devops folders consolidate

deploy/compose/docker-compose.crypto-sim.yml

@@ -0,0 +1,119 @@
+# =============================================================================
+# STELLA OPS - CRYPTO SIMULATION OVERLAY
+# =============================================================================
+# Universal crypto simulation service for testing sovereign crypto without
+# licensed hardware or certified modules.
+#
+# This overlay provides the sim-crypto-service which simulates:
+# - GOST R 34.10-2012 (Russia): GOST12-256, GOST12-512, ru.magma.sim, ru.kuznyechik.sim
+# - SM2/SM3/SM4 (China): SM2, sm.sim, sm2.sim
+# - Post-Quantum: DILITHIUM3, FALCON512, pq.sim
+# - FIPS/eIDAS/KCMVP: fips.sim, eidas.sim, kcmvp.sim, world.sim
+#
+# Usage with China compliance:
+#   docker compose -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-china.yml \
+#     -f docker-compose.crypto-sim.yml up -d
+#
+# Usage with Russia compliance:
+#   docker compose -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-russia.yml \
+#     -f docker-compose.crypto-sim.yml up -d
+#
+# Usage with EU compliance:
+#   docker compose -f docker-compose.stella-ops.yml \
+#     -f docker-compose.compliance-eu.yml \
+#     -f docker-compose.crypto-sim.yml up -d
+#
+# IMPORTANT: This is for TESTING/DEVELOPMENT ONLY.
+# - Uses deterministic HMAC-SHA256 for SM/GOST/PQ (not real algorithms)
+# - Uses static ECDSA P-256 key for FIPS/eIDAS/KCMVP
+# - NOT suitable for production or compliance certification
+#
+# =============================================================================
+
+x-crypto-sim-labels: &crypto-sim-labels
+  com.stellaops.component: "crypto-sim"
+  com.stellaops.profile: "simulation"
+  com.stellaops.production: "false"
+
+x-sim-crypto-env: &sim-crypto-env
+  STELLAOPS_CRYPTO_ENABLE_SIM: "1"
+  STELLAOPS_CRYPTO_SIM_URL: "http://sim-crypto:8080"
+
+networks:
+  stellaops:
+    external: true
+    name: stellaops
+
+services:
+  # ---------------------------------------------------------------------------
+  # Sim Crypto Service - Universal sovereign crypto simulator
+  # ---------------------------------------------------------------------------
+  sim-crypto:
+    build:
+      context: ../services/crypto/sim-crypto-service
+      dockerfile: Dockerfile
+    image: registry.stella-ops.org/stellaops/sim-crypto:dev
+    container_name: stellaops-sim-crypto
+    restart: unless-stopped
+    environment:
+      ASPNETCORE_URLS: "http://0.0.0.0:8080"
+      ASPNETCORE_ENVIRONMENT: "Development"
+    ports:
+      - "${SIM_CRYPTO_PORT:-18090}:8080"
+    networks:
+      - stellaops
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/keys"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+    labels: *crypto-sim-labels
+
+  # ---------------------------------------------------------------------------
+  # Override services to use sim-crypto
+  # ---------------------------------------------------------------------------
+
+  # Authority - Enable sim crypto
+  authority:
+    environment:
+      <<: *sim-crypto-env
+    labels:
+      com.stellaops.crypto.simulator: "enabled"
+
+  # Signer - Enable sim crypto
+  signer:
+    environment:
+      <<: *sim-crypto-env
+    labels:
+      com.stellaops.crypto.simulator: "enabled"
+
+  # Attestor - Enable sim crypto
+  attestor:
+    environment:
+      <<: *sim-crypto-env
+    labels:
+      com.stellaops.crypto.simulator: "enabled"
+
+  # Scanner Web - Enable sim crypto
+  scanner-web:
+    environment:
+      <<: *sim-crypto-env
+    labels:
+      com.stellaops.crypto.simulator: "enabled"
+
+  # Scanner Worker - Enable sim crypto
+  scanner-worker:
+    environment:
+      <<: *sim-crypto-env
+    labels:
+      com.stellaops.crypto.simulator: "enabled"
+
+  # Excititor - Enable sim crypto
+  excititor:
+    environment:
+      <<: *sim-crypto-env
+    labels:
+      com.stellaops.crypto.simulator: "enabled"