alice.pds.demo.boltless.dev
This repository has no description
13 kB
416 lines
1services:
2 redis:
3 image: redis:7-alpine
4 restart: unless-stopped
5 networks: [tngl]
6
7 postgres:
8 image: postgres:14-alpine
9 restart: unless-stopped
10 environment:
11 POSTGRES_USER: tnglr
12 POSTGRES_PASSWORD: tnglr
13 volumes:
14 - postgres-data:/var/lib/postgresql/data
15 - ./localinfra/postgres-init.sql:/docker-entrypoint-initdb.d/init.sql
16 healthcheck:
17 test: ["CMD-SHELL", "pg_isready -U tnglr -d plc"]
18 interval: 2s
19 timeout: 2s
20 retries: 30
21 start_period: 5s
22 networks: [tngl]
23
24 pds:
25 image: ghcr.io/bluesky-social/pds:0.4.219
26 restart: unless-stopped
27 env_file: localinfra/pds.env
28 environment:
29 PDS_DID_PLC_URL: http://plc:8080
30 NODE_EXTRA_CA_CERTS: /caddy-ca/root.crt
31 volumes:
32 - pds-data:/pds
33 - ./localinfra/certs/root.crt:/caddy-ca/root.crt:ro
34 healthcheck:
35 test: ["CMD", "wget", "-qO-", "http://localhost:3000/xrpc/_health"]
36 interval: 2s
37 timeout: 2s
38 retries: 30
39 start_period: 5s
40 depends_on:
41 plc:
42 condition: service_started
43 networks: [tngl]
44
45 init-accounts:
46 image: alpine:3.22
47 restart: "no"
48 env_file: localinfra/pds.env
49 environment:
50 PDS_URL: http://pds:3000
51 OWNER_USER: alice
52 KNOT_HOSTNAME: knot.tngl.boltless.dev
53 SPINDLE_HOSTNAME: spindle.tngl.boltless.dev
54 volumes:
55 - ./localinfra/scripts/init-accounts.sh:/init.sh:ro
56 - init-state:/shared
57 command: sh -c "apk add --no-cache curl jq >/dev/null && sh /init.sh"
58 depends_on:
59 pds:
60 condition: service_healthy
61 networks: [tngl]
62
63 plc:
64 platform: linux/amd64
65 image: ghcr.io/bluesky-social/did-method-plc:plc-f2ab7516bac5bc0f3f86842fa94e996bd1b3815b
66 restart: unless-stopped
67 environment:
68 DEBUG_MODE: "1"
69 LOG_ENABLED: "true"
70 LOG_LEVEL: debug
71 LOG_DESTINATION: "1"
72 PLC_VERSION: 0.0.1
73 PORT: "8080"
74 DB_CREDS_JSON: &DB_CREDS_JSON '{"username":"tnglr","password":"tnglr","host":"postgres","port":5432}'
75 DB_MIGRATE_CREDS_JSON: *DB_CREDS_JSON
76 depends_on: [postgres]
77 networks: [tngl]
78
79 jetstream:
80 platform: linux/amd64
81 image: ghcr.io/bluesky-social/jetstream:sha-d5a3b62
82 restart: unless-stopped
83 environment:
84 JETSTREAM_DATA_DIR: /data
85 JETSTREAM_LIVENESS_TTL: 300s
86 JETSTREAM_WS_URL: wss://pds.tngl.boltless.dev/xrpc/com.atproto.sync.subscribeRepos
87 volumes:
88 - jetstream-data:/data
89 - ./localinfra/certs/root.crt:/etc/ssl/certs/ca-certificates.crt:ro
90 depends_on:
91 pds:
92 condition: service_healthy
93 networks: [tngl]
94
95 knot:
96 build:
97 context: .
98 dockerfile: localinfra/knot.Dockerfile
99 restart: unless-stopped
100 environment:
101 KNOT_SERVER_HOSTNAME: knot.tngl.boltless.dev
102 KNOT_SERVER_LISTEN_ADDR: 0.0.0.0:5555
103 KNOT_SERVER_INTERNAL_LISTEN_ADDR: 127.0.0.1:5444
104 KNOT_SERVER_DB_PATH: /home/git/knotserver.db
105 KNOT_SERVER_PLC_URL: https://plc.tngl.boltless.dev
106 KNOT_SERVER_JETSTREAM_ENDPOINT: wss://jetstream.tngl.boltless.dev/subscribe
107 KNOT_SERVER_DEV: "false"
108 KNOT_REPO_SCAN_PATH: /home/git/repositories
109 APPVIEW_ENDPOINT: https://tangled.org
110 KNOT_MIRRORS: https://mirror.tngl.boltless.dev
111 ports:
112 - "2222:22"
113 volumes:
114 - knot-data:/home/git
115 - knot-ssh-keys:/etc/ssh/keys
116 - init-state:/shared:ro
117 - ./localinfra/certs/root.crt:/usr/local/share/ca-certificates/caddy.crt:ro
118 healthcheck:
119 test: ["CMD", "wget", "-qO-", "http://localhost:5555/"]
120 interval: 2s
121 timeout: 2s
122 retries: 60
123 start_period: 30s
124 depends_on:
125 plc:
126 condition: service_started
127 jetstream:
128 condition: service_started
129 knotmirror:
130 condition: service_healthy
131 init-accounts:
132 condition: service_completed_successfully
133 networks: [tngl]
134
135 ncps-migrate:
136 image: &ncps-image ghcr.io/kalbasit/ncps:v0.9.4
137 profiles: ["linux"]
138 restart: "no"
139 command:
140 - /bin/dbmate
141 - --migrations-dir=/share/ncps/db/migrations/sqlite
142 - --no-dump-schema
143 - --url=sqlite:/storage/db.sqlite
144 - up
145 volumes:
146 - ncps-data:/storage
147 networks: [tngl]
148
149 ncps:
150 image: *ncps-image
151 profiles: ["linux"]
152 restart: unless-stopped
153 environment:
154 ANALYTICS_REPORTING_ENABLED: "false"
155 command: ["/bin/ncps", "serve", "--config", "/etc/ncps/ncps.yaml"]
156 volumes:
157 - ncps-data:/storage
158 - ./localinfra/ncps.yaml:/etc/ncps/ncps.yaml:ro
159 - ./localinfra/ncps-secret-key:/keys/ncps-secret-key:ro
160 depends_on:
161 ncps-migrate:
162 condition: service_completed_successfully
163 networks: [tngl]
164
165 spindle:
166 build:
167 context: .
168 dockerfile: localinfra/spindle.Dockerfile
169 restart: unless-stopped
170 environment:
171 SPINDLE_SERVER_HOSTNAME: spindle.tngl.boltless.dev
172 SPINDLE_SERVER_ADMIN_PASSWORD: spindle-admin
173 SPINDLE_SERVER_LISTEN_ADDR: 0.0.0.0:6555
174 SPINDLE_SERVER_DB_PATH: /var/lib/spindle/spindle.db
175 SPINDLE_SERVER_PLC_URL: https://plc.tngl.boltless.dev
176 SPINDLE_SERVER_JETSTREAM_ENDPOINT: wss://jetstream.tngl.boltless.dev/subscribe
177 SPINDLE_SERVER_DEV: "true"
178 SPINDLE_SERVER_DEV_EXTRA_HOSTS: knot.tngl.boltless.dev,mirror.tngl.boltless.dev
179 SPINDLE_SERVER_TAP_DB_PATH: /var/lib/spindle/tap.db
180 SPINDLE_SERVER_TAP_RELAY_URL: https://pds.tngl.boltless.dev
181 SPINDLE_MICROVM_PIPELINES_IMAGE_DIR: /var/lib/spindle/images
182 SPINDLE_MICROVM_PIPELINES_OVERLAY_DIR: /var/lib/spindle/overlays
183 SPINDLE_MICROVM_PIPELINES_AGENT_PORT: "11240"
184 SPINDLE_S3_LOG_BUCKET: ""
185 SPINDLE_MICROVM_PIPELINES_ENABLE_CGROUPS: "false"
186 # route guest nix substitution + uploads through the local ncps cache.
187 # ncps re-signs on serve with cache.local's key, so the guest trusts the
188 # matching public key below (no signing happens in spindle itself).
