ardur/docker-compose.yml at dev · ArdurAI/ardur · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
# Ardur — local development stack with SPIRE, TLS, and full governance.
# Start:  docker compose up --build
# Stop:   docker compose down -v

services:
  # ── SPIRE (SPIFFE workload identity) ──────────────────────────────────────

  # Named volumes are created root-owned, while the SPIRE server image runs as
  # uid 1000. Prepare the server datastore and join-token volume once before
  # starting any uid-1000 SPIRE process.
  spire-volume-init:
    image: alpine:3.22
    user: "0:0"
    entrypoint:
      - /bin/sh
      - -ec
      - |
        chown -R 1000:1000 /run/spire/server-data /run/spire/shared
        chmod 0750 /run/spire/server-data /run/spire/shared
    volumes:
      - spire-server-data:/run/spire/server-data
      - spire-shared:/run/spire/shared

  spire-server:
    image: ghcr.io/spiffe/spire-server:1.14.4
    command:
      - -config
      - /run/spire/config/server.conf
    volumes:
      - spire-server-data:/run/spire/data
      - spire-shared:/run/spire/sockets
      - ./deploy/local/spire/server.conf:/run/spire/config/server.conf:ro
    depends_on:
      spire-volume-init:
        condition: service_completed_successfully
    ports:
      - "${ARDUR_SPIRE_SERVER_PORT:-8081}:8081"
    healthcheck:
      test: ["CMD", "/opt/spire/bin/spire-server", "healthcheck", "-socketPath", "/run/spire/sockets/server.sock"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 5s
    restart: unless-stopped

  spire-init:
    build:
      context: .
      dockerfile: deploy/local/spire/Dockerfile.init
    entrypoint: ["/bin/sh", "/tmp/setup.sh"]
    volumes:
      - spire-shared:/tmp/spire-shared
      - spire-shared:/run/spire/sockets
      - ./deploy/local/spire/setup.sh:/tmp/setup.sh:ro
    depends_on:
      spire-server:
        condition: service_healthy

  spire-agent:
    image: ghcr.io/spiffe/spire-agent:1.14.4
    command:
      - -config
      - /run/spire/config/agent.conf
      - -joinTokenFile
      - /tmp/spire-shared/join_token
    volumes:
      - spire-agent-data:/run/spire/data
      - spire-shared:/tmp/spire-shared:ro
      - spire-shared:/run/spire/sockets
      - spire-shared:/run/spire/bundle:ro
      - ./deploy/local/spire/agent.conf:/run/spire/config/agent.conf:ro
    depends_on:
      spire-init:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "/opt/spire/bin/spire-agent", "healthcheck", "-socketPath", "/run/spire/sockets/agent.sock"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 5s
    restart: unless-stopped

  # ── Ardur services ────────────────────────────────────────────────────────

  proxy:
    build:
      context: .
      dockerfile: Dockerfile.proxy
    ports:
      - "${ARDUR_PROXY_PORT:-8443}:8443"
    environment:
      - ARDUR_NO_TLS=${ARDUR_NO_TLS:-}
      - ARDUR_API_TOKEN=${ARDUR_API_TOKEN:-}
      - VIBAP_API_TOKEN=${ARDUR_API_TOKEN:-}
      - ARDUR_RATE_LIMIT_RPS=${ARDUR_RATE_LIMIT_RPS:-100}
      - ARDUR_RATE_LIMIT_BURST=${ARDUR_RATE_LIMIT_BURST:-200}
      - SPIFFE_ENDPOINT_SOCKET=unix:///run/spire/sockets/agent.sock
    volumes:
      - ardur-data:/home/ardur/.ardur
      - spire-shared:/run/spire/sockets:ro
    depends_on:
      spire-agent:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python3", "-c", "import urllib.request,ssl;c=ssl.create_default_context();c.check_hostname=False;c.verify_mode=ssl.CERT_NONE;urllib.request.urlopen('https://localhost:8443/health',context=c)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512M

  hub:
    build:
      context: .
      dockerfile: Dockerfile.hub
    ports:
      - "${ARDUR_HUB_PORT:-8765}:8765"
    environment:
      - ARDUR_NO_TLS=${ARDUR_NO_TLS:-}
      - ARDUR_RATE_LIMIT_RPS=${ARDUR_RATE_LIMIT_RPS:-100}
      - ARDUR_RATE_LIMIT_BURST=${ARDUR_RATE_LIMIT_BURST:-200}
      - ARDUR_PERSONAL_HUB_URL=${ARDUR_PERSONAL_HUB_URL:-https://proxy:8443}
      - SPIFFE_ENDPOINT_SOCKET=unix:///run/spire/sockets/agent.sock
    volumes:
      - ardur-data:/home/ardur/.ardur
      - spire-shared:/run/spire/sockets:ro
    depends_on:
      proxy:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python3", "-c", "import urllib.request,ssl;c=ssl.create_default_context();c.check_hostname=False;c.verify_mode=ssl.CERT_NONE;urllib.request.urlopen('https://localhost:8765/health',context=c)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512M

volumes:
  spire-server-data:
  spire-agent-data:
  spire-shared:
  ardur-data: