PuppetBoard -> PuppetDB SSL

## Working config, additional persistency needed, please bear this in mind.
## For PuppetDB you might want to include some additional folders as persistent storage like logs or data.

---
services:
  puppet:
    image: ghcr.io/voxpupuli/puppetserver:8.7.0-latest
    hostname: puppet.home.lan
    environment:
      PUPPETSERVER_HOSTNAME: puppet.home.lan
      PUPPETSERVER_PORT: 8140
      PUPPETDB_HOSTNAME: puppetdb.home.lan
      PUPPETDB_SSL_PORT: 8081
      PUPPETDB_SERVER_URLS: "https://puppetdb.home.lan:8081"
      USE_PUPPETDB: true
      PUPPET_STORECONFIGS_BACKEND: puppetdb
      PUPPET_STORECONFIGS: true
      PUPPET_REPORTS: "puppetdb,store"
      CA_ALLOW_SUBJECT_ALT_NAMES: true
      AUTOSIGN: true
    volumes:
      - ./puppetserver-ssl:/etc/puppetlabs/puppet/ssl
      - ./puppetserver-ca:/etc/puppetlabs/puppetserver/ca
      - ./puppetserver:/opt/puppetlabs/server/data/puppetserver
      - ./puppetserver-code:/etc/puppetlabs/code
    ports:
      - 8140:8140
    restart: always

  puppetdb:
    image: ghcr.io/voxpupuli/puppetdb:8.8.1-latest
    hostname: puppetdb.home.lan
    environment:
      USE_PUPPETSERVER: true
      PUPPETSERVER_HOSTNAME: puppet.home.lan
      PUPPETSERVER_PORT: 8140
      PUPPETDB_SSL_PORT: 8081
      PUPPETDB_POSTGRES_HOSTNAME: postgres.home.lan
      PUPPETDB_POSTGRES_PORT: 5432
      PUPPETDB_PASSWORD: puppetdb
      PUPPETDB_USER: puppetdb
      CERTNAME: puppetdb.home.lan
      PUPPETDB_CERTIFICATE_ALLOWLIST: "puppet,puppet.home.lan,puppetdb,puppetdb.home.lan,puppetboard,puppetboard.home.lan"
    volumes:
      - ./puppetdb-ssl:/opt/puppetlabs/server/data/puppetdb/certs
    ports:
      - 8081:8081
    depends_on:
      postgres:
        condition: service_healthy
        restart: true
      puppet:
        condition: service_healthy
        restart: true
    restart: always

  postgres:
    image: docker.io/postgres:17-alpine
    hostname: postgres.home.lan
    environment:
      POSTGRES_DB: puppetdb
      POSTGRES_USER: puppetdb
      POSTGRES_PASSWORD: puppetdb
    healthcheck:
      test: ["CMD-SHELL", "sh -c 'pg_isready -U puppetdb -d puppetdb'"]
      interval: 10s
      timeout: 3s
      retries: 3
    volumes:
      - ./enable_pg_trgm.sql:/docker-entrypoint-initdb.d/enable_pg_trgm.sql
      - ./postgres-data:/var/lib/postgresql/data
    restart: always

  puppetboard:
    image: ghcr.io/voxpupuli/puppetboard
    hostname: puppetboard.home.lan
    ### entrypoint: ["/bin/sh", "-c", "sleep infinity"]
    environment:
      PUPPETDB_HOST: puppetdb.home.lan
      PUPPETDB_PORT: 8081
      PUPPETBOARD_PORT: 8080
      ENABLE_CATALOG: true
      PUPPETDB_SSL_VERIFY: /etc/puppetlabs/puppet/ssl/ca.pem
      PUPPETDB_KEY: /etc/puppetlabs/puppet/ssl/puppetdb-key.pem
      PUPPETDB_CERT: /etc/puppetlabs/puppet/ssl/puppetdb-cert.pem
      SECRET_KEY: "495ed6e5e799015811d1d00bd424b464df1b9809dade7964b6e4dcf124d9e170"
      DEFAULT_ENVIRONMENT: "*"
    volumes:
      - ./puppetboard-ssl:/etc/puppetlabs/puppet/ssl
    ports:
      - 8282:8080
    restart: none

networks:
  default:
    name: crafty-minimal