services:

proxy:

image: traefik:v3.5

container_name: proxy

ports:

- "80:80"

- "443:443"

- "5433:5433"

environment:

- TZ=${TZ}

- ROOT_DOMAIN=${ROOT_DOMAIN}

volumes:

- "/var/run/docker.sock:/var/run/docker.sock:ro"

- ./services/proxy/rules:/rules:ro

- ./services/proxy/certs:/certs:ro

- ./z_tmp_state/proxy/logs:/logs

networks:

- duckpond_proxy_net

restart: unless-stopped

command:

# - --log.level=DEBUG

#- "--providers.docker=true"

- --providers.docker.endpoint=unix:///var/run/docker.sock

- "--providers.docker.exposedbydefault=false"

- "--providers.docker.network=duckpond_proxy_net"

- "--entrypoints.web.address=:80"

- "--entrypoints.websecure.address=:443"

- "--entrypoints.database.address=:5433"

- --entrypoints.websecure.http.tls.options=tls-opts@file

- --providers.file.directory=/rules

- --providers.file.watch=true

- --entryPoints.web.http.redirections.entrypoint.to=websecure

- --entryPoints.web.http.redirections.entrypoint.scheme=https

- "--providers.file.filename=/rules/dynamic_conf.toml"

minio:

# Current latest image ( after the UI rug-pull with limited functionality)

image: minio/minio:RELEASE.2025-09-07T16-13-09Z

# before the rug-pull

#image: minio/minio:RELEASE.2025-04-22T22-12-26Z

command: server /data --console-address ":9001"

environment:

MINIO_ROOT_USER: ${OBJECT_STORE_ROOT_USER}

MINIO_ROOT_PASSWORD: ${OBJECT_STORE_ROOT_PASSWORD}

# MINIO_BROWSER: off

MINIO_BROWSER_REDIRECT_URL: https://objectstore-ui.${ROOT_DOMAIN}

MINIO_SITE_REGION: ${OBJECT_STORE_REGION}

MINIO_SITE_NAME: ${OBJECT_STORE_SITE_NAME}

volumes:

- ./z_tmp_state/minio/data:/data

#ports:

# - "9000:9000"

# - "9001:9001" # (limited MinIO-CE browser only) -> disabled

healthcheck:

test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/ready"]

interval: 5s

timeout: 3s

retries: 20

networks:

- duckpond_proxy_net

- object_store_net

labels:

- "traefik.enable=true"

- "traefik.http.routers.objectstore-api.rule=Host(`objectstore.${ROOT_DOMAIN}`)"

- "traefik.http.routers.objectstore-api.entrypoints=websecure"

- "traefik.http.services.objectstore-api-svc.loadbalancer.server.port=9000"

- "traefik.http.routers.objectstore-api.middlewares=chain-no-auth@file"

openmaxio:

image: duckpond/objectstore-ui:v1.7.6

build:

context: ./services/objectstore

dockerfile: Dockerfile

environment:

CONSOLE_MINIO_SERVER: http://minio:9000

CONSOLE_PBKDF_PASSPHRASE: ${CONSOLE_PBKDF_PASSPHRASE}

CONSOLE_PBKDF_SALT: ${CONSOLE_PBKDF_SALT}

CONSOLE_MINIO_REGION: ${OBJECT_STORE_REGION}

depends_on:

minio:

condition: service_healthy

#ports:

# - "9001:9090"

networks:

- duckpond_proxy_net

- object_store_net

labels:

- "traefik.enable=true"

- "traefik.http.routers.objectstore-ui.rule=Host(`objectstore-ui.${ROOT_DOMAIN}`)"

- "traefik.http.routers.objectstore-ui.entrypoints=websecure"

- "traefik.http.services.objectstore-ui-svc.loadbalancer.server.port=9090"

- "traefik.http.routers.objectstore-ui.middlewares=chain-no-auth@file"

database:

image: duckpond/database:${GIT_COMMIT_SHA:-latest}

build:

# using own as published build is very old

# WARNING: Can build several minutes

context: ./services/database

dockerfile: Dockerfile

target: db

environment:

POSTGRES_DB: ${POSTGRES_DB}

POSTGRES_USER: ${POSTGRES_USER}

POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}

ports:

- "5434:5432"

- "4213:4213"

networks:

- duckpond_proxy_net

volumes:

- ./z_tmp_state/database/data:/var/lib/postgresql/18/docker

- ./services/database/init.sql:/docker-entrypoint-initdb.d/init.sql

healthcheck:

test: [ "CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}" ]

interval: 5s

timeout: 10s

retries: 10

command:

[

"postgres",

"-c",

"shared_preload_libraries=pg_stat_statements,pg_duckdb",

"-c",

"pg_stat_statements.track=top", # all, top

"-c",

"pg_stat_statements.max=10000",

"-c",

"maintenance_work_mem=256MB",

"-c",

"autovacuum_vacuum_scale_factor=0.1",

"-c",

"autovacuum_analyze_scale_factor=0.05"

]

labels:

- "traefik.enable=true"

- "traefik.tcp.routers.database.rule=HostSNI(`db.${ROOT_DOMAIN}`)"

- "traefik.tcp.routers.database.entrypoints=database"

- "traefik.tcp.routers.database.tls=true"

- "traefik.tcp.routers.database.service=database-svc"

- "traefik.tcp.services.database-svc.loadbalancer.server.port=5432"

postgresql:

image: postgres:18.0-alpine3.22

profiles:

- om

- catalogs

environment:

POSTGRES_DB: ${CATALOG_DB}

POSTGRES_USER: ${CATALOG_DB_USER}

POSTGRES_PASSWORD: ${CATALOG_DB_PASSWORD}

#ports:

# - "5434:5432"

volumes:

- ./z_tmp_state/catalogdb/data:/var/lib/postgresql/18/docker

healthcheck:

test: [ "CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}" ]

interval: 5s

timeout: 10s

retries: 10

networks:

- data_catalog_net

elasticsearch:

container_name: openmetadata_elasticsearch

profiles:

- om

- catalogs

image: docker.elastic.co/elasticsearch/elasticsearch:8.19.3

environment:

- discovery.type=single-node

- ES_JAVA_OPTS=-Xms1024m -Xmx1024m

- xpack.security.enabled=false

networks:

- data_catalog_net

#ports:

# - "9200:9200"

# - "9300:9300"

healthcheck:

test: "curl -s http://localhost:9200/_cluster/health?pretty | grep status | grep -qE 'green|yellow' || exit 1"

interval: 15s

timeout: 10s

retries: 10

volumes:

- es-data:/usr/share/elasticsearch/data

execute-migrate-all:

profiles:

- om

- catalogs

container_name: execute_migrate_all

restart: no

command: "./bootstrap/openmetadata-ops.sh migrate"

image: docker.getcollate.io/openmetadata/server:${CATALOG_VERSION}

environment:

OPENMETADATA_CLUSTER_NAME: ${OPENMETADATA_CLUSTER_NAME:-openmetadata}

SERVER_PORT: ${SERVER_PORT:-8585}

SERVER_ADMIN_PORT: ${SERVER_ADMIN_PORT:-8586}

LOG_LEVEL: ${LOG_LEVEL:-INFO}

# Migration

MIGRATION_LIMIT_PARAM: ${MIGRATION_LIMIT_PARAM:-1200}

# OpenMetadata Server Authentication Configuration

AUTHORIZER_CLASS_NAME: ${AUTHORIZER_CLASS_NAME:-org.openmetadata.service.security.DefaultAuthorizer}

AUTHORIZER_REQUEST_FILTER: ${AUTHORIZER_REQUEST_FILTER:-org.openmetadata.service.security.JwtFilter}

AUTHORIZER_ADMIN_PRINCIPALS: ${AUTHORIZER_ADMIN_PRINCIPALS:-[admin]}

AUTHORIZER_ALLOWED_REGISTRATION_DOMAIN: ${AUTHORIZER_ALLOWED_REGISTRATION_DOMAIN:-["all"]}

AUTHORIZER_INGESTION_PRINCIPALS: ${AUTHORIZER_INGESTION_PRINCIPALS:-[ingestion-bot]}

AUTHORIZER_PRINCIPAL_DOMAIN: ${AUTHORIZER_PRINCIPAL_DOMAIN:-"open-metadata.org"}

AUTHORIZER_ALLOWED_DOMAINS: ${AUTHORIZER_ALLOWED_DOMAINS:-[]}

AUTHORIZER_ENFORCE_PRINCIPAL_DOMAIN: ${AUTHORIZER_ENFORCE_PRINCIPAL_DOMAIN:-false}

AUTHORIZER_ENABLE_SECURE_SOCKET: ${AUTHORIZER_ENABLE_SECURE_SOCKET:-false}

AUTHENTICATION_PROVIDER: ${AUTHENTICATION_PROVIDER:-basic}

AUTHENTICATION_RESPONSE_TYPE: ${AUTHENTICATION_RESPONSE_TYPE:-id_token}

CUSTOM_OIDC_AUTHENTICATION_PROVIDER_NAME: ${CUSTOM_OIDC_AUTHENTICATION_PROVIDER_NAME:-""}

AUTHENTICATION_PUBLIC_KEYS: ${AUTHENTICATION_PUBLIC_KEYS:-[http://localhost:8585/api/v1/system/config/jwks]}

AUTHENTICATION_AUTHORITY: ${AUTHENTICATION_AUTHORITY:-https://accounts.google.com}

AUTHENTICATION_CLIENT_ID: ${AUTHENTICATION_CLIENT_ID:-""}

AUTHENTICATION_CALLBACK_URL: ${AUTHENTICATION_CALLBACK_URL:-""}

AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS:-[email,preferred_username,sub]}

AUTHENTICATION_JWT_PRINCIPAL_CLAIMS_MAPPING: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS_MAPPING:-[]}

AUTHENTICATION_ENABLE_SELF_SIGNUP: ${AUTHENTICATION_ENABLE_SELF_SIGNUP:-true}

AUTHENTICATION_CLIENT_TYPE: ${AUTHENTICATION_CLIENT_TYPE:-public}

#For OIDC Authentication, when client is confidential

OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-""}

OIDC_TYPE: ${OIDC_TYPE:-""} # google, azure etc.

OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-""}

OIDC_SCOPE: ${OIDC_SCOPE:-"openid email profile"}

OIDC_DISCOVERY_URI: ${OIDC_DISCOVERY_URI:-""}

OIDC_USE_NONCE: ${OIDC_USE_NONCE:-true}

OIDC_PREFERRED_JWS: ${OIDC_PREFERRED_JWS:-"RS256"}

OIDC_RESPONSE_TYPE: ${OIDC_RESPONSE_TYPE:-"code"}

OIDC_DISABLE_PKCE: ${OIDC_DISABLE_PKCE:-true}

OIDC_CALLBACK: ${OIDC_CALLBACK:-"http://localhost:8585/callback"}

OIDC_SERVER_URL: ${OIDC_SERVER_URL:-"http://localhost:8585"}

OIDC_CLIENT_AUTH_METHOD: ${OIDC_CLIENT_AUTH_METHOD:-"client_secret_post"}

OIDC_TENANT: ${OIDC_TENANT:-""}

OIDC_MAX_CLOCK_SKEW: ${OIDC_MAX_CLOCK_SKEW:-""}

OIDC_CUSTOM_PARAMS: ${OIDC_CUSTOM_PARAMS:-{}}

OIDC_MAX_AGE: ${OIDC_MAX_AGE:-"0"}

OIDC_PROMPT_TYPE: ${OIDC_PROMPT_TYPE:-"consent"}

OIDC_SESSION_EXPIRY: ${OIDC_SESSION_EXPIRY:-"604800"}

# For SAML Authentication

# SAML_DEBUG_MODE: ${SAML_DEBUG_MODE:-false}

# SAML_IDP_ENTITY_ID: ${SAML_IDP_ENTITY_ID:-""}

# SAML_IDP_SSO_LOGIN_URL: ${SAML_IDP_SSO_LOGIN_URL:-""}

# SAML_IDP_CERTIFICATE: ${SAML_IDP_CERTIFICATE:-""}

# SAML_AUTHORITY_URL: ${SAML_AUTHORITY_URL:-"http://localhost:8585/api/v1/saml/login"}

# SAML_IDP_NAME_ID: ${SAML_IDP_NAME_ID:-"urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"}

# SAML_SP_ENTITY_ID: ${SAML_SP_ENTITY_ID:-"http://localhost:8585/api/v1/saml/metadata"}

# SAML_SP_ACS: ${SAML_SP_ACS:-"http://localhost:8585/api/v1/saml/acs"}

# SAML_SP_CERTIFICATE: ${SAML_SP_CERTIFICATE:-""}

# SAML_SP_CALLBACK: ${SAML_SP_CALLBACK:-"http://localhost:8585/saml/callback"}

# SAML_STRICT_MODE: ${SAML_STRICT_MODE:-false}

# SAML_SP_TOKEN_VALIDITY: ${SAML_SP_TOKEN_VALIDITY:-"3600"}

# SAML_SEND_ENCRYPTED_NAME_ID: ${SAML_SEND_ENCRYPTED_NAME_ID:-false}

# SAML_SEND_SIGNED_AUTH_REQUEST: ${SAML_SEND_SIGNED_AUTH_REQUEST:-false}

# SAML_SIGNED_SP_METADATA: ${SAML_SIGNED_SP_METADATA:-false}

# SAML_WANT_MESSAGE_SIGNED: ${SAML_WANT_MESSAGE_SIGNED:-false}

# SAML_WANT_ASSERTION_SIGNED: ${SAML_WANT_ASSERTION_SIGNED:-false}

# SAML_WANT_ASSERTION_ENCRYPTED: ${SAML_WANT_ASSERTION_ENCRYPTED:-false}

# SAML_WANT_NAME_ID_ENCRYPTED: ${SAML_WANT_NAME_ID_ENCRYPTED:-false}

# SAML_KEYSTORE_FILE_PATH: ${SAML_KEYSTORE_FILE_PATH:-""}

# SAML_KEYSTORE_ALIAS: ${SAML_KEYSTORE_ALIAS:-""}

# SAML_KEYSTORE_PASSWORD: ${SAML_KEYSTORE_PASSWORD:-""}

# For LDAP Authentication

# AUTHENTICATION_LDAP_HOST: ${AUTHENTICATION_LDAP_HOST:-}

# AUTHENTICATION_LDAP_PORT: ${AUTHENTICATION_LDAP_PORT:-}

# AUTHENTICATION_LOOKUP_ADMIN_DN: ${AUTHENTICATION_LOOKUP_ADMIN_DN:-""}

# AUTHENTICATION_LOOKUP_ADMIN_PWD: ${AUTHENTICATION_LOOKUP_ADMIN_PWD:-""}

# AUTHENTICATION_USER_LOOKUP_BASEDN: ${AUTHENTICATION_USER_LOOKUP_BASEDN:-""}

# AUTHENTICATION_USER_MAIL_ATTR: ${AUTHENTICATION_USER_MAIL_ATTR:-}

# AUTHENTICATION_LDAP_POOL_SIZE: ${AUTHENTICATION_LDAP_POOL_SIZE:-3}

# AUTHENTICATION_LDAP_SSL_ENABLED: ${AUTHENTICATION_LDAP_SSL_ENABLED:-}

# AUTHENTICATION_LDAP_TRUSTSTORE_TYPE: ${AUTHENTICATION_LDAP_TRUSTSTORE_TYPE:-TrustAll}

# AUTHENTICATION_LDAP_TRUSTSTORE_PATH: ${AUTHENTICATION_LDAP_TRUSTSTORE_PATH:-}

# AUTHENTICATION_LDAP_KEYSTORE_PASSWORD: ${AUTHENTICATION_LDAP_KEYSTORE_PASSWORD:-}

# AUTHENTICATION_LDAP_SSL_KEY_FORMAT: ${AUTHENTICATION_LDAP_SSL_KEY_FORMAT:-}

# AUTHENTICATION_LDAP_ALLOW_WILDCARDS: ${AUTHENTICATION_LDAP_ALLOW_WILDCARDS:-}

# AUTHENTICATION_LDAP_ALLOWED_HOSTNAMES: ${AUTHENTICATION_LDAP_ALLOWED_HOSTNAMES:-[]}

# AUTHENTICATION_LDAP_SSL_VERIFY_CERT_HOST: ${AUTHENTICATION_LDAP_SSL_VERIFY_CERT_HOST:-}

# AUTHENTICATION_LDAP_EXAMINE_VALIDITY_DATES: ${AUTHENTICATION_LDAP_EXAMINE_VALIDITY_DATES:-true}

# JWT Configuration

RSA_PUBLIC_KEY_FILE_PATH: ${RSA_PUBLIC_KEY_FILE_PATH:-"./conf/public_key.der"}

RSA_PRIVATE_KEY_FILE_PATH: ${RSA_PRIVATE_KEY_FILE_PATH:-"./conf/private_key.der"}

JWT_ISSUER: ${JWT_ISSUER:-"open-metadata.org"}

JWT_KEY_ID: ${JWT_KEY_ID:-"Gb389a-9f76-gdjs-a92j-0242bk94356"}

# OpenMetadata Server Pipeline Service Client Configuration

PIPELINE_SERVICE_CLIENT_ENDPOINT: ${PIPELINE_SERVICE_CLIENT_ENDPOINT:-http://ingestion:8080}

PIPELINE_SERVICE_CLIENT_HEALTH_CHECK_INTERVAL: ${PIPELINE_SERVICE_CLIENT_HEALTH_CHECK_INTERVAL:-300}

SERVER_HOST_API_URL: ${SERVER_HOST_API_URL:-http://openmetadata-server:8585/api}

PIPELINE_SERVICE_CLIENT_VERIFY_SSL: ${PIPELINE_SERVICE_CLIENT_VERIFY_SSL:-"no-ssl"}

PIPELINE_SERVICE_CLIENT_SSL_CERT_PATH: ${PIPELINE_SERVICE_CLIENT_SSL_CERT_PATH:-""}

# Database configuration for MySQL

DB_DRIVER_CLASS: ${DB_DRIVER_CLASS:-com.mysql.cj.jdbc.Driver}

DB_SCHEME: ${DB_SCHEME:-mysql}

DB_PARAMS: ${DB_PARAMS:-allowPublicKeyRetrieval=true&useSSL=false&serverTimezone=UTC}

DB_USE_SSL: ${DB_USE_SSL:-false}

DB_USER: ${DB_USER:-openmetadata_user}

DB_USER_PASSWORD: ${DB_USER_PASSWORD:-openmetadata_password}

DB_HOST: ${DB_HOST:-mysql}

DB_PORT: ${DB_PORT:-3306}

OM_DATABASE: ${OM_DATABASE:-openmetadata_db}

# ElasticSearch Configurations

ELASTICSEARCH_HOST: ${ELASTICSEARCH_HOST:- elasticsearch}

ELASTICSEARCH_PORT: ${ELASTICSEARCH_PORT:-9200}

ELASTICSEARCH_SCHEME: ${ELASTICSEARCH_SCHEME:-http}

ELASTICSEARCH_USER: ${ELASTICSEARCH_USER:-""}

ELASTICSEARCH_PASSWORD: ${ELASTICSEARCH_PASSWORD:-""}

SEARCH_TYPE: ${SEARCH_TYPE:- "elasticsearch"}

ELASTICSEARCH_TRUST_STORE_PATH: ${ELASTICSEARCH_TRUST_STORE_PATH:-""}

ELASTICSEARCH_TRUST_STORE_PASSWORD: ${ELASTICSEARCH_TRUST_STORE_PASSWORD:-""}

ELASTICSEARCH_CONNECTION_TIMEOUT_SECS: ${ELASTICSEARCH_CONNECTION_TIMEOUT_SECS:-5}

ELASTICSEARCH_SOCKET_TIMEOUT_SECS: ${ELASTICSEARCH_SOCKET_TIMEOUT_SECS:-60}

ELASTICSEARCH_KEEP_ALIVE_TIMEOUT_SECS: ${ELASTICSEARCH_KEEP_ALIVE_TIMEOUT_SECS:-600}

ELASTICSEARCH_BATCH_SIZE: ${ELASTICSEARCH_BATCH_SIZE:-100}

ELASTICSEARCH_PAYLOAD_BYTES_SIZE: ${ELASTICSEARCH_PAYLOAD_BYTES_SIZE:-10485760} #max payLoadSize in Bytes

ELASTICSEARCH_INDEX_MAPPING_LANG: ${ELASTICSEARCH_INDEX_MAPPING_LANG:-EN}

#eventMonitoringConfiguration

EVENT_MONITOR: ${EVENT_MONITOR:-prometheus}

EVENT_MONITOR_BATCH_SIZE: ${EVENT_MONITOR_BATCH_SIZE:-10}

EVENT_MONITOR_PATH_PATTERN: ${EVENT_MONITOR_PATH_PATTERN:-["/api/v1/tables/*", "/api/v1/health-check"]}

EVENT_MONITOR_LATENCY: ${EVENT_MONITOR_LATENCY:-[]}

#pipelineServiceClientConfiguration

PIPELINE_SERVICE_CLIENT_CLASS_NAME: ${PIPELINE_SERVICE_CLIENT_CLASS_NAME:-"org.openmetadata.service.clients.pipeline.airflow.AirflowRESTClient"}

PIPELINE_SERVICE_IP_INFO_ENABLED: ${PIPELINE_SERVICE_IP_INFO_ENABLED:-false}

PIPELINE_SERVICE_CLIENT_HOST_IP: ${PIPELINE_SERVICE_CLIENT_HOST_IP:-""}

PIPELINE_SERVICE_CLIENT_SECRETS_MANAGER_LOADER: ${PIPELINE_SERVICE_CLIENT_SECRETS_MANAGER_LOADER:-"noop"}

#airflow parameters

AIRFLOW_USERNAME: ${AIRFLOW_USERNAME:-admin}

AIRFLOW_PASSWORD: ${AIRFLOW_PASSWORD:-admin}

AIRFLOW_TIMEOUT: ${AIRFLOW_TIMEOUT:-10}

AIRFLOW_TRUST_STORE_PATH: ${AIRFLOW_TRUST_STORE_PATH:-""}

AIRFLOW_TRUST_STORE_PASSWORD: ${AIRFLOW_TRUST_STORE_PASSWORD:-""}

FERNET_KEY: ${FERNET_KEY:-jJ/9sz0g0OHxsfxOoSfdFdmk3ysNmPRnH3TUAbz3IHA=}

#secretsManagerConfiguration

SECRET_MANAGER: ${SECRET_MANAGER:-db}

# AWS:

OM_SM_REGION: ${OM_SM_REGION:-""}

OM_SM_ACCESS_KEY_ID: ${OM_SM_ACCESS_KEY_ID:-""}

OM_SM_ACCESS_KEY: ${OM_SM_ACCESS_KEY:-""}

# Azure:

OM_SM_VAULT_NAME: ${OM_SM_VAULT_NAME:-""}

OM_SM_CLIENT_ID: ${OM_SM_CLIENT_ID:-""}

OM_SM_CLIENT_SECRET: ${OM_SM_CLIENT_SECRET:-""}

OM_SM_TENANT_ID: ${OM_SM_TENANT_ID:-""}

#email configuration:

OM_EMAIL_ENTITY: ${OM_EMAIL_ENTITY:-"OpenMetadata"}

OM_SUPPORT_URL: ${OM_SUPPORT_URL:-"https://slack.open-metadata.org"}

AUTHORIZER_ENABLE_SMTP: ${AUTHORIZER_ENABLE_SMTP:-false}

OPENMETADATA_SERVER_URL: ${OPENMETADATA_SERVER_URL:-""}

OPENMETADATA_SMTP_SENDER_MAIL: ${OPENMETADATA_SMTP_SENDER_MAIL:-""}

SMTP_SERVER_ENDPOINT: ${SMTP_SERVER_ENDPOINT:-""}

SMTP_SERVER_PORT: ${SMTP_SERVER_PORT:-""}

SMTP_SERVER_USERNAME: ${SMTP_SERVER_USERNAME:-""}

SMTP_SERVER_PWD: ${SMTP_SERVER_PWD:-""}

SMTP_SERVER_STRATEGY: ${SMTP_SERVER_STRATEGY:-"SMTP_TLS"}

#extensionConfiguration

OM_RESOURCE_PACKAGES: ${OM_RESOURCE_PACKAGES:-[]}

OM_EXTENSIONS: ${OM_EXTENSIONS:-[]}

# Heap OPTS Configurations

OPENMETADATA_HEAP_OPTS: ${OPENMETADATA_HEAP_OPTS:--Xmx1G -Xms1G}

# Mask passwords values in UI

MASK_PASSWORDS_API: ${MASK_PASSWORDS_API:-false}

#OpenMetadata Web Configuration

WEB_CONF_URI_PATH: ${WEB_CONF_URI_PATH:-"/api"}

#HSTS

WEB_CONF_HSTS_ENABLED: ${WEB_CONF_HSTS_ENABLED:-false}

WEB_CONF_HSTS_MAX_AGE: ${WEB_CONF_HSTS_MAX_AGE:-"365 days"}

WEB_CONF_HSTS_INCLUDE_SUBDOMAINS: ${WEB_CONF_HSTS_INCLUDE_SUBDOMAINS:-"true"}

WEB_CONF_HSTS_PRELOAD: ${WEB_CONF_HSTS_PRELOAD:-"true"}

#Frame Options

WEB_CONF_FRAME_OPTION_ENABLED: ${WEB_CONF_FRAME_OPTION_ENABLED:-false}

WEB_CONF_FRAME_OPTION: ${WEB_CONF_FRAME_OPTION:-"SAMEORIGIN"}

WEB_CONF_FRAME_ORIGIN: ${WEB_CONF_FRAME_ORIGIN:-""}

#Content Type

WEB_CONF_CONTENT_TYPE_OPTIONS_ENABLED: ${WEB_CONF_CONTENT_TYPE_OPTIONS_ENABLED:-false}

#XSS-Protection

WEB_CONF_XSS_PROTECTION_ENABLED: ${WEB_CONF_XSS_PROTECTION_ENABLED:-false}

WEB_CONF_XSS_PROTECTION_ON: ${WEB_CONF_XSS_PROTECTION_ON:-true}

WEB_CONF_XSS_PROTECTION_BLOCK: ${WEB_CONF_XSS_PROTECTION_BLOCK:-true}

#CSP

WEB_CONF_XSS_CSP_ENABLED: ${WEB_CONF_XSS_CSP_ENABLED:-false}

WEB_CONF_XSS_CSP_POLICY: ${WEB_CONF_XSS_CSP_POLICY:-"default-src 'self'"}

WEB_CONF_XSS_CSP_REPORT_ONLY_POLICY: ${WEB_CONF_XSS_CSP_REPORT_ONLY_POLICY:-""}

#Referrer-Policy

WEB_CONF_REFERRER_POLICY_ENABLED: ${WEB_CONF_REFERRER_POLICY_ENABLED:-false}

WEB_CONF_REFERRER_POLICY_OPTION: ${WEB_CONF_REFERRER_POLICY_OPTION:-"SAME_ORIGIN"}

#Permission-Policy

WEB_CONF_PERMISSION_POLICY_ENABLED: ${WEB_CONF_PERMISSION_POLICY_ENABLED:-false}

WEB_CONF_PERMISSION_POLICY_OPTION: ${WEB_CONF_PERMISSION_POLICY_OPTION:-""}

#Cache

WEB_CONF_CACHE_CONTROL: ${WEB_CONF_CACHE_CONTROL:-""}

WEB_CONF_PRAGMA: ${WEB_CONF_PRAGMA:-""}

networks:

- data_catalog_net

depends_on:

postgresql:

condition: service_healthy

openmetadata-server:

container_name: openmetadata_server

profiles:

- om

- catalogs

#restart: no

image: docker.getcollate.io/openmetadata/server:${CATALOG_VERSION}

environment:

OPENMETADATA_CLUSTER_NAME: ${OPENMETADATA_CLUSTER_NAME:-openmetadata}

SERVER_PORT: ${SERVER_PORT:-8585}

SERVER_ADMIN_PORT: ${SERVER_ADMIN_PORT:-8586}

LOG_LEVEL: ${LOG_LEVEL:-INFO}

# OpenMetadata Server Authentication Configuration

AUTHORIZER_CLASS_NAME: ${AUTHORIZER_CLASS_NAME:-org.openmetadata.service.security.DefaultAuthorizer}

AUTHORIZER_REQUEST_FILTER: ${AUTHORIZER_REQUEST_FILTER:-org.openmetadata.service.security.JwtFilter}

AUTHORIZER_ADMIN_PRINCIPALS: ${AUTHORIZER_ADMIN_PRINCIPALS:-[admin]}

AUTHORIZER_ALLOWED_REGISTRATION_DOMAIN: ${AUTHORIZER_ALLOWED_REGISTRATION_DOMAIN:-["all"]}

AUTHORIZER_INGESTION_PRINCIPALS: ${AUTHORIZER_INGESTION_PRINCIPALS:-[ingestion-bot]}

AUTHORIZER_PRINCIPAL_DOMAIN: ${AUTHORIZER_PRINCIPAL_DOMAIN:-"open-metadata.org"}

AUTHORIZER_ALLOWED_DOMAINS: ${AUTHORIZER_ALLOWED_DOMAINS:-[]}

AUTHORIZER_ENFORCE_PRINCIPAL_DOMAIN: ${AUTHORIZER_ENFORCE_PRINCIPAL_DOMAIN:-false}

AUTHORIZER_ENABLE_SECURE_SOCKET: ${AUTHORIZER_ENABLE_SECURE_SOCKET:-false}

AUTHENTICATION_PROVIDER: ${AUTHENTICATION_PROVIDER:-basic}

AUTHENTICATION_RESPONSE_TYPE: ${AUTHENTICATION_RESPONSE_TYPE:-id_token}

CUSTOM_OIDC_AUTHENTICATION_PROVIDER_NAME: ${CUSTOM_OIDC_AUTHENTICATION_PROVIDER_NAME:-""}

AUTHENTICATION_PUBLIC_KEYS: ${AUTHENTICATION_PUBLIC_KEYS:-[http://localhost:8585/api/v1/system/config/jwks]}

AUTHENTICATION_AUTHORITY: ${AUTHENTICATION_AUTHORITY:-https://accounts.google.com}

AUTHENTICATION_CLIENT_ID: ${AUTHENTICATION_CLIENT_ID:-""}

AUTHENTICATION_CALLBACK_URL: ${AUTHENTICATION_CALLBACK_URL:-""}

AUTHENTICATION_JWT_PRINCIPAL_CLAIMS: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS:-[email,preferred_username,sub]}

AUTHENTICATION_JWT_PRINCIPAL_CLAIMS_MAPPING: ${AUTHENTICATION_JWT_PRINCIPAL_CLAIMS_MAPPING:-[]}

AUTHENTICATION_ENABLE_SELF_SIGNUP: ${AUTHENTICATION_ENABLE_SELF_SIGNUP:-true}

AUTHENTICATION_CLIENT_TYPE: ${AUTHENTICATION_CLIENT_TYPE:-public}

#For OIDC Authentication, when client is confidential

OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-""}

OIDC_TYPE: ${OIDC_TYPE:-""} # google, azure etc.

OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-""}

OIDC_SCOPE: ${OIDC_SCOPE:-"openid email profile"}

OIDC_DISCOVERY_URI: ${OIDC_DISCOVERY_URI:-""}

OIDC_USE_NONCE: ${OIDC_USE_NONCE:-true}

OIDC_PREFERRED_JWS: ${OIDC_PREFERRED_JWS:-"RS256"}

OIDC_RESPONSE_TYPE: ${OIDC_RESPONSE_TYPE:-"code"}

OIDC_DISABLE_PKCE: ${OIDC_DISABLE_PKCE:-true}

OIDC_CALLBACK: ${OIDC_CALLBACK:-"http://localhost:8585/callback"}

OIDC_SERVER_URL: ${OIDC_SERVER_URL:-"http://localhost:8585"}

OIDC_CLIENT_AUTH_METHOD: ${OIDC_CLIENT_AUTH_METHOD:-"client_secret_post"}

OIDC_TENANT: ${OIDC_TENANT:-""}

OIDC_MAX_CLOCK_SKEW: ${OIDC_MAX_CLOCK_SKEW:-""}

OIDC_CUSTOM_PARAMS: ${OIDC_CUSTOM_PARAMS:-{}}

OIDC_MAX_AGE: ${OIDC_MAX_AGE:-"0"}

OIDC_PROMPT_TYPE: ${OIDC_PROMPT_TYPE:-"consent"}

OIDC_SESSION_EXPIRY: ${OIDC_SESSION_EXPIRY:-"604800"}

# For SAML Authentication

# SAML_DEBUG_MODE: ${SAML_DEBUG_MODE:-false}

# SAML_IDP_ENTITY_ID: ${SAML_IDP_ENTITY_ID:-""}

# SAML_IDP_SSO_LOGIN_URL: ${SAML_IDP_SSO_LOGIN_URL:-""}

# SAML_IDP_CERTIFICATE: ${SAML_IDP_CERTIFICATE:-""}

# SAML_AUTHORITY_URL: ${SAML_AUTHORITY_URL:-"http://localhost:8585/api/v1/saml/login"}

# SAML_IDP_NAME_ID: ${SAML_IDP_NAME_ID:-"urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"}

# SAML_SP_ENTITY_ID: ${SAML_SP_ENTITY_ID:-"http://localhost:8585/api/v1/saml/metadata"}

# SAML_SP_ACS: ${SAML_SP_ACS:-"http://localhost:8585/api/v1/saml/acs"}

# SAML_SP_CERTIFICATE: ${SAML_SP_CERTIFICATE:-""}

# SAML_SP_CALLBACK: ${SAML_SP_CALLBACK:-"http://localhost:8585/saml/callback"}

# SAML_STRICT_MODE: ${SAML_STRICT_MODE:-false}

# SAML_SP_TOKEN_VALIDITY: ${SAML_SP_TOKEN_VALIDITY:-"3600"}

# SAML_SEND_ENCRYPTED_NAME_ID: ${SAML_SEND_ENCRYPTED_NAME_ID:-false}

# SAML_SEND_SIGNED_AUTH_REQUEST: ${SAML_SEND_SIGNED_AUTH_REQUEST:-false}

# SAML_SIGNED_SP_METADATA: ${SAML_SIGNED_SP_METADATA:-false}

# SAML_WANT_MESSAGE_SIGNED: ${SAML_WANT_MESSAGE_SIGNED:-false}

# SAML_WANT_ASSERTION_SIGNED: ${SAML_WANT_ASSERTION_SIGNED:-false}

# SAML_WANT_ASSERTION_ENCRYPTED: ${SAML_WANT_ASSERTION_ENCRYPTED:-false}

# SAML_WANT_NAME_ID_ENCRYPTED: ${SAML_WANT_NAME_ID_ENCRYPTED:-false}

# SAML_KEYSTORE_FILE_PATH: ${SAML_KEYSTORE_FILE_PATH:-""}

# SAML_KEYSTORE_ALIAS: ${SAML_KEYSTORE_ALIAS:-""}

# SAML_KEYSTORE_PASSWORD: ${SAML_KEYSTORE_PASSWORD:-""}

# For LDAP Authentication

# AUTHENTICATION_LDAP_HOST: ${AUTHENTICATION_LDAP_HOST:-}

# AUTHENTICATION_LDAP_PORT: ${AUTHENTICATION_LDAP_PORT:-}

# AUTHENTICATION_LOOKUP_ADMIN_DN: ${AUTHENTICATION_LOOKUP_ADMIN_DN:-""}

# AUTHENTICATION_LOOKUP_ADMIN_PWD: ${AUTHENTICATION_LOOKUP_ADMIN_PWD:-""}

# AUTHENTICATION_USER_LOOKUP_BASEDN: ${AUTHENTICATION_USER_LOOKUP_BASEDN:-""}

# AUTHENTICATION_USER_MAIL_ATTR: ${AUTHENTICATION_USER_MAIL_ATTR:-}

# AUTHENTICATION_LDAP_POOL_SIZE: ${AUTHENTICATION_LDAP_POOL_SIZE:-3}

# AUTHENTICATION_LDAP_SSL_ENABLED: ${AUTHENTICATION_LDAP_SSL_ENABLED:-}

# AUTHENTICATION_LDAP_TRUSTSTORE_TYPE: ${AUTHENTICATION_LDAP_TRUSTSTORE_TYPE:-TrustAll}

# AUTHENTICATION_LDAP_TRUSTSTORE_PATH: ${AUTHENTICATION_LDAP_TRUSTSTORE_PATH:-}

# AUTHENTICATION_LDAP_KEYSTORE_PASSWORD: ${AUTHENTICATION_LDAP_KEYSTORE_PASSWORD:-}

# AUTHENTICATION_LDAP_SSL_KEY_FORMAT: ${AUTHENTICATION_LDAP_SSL_KEY_FORMAT:-}

# AUTHENTICATION_LDAP_ALLOW_WILDCARDS: ${AUTHENTICATION_LDAP_ALLOW_WILDCARDS:-}

# AUTHENTICATION_LDAP_ALLOWED_HOSTNAMES: ${AUTHENTICATION_LDAP_ALLOWED_HOSTNAMES:-[]}

# AUTHENTICATION_LDAP_SSL_VERIFY_CERT_HOST: ${AUTHENTICATION_LDAP_SSL_VERIFY_CERT_HOST:-}

# AUTHENTICATION_LDAP_EXAMINE_VALIDITY_DATES: ${AUTHENTICATION_LDAP_EXAMINE_VALIDITY_DATES:-true}

# JWT Configuration

RSA_PUBLIC_KEY_FILE_PATH: ${RSA_PUBLIC_KEY_FILE_PATH:-"./conf/public_key.der"}

RSA_PRIVATE_KEY_FILE_PATH: ${RSA_PRIVATE_KEY_FILE_PATH:-"./conf/private_key.der"}

