architect.yml

version: v2

variables:
  allowed_return_urls:
    description: URLs that the service can safely redirect to after auth flows
    merge: true
    default:
      - ${{ ingresses.auth.url }}

dependencies:
  smtp: architectio/smtp4dev

databases:
  kratos:
    type: postgres:15

builds:
  kratos-ui:
    context: ./
    dockerfile: Dockerfile
    debug:
      dockerfile: Dockerfile-dev

deployments:
  kratos:
    image: oryd/kratos:v1.0
    entrypoint: [""]
    command:
      - sh
      - -c
      - |
        mkdir ./kratos
        echo "$IDENTITY_SCHEMA" > ./kratos/identity.schema.json
        echo "$CONFIG" > ./kratos/.kratos.yml
        kratos -c ./kratos/.kratos.yml migrate sql -e --yes
        kratos serve -c ./kratos/.kratos.yml --watch-courier --dev
    environment:
      CONFIG: |
        version: v0.13.0
        dsn: ${{ databases.kratos.url }}?max_conns=20&max_idle_conns=4
        serve:
          public:
            base_url: ${{ ingresses.kratos-public.url }}
            cors:
              enabled: false
          admin:
            base_url: ${{ services.kratos-admin.url }}
        selfservice:
          default_browser_return_url: ${{ ingresses.auth.url }}
          allowed_return_urls: ${{ variables.allowed_return_urls }}
          methods:
            password:
              enabled: true
            totp:
              config:
                issuer: Kratos
              enabled: true
            code:
              enabled: true
            link:
              enabled: true
            lookup_secret:
              enabled: true
          flows:
            error:
              ui_url: ${{ ingresses.auth.url }}/error
            settings:
              ui_url: ${{ ingresses.auth.url }}/settings
              privileged_session_max_age: 15m
              required_aal: highest_available
            logout:
              after:
                default_browser_return_url: ${{ ingresses.auth.url }}
            login:
              ui_url: ${{ ingresses.auth.url }}/login
              lifespan: 10m
            registration:
              ui_url: ${{ ingresses.auth.url }}/registration
              lifespan: 10m
              after:
                password:
                  hooks:
                    - hook: session
                    - hook: show_verification_ui
            verification:
              enabled: true
              ui_url: ${{ ingresses.auth.url }}/verification
              use: code
              after:
                default_browser_return_url: ${{ ingresses.auth.url }}
            recovery:
              enabled: true
              ui_url: ${{ ingresses.auth.url }}/recovery
              use: code
        courier:
          smtp:
            connection_uri: ${{ dependencies.smtp.services.smtp.url }}/?skip_ssl_verify=true
        log:
          level: info
          format: text
          leak_sensitive_values: true
        secrets:
          cookie:
            - PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
          cipher:
            - 32-LONG-SECRET-NOT-SECURE-AT-ALL
        ciphers:
          algorithm: xchacha20-poly1305
        hashers:
          algorithm: bcrypt
          bcrypt:
            cost: 8
        identity:
          default_schema_id: default
          schemas:
            - id: default
              url: file://./kratos/identity.schema.json
        cookies:
          domain: ${{ ingresses.kratos-public.dns_zone }}
          path: /
          same_site: Lax
      IDENTITY_SCHEMA: |
        {
          "$id": "https://schemas.ory.sh/presets/kratos/quickstart/email-password/identity.schema.json",
          "$schema": "http://json-schema.org/draft-07/schema#",
          "title": "Person",
          "type": "object",
          "properties": {
            "traits": {
              "type": "object",
              "properties": {
                "email": {
                  "type": "string",
                  "format": "email",
                  "title": "E-Mail",
                  "minLength": 3,
                  "ory.sh/kratos": {
                    "credentials": {
                      "password": {
                        "identifier": true
                      }
                    },
                    "verification": {
                      "via": "email"
                    },
                    "recovery": {
                      "via": "email"
                    }
                  }
                },
                "username": {
                  "type": "string",
                  "minLength": 1,
                  "title": "Username",
                  "ory.sh/kratos": {
                    "credentials": {
                      "password": {
                        "identifier": true
                      }
                    }
                  }
                },
                "name": {
                  "type": "object",
                  "properties": {
                    "first": {
                      "title": "First Name",
                      "type": "string"
                    },
                    "last": {
                      "title": "Last Name",
                      "type": "string"
                    }
                  }
                }
              },
              "required": [
                "email",
                "username"
              ],
              "additionalProperties": false
            }
          }
        }

  ui:
    image: ${{ builds.kratos-ui.image }}
    environment:
      PORT: "4455"
      KRATOS_PUBLIC_URL: ${{ services.kratos-public.url }}
      KRATOS_BROWSER_URL: ${{ ingresses.kratos-public.url }}
    debug:
      volumes:
        src:
          host_path: ./src
          mount_path: /usr/src/app/src
        views:
          host_path: ./views
          mount_path: /usr/src/app/views
        public:
          host_path: ./public
          mount_path: /usr/src/app/public

services:
  kratos-public:
    deployment: kratos
    port: 4433
  kratos-admin:
    deployment: kratos
    port: 4434
  frontend:
    deployment: ui
    port: 4455

ingresses:
  kratos-public:
    service: kratos-public
    headers:
      Access-Control-Allow-Origin: ${{ variables.allowed_return_urls }}
      Access-Control-Allow-Methods:
        '["GET", "OPTIONS", "POST", "PUT", "DELETE"]'
      Access-Control-Allow-Headers: "*"
      Access-Control-Allow-Credentials: "true"
  auth:
    service: frontend