docker-compose-tls.yml

services:
  elasticsearch:
    container_name: temporal-elasticsearch
    environment:
      - cluster.routing.allocation.disk.threshold_enabled=true
      - cluster.routing.allocation.disk.watermark.low=512mb
      - cluster.routing.allocation.disk.watermark.high=256mb
      - cluster.routing.allocation.disk.watermark.flood_stage=128mb
      - discovery.type=single-node
      - ES_JAVA_OPTS=-Xms256m -Xmx256m
      - ELASTIC_PASSWORD=elastic
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=certs/elasticsearch-key.pem
      - xpack.security.http.ssl.certificate=certs/elasticsearch.pem
      - xpack.security.http.ssl.certificate_authorities=certs/ca.pem
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.key=certs/elasticsearch-key.pem
      - xpack.security.transport.ssl.certificate=certs/elasticsearch.pem
      - xpack.security.transport.ssl.certificate_authorities=certs/ca.pem
    image: elasticsearch:${ELASTICSEARCH_VERSION}
    networks:
      - temporal-network
    expose:
      - 9200
    volumes:
      - temporal_tls_pki:/usr/share/elasticsearch/config/certs
      - /var/lib/elasticsearch/data
    restart: on-failure
    healthcheck:
      test: ["CMD-SHELL", "curl -f -k -u elastic:elastic https://localhost:9200/_cluster/health?wait_for_status=yellow&timeout=1s || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 60
      start_period: 30s

  postgresql:
    container_name: temporal-postgresql
    command:
      - "-c"
      - "ssl=on"
      - "-c"
      - "ssl_cert_file=/pki/postgresql.pem"
      - "-c"
      - "ssl_key_file=/pki/postgresql-key.pem"
      - "-c"
      - "ssl_ca_file=/pki/ca.pem"
    environment:
      POSTGRES_PASSWORD: temporal
      POSTGRES_USER: temporal
    image: postgres:${POSTGRESQL_VERSION}
    networks:
      - temporal-network
    expose:
      - 5432
    volumes:
      - temporal_tls_pki:/pki
      - /var/lib/postgresql/data
    restart: on-failure
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U temporal"]
      interval: 5s
      timeout: 5s
      retries: 60
      start_period: 30s

  temporal-admin-tools-setup:
    container_name: temporal-admin-tools-setup
    restart: on-failure:6
    depends_on:
      postgresql:
        condition: service_healthy
      elasticsearch:
        condition: service_healthy
    environment:
      - DB=postgres12
      - DB_PORT=5432
      - POSTGRES_USER=temporal
      - POSTGRES_PWD=temporal
      - POSTGRES_SEEDS=postgresql
      - SQL_PASSWORD=temporal
      - SQL_TLS=true
      - ES_HOST=elasticsearch
      - ES_PORT=9200
      - ES_SCHEME=https
      - ES_USER=elastic
      - ES_PWD=elastic
      - ES_VERSION=v7
      - ES_VISIBILITY_INDEX=temporal_visibility_v1_dev
    build:
      context: .
      dockerfile: tls/Dockerfile.admin-tools-tls
      args:
        - BASEIMAGE=admin-tools:${TEMPORAL_ADMINTOOLS_VERSION}
    image: temporalio/admin-tools-tls:${TEMPORAL_ADMINTOOLS_VERSION}
    networks:
      - temporal-network
    volumes:
      - ./scripts:/scripts
    entrypoint: ["/bin/sh"]
    command: /scripts/setup-postgres-es-tls.sh

  temporal:
    container_name: temporal
    build:
      context: .
      dockerfile: tls/Dockerfile.auto-setup-tls
      args:
        - BASEIMAGE=server:${TEMPORAL_VERSION}
    image: server-tls:${TEMPORAL_VERSION}
    depends_on:
      temporal-admin-tools-setup:
        condition: service_completed_successfully
    environment:
      - DB=postgres12
      - DB_PORT=5432
      - POSTGRES_USER=temporal
      - POSTGRES_PWD=temporal
      - POSTGRES_SEEDS=postgresql
      - SQL_TLS=true
      - BIND_ON_IP=0.0.0.0
      - DYNAMIC_CONFIG_FILE_PATH=config/dynamicconfig/development-sql.yaml
      - ENABLE_ES=true
      - ES_SEEDS=elasticsearch
      - ES_VERSION=v7
      - ES_SCHEME=https
      - ES_USER=elastic
      - ES_PWD=elastic
      - TEMPORAL_ADDRESS=temporal:7233
      - TEMPORAL_CLI_ADDRESS=temporal:7233
    networks:
      - temporal-network
    ports:
      - 7233:7233
    volumes:
      - ./dynamicconfig:/etc/temporal/config/dynamicconfig
    restart: on-failure
    healthcheck:
      test: ["CMD", "nc", "-z", "localhost", "7233"]
      interval: 5s
      timeout: 3s
      start_period: 30s
      retries: 60

  temporal-create-namespace:
    image: temporalio/admin-tools-tls:${TEMPORAL_ADMINTOOLS_VERSION}
    container_name: temporal-create-namespace
    restart: on-failure:5
    depends_on:
      temporal:
        condition: service_healthy
    environment:
      - TEMPORAL_ADDRESS=temporal:7233
      - DEFAULT_NAMESPACE=default
    networks:
      - temporal-network
    volumes:
      - ./scripts:/scripts
    entrypoint: ["/bin/sh"]
    command: /scripts/create-namespace.sh

  temporal-admin-tools:
    container_name: temporal-admin-tools
    depends_on:
      temporal:
        condition: service_healthy
    environment:
      - TEMPORAL_ADDRESS=temporal:7233
      - TEMPORAL_CLI_ADDRESS=temporal:7233
    build:
      context: .
      dockerfile: tls/Dockerfile.admin-tools-tls
      args:
        - BASEIMAGE=admin-tools:${TEMPORAL_ADMINTOOLS_VERSION}
    image: temporalio/admin-tools-tls:${TEMPORAL_ADMINTOOLS_VERSION}
    networks:
      - temporal-network
    stdin_open: true
    tty: true

  temporal-ui:
    container_name: temporal-ui
    depends_on:
      temporal:
        condition: service_healthy
    environment:
      - TEMPORAL_ADDRESS=temporal:7233
      - TEMPORAL_CORS_ORIGINS=http://localhost:3000
    image: temporalio/ui:${TEMPORAL_UI_VERSION}
    networks:
      - temporal-network
    ports:
      - 8080:8080
    restart: on-failure

networks:
  temporal-network:
    driver: bridge
    name: temporal-network
volumes:
  temporal_tls_pki:
   external: true