docker-compose.yml

version: '3.2'

services:
  vault:
    image: "vault:0.7.3"
    cap_add:
      - IPC_LOCK
    ports: ["8200:8200"]
    volumes: 
      - ./keys/vault:/vault/config
    command: vault server -config /vault/config/vault.hcl 

  concourse-db:
    image: postgres:9.5
    environment:
      POSTGRES_DB: concourse
      POSTGRES_USER: concourse
      POSTGRES_PASSWORD: changeme
      PGDATA: /database

  concourse-web:
    image: concourse/concourse:3.3.1
    links: [concourse-db]
    command: web --vault-insecure-skip-verify --vault-auth-param role_id="${CONCOURSE_ROLE_ID}" --vault-auth-param secret_id="${CONCOURSE_SECRET_ID}"
    depends_on: [concourse-db]
    ports: ["8080:8080"]
    volumes: ["./keys/web:/concourse-keys"]
    restart: unless-stopped # required so that it retries until conocurse-db comes up
    environment:
      CONCOURSE_BASIC_AUTH_USERNAME: concourse
      CONCOURSE_BASIC_AUTH_PASSWORD: changeme
      CONCOURSE_EXTERNAL_URL: "${CONCOURSE_EXTERNAL_URL}"
      CONCOURSE_POSTGRES_HOST: concourse-db
      CONCOURSE_POSTGRES_USER: concourse
      CONCOURSE_POSTGRES_PASSWORD: changeme
      CONCOURSE_POSTGRES_DATABASE: concourse
      CONCOURSE_VAULT_URL: https://vault:8200
      CONCOURSE_VAULT_TLS_INSECURE_SKIP_VERIFY: "true"
      CONCOURSE_VAULT_AUTH_BACKEND: approle
      CONCOURSE_VAULT_PATH_PREFIX: /secret/concourse

  concourse-worker:
    image: concourse/concourse:3.3.1
    privileged: true
    links: [concourse-web]
    depends_on: [concourse-web]
    # The naive driver workaround for https://github.com/concourse/concourse/issues/1230
    command: "worker --baggageclaim-driver=naive"
    volumes: ["./keys/worker:/concourse-keys"]
    environment:
      CONCOURSE_TSA_HOST: concourse-web