docker-compose.yml

version: '3.9'
networks:
  internal:
    driver: bridge
    ipam:
      config:
        - subnet: 172.16.8.0/21
volumes:
  mongo_data: null
  cicdtoolbox_db_data: null
  cicdtoolbox_db_conf: null
  gitea:
    driver: local
  jenkins_certs: null
  jenkins_data: null
  jenkins_conf: null
  ldap_data: null
  nexus-work: null
  nexus-data: null
  consul-config: null
  consul-data: null
  vault-config: null
  vault-policies: null
  vault-data: null
  vault-logs: null
  backstage: null
  nodered: null
  portainer_data: null
  promtail: null
  netbox: null
  redis: null
  opennebula_db: null
  opennebula_datastores: null
  opennebula_srv: null
  opennebula_oneadmin_auth: null
  opennebula_oneadmin_ssh: null
  opennebula_etcd: null
  opennebula_etcd_secrets: null
  opennebula_logs: null
  minio_data: null

secrets:
  ca_crt:
    file: ./vault/certs/ca.crt
  argos_key:
    file: ./vault/certs/argos.services.provider.test.pem
  argos_crt:
    file: ./vault/certs/argos.services.provider.test.crt
  argos-service_key:
    file: ./vault/certs/argos-service.tooling.provider.test.pem
  argos-service_crt:
    file: ./vault/certs/argos-service.tooling.provider.test.crt
  mongodb_key:
    file: ./vault/certs/mongodb.internal.provider.test.pem
  mongodb_crt:
    file: ./vault/certs/mongodb.internal.provider.test.crt
  backstage_key:
    file: ./vault/certs/backstage.tooling.provider.test.pem
  backstage_crt:
    file: ./vault/certs/backstage.tooling.provider.test.crt
  cicdtoolbox-db_key:
    file: ./vault/certs/cicdtoolbox-db.internal.provider.test.pem
  cicdtoolbox-db_crt:
    file: ./vault/certs/cicdtoolbox-db.internal.provider.test.crt
  gitea_key:
    file: ./vault/certs/gitea.tooling.provider.test.pem
  gitea_crt:
    file: ./vault/certs/gitea.tooling.provider.test.crt
  grafana_key:
    file: ./vault/certs/grafana.monitoring.provider.test.pem
  grafana_crt:
    file: ./vault/certs/grafana.monitoring..provider.test.crt
  loki_key:
    file: ./vault/certs/loki.monitoring.provider.test.pem
  loki_crt:
    file: ./vault/certs/loki.monitoring.provider.test.crt
  promtail_key:
    file: ./vault/certs/promtail.monitoring.provider.test.pem
  promtail_crt:
    file: ./vault/certs/promtail.monitoring.provider.test.crt
  jenkins_key:
    file: ./vault/certs/jenkins.tooling.provider.test.pem
  jenkins_crt:
    file: ./vault/certs/jenkins.tooling.provider.test.crt
  dev_jenkins_secret:
    file: ./jenkins_buildnode/Dev_secret.txt
  test_jenkins_secret:
    file: ./jenkins_buildnode/Test_secret.txt
  acc_jenkins_secret:
    file: ./jenkins_buildnode/Acc_secret.txt
  prod_jenkins_secret:
    file: ./jenkins_buildnode/Prod_secret.txt
  build-dev_key:
    file: ./vault/certs/build-dev.delivery.provider.test.pem
  build-dev_crt:
    file: ./vault/certs/build-dev.delivery.provider.test.crt
  build-test_key:
    file: ./vault/certs/build-test.delivery.provider.test.pem
  build-test_crt:
    file: ./vault/certs/build-test.delivery.provider.test.crt
  build-acc_key:
    file: ./vault/certs/build-acc.delivery.provider.test.pem
  build-acc_crt:
    file: ./vault/certs/build-acc.delivery.provider.test.crt
  build-prod_key:
    file: ./vault/certs/build-prod.delivery.provider.test.pem
  build-prod_crt:
    file: ./vault/certs/build-prod.delivery.provider.test.crt
  keycloak_key:
    file: ./vault/certs/keycloak.services.provider.test.pem
  keycloak_crt:
    file: ./vault/certs/keycloak.services.provider.test.crt
  ldap_key:
    file: ./vault/certs/ldap.iam.provider.test.pem
  ldap_crt:
    file: ./vault/certs/ldap.iam.provider.test.crt
  nexus_key:
    file: ./vault/certs/nexus.tooling.provider.test.pem
  nexus_crt:
    file: ./vault/certs/nexus.tooling.provider.test.crt
  nodered_key:
    file: ./vault/certs/nodered.tooling.provider.test.pem
  nodered_crt:
    file: ./vault/certs/nodered.tooling.provider.test.crt
  portainer_key:
    file: ./vault/certs/portainer.monitoring.provider.test.pem
  portainer_crt:
    file: ./vault/certs/portainer.monitoring.provider.test.crt
  netbox_key:
    file: ./vault/certs/netbox.tooling.provider.test.pem
  netbox_crt:
    file: ./vault/certs/netbox.tooling.provider.test.crt
  redis_key:
    file: ./vault/certs/redis.internal.provider.test.pem
  redis_crt:
    file: ./vault/certs/redis.internal.provider.test.crt

