---
x-infrahub-config: &infrahub_config
AWS_ACCESS_KEY_ID:
AWS_DEFAULT_ACL: ${AWS_DEFAULT_ACL:-private}
AWS_QUERYSTRING_AUTH: ${AWS_QUERYSTRING_AUTH:-false}
AWS_S3_BUCKET_NAME:
AWS_S3_CUSTOM_DOMAIN:
AWS_S3_ENDPOINT_URL:
AWS_S3_USE_SSL: ${AWS_S3_USE_SSL:-true}
AWS_SECRET_ACCESS_KEY:
DB_TYPE: ${DB_TYPE:-neo4j}
INFRAHUB_ADDRESS:
INFRAHUB_ALLOW_ANONYMOUS_ACCESS: ${INFRAHUB_ALLOW_ANONYMOUS_ACCESS:-true}
INFRAHUB_ANALYTICS_ADDRESS:
INFRAHUB_ANALYTICS_API_KEY:
INFRAHUB_ANALYTICS_ENABLE: ${INFRAHUB_ANALYTICS_ENABLE:-true}
INFRAHUB_ANONYMOUS_ACCESS_ROLE: ${INFRAHUB_ANONYMOUS_ACCESS_ROLE:-Anonymous User}
INFRAHUB_API_CORS_ALLOW_CREDENTIALS: ${INFRAHUB_API_CORS_ALLOW_CREDENTIALS:-true}
INFRAHUB_API_CORS_ALLOW_HEADERS:
INFRAHUB_API_CORS_ALLOW_METHODS:
INFRAHUB_API_CORS_ALLOW_ORIGINS:
INFRAHUB_BROKER_ADDRESS: ${INFRAHUB_BROKER_ADDRESS:-localhost}
INFRAHUB_BROKER_DRIVER: ${INFRAHUB_BROKER_DRIVER:-rabbitmq}
INFRAHUB_BROKER_ENABLE: ${INFRAHUB_BROKER_ENABLE:-true}
INFRAHUB_BROKER_MAXIMUM_CONCURRENT_MESSAGES: ${INFRAHUB_BROKER_MAXIMUM_CONCURRENT_MESSAGES:-2}
INFRAHUB_BROKER_MAXIMUM_MESSAGE_RETRIES: ${INFRAHUB_BROKER_MAXIMUM_MESSAGE_RETRIES:-10}
INFRAHUB_BROKER_NAMESPACE: ${INFRAHUB_BROKER_NAMESPACE:-infrahub}
INFRAHUB_BROKER_PASSWORD: &broker_password ${INFRAHUB_BROKER_PASSWORD:-infrahub}
INFRAHUB_BROKER_PORT:
INFRAHUB_BROKER_RABBITMQ_HTTP_PORT:
INFRAHUB_BROKER_TLS_CA_FILE:
INFRAHUB_BROKER_TLS_ENABLED: ${INFRAHUB_BROKER_TLS_ENABLED:-false}
INFRAHUB_BROKER_TLS_INSECURE: ${INFRAHUB_BROKER_TLS_INSECURE:-false}
INFRAHUB_BROKER_USERNAME: &broker_username ${INFRAHUB_BROKER_USERNAME:-infrahub}
INFRAHUB_BROKER_VIRTUALHOST: ${INFRAHUB_BROKER_VIRTUALHOST:-/}
INFRAHUB_CACHE_ADDRESS: ${INFRAHUB_CACHE_ADDRESS:-localhost}
INFRAHUB_CACHE_CLEAN_UP_DEADLOCKS_INTERVAL_MINS: ${INFRAHUB_CACHE_CLEAN_UP_DEADLOCKS_INTERVAL_MINS:-15}
INFRAHUB_CACHE_DATABASE: ${INFRAHUB_CACHE_DATABASE:-0}
INFRAHUB_CACHE_DRIVER: ${INFRAHUB_CACHE_DRIVER:-redis}
INFRAHUB_CACHE_ENABLE: ${INFRAHUB_CACHE_ENABLE:-true}
INFRAHUB_CACHE_PASSWORD: &cache_password ${INFRAHUB_CACHE_PASSWORD:-}
INFRAHUB_CACHE_PORT:
INFRAHUB_CACHE_TLS_CA_FILE:
INFRAHUB_CACHE_TLS_ENABLED: ${INFRAHUB_CACHE_TLS_ENABLED:-false}
INFRAHUB_CACHE_TLS_INSECURE: ${INFRAHUB_CACHE_TLS_INSECURE:-false}
INFRAHUB_CACHE_USERNAME: &cache_username ${INFRAHUB_CACHE_USERNAME:-}
INFRAHUB_CONFIG:
INFRAHUB_DB_ADDRESS: ${INFRAHUB_DB_ADDRESS:-localhost}
INFRAHUB_DB_DATABASE:
INFRAHUB_DB_MAX_CONCURRENT_QUERIES: ${INFRAHUB_DB_MAX_CONCURRENT_QUERIES:-0}
INFRAHUB_DB_MAX_CONCURRENT_QUERIES_DELAY: ${INFRAHUB_DB_MAX_CONCURRENT_QUERIES_DELAY:-0.01}
INFRAHUB_DB_MAX_DEPTH_SEARCH_HIERARCHY: ${INFRAHUB_DB_MAX_DEPTH_SEARCH_HIERARCHY:-5}
INFRAHUB_DB_PASSWORD: ${INFRAHUB_DB_PASSWORD:-admin}
INFRAHUB_DB_POLICY:
INFRAHUB_DB_PORT: ${INFRAHUB_DB_PORT:-7687}
INFRAHUB_DB_PROTOCOL: ${INFRAHUB_DB_PROTOCOL:-bolt}
INFRAHUB_DB_QUERY_SIZE_LIMIT: ${INFRAHUB_DB_QUERY_SIZE_LIMIT:-5000}
INFRAHUB_DB_RETRY_LIMIT: ${INFRAHUB_DB_RETRY_LIMIT:-3}
INFRAHUB_DB_TLS_CA_FILE:
INFRAHUB_DB_TLS_ENABLED: ${INFRAHUB_DB_TLS_ENABLED:-false}
INFRAHUB_DB_TLS_INSECURE: ${INFRAHUB_DB_TLS_INSECURE:-false}
INFRAHUB_DB_TYPE: ${INFRAHUB_DB_TYPE:-neo4j}
INFRAHUB_DB_USERNAME: ${INFRAHUB_DB_USERNAME:-neo4j}
INFRAHUB_DOCS_INDEX_PATH: ${INFRAHUB_DOCS_INDEX_PATH:-/opt/infrahub/docs/build/search-index.json}
INFRAHUB_EXPERIMENTAL_GRAPHQL_ENUMS: ${INFRAHUB_EXPERIMENTAL_GRAPHQL_ENUMS:-false}
INFRAHUB_EXPERIMENTAL_VALUE_DB_INDEX: ${INFRAHUB_EXPERIMENTAL_VALUE_DB_INDEX:-false}
INFRAHUB_GIT_APPEND_GIT_SUFFIX:
INFRAHUB_GIT_GLOBAL_CONFIG_FILE: ${INFRAHUB_GIT_GLOBAL_CONFIG_FILE:-/opt/infrahub/.gitconfig}
INFRAHUB_GIT_IMPORT_SYNC_BRANCH_NAMES:
INFRAHUB_GIT_REPOSITORIES_DIRECTORY: ${INFRAHUB_GIT_REPOSITORIES_DIRECTORY:-repositories}
INFRAHUB_GIT_SYNC_INTERVAL: ${INFRAHUB_GIT_SYNC_INTERVAL:-10}
INFRAHUB_GIT_USER_EMAIL: ${INFRAHUB_GIT_USER_EMAIL:-infrahub@opsmill.com}
INFRAHUB_GIT_USER_NAME: ${INFRAHUB_GIT_USER_NAME:-Infrahub}
INFRAHUB_GIT_USE_EXPLICIT_MERGE_COMMIT: ${INFRAHUB_GIT_USE_EXPLICIT_MERGE_COMMIT:-false}
INFRAHUB_HTTP_TIMEOUT: ${INFRAHUB_HTTP_TIMEOUT:-10}
INFRAHUB_HTTP_TLS_CA_BUNDLE:
INFRAHUB_HTTP_TLS_INSECURE: ${INFRAHUB_HTTP_TLS_INSECURE:-false}
INFRAHUB_INITIAL_ADMIN_PASSWORD: ${INFRAHUB_INITIAL_ADMIN_PASSWORD:-infrahub}
INFRAHUB_INITIAL_ADMIN_TOKEN:
INFRAHUB_INITIAL_AGENT_PASSWORD:
INFRAHUB_INITIAL_AGENT_TOKEN:
INFRAHUB_INITIAL_DEFAULT_BRANCH: ${INFRAHUB_INITIAL_DEFAULT_BRANCH:-main}
INFRAHUB_INTERNAL_ADDRESS:
INFRAHUB_LOGGING_REMOTE_API_SERVER_DSN:
INFRAHUB_LOGGING_REMOTE_ENABLE: ${INFRAHUB_LOGGING_REMOTE_ENABLE:-false}
INFRAHUB_LOGGING_REMOTE_FRONTEND_DSN:
INFRAHUB_LOGGING_REMOTE_GIT_AGENT_DSN:
INFRAHUB_LOG_LEVEL:
INFRAHUB_MISC_MAXIMUM_VALIDATOR_EXECUTION_TIME: ${INFRAHUB_MISC_MAXIMUM_VALIDATOR_EXECUTION_TIME:-1800}
INFRAHUB_MISC_PRINT_QUERY_DETAILS: ${INFRAHUB_MISC_PRINT_QUERY_DETAILS:-false}
INFRAHUB_MISC_RESPONSE_DELAY: ${INFRAHUB_MISC_RESPONSE_DELAY:-0}
INFRAHUB_MISC_START_BACKGROUND_RUNNER: ${INFRAHUB_MISC_START_BACKGROUND_RUNNER:-true}
INFRAHUB_PERMISSION_BACKENDS: ${INFRAHUB_PERMISSION_BACKENDS:-["infrahub.permissions.LocalPermissionBackend"]}
INFRAHUB_POLICY_REQUIRED_PROPOSED_CHANGE_APPROVALS: ${INFRAHUB_POLICY_REQUIRED_PROPOSED_CHANGE_APPROVALS:-0}
INFRAHUB_POLICY_REVOKE_PROPOSED_CHANGE_APPROVALS: ${INFRAHUB_POLICY_REVOKE_PROPOSED_CHANGE_APPROVALS:-false}
INFRAHUB_PRODUCTION:
INFRAHUB_PUBLIC_URL:
INFRAHUB_SCHEMA_STRICT_MODE: ${INFRAHUB_SCHEMA_STRICT_MODE:-true}
INFRAHUB_SECURITY_ACCESS_TOKEN_LIFETIME: ${INFRAHUB_SECURITY_ACCESS_TOKEN_LIFETIME:-3600}
INFRAHUB_SECURITY_REFRESH_TOKEN_LIFETIME: ${INFRAHUB_SECURITY_REFRESH_TOKEN_LIFETIME:-2592000}
INFRAHUB_SECURITY_RESTRICT_UNTRUSTED_JINJA2_FILTERS: ${INFRAHUB_SECURITY_RESTRICT_UNTRUSTED_JINJA2_FILTERS:-true}
INFRAHUB_SECURITY_SECRET_KEY:
INFRAHUB_STORAGE_BUCKET_NAME:
INFRAHUB_STORAGE_CUSTOM_DOMAIN:
INFRAHUB_STORAGE_DEFAULT_ACL: ${INFRAHUB_STORAGE_DEFAULT_ACL:-private}
INFRAHUB_STORAGE_DRIVER: ${INFRAHUB_STORAGE_DRIVER:-local}
INFRAHUB_STORAGE_ENDPOINT_URL:
INFRAHUB_STORAGE_LOCAL_PATH: ${INFRAHUB_STORAGE_LOCAL_PATH:-/opt/infrahub/storage}
INFRAHUB_STORAGE_QUERYSTRING_AUTH: ${INFRAHUB_STORAGE_QUERYSTRING_AUTH:-false}
INFRAHUB_STORAGE_USE_SSL: ${INFRAHUB_STORAGE_USE_SSL:-true}
INFRAHUB_TELEMETRY_ENDPOINT: ${INFRAHUB_TELEMETRY_ENDPOINT:-https://telemetry.opsmill.cloud/infrahub}
INFRAHUB_TELEMETRY_INTERVAL:
INFRAHUB_TELEMETRY_OPTOUT: ${INFRAHUB_TELEMETRY_OPTOUT:-false}
INFRAHUB_TIMEOUT:
INFRAHUB_TRACE_ENABLE: ${INFRAHUB_TRACE_ENABLE:-false}
INFRAHUB_TRACE_EXPORTER_ENDPOINT:
INFRAHUB_TRACE_EXPORTER_PROTOCOL: ${INFRAHUB_TRACE_EXPORTER_PROTOCOL:-grpc}
INFRAHUB_TRACE_EXPORTER_TYPE: ${INFRAHUB_TRACE_EXPORTER_TYPE:-console}
INFRAHUB_TRACE_INSECURE: ${INFRAHUB_TRACE_INSECURE:-true}
INFRAHUB_WORKFLOW_ADDRESS: ${INFRAHUB_WORKFLOW_ADDRESS:-localhost}
