sicabe-control-panel/deploy/stack/docker-compose.yml

# =============================================================================
# sicabe-host — SATU compose untuk satu host SiCABE.
#
# Berisi: docker-socket-proxy + config-agent + gateway(nginx) + control-panel.
#
# PROFILE:
#   - tanpa profile  → docker-socket-proxy + config-agent + gateway
#                      (WAJIB di SEMUA host SiCABE)
#   - profile panel  → + sicabe-control-panel
#                      (hanya di SATU host: host panel)
#
# Pemakaian:
#   # di SEMUA host SiCABE:
#   docker compose up -d
#
#   # di HOST PANEL (selain di atas):
#   docker compose --profile panel up -d
#
# Env: salin `env.example` → `.env` (compose membacanya otomatis).
# Image TIDAK di-build di sini — pakai image dari registry:
#   SICABE_REGISTRY=<registry>  SICABE_TAG=<tag>   (lihat scripts/build-image.sh --all --push)
#
# Lihat README.md.
# =============================================================================

name: sicabe-host

services:
  # ── Docker Engine API (ACL ketat, internal saja) ──────────────────────────
  docker-proxy:
    image: tecnativa/docker-socket-proxy:v0.5.0
    container_name: sicabe-docker-proxy
    environment:
      CONTAINERS: "1"
      POST: "1"
      INFO: "1"
      SYSTEM: "1"
      EXEC: "0"
      SWARM: "0"
      SERVICES: "0"
      SECRETS: "0"
      CONFIGS: "0"
      NETWORKS: "0"
      VOLUMES: "0"
      IMAGES: "0"
      BUILD: "0"
      GRPC: "0"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    expose:
      - "2375"
    read_only: true
    tmpfs:
      - /tmp
      - /run
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  # ── Konfigurasi platform per host (internal saja) ─────────────────────────
  config-agent:
    image: ${SICABE_REGISTRY:-sicabe}/config-agent:${SICABE_TAG:-latest}
    container_name: sicabe-config-agent
    # Jalan sebagai UID/GID host agar file yang ditulis (katalog Trino, data OPA)
    # tetap milik user host, bukan root.
    user: "${AGENT_UID:-1000}:${AGENT_GID:-1000}"
    environment:
      AGENT_API_KEY: ${GATEWAY_API_KEY:?GATEWAY_API_KEY wajib diisi (env)}
      AGENT_PORT: "8080"
      PYTHONDONTWRITEBYTECODE: "1"
      SICABE_ENV_FILE: /config/.env
      TRINO_CATALOG_DIR: /config/config/trino/catalog
      DBT_PROJECT_DIR: /config/config/airflow/dbt/sicabe
      OPA_DATA_FILE: /config/config/opa/data.json
      # Nama file PEM di dalam /ca (lihat AGENT_CA_HOST_PATH). Diperlukan agar
      # panel bisa memverifikasi TLS Trino (self-signed).
      AGENT_CA_FILE: ${AGENT_CA_FILE:-/ca/trino.crt}
      # Sumber daftar container untuk scan (docker-proxy internal).
      DOCKER_PROXY_URL: http://docker-proxy:2375
    volumes:
      - ${SICABE_DEPLOY_DIR:?set SICABE_DEPLOY_DIR (env)}:/config:ro
      - ${SICABE_DEPLOY_DIR:?}/config/trino/catalog:/config/config/trino/catalog:rw
      - ${SICABE_DEPLOY_DIR:?}/config/opa:/config/config/opa:rw
      # CA TLS (GET /ca): direktori berisi PEM → /ca. WAJIB diisi di host
      # panel agar TLS Trino (self-signed) bisa diverifikasi.
      - ${AGENT_CA_HOST_PATH:-${SICABE_DEPLOY_DIR:?}}:/ca:ro
    expose:
      - "8080"
    read_only: true
    tmpfs:
      - /tmp
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  # ── Gateway nginx: satu-satunya port ke host ──────────────────────────────
  gateway:
    image: nginx:1.30.4-alpine3.24
    container_name: sicabe-host-gateway
    depends_on:
      - docker-proxy
      - config-agent
    environment:
      GATEWAY_API_KEY: ${GATEWAY_API_KEY:?GATEWAY_API_KEY wajib diisi (env)}
    volumes:
      # Template nginx dipakai bersama dari deploy/host-gateway (tanpa duplikasi).
      - ../host-gateway/nginx/gateway.conf.template:/etc/nginx/templates/default.conf.template:ro
    ports:
      - "${GATEWAY_BIND_IP:-127.0.0.1}:${GATEWAY_PORT:-22375}:80"
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  # ── Control panel — HANYA di host panel (profile "panel") ────────────────
  panel:
    profiles: ["panel"]
    image: ${SICABE_REGISTRY:-sicabe}/control-panel:${SICABE_TAG:-latest}
    container_name: sicabe-control-panel
    depends_on:
      - gateway
    # Host network: gateway host bind 127.0.0.1 → tak terjangkau dari bridge,
    # dan SAN sertifikat Trino (localhost) cocok. Port via PORT.
    network_mode: host
    environment:
      NODE_ENV: production
      HOSTNAME: "0.0.0.0"
      PORT: ${PANEL_PORT:-3000}
      # ── Wajib (panel gagal-cepat bila kosong) ──
      NEXTAUTH_URL: ${PANEL_URL:-}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:-}
      KEYCLOAK_CLIENT_SECRET: ${KEYCLOAK_CLIENT_SECRET:-}
      SICABE_HOSTS: ${SICABE_HOSTS:-}
      # ── Login lokal (hybrid, opsional) ──
      # Akun lokal berlaku juga di produksi. Pakai varian _B64 (bcrypt memuat
      # '$' yang bisa di-interpolasi Compose). Kosong = hanya SSO.
      PANEL_LOCAL_USER: ${PANEL_LOCAL_USER:-}
      PANEL_LOCAL_PASSWORD_HASH: ${PANEL_LOCAL_PASSWORD_HASH:-}
      PANEL_LOCAL_PASSWORD_HASH_B64: ${PANEL_LOCAL_PASSWORD_HASH_B64:-}
      PANEL_LOCAL_ROLE: ${PANEL_LOCAL_ROLE:-}
      # Identitas Trino untuk sesi lokal (tanpa JWT) — service account Basic.
      TRINO_SERVICE_ACCOUNT: ${TRINO_SERVICE_ACCOUNT:-}
      TRINO_SERVICE_PASSWORD: ${TRINO_SERVICE_PASSWORD:-}
      # Pin host per-service (opsional) — registry difilter ke host ini.
      SICABE_TRINO_HOST: ${SICABE_TRINO_HOST:-}
      SICABE_AIRFLOW_HOST: ${SICABE_AIRFLOW_HOST:-}
      SICABE_STARROCKS_HOST: ${SICABE_STARROCKS_HOST:-}
      SICABE_OPA_HOST: ${SICABE_OPA_HOST:-}
      # ── Opsional (ada default di kode) ──
      KEYCLOAK_URL: ${KEYCLOAK_URL:-}
      KEYCLOAK_CLIENT_ID: ${KEYCLOAK_CLIENT_ID:-sicabe-control-panel}
      KEYCLOAK_WEB_URL: ${KEYCLOAK_WEB_URL:-}
      TRINO_URL: ${TRINO_URL:-}
      TRINO_WEB_URL: ${TRINO_WEB_URL:-}
      # CA Trino (file di host, dibuat scripts/export-trino-ca.sh) → dilihat panel.
      TRINO_CA_FILE: ${TRINO_CA_FILE:-/app/.ca/trino.crt}
      NESSIE_URL: ${NESSIE_URL:-}
      AIRFLOW_URL: ${AIRFLOW_URL:-}
      STARROCKS_HOST: ${STARROCKS_HOST:-}
      STARROCKS_PORT: ${STARROCKS_PORT:-}
      STARROCKS_WEB_URL: ${STARROCKS_WEB_URL:-}
      OPENMETADATA_URL: ${OPENMETADATA_URL:-}
      GRAFANA_URL: ${GRAFANA_URL:-}
      MINIO_CONSOLE_URL: ${MINIO_CONSOLE_URL:-}
      SICABE_COMPOSE_PROJECTS: ${SICABE_COMPOSE_PROJECTS:-sicabe}
      SICABE_CONFIG_FILE: data/config.json
      SICABE_STATE_FILE: data/state.json
    volumes:
      - panel-data:/app/data
      # CA Trino: direktori host berisi trino.crt → /app/.ca (read-only).
      - ${TRINO_CA_DIR:-../../.ca}:/app/.ca:ro
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  panel-data: