ACME

services:
  kong:
    container_name: kong
    image: "${KONG_DOCKER_TAG:-kong:latest}"
    user: "${KONG_USER:-kong}"
    environment:
      <<: *kong-env
      KONG_ADMIN_ACCESS_LOG: /dev/stdout
      KONG_ADMIN_ERROR_LOG: /dev/stderr
      KONG_PROXY_LISTEN: "0.0.0.0:8000, 0.0.0.0:8443 http2 ssl"
      KONG_ADMIN_LISTEN: "0.0.0.0:8001, 0.0.0.0:8444 ssl"
      KONG_ADMIN_GUI_LISTEN: "0.0.0.0:8002, 0.0.0.0:8445 ssl"
      KONG_PROXY_ACCESS_LOG: /dev/stdout
      KONG_PROXY_ERROR_LOG: /dev/stderr
      KONG_PREFIX: ${KONG_PREFIX:-/var/run/kong}
      KONG_DECLARATIVE_CONFIG: "/opt/kong/kong.yaml"
      KONG_LUA_SSL_TRUSTED_CERTIFICATE: system
      KONG_ADMIN_GUI_URL: "https://backend-tgo.dev-env-th.com/kong-manager-ui"
      KONG_ADMIN_GUI_API_URL: "https://backend-tgo.dev-env-th.com/kong-manager-api"
      KONG_ADMIN_GUI_PATH: "/kong-manager-ui"
    secrets:
      - kong_postgres_password
    networks:
      - kong-net
    ports:
      # The following two environment variables default to an insecure value (0.0.0.0)
      # according to the CIS Security test.
      # "${KONG_INBOUND_PROXY_LISTEN:-0.0.0.0}:80:8000/tcp"
      # "${KONG_INBOUND_SSL_PROXY_LISTEN:-0.0.0.0}:443:8443/tcp"
      # Making them mandatory but undefined, like so would be backwards-breaking:
      # - "${KONG_INBOUND_PROXY_LISTEN?Missing inbound proxy host}:8000:8000/tcp"
      # - "${KONG_INBOUND_SSL_PROXY_LISTEN?Missing inbound proxy ssl host}:8443:8443/tcp"
      # Alternative is deactivating check 5.13 in the security bench, if we consider Kong's own config to be enough security here

      - "0.0.0.0:80:8000/tcp"
      - "0.0.0.0:443:8443/tcp"
      - "0.0.0.0:8001:8001/tcp"
      - "0.0.0.0:8444:8444/tcp"
      - "0.0.0.0:8002:8002/tcp"
    healthcheck:
      test: ["CMD", "kong", "health"]
      interval: 10s
      timeout: 10s
      retries: 10
    restart: on-failure:5
    read_only: true
    volumes:
      - kong_prefix_vol:${KONG_PREFIX:-/var/run/kong}
      - kong_tmp_vol:/tmp
      - ./config:/opt/kong
    security_opt:
      - no-new-privileges