INFRAHUB_WORKFLOW_DEFAULT_WORKER_TYPE: ${INFRAHUB_WORKFLOW_DEFAULT_WORKER_TYPE:-infrahubasync}
INFRAHUB_WORKFLOW_DRIVER: ${INFRAHUB_WORKFLOW_DRIVER:-worker}
INFRAHUB_WORKFLOW_ENABLE: ${INFRAHUB_WORKFLOW_ENABLE:-true}
INFRAHUB_WORKFLOW_EXTRA_LOGGERS:
INFRAHUB_WORKFLOW_EXTRA_LOG_LEVEL: ${INFRAHUB_WORKFLOW_EXTRA_LOG_LEVEL:-INFO}
INFRAHUB_WORKFLOW_FLOW_RUN_COUNT_CACHE_THRESHOLD: ${INFRAHUB_WORKFLOW_FLOW_RUN_COUNT_CACHE_THRESHOLD:-100000}
INFRAHUB_WORKFLOW_PORT:
INFRAHUB_WORKFLOW_TLS_ENABLED: ${INFRAHUB_WORKFLOW_TLS_ENABLED:-false}
INFRAHUB_WORKFLOW_WORKER_POLLING_INTERVAL: ${INFRAHUB_WORKFLOW_WORKER_POLLING_INTERVAL:-2}
OTEL_RESOURCE_ATTRIBUTES:
x-infrahub-sso: &infrahub_sso
INFRAHUB_SECURITY_SSO_USER_DEFAULT_GROUP:
INFRAHUB_SECURITY_OAUTH2_PROVIDERS:
INFRAHUB_SECURITY_OAUTH2_PROVIDER_SETTINGS:
INFRAHUB_SECURITY_OIDC_PROVIDERS:
INFRAHUB_SECURITY_OIDC_PROVIDER_SETTINGS:
INFRAHUB_OAUTH2_PROVIDER1_CLIENT_ID:
INFRAHUB_OAUTH2_PROVIDER1_CLIENT_SECRET:
INFRAHUB_OAUTH2_PROVIDER1_AUTHORIZATION_URL:
INFRAHUB_OAUTH2_PROVIDER1_TOKEN_URL:
INFRAHUB_OAUTH2_PROVIDER1_USERINFO_URL:
INFRAHUB_OAUTH2_PROVIDER1_DISPLAY_LABEL:
INFRAHUB_OAUTH2_PROVIDER1_ICON:
INFRAHUB_OIDC_PROVIDER1_CLIENT_ID:
INFRAHUB_OIDC_PROVIDER1_CLIENT_SECRET:
INFRAHUB_OIDC_PROVIDER1_DISCOVERY_URL:
INFRAHUB_OIDC_PROVIDER1_DISPLAY_LABEL:
INFRAHUB_OIDC_PROVIDER1_ICON:
x-task-manager-config:
INFRAHUB_TASKMANAGER_DB_USER: ${INFRAHUB_TASKMANAGER_DB_USER:-postgres}
INFRAHUB_TASKMANAGER_DB_PASSWORD: ${INFRAHUB_TASKMANAGER_DB_PASSWORD:-postgres}
INFRAHUB_TASKMANAGER_DB_DATABASE: ${INFRAHUB_TASKMANAGER_DB_DATABASE:-prefect}
services:
message-queue:
image: ${MESSAGE_QUEUE_DOCKER_IMAGE:-rabbitmq:4.2.1-management}
restart: unless-stopped
environment:
RABBITMQ_DEFAULT_USER: *broker_username
RABBITMQ_DEFAULT_PASS: *broker_password
healthcheck:
test: rabbitmq-diagnostics -q check_port_connectivity
interval: 5s
timeout: 30s
retries: 10
start_period: 3s
ports:
- 15692:15692
cache:
image: ${CACHE_DOCKER_IMAGE:-redis:8.4.0}
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
interval: 5s
timeout: 5s
retries: 3
database:
image: ${NEO4J_DOCKER_IMAGE:-neo4j:2025.10.1-community}
restart: unless-stopped
environment:
NEO4J_AUTH: ${INFRAHUB_DB_USERNAME:-neo4j}/${INFRAHUB_DB_PASSWORD:-admin}
NEO4J_dbms_security_procedures_unrestricted: "apoc.*"
NEO4J_dbms_security_auth__minimum__password__length: 4
volumes:
- "database_data:/data"
- "database_logs:/logs"
healthcheck:
test: wget -O /dev/null http://localhost:7474 || exit 1
interval: 2s
timeout: 10s
retries: 20
start_period: 3s
ports:
- 2004:2004
- 6362:6362
task-manager:
image: "${INFRAHUB_DOCKER_IMAGE:-registry.opsmill.io/opsmill/infrahub}:${VERSION:-1.7.3}"
command: uvicorn --host 0.0.0.0 --port 4200 --factory infrahub.prefect_server.app:create_infrahub_prefect
restart: unless-stopped
depends_on:
task-manager-db:
condition: service_healthy
environment:
PREFECT_API_DATABASE_CONNECTION_URL: postgresql+asyncpg://${INFRAHUB_TASKMANAGER_DB_USER:-postgres}:${INFRAHUB_TASKMANAGER_DB_PASSWORD:-postgres}@task-manager-db:5432/${INFRAHUB_TASKMANAGER_DB_DATABASE:-prefect}
healthcheck:
test: curl -s -f -o /dev/null http://localhost:4200/api/health || exit 1
interval: 5s
timeout: 5s
retries: 20
start_period: 10s
task-manager-db:
image: "${POSTGRES_DOCKER_IMAGE:-pgautoupgrade/pgautoupgrade:18-alpine}"
restart: unless-stopped
environment:
- POSTGRES_USER=${INFRAHUB_TASKMANAGER_DB_USER:-postgres}
- POSTGRES_PASSWORD=${INFRAHUB_TASKMANAGER_DB_PASSWORD:-postgres}
- POSTGRES_DB=${INFRAHUB_TASKMANAGER_DB_DATABASE:-prefect}
volumes:
- workflow_db:/var/lib/postgresql/18/docker
healthcheck:
test:
- "CMD-SHELL"
- "pg_isready -q -d ${INFRAHUB_TASKMANAGER_DB_DATABASE:-prefect} -U ${INFRAHUB_TASKMANAGER_DB_USER:-postgres}"
interval: 10s
timeout: 5s
retries: 5
infrahub-server:
image: "${INFRAHUB_DOCKER_IMAGE:-registry.opsmill.io/opsmill/infrahub}:${VERSION:-1.7.3}"
restart: unless-stopped
command: >
gunicorn --config backend/infrahub/serve/gunicorn_config.py
-w ${WEB_CONCURRENCY:-4}
--logger-class infrahub.serve.log.GunicornLogger
infrahub.server:app
depends_on:
database:
condition: service_healthy
message-queue:
condition: service_healthy
cache:
condition: service_healthy
task-manager:
condition: service_healthy
environment:
<<: [*infrahub_config, *infrahub_sso]
INFRAHUB_PRODUCTION: ${INFRAHUB_PRODUCTION:-false}
INFRAHUB_LOG_LEVEL: ${INFRAHUB_LOG_LEVEL:-INFO}
INFRAHUB_BROKER_ADDRESS: ${INFRAHUB_BROKER_ADDRESS:-message-queue}
INFRAHUB_CACHE_ADDRESS: ${INFRAHUB_CACHE_ADDRESS:-cache}
