docker-compose.yaml

version: "3.7"

services:
  reverseproxy:
    image: nginxinc/nginx-unprivileged:stable-alpine
    container_name: nginx
    hostname: nginx
    restart: always
    deploy:
      resources:
        limits:
          cpus: '0.50'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M
    privileged: false
    read_only: true
    security_opt:
      - apparmor:docker-default
      - seccomp:unconfined
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - AUDIT_WRITE
    command: ["sh", "-c", "sleep 10 && nginx -g 'daemon off;'"]
    logging:
      driver: syslog
      options:
        tag: "dy-{{.Name}}"
    ports:
      - target: 8443
        published: 443
        protocol: tcp
    volumes:
      - ./docker/nginx.conf:/etc/nginx/conf.d/distributey.conf:ro
      - ./docker/certs:/etc/nginx/certs:ro
    depends_on:
      - distributey
    healthcheck:
      test: curl -f -k https://localhost:8443/v1/healthz || exit 1
      interval: 30s
      timeout: 3s
      retries: 2
    tmpfs:
      - /tmp:mode=770,size=20k

  distributey:
    image: pat/distributey:0.1
    container_name: distributey
    hostname: distributey
    restart: always
    deploy:
      resources:
        limits:
          cpus: '0.50'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    privileged: false
    read_only: true
    security_opt:
      - apparmor:docker-default
      - seccomp:./docker/seccomp-docker-default.json
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - AUDIT_WRITE
      - DAC_OVERRIDE
      - CHOWN
    build:
      context: .
      dockerfile: docker/Dockerfile-distributey
    logging:
      driver: syslog
      options:
        tag: "dy-{{.Name}}"
    depends_on: # Comment for production.
      - vault   # Comment for production.
    healthcheck:
      test: curl -f http://localhost:5000/v1/healthz || exit 1
      interval: 30s
      timeout: 3s
      retries: 2
    tmpfs:
      # default replay attack cache size of 10k requires approx. 324kb
      # for /tmp/cache.db
      - /tmp:mode=0777,size=1m
    volumes:
      - ./config:/opt/distributey/config/:ro

###################################
# Comment until EOF for production.
###################################

  vault:
    image: hashicorp/vault-enterprise:latest
    container_name: vault
    hostname: vault
    restart: always
    cap_add:
      - IPC_LOCK
    environment:
      - VAULT_DEV_ROOT_TOKEN_ID=root          # server config
      - VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:8200 # server config
      - VAULT_ADDR=http://127.0.0.1:8200      # cli config
      - VAULT_TOKEN=root                      # cli config
      - VAULT_LICENSE=$VAULT_LICENSE          # https://www.hashicorp.com/products/vault/trial
    volumes:
      - ./docker/vault:/vault/config
    ports:
      - target: 8200
        published: 8200
        protocol: tcp
      - target: 8300
        published: 8300
        protocol: tcp

  terraform:
    image: pat/terraform:0.1
    container_name: terraform
    hostname: terraform
    # remove state from old Vault dev mode, init, re-apply and leave running for debugging purposes
    # sleep() gives `01-start.sh` time to install Terraform providers
    entrypoint: "/bin/sh -c 'rm -rf .terraform && rm -rf terraform.tfstate* && terraform init -plugin-dir /terraform/tf-cache && terraform apply -auto-approve && sleep 3600'"
    working_dir: "/terraform"
    build:
      context: .
      dockerfile: docker/Dockerfile-terraform
    environment:
      # - TF_LOG=debug
      - VAULT_ADDR=http://vault:8200          # tf config
      - VAULT_TOKEN=root                      # tf config
      - CHECKPOINT_DISABLE=true               # prevent tf from checking for updates
    volumes:
      - ./docker/terraform:/terraform
    depends_on:
      - vault