189 SPINDLE_NIX_CACHE_READ_URLS: http://ncps:8501
190 SPINDLE_NIX_CACHE_TRUSTED_PUBLIC_KEYS: cache.local:F7YqpMzuBdILYd/v+wMZN2YKxCzliXQyFmeezOxw7rU=
191 SPINDLE_NIX_CACHE_UPLOAD_URL: http://ncps:8501/upload
192 # microVM devices/caps live in docker-compose.linux.yml (Linux only)
193 volumes:
194 - spindle-data:/var/lib/spindle
195 - spindle-logs:/var/log/spindle
196 - ./out/localinfra-spindle-images:/var/lib/spindle/images:ro
197 - init-state:/shared:ro
198 - ./localinfra/certs/root.crt:/usr/local/share/ca-certificates/caddy.crt:ro
199 healthcheck:
200 test: ["CMD", "wget", "-qO-", "http://localhost:6555/"]
201 interval: 2s
202 timeout: 2s
203 retries: 30
204 start_period: 5s
205 depends_on:
206 plc:
207 condition: service_started
208 jetstream:
209 condition: service_started
210 init-accounts:
211 condition: service_completed_successfully
212 ncps:
213 condition: service_started
214 required: false
215 networks: [tngl]
216
217 knotmirror-tap:
218 image: ghcr.io/bluesky-social/indigo/tap:sha-4f47add43060c27e8a37d9d76482ecddf001fcd8 # 0.1.10
219 restart: unless-stopped
220 environment:
221 TAP_BIND: ":2480"
222 TAP_PLC_URL: https://plc.tngl.boltless.dev
223 TAP_RELAY_URL: https://pds.tngl.boltless.dev # PDS can be used as basic relay without collectiondir.
224 TAP_DATABASE_URL: postgres://tnglr:tnglr@postgres:5432/mirror_tap?sslmode=disable
225 TAP_COLLECTION_FILTERS: sh.tangled.repo
226 TAP_SIGNAL_COLLECTION: sh.tangled.repo
227 TAP_RESYNC_PARALLELISM: "10"
228 TAP_RETRY_TIMEOUT: 60s
229 volumes:
230 - ./localinfra/certs/root.crt:/etc/ssl/certs/ca-certificates.crt:ro
231 depends_on:
232 postgres:
233 condition: service_started
234 pds:
235 condition: service_healthy
236 networks: [tngl]
237
238 knotmirror:
239 build:
240 context: .
241 dockerfile: localinfra/knotmirror.Dockerfile
242 restart: unless-stopped
243 environment:
244 MIRROR_LISTEN: 0.0.0.0:7000
245 MIRROR_ADMIN_LISTEN: 0.0.0.0:7200
246 MIRROR_HOSTNAME: mirror.tngl.boltless.dev
247 MIRROR_TAP_URL: http://knotmirror-tap:2480
248 MIRROR_DB_URL: postgres://tnglr:tnglr@postgres:5432/mirror?sslmode=disable
249 MIRROR_REDIS_ADDR: redis:6379
250 MIRROR_PLC_URL: https://plc.tngl.boltless.dev
251 MIRROR_GIT_BASEPATH: /data/repos
252 MIRROR_KNOT_USE_SSL: "true"
253 MIRROR_KNOT_SSRF: "true"
254 MIRROR_RESYNC_PARALLELISM: "4"
255 MIRROR_APPVIEW_URL: http://appview:3000
256 MIRROR_SEARCH_ZOEKT_URL: https://zoekt.tngl.boltless.dev/indexserver
257 volumes:
258 - knotmirror-data:/data
259 - ./localinfra/certs/root.crt:/usr/local/share/ca-certificates/caddy.crt:ro
260 healthcheck:
261 test: ["CMD", "wget", "-qO-", "http://localhost:7000/"]
262 interval: 2s
263 timeout: 2s
264 retries: 30
265 start_period: 5s
266 ports:
267 - "7201:7200"
268 depends_on:
269 postgres:
270 condition: service_started
271 knotmirror-tap:
272 condition: service_started
273 networks: [tngl]
274
275 zoekt-webserver:
276 build:
277 context: https://tangled.org/boltless.me/zoekt.git#tngl
278 volumes:
279 - zoekt-index:/data/index
280 - ./localinfra/certs/root.crt:/etc/ssl/certs/caddy.crt:ro
281 command: ["zoekt-webserver", "-index", "/data/index", "-pprof", "-rpc"]
282 networks: [tngl]
283
284 zoekt-tngl-indexserver:
285 build:
286 context: .
287 dockerfile: localinfra/zoekt-tngl-indexserver.Dockerfile
288 environment:
289 TANGLED_ZOEKT_INDEX_DIR: /data/index
290 TANGLED_ZOEKT_PLC_URL: https://plc.tngl.boltless.dev
291 TANGLED_ZOEKT_APPVIEW_URL: http://127.0.0.1:3000
292 volumes:
293 - zoekt-index:/data/index
294 - ./localinfra/certs/root.crt:/etc/ssl/certs/caddy.crt:ro
295 command: ["zoekt-tngl-indexserver", "serve"]
296 networks: [tngl]
297
298 tailwind:
299 build:
300 context: .
301 dockerfile: localinfra/tailwind.Dockerfile
302 restart: unless-stopped
303 working_dir: /build
304 init: true
305 volumes:
306 - ./tailwind.config.js:/build/tailwind.config.js:ro
307 - ./input.css:/build/input.css:ro
308 - ./appview/pages/templates:/build/appview/pages/templates:ro
309 - ./docs:/build/docs:ro
310 - ./blog/templates:/build/blog/templates:ro
311 - ./blog/posts:/build/blog/posts:ro
312 - ./appview/pages/static:/build/appview/pages/static
313 command:
314 ["-i", "input.css", "-o", "appview/pages/static/tw.css", "--watch=always"]
315 network_mode: none
316
317 appview:
318 build:
319 context: .
320 dockerfile: localinfra/appview.Dockerfile
321 restart: unless-stopped
322 environment:
323 TANGLED_DEV: "true"
324 TANGLED_APPVIEW_HOST: 127.0.0.1:3000
325 TANGLED_DB_PATH: /var/lib/appview/appview.db
326 TANGLED_PLC_URL: https://plc.tngl.boltless.dev
327 TANGLED_JETSTREAM_ENDPOINT: wss://jetstream.tngl.boltless.dev/subscribe
328 TANGLED_REDIS_ADDR: redis:6379
329 TANGLED_KNOTMIRROR_URL: https://mirror.tngl.boltless.dev
330 TANGLED_CODESEARCH_ZOEKT_URL: https://zoekt.tngl.boltless.dev
331 TANGLED_SSH_ENABLED: "true"
332 TANGLED_SSH_LISTEN_ADDR: "0.0.0.0:3333"
333 ports:
334 - "3000:3000"
335 - "3333:3333"
336 volumes:
337 - .:/src:cached
338 - go-cache:/go/cache
339 - go-mod-cache:/go/mod
340 - appview-data:/var/lib/appview
341 - init-state:/shared:ro
342 - ./localinfra/certs/root.crt:/usr/local/share/ca-certificates/caddy.crt:ro
343 depends_on:
344 redis:
345 condition: service_started
346 pds:
347 condition: service_healthy
348 init-accounts:
349 condition: service_completed_successfully
350 networks: [tngl]
351
352 pdsls:
353 build:
354 context: .
355 dockerfile: localinfra/pdsls.Dockerfile
356 restart: unless-stopped
357 ports:
358 - "8081:80"
359 depends_on:
360 init-accounts:
361 condition: service_completed_successfully
362 networks: [tngl]
363
364 caddy:
365 image: caddy:2-alpine
366 restart: unless-stopped
367 ports:
368 - "80:80"
369 - "443:443"
370 volumes:
371 - ./localinfra/Caddyfile:/etc/caddy/Caddyfile
372 - ./localinfra/certs:/etc/caddy/certs:ro
373 - caddy-data:/data
374 networks:
375 tngl:
376 aliases:
377 - plc.tngl.boltless.dev
378 - pds.tngl.boltless.dev
379 - alice.pds.tngl.boltless.dev
380 - bob.pds.tngl.boltless.dev
381 - charlie.pds.tngl.boltless.dev
382 - david.pds.tngl.boltless.dev
383 - jetstream.tngl.boltless.dev
384 - knot.tngl.boltless.dev
385 - spindle.tngl.boltless.dev
386 - tngl.boltless.dev
387 - mirror.tngl.boltless.dev
388 - zoekt.tngl.boltless.dev
389 - pdsls.tngl.boltless.dev
390
391volumes:
392 caddy-data:
393 postgres-data:
394 pds-data:
395 jetstream-data:
396 knot-data:
397 knot-ssh-keys:
398 knotmirror-data:
399 zoekt-index:
400 spindle-data:
401 spindle-logs:
402 ncps-data:
403 init-state:
404 go-cache:
405 go-mod-cache:
406 appview-data:
407
408networks:
409 tngl:
410 driver: bridge
411 # Public-looking subnet so SSRF checks see container IPs as "public".
412 # RFC1918 + doc/benchmark ranges are blocklisted; 11.x is unrouted on
413 # the public internet, so it passes the check and won't collide.
414 ipam:
415 config:
416 - subnet: 11.0.0.0/24