services:
  argos-service.tooling.provider.test:
    container_name: argos-service.tooling.provider.test
    build: ./argos-service
    environment:
      spring.config.location: /application.yml
      jwt.token.secret: '${argos_service_jwt}'
      spring.profiles.active: integration-test
      JAVA_OPTS: '-Xmx1g'
    networks:
      internal:
        ipv4_address: 172.16.11.4
    expose:
      - '8080'
    depends_on:
      - mongodb.internal.provider.test
      - keycloak.services.provider.test
    volumes:
      - './argos/application.yml:/application.yml'

  argos.services.provider.test:
    container_name: argos.services.provider.test
    image: 'argosnotary/argos-frontend:1.0.2'
    environment:
      - 'BACKEND_URL=http://argos-service.tooling.provider.test:8080'
    networks:
      internal:
        ipv4_address: 172.16.10.4
    expose:
      - '8082'
    depends_on:
      - argos-service.tooling.provider.test

  mongodb.internal.provider.test:
    container_name: mongodb.internal.provider.test
    image: 'argosnotary/mongo:4.2.8'
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    networks:
      internal:
        ipv4_address: 172.16.9.3
    expose:
      - '27017'

  minio.internal.provider.test:
    container_name: minio.internal.provider.test
    image: quay.io/minio/minio
    command: server /data --console-address ":9001"
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    environment:
      - MINIO_ROOT_USER=${minio_user}
      - MINIO_ROOT_PASSWORD=${minio_password}
      - MINIO_IDENTITY_OPENID_CONFIG_URL="https://keycloak.services.provider.test:8443/realms/cicdtoolbox/.well-known/openid-configuration"
      - MINIO_IDENTITY_OPENID_CLIENT_ID="Minio"
      - MINIO_IDENTITY_OPENID_CLIENT_SECRET="<string>"
      - MINIO_IDENTITY_OPENID_SCOPES="Minio"
    networks:
      internal:
        ipv4_address: 172.16.9.6
    expose:
      - '9000'
      - '9001'
    volumes:
      - 'minio_data:/data'


  backstage.tooling.provider.test:
    container_name: backstage.tooling.provider.test
    build:
      context: ./backstage
      dockerfile: Dockerfile
    networks:
      internal:
        ipv4_address: 172.16.11.14
    expose:
      - '3000'
      - '7000'

  cicdtoolbox-db.internal.provider.test:
    container_name: cicdtoolbox-db.internal.provider.test
    build: cicdtoolbox-db
    command: |
      -c ssl=on  -c ssl_cert_file=/var/lib/postgresql/server.crt -c ssl_key_file=/var/lib/postgresql/server.key
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    environment:
      - 'POSTGRES_MULTIPLE_DATABASES=gitea,keycloak,sonar,terraform,grafana,netbox,backstage'
      - 'POSTGRES_USER=${postgres_user}'
      - 'POSTGRES_PASSWORD=${postgres_password}'
    secrets:
      - source: cicdtoolbox-db_key
        target: /var/lib/postgresql/server1.key
      - source: cicdtoolbox-db_crt
        target: /var/lib/postgresql/server.crt
      - source: ca_crt
        target: /var/lib/postgresql/root.crt
    networks:
      internal:
        ipv4_address: 172.16.9.2
    expose:
      - '5432'
    volumes:
      - 'cicdtoolbox_db_data:/var/lib/postgresql/data'
      - 'cicdtoolbox_db_conf:/etc/postgresql'
      - './cicdtoolbox-db/docker-entrypoint-initdb-resources:/docker-entrypoint-initdb-resources:ro'
    healthcheck:
      test:
        - CMD-SHELL
        - 'pg_isready -U ${postgres_user}'
      interval: 5s
      timeout: 5s
      retries: 5

  gitea.tooling.provider.test:
    container_name: gitea.tooling.provider.test
    build: gitea
    depends_on:
      - cicdtoolbox-db.internal.provider.test
      - keycloak.services.provider.test
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__server__DOMAIN=gitea.tooling.provider.test
      - 'GITEA__database__USER=${gitea_db_user}'
      - 'GITEA__database__PASSWD=${gitea_db_password}'
    secrets:
      - source: ca_crt
        target: /usr/local/share/ca-certificates/CICD-toolbox-ca.crt
    networks:
      internal:
        ipv4_address: 172.16.11.3
    volumes:
      - 'gitea:/data'
      - '/etc/timezone:/etc/timezone:ro'
      - '/etc/localtime:/etc/localtime:ro'
    expose:
      - '3000'
    healthcheck:
      test: 'curl --insecure -fSs https://172.16.11.3:3000/api/healthz'
      start_period: 60s
      interval: 5s
      timeout: 5s
      retries: 5

  loki.monitoring.provider.test:
    container_name: loki.monitoring.provider.test
    build: loki
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    expose:
      - '3100'
    command: '-config.file=/etc/loki/local-config.yaml'
    networks:
      internal:
        ipv4_address: 172.16.13.4

  promtail.monitoring.provider.test:
    container_name: promtail.monitoring.provider.test
    build: promtail
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    volumes:
      - 'promtail:/var/log'
    command: '-config.file=/etc/promtail/config.yml'
    networks:
      internal:
        ipv4_address: 172.16.13.5

  grafana.monitoring.provider.test:
    container_name: grafana.monitoring.provider.test
    build: grafana
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    environment:
      - 'GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=${Grafana_CLIENT_SECRET}'
    expose:
      - '3000'
    networks:
      internal:
        ipv4_address: 172.16.13.6

  jenkins.tooling.provider.test:
    container_name: jenkins.tooling.provider.test
    build: ./jenkins
    restart: unless-stopped
    privileged: true
    user: root
    networks:
      internal:
        ipv4_address: 172.16.11.8
    environment:
      - 'JENKINS_ADMIN_ID=${jenkins_admin}'
      - 'JENKINS_ADMIN_PASSWORD=${jenkins_admin_password}'
      - 'NETCICD_PASSWORD=${default_user_password}'
      - 'CML_USER=${cml_user}'
      - 'CML_PASSWORD=${cml_password}'
      - 'CML_URL=https://192.168.32.161'
      - GITEA_IP=172.16.11.3
      - JENKINS_IP=172.16.11.8
      - NEXUS_IP=172.16.11.9
      - 'JENKINS_NEXUS_PASSWORD=${jenkins_nexus_password}'
      - 'JENKINS_ARGOS_PASSWORD=${jenkins_argos_password}'
    secrets:
      - source: jenkins_key
        target: /var/jenkins_home/jenkins.tooling.provider.test.pem
      - source: jenkins_crt
        target: /var/jenkins_home/jenkins.tooling.provider.test.crt
    volumes:
      - 'jenkins_certs:/certs/client'
      - 'jenkins_data:/var/jenkins_home'
      - 'jenkins_conf:/var/jenkins_conf'
    expose:
      - '8084'
      - '50000'
    depends_on:
      - keycloak.services.provider.test

  build-dev.delivery.provider.test:
    container_name: build-dev.delivery.provider.test
    build:
      context: ./jenkins_buildnode
      dockerfile: Dockerfile
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    cap_add:
      - NET_ADMIN
      - NET_RAW
    environment:
      BUILD_ENVIRONMENT: Dev
      ANSIBLE_TF_DIR: AppCICD
      ARM_SKIP_PROVIDER_REGISTRATION: 'true'
      RUNNER_TOKEN: '${RUNNER_TOKEN}'
    secrets:
      - source: dev_jenkins_secret
        target: /home/jenkins/secret-file.txt
    expose:
      - '50000'
    networks:
      internal:
        ipv4_address: 172.16.12.2

  build-test.delivery.provider.test:
    container_name: build-test.delivery.provider.test
    build:
      context: ./jenkins_buildnode
      dockerfile: Dockerfile
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    cap_add:
      - NET_ADMIN
      - NET_RAW
    environment:
      BUILD_ENVIRONMENT: Test
      ANSIBLE_TF_DIR: AppCICD
      ARM_SKIP_PROVIDER_REGISTRATION: 'true'
      RUNNER_TOKEN: '${RUNNER_TOKEN}'
    secrets:
      - source: test_jenkins_secret
        target: /home/jenkins/secret-file.txt
    expose:
      - '50000'
    networks:
      internal:
        ipv4_address: 172.16.12.3

  build-acc.delivery.provider.test:
    container_name: build-acc.delivery.provider.test
    build:
      context: ./jenkins_buildnode
      dockerfile: Dockerfile
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    cap_add:
      - NET_ADMIN
      - NET_RAW
    environment:
      BUILD_ENVIRONMENT: Acc
      ANSIBLE_TF_DIR: AppCICD
      ARM_SKIP_PROVIDER_REGISTRATION: 'true'
      RUNNER_TOKEN: '${RUNNER_TOKEN}'
    secrets:
      - source: acc_jenkins_secret
        target: /home/jenkins/secret-file.txt
    expose:
      - '50000'
    networks:
      internal:
        ipv4_address: 172.16.12.4

  build-prod.delivery.provider.test:
    container_name: build-prod.delivery.provider.test
    build:
      context: ./jenkins_buildnode
      dockerfile: Dockerfile
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    cap_add:
      - NET_ADMIN
      - NET_RAW
    environment:
      BUILD_ENVIRONMENT: Prod
      ANSIBLE_TF_DIR: AppCICD
      ARM_SKIP_PROVIDER_REGISTRATION: 'true'
      RUNNER_TOKEN: '${RUNNER_TOKEN}'
    secrets:
      - source: prod_jenkins_secret
        target: /home/jenkins/secret-file.txt
    expose:
      - '50000'
    networks:
      internal:
        ipv4_address: 172.16.12.5

  keycloak.services.provider.test:
    container_name: keycloak.services.provider.test
    build: keycloak
    command: ["start"]
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    environment:
      KEYCLOAK_ADMIN: '${keycloak_admin}'
      KEYCLOAK_ADMIN_PASSWORD: '${keycloak_admin_password}'
      KC_HEALTH_ENABLED: 'true'
      KC_METRICS_ENABLED: 'true' 
      KC_DB: postgres
      KC_DB_URL_DATABASE: keycloak 
      KC_DB_URL_HOST: cicdtoolbox-db.internal.provider.test 
      KC_DB_URL_PORT: 5432 
      KC_DB_SCHEMA: public
      KC_DB_USERNAME: '${keycloak_db_user}'
      KC_DB_PASSWORD: '${keycloak_db_password}' 
      KC_HOSTNAME: keycloak.services.provider.test 
      KC_HTTPS_CERTIFICATE_FILE: '/etc/x509/https/tls.crt'
      KC_HTTPS_CERTIFICATE_KEY_FILE: '/etc/x509/https/tls.key'
      QUARKUS_TRANSACTION_MANAGER_ENABLE_RECOVERY: 'true' 
      JDBC_PARAMS: ssl=true&sslmode=verify-ca&sslrootcert=/etc/pki/ca-trust/source/anchors/ca.crt
    secrets:
      - source: keycloak_key
        target: /etc/x509/https/tls.key
      - source: keycloak_crt
        target: /etc/x509/https/tls.crt
    networks:
      internal:
        ipv4_address: 172.16.10.11
    expose:
      - '8080'
      - '8443'
    healthcheck:
      test: 'curl --insecure -fSs https://172.16.10.11:8443'
      start_period: 60s
      interval: 5s
      timeout: 5s
      retries: 5
    depends_on:
      - cicdtoolbox-db.internal.provider.test

  ldap.iam.provider.test:
    container_name: ldap.iam.provider.test
    build: lldap
    restart: unless-stopped
    hostname: ldap
    expose:
      - '3890'
      - '17170'
    secrets:
      - source: ldap_key
        target: /data/key.pem
      - source: ldap_crt
        target: /data/cert.crt
    volumes:
      - './lldap/data:/data'
    networks:
      internal:
        ipv4_address: 172.16.8.11
    healthcheck:
      test: 'curl --insecure -fSs http://172.16.8.11:17170/login'
      start_period: 60s
      interval: 5s
      timeout: 5s
      retries: 5

  nexus.tooling.provider.test:
    container_name: nexus.tooling.provider.test
    build: nexus
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    user: nexus
    environment:
      BASE_URL: 'https://nexus.tooling.provider.test:8443'
      NEXUS_SECURITY_RANDOMPASSWORD: 'true'
      NEXUS_CASC_CONFIG: /opt/nexus.yaml
    secrets:
      - source: ca_crt
        target: /nexus-data/etc/ssl/ca.crt
    volumes:
      - 'nexus-work:/sonatype-work'
      - 'nexus-data:/nexus-data'
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    networks:
      internal:
        ipv4_address: 172.16.11.9
    expose:
      - '8443'
    depends_on:
      - keycloak.services.provider.test

  nodered.tooling.provider.test:
    container_name: nodered.tooling.provider.test
    image: 'nodered/node-red:latest'
    restart: unless-stopped
    environment:
      - TZ=Europe/Amsterdam
    secrets:
      - source: ca_crt
        target: /etc/ssl/ca.crt
      - source: jenkins_key
        target: /etc/ssl/jenkins.tooling.provider.test.pem
      - source: jenkins_crt
        target: /etc/ssl/jenkins.tooling.provider.test.crt
    volumes:
      - 'nodered:/data'
    networks:
      internal:
        ipv4_address: 172.16.11.13
    expose:
      - '1880'

  portainer.monitoring.provider.test:
    container_name: portainer.monitoring.provider.test
    image: portainer/portainer-ce
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    secrets:
      - source: ca_crt
        target: /etc/ssl/certs/cacert.pem
      - source: portainer_key
        target: /etc/ssl/portainer.monitoring.provider.test.pem
      - source: portainer_crt
        target: /etc/ssl/portainer.monitoring.provider.test.crt
    volumes:
      - 'portainer_data:/data'
      - '/var/run/docker.sock:/var/run/docker.sock'
    networks:
      internal:
        ipv4_address: 172.16.13.3
    expose:
      - '9000'

  restportal.services.provider.test:
    container_name: restportal.services.provider.test
    image: 'mockoon/cli:latest'
    restart: unless-stopped
    command: '--data data'
    networks:
      internal:
        ipv4_address: 172.16.10.2
    volumes:
      - type: bind
        source: ./restportal/bis2.json
        target: /data
    expose:
      - '3001'

  consul.internal.provider.test:
    container_name: consul.internal.provider.test
    build:
      context: ./vault
      dockerfile: docker/Dockerfile-consul
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    networks:
      internal:
        ipv4_address: 172.16.9.4
    volumes:
      - 'consul-data:/consul/data'

  vault.internal.provider.test:
    container_name: vault.internal.provider.test
    build:
      context: ./vault
      dockerfile: docker/Dockerfile-vault
    depends_on:
      - consul.internal.provider.test
    restart: unless-stopped
    init: true
    stop_signal: SIGINT
    stop_grace_period: 15s
    networks:
      internal:
        ipv4_address: 172.16.9.5
    expose:
      - '8200'
    volumes:
      - 'vault-config:/vault/config'
      - 'vault-policies:/vault/policies'
      - 'vault-data:/vault/data'
      - 'vault-logs:/vault/logs'
    environment:
      - 'VAULT_ADDR=http://vault.internal.provider.test:8200'
      - 'VAULT_API_ADDR=http://vault.internal.provider.test:8200'
    cap_add:
      - IPC_LOCK

  redis.tooling.provider.test:
    container_name: redis.tooling.provider.test
    image: 'redis:6.2-alpine'
    expose:
      - '6379'
    command: redis-server --save 60 1 --requirepass netbox --loglevel warning
    restart: unless-stopped
    volumes:
      - 'redis:/data'
    networks:
      internal:
        ipv4_address: 172.16.11.11

  netbox.tooling.provider.test:
    container_name: netbox.tooling.provider.test
    image: 'lscr.io/linuxserver/netbox:latest'
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Amsterdam
      - 'SUPERUSER_EMAIL=${netbox_admin}'
      - 'SUPERUSER_PASSWORD=${netbox_admin_password}'
      - ALLOWED_HOST=netbox.tooling.provider.test
      - DB_NAME=netbox
      - DB_USER=netbox
#      - 'DB_USER=${netbox_db_user}'
      - 'DB_PASSWORD=${netbox_db_password}'
      - DB_HOST=cicdtoolbox-db.internal.provider.test
      - DB_PORT=5432
      - REDIS_HOST=redis.tooling.provider.test
      - REDIS_PORT=6379
      - 'REDIS_PASSWORD=${netbox_db_password}'
    secrets:
      - source: ca_crt
        target: /opt/netbox/venv/lib/python3.9/site-packages/certifi/cacert.pem
      - source: cicdtoolbox-db_crt
        target: /root/.postgresql/postgresql.crt
    volumes:
      - 'netbox:/config'
    expose:
      - '8000'
    restart: unless-stopped
    networks:
      internal:
        ipv4_address: 172.16.11.12

  seleniumffhost.internal.provider.test:
    container_name: seleniumffhost.internal.provider.test
    image: 'selenium/standalone-firefox:latest'
    restart: unless-stopped
    expose:
      - 4444
      - 7900
    shm_size: '2gb'
    networks:
      internal:
        ipv4_address: 172.16.10.100

  seleniumgchost.internal.provider.test:
    container_name: seleniumgchost.internal.provider.test
    image: 'selenium/standalone-chrome:latest'
    restart: unless-stopped
    expose:
      - 4444
      - 7900
    shm_size: '2gb'
    networks:
      internal:
        ipv4_address: 172.16.10.101
  
  opennebula.tooling.provider.test:
    container_name: opennebula.tooling.provider.test
    image: 'opennebula/opennebula:latest'
    environment:
      - OPENNEBULA_HOST=one.tooling.provider.test
      - OPENNEBULA_SSH_HOST=one.tooling.provider.test
      - 'ONEADMIN_PASSWORD=${opennebula_oneadmin_password}'
      - DIND_ENABLED=yes
      - SUNSTONE_HTTPS_ENABLED=no
    networks:
      internal:
        ipv4_address: 172.16.10.30
    volumes:
      - 'opennebula_db:/var/lib/mysql'
      - 'opennebula_datastores:/var/lib/one/datastores'
      - 'opennebula_srv:/srv/one'
      - 'opennebula_oneadmin_auth:/var/lib/one/.one'
      - 'opennebula_oneadmin_ssh:/var/lib/one/.ssh'
      - 'opennebula_etcd:/srv/one/etcd'
      - 'opennebula_etcd_secrets:/srv/one/etcd-secrets'
      - 'opennebula_logs:/var/log'
    expose:
      - '22'
      - '80'
      - '2474'
      - '2633'
      - '4124'
      - '5030'
      - '29876'
    restart: unless-stopped
    privileged: true
    cap_add:
      - NET_ADMIN
      - NET_RAW
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    healthcheck:  
      test: ["CMD", "curl", "-f", "http://localhost:2633"]
      interval: 30s
      timeout: 10s
      retries: 5