labca/build/docker-compose.yml

version: '3'
name: labca
services:
  boulder:
    # Should match one of the GO_DEV_VERSIONS in test/boulder-tools/tag_and_upload.sh.
    image: ghcr.io/hakwerk/labca-boulder:${LABCA_IMAGE_VERSION:-latest}
    environment:
      # To solve HTTP-01 and TLS-ALPN-01 challenges, change the IP in FAKE_DNS
      # to the IP address where your ACME client's solver is listening.
      # FAKE_DNS: 172.17.0.1
      FAKE_DNS: 10.77.77.77
      BOULDER_CONFIG_DIR: &boulder_config_dir labca/config
      GOFLAGS: -mod=vendor
      # Forward the parent env's GOEXPERIMENT value into the container.
      GOEXPERIMENT: ${GOEXPERIMENT:-}
    volumes:
      - boulder_data:/opt/boulder/labca
      - nginx_html:/opt/wwwstatic
      - softhsm:/var/lib/softhsm/tokens:cached
    networks:
      bluenet:
        ipv4_address: 10.77.77.77
      rednet:
        ipv4_address: 10.88.88.88
      consulnet:
        ipv4_address: 10.55.55.55
    # Use consul as a backup to Docker's embedded DNS server. If there's a name
    # Docker's DNS server doesn't know about, it will forward the query to this
    # IP (running consul).
    # (https://docs.docker.com/config/containers/container-networking/#dns-services).
    # This is used to look up service names via A records (like ra.service.consul) that
    # are configured via the ServerAddress field of cmd.GRPCClientConfig.
    # TODO: Remove this when ServerAddress is deprecated in favor of SRV records
    # and DNSAuthority.
    dns: 10.55.55.10
    expose:
      - 4001 # ACMEv2
      - 4002 # OCSP
      - 4003 # OCSP
    depends_on:
      - bmysql
      - bconsul
      - control
    entrypoint: labca/entrypoint.sh
    working_dir: &boulder_working_dir /opt/boulder
    logging:
      driver: "json-file"
      options:
        max-size: "500k"
        max-file: "5"
    restart: always

  bmysql:
    image: mariadb:10.5
    volumes:
      - dbdata:/var/lib/mysql
    networks:
      bluenet:
        aliases:
          - boulder-mysql
    environment:
      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
    # Send slow queries to a table so we can check for them in the
    # integration tests. For now we ignore queries not using indexes,
    # because that seems to trigger based on the optimizer's choice to not
    # use an index for certain queries, particularly when tables are still
    # small.
    command: mysqld --bind-address=0.0.0.0 --slow-query-log --log-output=TABLE --log-queries-not-using-indexes=ON
    logging:
      driver: "json-file"
      options:
        max-size: "500k"
        max-file: "5"
    restart: always

  bconsul:
    image: hashicorp/consul:1.15.4
    depends_on:
      - control
    volumes:
      - boulder_data:/opt/boulder/labca
    networks:
      consulnet:
        ipv4_address: 10.55.55.10
      bluenet:
        ipv4_address: 10.77.77.10
      rednet:
        ipv4_address: 10.88.88.10
    command: "consul agent -dev -config-format=hcl -config-file=/opt/boulder/labca/consul/config.hcl"
    working_dir: /opt/boulder
    restart: always

  gui:
    image: ghcr.io/hakwerk/labca-gui:${LABCA_IMAGE_VERSION:-latest}
    networks:
      - bluenet
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./docker-compose.yml:/opt/boulder/docker-compose.yml
      - ldata:/opt/labca/data
      - nginx_html:/opt/wwwstatic
      - backup:/opt/backup
      - boulder_data:/opt/boulder/labca
    expose:
      - 3000
    depends_on:
      - bmysql
      - control
    working_dir: /opt/labca
    command: bin/labca-gui
    logging:
      driver: "json-file"
      options:
        max-size: "500k"
        max-file: "5"
    restart: always

  nginx:
    image: nginx:1.25.3
    restart: always
    networks:
      - bluenet
    ports:
      - 80:80
      - 443:443
    volumes:
      - nginx_conf:/etc/nginx/conf.d
      - nginx_ssl:/etc/nginx/ssl
      - nginx_html:/var/www/html
    depends_on:
      - control

  control:
    image: ghcr.io/hakwerk/labca-control:${LABCA_IMAGE_VERSION:-latest}
    networks:
      - bluenet
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./docker-compose.yml:/opt/boulder/docker-compose.yml
      - ldata:/opt/labca/data
      - backup:/opt/backup
      - logs:/opt/logs
      - boulder_data:/opt/boulder/labca
      - nginx_conf:/etc/nginx/conf.d
      - nginx_ssl:/etc/nginx/ssl
      - nginx_html:/var/www/html
    expose:
      - 3030
    environment:
      LABCA_FQDN: ${LABCA_FQDN:-notset}
    working_dir: /opt/labca
    command: ./control.sh
    restart: always

volumes:
  dbdata:
  nginx_conf:
  nginx_ssl:
  nginx_html:
  boulder_data:
  ldata:
  backup:
  logs:
  softhsm:

networks:
  bluenet:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 10.77.77.0/24

  rednet:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 10.88.88.0/24

  consulnet:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 10.55.55.0/24