sicabe-control-panel/deploy/host-gateway/docker-compose.yml

# =============================================================================
# sicabe-host-gateway — SATU port untuk docker-proxy + config-agent.
#
# CATATAN: ini varian LOKAL (build dari ./agent). Untuk DEPLOY dari registry
# (termasuk panel, dengan profile) pakai: deploy/stack/docker-compose.yml
#
# Hanya nginx (gateway) yang membuka port host; docker-socket-proxy dan
# config-agent bersifat internal (expose, tanpa port host). Satu API key
# (GATEWAY_API_KEY) diperiksa nginx, lalu request diarahkan berdasarkan path:
#   /_ping /version /info /events /containers/*   → docker-proxy
#   /healthz /env /dbt /ca /catalog(/<name>)      → config-agent
#
# Lihat: docs/desain-host-gateway-terpadu.md
#
# Cara pakai:
#   GATEWAY_API_KEY='<secret-kuat>' \
#   SICABE_DEPLOY_DIR=/path/ke/sicabe-doc/deploy \
#   AGENT_CA_HOST_PATH=/path/berisi/pem AGENT_CA_FILE=/ca/trino.crt \
#     docker compose up -d
#
# Opsional: AGENT_UID/AGENT_GID (default 1000:1000) — UID/GID yang dipakai
# config-agent saat menulis ke host, supaya file (katalog Trino, data OPA) tetap
# dimiliki user host dan bukan root.
#
# Panel (satu URL untuk proxy & config):
#   SICABE_HOSTS=[{"name":"h1","proxyUrl":"http://<host>:22375",
#                  "apiKey":"<GATEWAY_API_KEY>",
#                  "configUrl":"http://<host>:22375",
#                  "configApiKey":"<GATEWAY_API_KEY>","enabled":true}]
# =============================================================================

name: sicabe-host-gateway

services:
  # --- Docker Engine API (ACL ketat, internal saja) ------------------------
  docker-proxy:
    image: tecnativa/docker-socket-proxy:v0.5.0
    container_name: sicabe-docker-proxy
    environment:
      CONTAINERS: "1"
      POST: "1"
      INFO: "1"
      SYSTEM: "1"
      EXEC: "0"
      SWARM: "0"
      SERVICES: "0"
      SECRETS: "0"
      CONFIGS: "0"
      NETWORKS: "0"
      VOLUMES: "0"
      IMAGES: "0"
      BUILD: "0"
      GRPC: "0"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    expose:
      - "2375"
    read_only: true
    tmpfs:
      - /tmp
      - /run
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  # --- Konfigurasi platform per host (internal saja) -----------------------
  config-agent:
    build: ./agent
    image: sicabe/config-agent:0.1.0
    container_name: sicabe-config-agent
    # Jalankan sebagai UID/GID host (bukan root) supaya file yang DITULIS agent
    # (katalog Trino, config/opa/data.json) tetap dimiliki user host — kalau root,
    # editor/git di host akan kena permission denied. Dir yang di-mount rw memang
    # milik user host. Bisa di-override via AGENT_UID/AGENT_GID.
    user: "${AGENT_UID:-1000}:${AGENT_GID:-1000}"
    environment:
      # Satu key: nginx memeriksa, agent tetap memvalidasi (defense-in-depth).
      AGENT_API_KEY: ${GATEWAY_API_KEY:?GATEWAY_API_KEY wajib diisi}
      AGENT_PORT: "8080"
      PYTHONDONTWRITEBYTECODE: "1"
      SICABE_ENV_FILE: /config/.env
      TRINO_CATALOG_DIR: /config/config/trino/catalog
      DBT_PROJECT_DIR: /config/config/airflow/dbt/sicabe
      AGENT_CA_FILE: ${AGENT_CA_FILE:-}
      # Dokumen data OPA (ACL Trino) — dibaca menu Authorization. Tulis (rw)
      # menyusul di Tahap 2.
      OPA_DATA_FILE: /config/config/opa/data.json
    volumes:
      - ${SICABE_DEPLOY_DIR:?set SICABE_DEPLOY_DIR}:/config:ro
      - ${SICABE_DEPLOY_DIR:?set SICABE_DEPLOY_DIR}/config/trino/catalog:/config/config/trino/catalog:rw
      # Dir OPA (data.json) — rw agar agent bisa menulis di Tahap 2.
      - ${SICABE_DEPLOY_DIR:?set SICABE_DEPLOY_DIR}/config/opa:/config/config/opa:rw
      # CA TLS opsional (GET /ca): direktori berisi PEM → /ca.
      - ${AGENT_CA_HOST_PATH:-${SICABE_DEPLOY_DIR:?set SICABE_DEPLOY_DIR}}:/ca:ro
    expose:
      - "8080"
    read_only: true
    tmpfs:
      - /tmp
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  # --- Gateway nginx: satu-satunya port ke host ----------------------------
  gateway:
    image: nginx:1.30.4-alpine3.24
    container_name: sicabe-host-gateway
    depends_on:
      - docker-proxy
      - config-agent
    environment:
      GATEWAY_API_KEY: ${GATEWAY_API_KEY:?GATEWAY_API_KEY wajib diisi}
    volumes:
      - ./nginx/gateway.conf.template:/etc/nginx/templates/default.conf.template:ro
    ports:
      - "${GATEWAY_BIND_IP:-127.0.0.1}:${GATEWAY_PORT:-22375}:80"
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"