INFRAHUB_DB_ADDRESS: ${INFRAHUB_DB_ADDRESS:-database}
INFRAHUB_WORKFLOW_ADDRESS: ${INFRAHUB_WORKFLOW_ADDRESS:-task-manager}
INFRAHUB_INITIAL_ADMIN_TOKEN: ${INFRAHUB_INITIAL_ADMIN_TOKEN:-06438eb2-8019-4776-878c-0941b1f1d1ec}
INFRAHUB_INITIAL_AGENT_TOKEN: ${INFRAHUB_INITIAL_AGENT_TOKEN:-44af444d-3b26-410d-9546-b758657e026c}
INFRAHUB_SECURITY_SECRET_KEY: ${INFRAHUB_SECURITY_SECRET_KEY:-327f747f-efac-42be-9e73-999f08f86b92"}
INFRAHUB_WORKFLOW_PORT: ${INFRAHUB_WORKFLOW_PORT:-4200}
PREFECT_API_URL: http://${INFRAHUB_WORKFLOW_ADDRESS:-task-manager}:${INFRAHUB_WORKFLOW_PORT:-4200}/api
ports:
- 8000:8000
volumes:
- "storage_data:${INFRAHUB_STORAGE_LOCAL_PATH:-/opt/infrahub/storage}"
- "workflow_data:/opt/infrahub/workflow"
tty: true
healthcheck:
test: curl -s -f -o /dev/null http://localhost:8000/api/config || exit 1
interval: 5s
timeout: 5s
retries: 20
start_period: 10s
task-worker:
deploy:
mode: replicated
replicas: 2
image: "${INFRAHUB_DOCKER_IMAGE:-registry.opsmill.io/opsmill/infrahub}:${VERSION:-1.7.3}"
command: prefect worker start --type infrahubasync --pool infrahub-worker --with-healthcheck
restart: unless-stopped
depends_on:
- infrahub-server
environment:
<<: *infrahub_config
INFRAHUB_PRODUCTION: ${INFRAHUB_PRODUCTION:-false}
INFRAHUB_LOG_LEVEL: ${INFRAHUB_LOG_LEVEL:-DEBUG}
INFRAHUB_GIT_REPOSITORIES_DIRECTORY: ${INFRAHUB_GIT_REPOSITORIES_DIRECTORY:-/opt/infrahub/git}
INFRAHUB_API_TOKEN: ${INFRAHUB_INITIAL_AGENT_TOKEN:-44af444d-3b26-410d-9546-b758657e026c}
INFRAHUB_SECURITY_SECRET_KEY: ${INFRAHUB_SECURITY_SECRET_KEY:-327f747f-efac-42be-9e73-999f08f86b92"}
INFRAHUB_ADDRESS: ${INFRAHUB_ADDRESS:-http://infrahub-server:8000}
INFRAHUB_INTERNAL_ADDRESS: ${INFRAHUB_INTERNAL_ADDRESS:-http://infrahub-server:8000}
INFRAHUB_BROKER_ADDRESS: ${INFRAHUB_BROKER_ADDRESS:-message-queue}
INFRAHUB_CACHE_ADDRESS: ${INFRAHUB_CACHE_ADDRESS:-cache}
INFRAHUB_DB_ADDRESS: ${INFRAHUB_DB_ADDRESS:-database}
INFRAHUB_WORKFLOW_ADDRESS: ${INFRAHUB_WORKFLOW_ADDRESS:-task-manager}
INFRAHUB_TIMEOUT: ${INFRAHUB_TIMEOUT:-60}
INFRAHUB_WORKFLOW_PORT: ${INFRAHUB_WORKFLOW_PORT:-4200}
PREFECT_API_URL: http://${INFRAHUB_WORKFLOW_ADDRESS:-task-manager}:${INFRAHUB_WORKFLOW_PORT:-4200}/api
tty: true
volumes:
database_data:
database_logs:
storage_data:
workflow_db:
workflow_data: