122 lines
4.2 KiB
YAML
122 lines
4.2 KiB
YAML
# =============================================================================
|
|
# SEALED CI - AIR-GAPPED TESTING ENVIRONMENT
|
|
# =============================================================================
|
|
# Sealed/air-gapped CI environment for testing offline functionality.
|
|
# All services run in isolated network with no external egress.
|
|
#
|
|
# Usage:
|
|
# docker compose -f docker-compose.sealed-ci.yml up -d
|
|
# =============================================================================
|
|
|
|
x-release-labels: &release-labels
|
|
com.stellaops.profile: 'sealed-ci'
|
|
com.stellaops.airgap.mode: 'sealed'
|
|
|
|
networks:
|
|
sealed-ci:
|
|
driver: bridge
|
|
|
|
volumes:
|
|
sealed-postgres-data:
|
|
sealed-valkey-data:
|
|
|
|
services:
|
|
postgres:
|
|
image: docker.io/library/postgres@sha256:8e97b8526ed19304b144f7478bc9201646acf0723cdc6e4b19bc9eb34879a27e
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: sealedci
|
|
POSTGRES_PASSWORD: sealedci-secret
|
|
POSTGRES_DB: stellaops
|
|
volumes:
|
|
- sealed-postgres-data:/var/lib/postgresql/data
|
|
networks:
|
|
- sealed-ci
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U sealedci -d stellaops"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
labels: *release-labels
|
|
|
|
valkey:
|
|
image: docker.io/valkey/valkey:9.0.1-alpine
|
|
restart: unless-stopped
|
|
command: ["valkey-server", "--appendonly", "yes"]
|
|
volumes:
|
|
- sealed-valkey-data:/data
|
|
networks:
|
|
- sealed-ci
|
|
healthcheck:
|
|
test: ["CMD", "valkey-cli", "ping"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
labels: *release-labels
|
|
|
|
authority:
|
|
image: registry.stella-ops.org/stellaops/authority@sha256:a8e8faec44a579aa5714e58be835f25575710430b1ad2ccd1282a018cd9ffcdd
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
valkey:
|
|
condition: service_healthy
|
|
restart: unless-stopped
|
|
environment:
|
|
ASPNETCORE_URLS: http://+:5088
|
|
STELLAOPS_AUTHORITY__ISSUER: http://authority.sealed-ci.local
|
|
STELLAOPS_AUTHORITY__STORAGE__DRIVER: postgres
|
|
STELLAOPS_AUTHORITY__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=authority;Username=sealedci;Password=sealedci-secret"
|
|
STELLAOPS_AUTHORITY__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
|
|
STELLAOPS_AUTHORITY__PLUGINDIRECTORIES__0: /app/plugins
|
|
STELLAOPS_AUTHORITY__PLUGINS__CONFIGURATIONDIRECTORY: /app/plugins
|
|
STELLAOPS_AUTHORITY__SECURITY__SENDERCONSTRAINTS__DPOP__ENABLED: 'true'
|
|
STELLAOPS_AUTHORITY__SECURITY__SENDERCONSTRAINTS__MTLS__ENABLED: 'true'
|
|
STELLAOPS_AUTHORITY__AIRGAP__EGRESS__MODE: Sealed
|
|
volumes:
|
|
- ../services/sealed-mode-ci/authority.harness.yaml:/etc/authority.yaml:ro
|
|
- ../services/sealed-mode-ci/plugins:/app/plugins:ro
|
|
- ../../certificates:/certificates:ro
|
|
ports:
|
|
- '5088:5088'
|
|
networks:
|
|
- sealed-ci
|
|
labels: *release-labels
|
|
|
|
signer:
|
|
image: registry.stella-ops.org/stellaops/signer@sha256:8bfef9a75783883d49fc18e3566553934e970b00ee090abee9cb110d2d5c3298
|
|
depends_on:
|
|
- authority
|
|
restart: unless-stopped
|
|
environment:
|
|
ASPNETCORE_URLS: http://+:6088
|
|
SIGNER__AUTHORITY__BASEURL: http://authority:5088
|
|
SIGNER__POE__INTROSPECTURL: http://authority:5088/device-code
|
|
SIGNER__STORAGE__DRIVER: postgres
|
|
SIGNER__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=signer;Username=sealedci;Password=sealedci-secret"
|
|
SIGNER__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
|
|
SIGNER__SEALED__MODE: Enabled
|
|
ports:
|
|
- '6088:6088'
|
|
networks:
|
|
- sealed-ci
|
|
labels: *release-labels
|
|
|
|
attestor:
|
|
image: registry.stella-ops.org/stellaops/attestor@sha256:5cc417948c029da01dccf36e4645d961a3f6d8de7e62fe98d845f07cd2282114
|
|
depends_on:
|
|
- signer
|
|
restart: unless-stopped
|
|
environment:
|
|
ASPNETCORE_URLS: http://+:7088
|
|
ATTESTOR__SIGNER__BASEURL: http://signer:6088
|
|
ATTESTOR__STORAGE__DRIVER: postgres
|
|
ATTESTOR__STORAGE__POSTGRES__CONNECTIONSTRING: "Host=postgres;Port=5432;Database=attestor;Username=sealedci;Password=sealedci-secret"
|
|
ATTESTOR__CACHE__REDIS__CONNECTIONSTRING: "valkey:6379"
|
|
ATTESTOR__SEALED__MODE: Enabled
|
|
ports:
|
|
- '7088:7088'
|
|
networks:
|
|
- sealed-ci
|
|
labels: *release-labels
|