JWT_ISSUER: ${JWT_ISSUER:-"open-metadata.org"}

JWT_KEY_ID: ${JWT_KEY_ID:-"Gb389a-9f76-gdjs-a92j-0242bk94356"}

# OpenMetadata Server Pipeline Service Client Configuration

PIPELINE_SERVICE_CLIENT_ENDPOINT: ${PIPELINE_SERVICE_CLIENT_ENDPOINT:-http://ingestion:8080}

PIPELINE_SERVICE_CLIENT_HEALTH_CHECK_INTERVAL: ${PIPELINE_SERVICE_CLIENT_HEALTH_CHECK_INTERVAL:-300}

SERVER_HOST_API_URL: ${SERVER_HOST_API_URL:-http://openmetadata-server:8585/api}

PIPELINE_SERVICE_CLIENT_VERIFY_SSL: ${PIPELINE_SERVICE_CLIENT_VERIFY_SSL:-"no-ssl"}

PIPELINE_SERVICE_CLIENT_SSL_CERT_PATH: ${PIPELINE_SERVICE_CLIENT_SSL_CERT_PATH:-""}

# Database configuration for MySQL

DB_DRIVER_CLASS: ${DB_DRIVER_CLASS:-com.mysql.cj.jdbc.Driver}

DB_SCHEME: ${DB_SCHEME:-mysql}

DB_PARAMS: ${DB_PARAMS:-allowPublicKeyRetrieval=true&useSSL=false&serverTimezone=UTC}

DB_USE_SSL: ${DB_USE_SSL:-false}

DB_USER: ${DB_USER:-openmetadata_user}

DB_USER_PASSWORD: ${DB_USER_PASSWORD:-openmetadata_password}

DB_HOST: ${DB_HOST:-mysql}

DB_PORT: ${DB_PORT:-3306}

OM_DATABASE: ${OM_DATABASE:-openmetadata_db}

# ElasticSearch Configurations

ELASTICSEARCH_HOST: ${ELASTICSEARCH_HOST:- elasticsearch}

ELASTICSEARCH_PORT: ${ELASTICSEARCH_PORT:-9200}

ELASTICSEARCH_SCHEME: ${ELASTICSEARCH_SCHEME:-http}

ELASTICSEARCH_USER: ${ELASTICSEARCH_USER:-""}

ELASTICSEARCH_PASSWORD: ${ELASTICSEARCH_PASSWORD:-""}

SEARCH_TYPE: ${SEARCH_TYPE:- "elasticsearch"}

ELASTICSEARCH_TRUST_STORE_PATH: ${ELASTICSEARCH_TRUST_STORE_PATH:-""}

ELASTICSEARCH_TRUST_STORE_PASSWORD: ${ELASTICSEARCH_TRUST_STORE_PASSWORD:-""}

ELASTICSEARCH_CONNECTION_TIMEOUT_SECS: ${ELASTICSEARCH_CONNECTION_TIMEOUT_SECS:-5}

ELASTICSEARCH_SOCKET_TIMEOUT_SECS: ${ELASTICSEARCH_SOCKET_TIMEOUT_SECS:-60}

ELASTICSEARCH_KEEP_ALIVE_TIMEOUT_SECS: ${ELASTICSEARCH_KEEP_ALIVE_TIMEOUT_SECS:-600}

ELASTICSEARCH_BATCH_SIZE: ${ELASTICSEARCH_BATCH_SIZE:-100}

ELASTICSEARCH_PAYLOAD_BYTES_SIZE: ${ELASTICSEARCH_PAYLOAD_BYTES_SIZE:-10485760} #max payLoadSize in Bytes

ELASTICSEARCH_INDEX_MAPPING_LANG: ${ELASTICSEARCH_INDEX_MAPPING_LANG:-EN}

#eventMonitoringConfiguration

EVENT_MONITOR: ${EVENT_MONITOR:-prometheus}

EVENT_MONITOR_BATCH_SIZE: ${EVENT_MONITOR_BATCH_SIZE:-10}

EVENT_MONITOR_PATH_PATTERN: ${EVENT_MONITOR_PATH_PATTERN:-["/api/v1/tables/*", "/api/v1/health-check"]}

EVENT_MONITOR_LATENCY: ${EVENT_MONITOR_LATENCY:-[]}

#pipelineServiceClientConfiguration

PIPELINE_SERVICE_CLIENT_CLASS_NAME: ${PIPELINE_SERVICE_CLIENT_CLASS_NAME:-"org.openmetadata.service.clients.pipeline.airflow.AirflowRESTClient"}

PIPELINE_SERVICE_IP_INFO_ENABLED: ${PIPELINE_SERVICE_IP_INFO_ENABLED:-false}

PIPELINE_SERVICE_CLIENT_HOST_IP: ${PIPELINE_SERVICE_CLIENT_HOST_IP:-""}

PIPELINE_SERVICE_CLIENT_SECRETS_MANAGER_LOADER: ${PIPELINE_SERVICE_CLIENT_SECRETS_MANAGER_LOADER:-"noop"}

#airflow parameters

AIRFLOW_USERNAME: ${AIRFLOW_USERNAME:-admin}

AIRFLOW_PASSWORD: ${AIRFLOW_PASSWORD:-admin}

AIRFLOW_TIMEOUT: ${AIRFLOW_TIMEOUT:-10}

AIRFLOW_TRUST_STORE_PATH: ${AIRFLOW_TRUST_STORE_PATH:-""}

AIRFLOW_TRUST_STORE_PASSWORD: ${AIRFLOW_TRUST_STORE_PASSWORD:-""}

FERNET_KEY: ${FERNET_KEY:-jJ/9sz0g0OHxsfxOoSfdFdmk3ysNmPRnH3TUAbz3IHA=}

#secretsManagerConfiguration

SECRET_MANAGER: ${SECRET_MANAGER:-db}

#parameters:

OM_SM_REGION: ${OM_SM_REGION:-""}

OM_SM_ACCESS_KEY_ID: ${OM_SM_ACCESS_KEY_ID:-""}

OM_SM_ACCESS_KEY: ${OM_SM_ACCESS_KEY:-""}

#email configuration:

OM_EMAIL_ENTITY: ${OM_EMAIL_ENTITY:-"OpenMetadata"}

OM_SUPPORT_URL: ${OM_SUPPORT_URL:-"https://slack.open-metadata.org"}

AUTHORIZER_ENABLE_SMTP: ${AUTHORIZER_ENABLE_SMTP:-false}

OPENMETADATA_SERVER_URL: ${OPENMETADATA_SERVER_URL:-""}

OPENMETADATA_SMTP_SENDER_MAIL: ${OPENMETADATA_SMTP_SENDER_MAIL:-""}

SMTP_SERVER_ENDPOINT: ${SMTP_SERVER_ENDPOINT:-""}

SMTP_SERVER_PORT: ${SMTP_SERVER_PORT:-""}

SMTP_SERVER_USERNAME: ${SMTP_SERVER_USERNAME:-""}

SMTP_SERVER_PWD: ${SMTP_SERVER_PWD:-""}

SMTP_SERVER_STRATEGY: ${SMTP_SERVER_STRATEGY:-"SMTP_TLS"}

#extensionConfiguration

OM_RESOURCE_PACKAGES: ${OM_RESOURCE_PACKAGES:-[]}

OM_EXTENSIONS: ${OM_EXTENSIONS:-[]}

# Heap OPTS Configurations

OPENMETADATA_HEAP_OPTS: ${OPENMETADATA_HEAP_OPTS:--Xmx1G -Xms1G}

#OpenMetadata Web Configuration

WEB_CONF_URI_PATH: ${WEB_CONF_URI_PATH:-"/api"}

#HSTS

WEB_CONF_HSTS_ENABLED: ${WEB_CONF_HSTS_ENABLED:-false}

WEB_CONF_HSTS_MAX_AGE: ${WEB_CONF_HSTS_MAX_AGE:-"365 days"}

WEB_CONF_HSTS_INCLUDE_SUBDOMAINS: ${WEB_CONF_HSTS_INCLUDE_SUBDOMAINS:-"true"}

WEB_CONF_HSTS_PRELOAD: ${WEB_CONF_HSTS_PRELOAD:-"true"}

#Frame Options

WEB_CONF_FRAME_OPTION_ENABLED: ${WEB_CONF_FRAME_OPTION_ENABLED:-false}

WEB_CONF_FRAME_OPTION: ${WEB_CONF_FRAME_OPTION:-"SAMEORIGIN"}

WEB_CONF_FRAME_ORIGIN: ${WEB_CONF_FRAME_ORIGIN:-""}

#Content Type

WEB_CONF_CONTENT_TYPE_OPTIONS_ENABLED: ${WEB_CONF_CONTENT_TYPE_OPTIONS_ENABLED:-false}

#XSS-Protection

WEB_CONF_XSS_PROTECTION_ENABLED: ${WEB_CONF_XSS_PROTECTION_ENABLED:-false}

WEB_CONF_XSS_PROTECTION_ON: ${WEB_CONF_XSS_PROTECTION_ON:-true}

WEB_CONF_XSS_PROTECTION_BLOCK: ${WEB_CONF_XSS_PROTECTION_BLOCK:-true}

#CSP

WEB_CONF_XSS_CSP_ENABLED: ${WEB_CONF_XSS_CSP_ENABLED:-false}

WEB_CONF_XSS_CSP_POLICY: ${WEB_CONF_XSS_CSP_POLICY:-"default-src 'self'"}

WEB_CONF_XSS_CSP_REPORT_ONLY_POLICY: ${WEB_CONF_XSS_CSP_REPORT_ONLY_POLICY:-""}

#Cache

WEB_CONF_CACHE_CONTROL: ${WEB_CONF_CACHE_CONTROL:-""}

WEB_CONF_PRAGMA: ${WEB_CONF_PRAGMA:-""}

expose:

- 8585

- 8586

#ports:

# - "8585:8585"

# - "8586:8586"

depends_on:

execute-migrate-all:

condition: service_completed_successfully

postgresql:

condition: service_healthy

networks:

- data_catalog_net

- duckpond_proxy_net

healthcheck:

test: [ "CMD", "wget", "-q", "--spider", "http://localhost:8586/healthcheck" ]

labels:

- "traefik.enable=true"

- "traefik.http.routers.catalog.rule=Host(`catalog.${ROOT_DOMAIN}`)"

- "traefik.http.routers.catalog.entrypoints=websecure"

- "traefik.http.services.catalog-svc.loadbalancer.server.port=8585"

- "traefik.http.routers.catalog.middlewares=chain-no-auth@file"

datahub-actions-quickstart:

profiles:

- datahub

- catalogs

depends_on:

datahub-gms-quickstart:

condition: service_healthy

required: true

environment:

ACTIONS_CONFIG: ''

ACTIONS_EXTRA_PACKAGES: ''

DATAHUB_GMS_HOST: datahub-gms

DATAHUB_GMS_PORT: '8080'

DATAHUB_GMS_PROTOCOL: http

DATAHUB_SYSTEM_CLIENT_ID: __datahub_system

DATAHUB_SYSTEM_CLIENT_SECRET: JohnSnowKnowsNothing

ELASTICSEARCH_HOST: search

ELASTICSEARCH_PORT: '9200'

ELASTICSEARCH_PROTOCOL: http

ELASTICSEARCH_USE_SSL: 'false'

KAFKA_BOOTSTRAP_SERVER: broker:29092

KAFKA_PROPERTIES_SECURITY_PROTOCOL: PLAINTEXT

METADATA_AUDIT_EVENT_NAME: MetadataAuditEvent_v4

METADATA_CHANGE_LOG_VERSIONED_TOPIC_NAME: MetadataChangeLog_Versioned_v1

SCHEMA_REGISTRY_URL: http://datahub-gms:8080/schema-registry/api/

hostname: actions

image: acryldata/datahub-actions:${DATAHUB_VERSION}-slim

networks:

- data_catalog_net

datahub-gms-quickstart:

profiles:

- datahub

- catalogs

depends_on:

system-update-quickstart:

condition: service_completed_successfully

required: true

environment:

ALTERNATE_MCP_VALIDATION: 'true'

DATAHUB_SERVER_TYPE: quickstart

DATAHUB_TELEMETRY_ENABLED: 'false'

DATAHUB_UPGRADE_HISTORY_KAFKA_CONSUMER_GROUP_ID: generic-duhe-consumer-job-client-gms

EBEAN_DATASOURCE_DRIVER: com.mysql.jdbc.Driver

EBEAN_DATASOURCE_HOST: mysql:3306

EBEAN_DATASOURCE_PASSWORD: datahub

EBEAN_DATASOURCE_URL: jdbc:mysql://mysql:3306/datahub?verifyServerCertificate=false&useSSL=true&useUnicode=yes&characterEncoding=UTF-8&enabledTLSProtocols=TLSv1.2

EBEAN_DATASOURCE_USERNAME: datahub

ELASTICSEARCH_HOST: search

ELASTICSEARCH_INDEX_BUILDER_MAPPINGS_REINDEX: 'true'

ELASTICSEARCH_INDEX_BUILDER_SETTINGS_REINDEX: 'true'

ELASTICSEARCH_LIMIT_RESULTS_STRICT: 'true'

ELASTICSEARCH_PORT: '9200'

ELASTICSEARCH_PROTOCOL: http

ELASTICSEARCH_USE_SSL: 'false'

ENTITY_REGISTRY_CONFIG_PATH: /datahub/datahub-gms/resources/entity-registry.yml

ENTITY_SERVICE_ENABLE_RETENTION: 'true'

ENTITY_VERSIONING_ENABLED: 'true'

ES_BULK_REFRESH_POLICY: WAIT_UNTIL

GRAPH_SERVICE_DIFF_MODE_ENABLED: 'true'

GRAPH_SERVICE_IMPL: elasticsearch

JAVA_OPTS: -Xms1g -Xmx1g

KAFKA_BOOTSTRAP_SERVER: broker:29092

KAFKA_SCHEMAREGISTRY_URL: http://datahub-gms:8080/schema-registry/api/

MAE_CONSUMER_ENABLED: 'true'

MCE_CONSUMER_ENABLED: 'true'

# TODO: producitionize here

METADATA_SERVICE_AUTH_ENABLED: 'false'

NEO4J_HOST: http://neo4j:7474

NEO4J_PASSWORD: datahub

NEO4J_URI: bolt://neo4j

NEO4J_USERNAME: neo4j

PE_CONSUMER_ENABLED: 'true'

SCHEMA_REGISTRY_TYPE: INTERNAL

STRICT_URN_VALIDATION_ENABLED: 'true'

THEME_V2_DEFAULT: 'true'

UI_INGESTION_ENABLED: 'true'

UI_INGESTION_DEFAULT_CLI_VERSION: ${UI_INGESTION_DEFAULT_CLI_VERSION}

hostname: datahub-gms

healthcheck:

test:

- CMD-SHELL

- curl -sS --fail http://datahub-gms:8080/health

timeout: 5s

interval: 1s

retries: 3

start_period: 1m30s

image: acryldata/datahub-gms:${DATAHUB_VERSION}

labels:

io.datahubproject.datahub.component: gms

networks:

- data_catalog_net

ports:

- mode: ingress

target: 8080

published: '8080'

protocol: tcp

volumes:

- type: bind

source: ./z_tmp_state/datahub/plugins

target: /etc/datahub/plugins

bind:

create_host_path: true

- type: bind

source: ./z_tmp_state/datahub/search

target: /etc/datahub/search

bind:

create_host_path: true

frontend-quickstart:

profiles:

- datahub

- catalogs

depends_on:

system-update-quickstart:

condition: service_completed_successfully

required: true

environment:

DATAHUB_APP_VERSION: '1.0'

DATAHUB_GMS_HOST: datahub-gms

DATAHUB_GMS_PORT: '8080'

DATAHUB_PLAY_MEM_BUFFER_SIZE: 10MB

DATAHUB_SECRET: YouKnowNothing

DATAHUB_TRACKING_TOPIC: DataHubUsageEvent_v1

ELASTIC_CLIENT_HOST: elasticsearch

ELASTIC_CLIENT_PORT: '9200'

JAVA_OPTS: -Xms512m -Xmx512m -Dhttp.port=9002 -Dconfig.file=datahub-frontend/conf/application.conf -Djava.security.auth.login.config=datahub-frontend/conf/jaas.conf

-Dlogback.configurationFile=datahub-frontend/conf/logback.xml -Dlogback.debug=false -Dpidfile.path=/dev/null

KAFKA_BOOTSTRAP_SERVER: broker:29092

THEME_V2_DEFAULT: 'true'

hostname: datahub-frontend-react

image: acryldata/datahub-frontend-react:${DATAHUB_VERSION}

networks:

- data_catalog_net

- duckpond_proxy_net

# ports:

# - mode: ingress

# target: 9002

# published: '9002'

# protocol: tcp

volumes:

- type: bind

source: ./z_tmp_state/datahub/plugins

target: /etc/datahub/plugins

bind:

create_host_path: true

labels:

- "traefik.enable=true"

- "traefik.http.routers.catalogdh.rule=Host(`datahub.${ROOT_DOMAIN}`)"

- "traefik.http.routers.catalogdh.entrypoints=websecure"

- "traefik.http.services.catalogdh-svc.loadbalancer.server.port=9002"

- "traefik.http.routers.catalogdh.middlewares=chain-no-auth@file"

kafka-broker:

command:

- /bin/bash

- -c

- |

# Generate KRaft clusterID

file_path="/var/lib/kafka/data/clusterID"

if [ ! -f "$$file_path" ]; then

/bin/kafka-storage random-uuid > $$file_path

echo "Cluster id has been created..."

# KRaft required step: Format the storage directory with a new cluster ID

kafka-storage format --ignore-formatted -t $$(cat "$$file_path") -c /etc/kafka/kafka.properties

fi

export CLUSTER_ID=$$(cat "$$file_path")

echo "CLUSTER_ID=$$CLUSTER_ID"

/etc/confluent/docker/run

environment:

KAFKA_ADVERTISED_LISTENERS: BROKER://broker:29092,EXTERNAL://localhost:9092

KAFKA_BROKER_ID: '1'

KAFKA_CONFLUENT_SUPPORT_METRICS_ENABLE: 'false'

KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER

KAFKA_CONTROLLER_QUORUM_VOTERS: 1@broker:39092

KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: '0'

KAFKA_HEAP_OPTS: -Xms256m -Xmx256m

KAFKA_INTER_BROKER_LISTENER_NAME: BROKER

KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: CONTROLLER:PLAINTEXT,BROKER:PLAINTEXT,EXTERNAL:PLAINTEXT

KAFKA_LISTENERS: BROKER://broker:29092,EXTERNAL://broker:9092,CONTROLLER://broker:39092

KAFKA_LOG4J_LOGGERS: org.apache.kafka.image.loader.MetadataLoader=WARN

KAFKA_MAX_MESSAGE_BYTES: '5242880'

KAFKA_MESSAGE_MAX_BYTES: '5242880'

KAFKA_NODE_ID: '1'

KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: '1'

KAFKA_PROCESS_ROLES: controller, broker

KAFKA_ZOOKEEPER_CONNECT: null

hostname: broker

healthcheck:

test:

- CMD-SHELL

- nc -z broker $${DATAHUB_KAFKA_BROKER_PORT:-9092}

timeout: 5s

interval: 1s

retries: 5

start_period: 1m0s

image: confluentinc/cp-kafka:8.0.0

profiles:

- datahub

- catalogs

networks:

- data_catalog_net

# ports:

# - mode: ingress

# target: 9092

# published: '9092'

# protocol: tcp

volumes:

- type: volume

source: broker

target: /var/lib/kafka/data

volume: {}

kafka-setup:

profiles:

- datahub

- catalogs

depends_on:

kafka-broker:

condition: service_healthy

required: true

environment:

DATAHUB_PRECREATE_TOPICS: 'false'

KAFKA_BOOTSTRAP_SERVER: broker:29092

KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181

USE_CONFLUENT_SCHEMA_REGISTRY: 'false'

hostname: kafka-setup

image: acryldata/datahub-kafka-setup:${DATAHUB_VERSION}

labels:

datahub_setup_job: 'true'

networks:

- data_catalog_net

mysql:

profiles:

- datahub

- catalogs

command:

- --character-set-server=utf8mb4

- --collation-server=utf8mb4_bin

- --default-authentication-plugin=caching_sha2_password

environment:

MYSQL_DATABASE: datahub

MYSQL_PASSWORD: datahub

MYSQL_ROOT_HOST: '%'

MYSQL_ROOT_PASSWORD: datahub

MYSQL_USER: datahub

hostname: mysql

healthcheck:

test:

- CMD-SHELL

- mysqladmin ping -h mysql -u $$MYSQL_USER --password=$$MYSQL_PASSWORD

timeout: 10s

interval: 2s

retries: 5

start_period: 20s

image: mysql:8.2

networks:

- data_catalog_net

# ports:

# - mode: ingress

# target: 3306

# published: '3306'

# protocol: tcp

restart: on-failure

volumes:

- type: volume

source: mysqldata

target: /var/lib/mysql

volume: {}

mysql-setup:

profiles:

- datahub

- catalogs

depends_on:

mysql:

condition: service_healthy

required: true

environment:

DATAHUB_DB_NAME: datahub

MYSQL_HOST: mysql

MYSQL_PASSWORD: datahub

MYSQL_PORT: '3306'

MYSQL_USERNAME: datahub

hostname: mysql-setup

image: acryldata/datahub-mysql-setup:${DATAHUB_VERSION}

labels:

datahub_setup_job: 'true'

networks:

- data_catalog_net

opensearch:

profiles:

- datahub

- catalogs

deploy:

resources:

limits:

memory: '1073741824'

environment:

ES_JAVA_OPTS: -Xms256m -Xmx512m -Dlog4j2.formatMsgNoLookups=true

OPENSEARCH_JAVA_OPTS: -Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true

discovery.type: single-node

plugins.security.disabled: 'true'

hostname: search

healthcheck:

test:

- CMD-SHELL

- curl -sS --fail http://search:$${DATAHUB_ELASTIC_PORT:-9200}/_cluster/health?wait_for_status=yellow&timeout=0s

timeout: 5s

interval: 1s

retries: 3

start_period: 30s

image: opensearchproject/opensearch:2.11.0

networks:

- data_catalog_net

# ports:

# - mode: ingress

# target: 9200

# published: '9200'

# protocol: tcp

volumes:

- type: volume

source: osdata

target: /usr/share/elasticsearch/data

volume: {}

opensearch-setup:

profiles:

- datahub

- catalogs

depends_on:

opensearch:

condition: service_healthy

required: true

environment:

ELASTICSEARCH_HOST: search

ELASTICSEARCH_PORT: '9200'

ELASTICSEARCH_PROTOCOL: http

ELASTICSEARCH_USE_SSL: 'false'

USE_AWS_ELASTICSEARCH: 'true'

hostname: opensearch-setup

image: acryldata/datahub-elasticsearch-setup:${DATAHUB_VERSION}

labels:

datahub_setup_job: 'true'

networks:

- data_catalog_net

system-update-quickstart:

profiles:

- datahub

- catalogs

command:

- -u

- SystemUpdate

depends_on:

kafka-setup:

condition: service_completed_successfully

required: true

mysql:

condition: service_healthy

required: true

mysql-setup:

condition: service_completed_successfully

required: true

opensearch:

condition: service_healthy

required: true

opensearch-setup:

condition: service_completed_successfully

required: true