129 lines
4.5 KiB
YAML
129 lines
4.5 KiB
YAML
# =============================================================================
|
|
# sicabe-host-gateway — SATU port untuk docker-proxy + config-agent.
|
|
#
|
|
# CATATAN: ini varian LOKAL (build dari ./agent). Untuk DEPLOY dari registry
|
|
# (termasuk panel, dengan profile) pakai: deploy/stack/docker-compose.yml
|
|
#
|
|
# Hanya nginx (gateway) yang membuka port host; docker-socket-proxy dan
|
|
# config-agent bersifat internal (expose, tanpa port host). Satu API key
|
|
# (GATEWAY_API_KEY) diperiksa nginx, lalu request diarahkan berdasarkan path:
|
|
# /_ping /version /info /events /containers/* → docker-proxy
|
|
# /healthz /env /dbt /ca /catalog(/<name>) → config-agent
|
|
#
|
|
# Lihat: docs/desain-host-gateway-terpadu.md
|
|
#
|
|
# Cara pakai:
|
|
# GATEWAY_API_KEY='<secret-kuat>' \
|
|
# SICABE_DEPLOY_DIR=/path/ke/sicabe-doc/deploy \
|
|
# AGENT_CA_HOST_PATH=/path/berisi/pem AGENT_CA_FILE=/ca/trino.crt \
|
|
# docker compose up -d
|
|
#
|
|
# Opsional: AGENT_UID/AGENT_GID (default 1000:1000) — UID/GID yang dipakai
|
|
# config-agent saat menulis ke host, supaya file (katalog Trino, data OPA) tetap
|
|
# dimiliki user host dan bukan root.
|
|
#
|
|
# Panel (satu URL untuk proxy & config):
|
|
# SICABE_HOSTS=[{"name":"h1","proxyUrl":"http://<host>:22375",
|
|
# "apiKey":"<GATEWAY_API_KEY>",
|
|
# "configUrl":"http://<host>:22375",
|
|
# "configApiKey":"<GATEWAY_API_KEY>","enabled":true}]
|
|
# =============================================================================
|
|
|
|
name: sicabe-host-gateway
|
|
|
|
services:
|
|
# --- Docker Engine API (ACL ketat, internal saja) ------------------------
|
|
docker-proxy:
|
|
image: tecnativa/docker-socket-proxy:v0.5.0
|
|
container_name: sicabe-docker-proxy
|
|
environment:
|
|
CONTAINERS: "1"
|
|
POST: "1"
|
|
INFO: "1"
|
|
SYSTEM: "1"
|
|
EXEC: "0"
|
|
SWARM: "0"
|
|
SERVICES: "0"
|
|
SECRETS: "0"
|
|
CONFIGS: "0"
|
|
NETWORKS: "0"
|
|
VOLUMES: "0"
|
|
IMAGES: "0"
|
|
BUILD: "0"
|
|
GRPC: "0"
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
expose:
|
|
- "2375"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
- /run
|
|
restart: unless-stopped
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
# --- Konfigurasi platform per host (internal saja) -----------------------
|
|
config-agent:
|
|
build: ./agent
|
|
image: sicabe/config-agent:0.1.0
|
|
container_name: sicabe-config-agent
|
|
# Jalankan sebagai UID/GID host (bukan root) supaya file yang DITULIS agent
|
|
# (katalog Trino, config/opa/data.json) tetap dimiliki user host — kalau root,
|
|
# editor/git di host akan kena permission denied. Dir yang di-mount rw memang
|
|
# milik user host. Bisa di-override via AGENT_UID/AGENT_GID.
|
|
user: "${AGENT_UID:-1000}:${AGENT_GID:-1000}"
|
|
environment:
|
|
# Satu key: nginx memeriksa, agent tetap memvalidasi (defense-in-depth).
|
|
AGENT_API_KEY: ${GATEWAY_API_KEY:?GATEWAY_API_KEY wajib diisi}
|
|
AGENT_PORT: "8080"
|
|
PYTHONDONTWRITEBYTECODE: "1"
|
|
SICABE_ENV_FILE: /config/.env
|
|
TRINO_CATALOG_DIR: /config/config/trino/catalog
|
|
DBT_PROJECT_DIR: /config/config/airflow/dbt/sicabe
|
|
AGENT_CA_FILE: ${AGENT_CA_FILE:-}
|
|
# Dokumen data OPA (ACL Trino) — dibaca menu Authorization. Tulis (rw)
|
|
# menyusul di Tahap 2.
|
|
OPA_DATA_FILE: /config/config/opa/data.json
|
|
volumes:
|
|
- ${SICABE_DEPLOY_DIR:?set SICABE_DEPLOY_DIR}:/config:ro
|
|
- ${SICABE_DEPLOY_DIR:?set SICABE_DEPLOY_DIR}/config/trino/catalog:/config/config/trino/catalog:rw
|
|
# Dir OPA (data.json) — rw agar agent bisa menulis di Tahap 2.
|
|
- ${SICABE_DEPLOY_DIR:?set SICABE_DEPLOY_DIR}/config/opa:/config/config/opa:rw
|
|
# CA TLS opsional (GET /ca): direktori berisi PEM → /ca.
|
|
- ${AGENT_CA_HOST_PATH:-${SICABE_DEPLOY_DIR:?set SICABE_DEPLOY_DIR}}:/ca:ro
|
|
expose:
|
|
- "8080"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
restart: unless-stopped
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
# --- Gateway nginx: satu-satunya port ke host ----------------------------
|
|
gateway:
|
|
image: nginx:1.30.4-alpine3.24
|
|
container_name: sicabe-host-gateway
|
|
depends_on:
|
|
- docker-proxy
|
|
- config-agent
|
|
environment:
|
|
GATEWAY_API_KEY: ${GATEWAY_API_KEY:?GATEWAY_API_KEY wajib diisi}
|
|
volumes:
|
|
- ./nginx/gateway.conf.template:/etc/nginx/templates/default.conf.template:ro
|
|
ports:
|
|
- "${GATEWAY_BIND_IP:-127.0.0.1}:${GATEWAY_PORT:-22375}:80"
|
|
restart: unless-stopped
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|