Server for this deployment
  #
  authorization-server-database:
    image: postgres:latest
    hostname: dbserver
    volumes:
      - ./idsvr/data:/var/lib/postgresql
    environment:
      POSTGRES_DB: 'idsvr'
      POSTGRES_USER: 'idsvr_user'
      POSTGRES_PASSWORD: 'Password1'

  #
  # A job container to initialize the database
  #
  authorization-server-database-init:
    image: curity.azurecr.io/curity/idsvr:latest
    hostname: dbserverinit
    volumes:
      - ./idsvr/dbinit/init.sh:/tmp/init.sh
      - ./idsvr/dbinit/test-user-accounts.xml:/opt/idsvr/etc/liquibase/test-user-accounts.xml
    command: ["/tmp/init.sh"]
    environment:
      JDBC_URL: jdbc:postgresql://dbserver:5432/idsvr
      JDBC_USERNAME: 'idsvr_user'
      JDBC_PASSWORD: 'Password1'
    depends_on:
      authorization-server-database:
        condition: service_started

  #
  # An email server with a test inbox to allow email authentication for test users
  #
  mail-server:
    image: maildev/maildev:latest
    hostname: smtpserver
    environment:
      MAILDEV_INCOMING_USER: 'noreply@maildev'
      MAILDEV_INCOMING_PASSWORD: 'Password1'