ced4568
d2280d0f0d
Named-bridge-network production Compose (not host networking, unlike dev) for rn-platform-01; egress-proxy + agents for rn-lab-host-01. Caddy reverse proxy, single public origin, Grafana restricted to management_cidr. iptables-restore firewall rulesets for all three hosts (Proxmox host, rn-platform-01, rn-lab-host-01) codifying the Platform/Lab-Host boundary: no student-to-student traffic, no direct Proxmox exposure, no direct Postgres/Provisioner exposure from the Lab Host. Mutual TLS for the Provisioner<->Lab Host Docker connection: certificate generation/verification scripts, dockerd TLS config, firewall-restricted port 2376. Application support already existed since Phase 1; this is purely the operational half. Validated: docker compose config, caddy validate, firewall structural lint, and a real openssl s_server/s_client mTLS handshake proving the cert chain and mutual-auth rejection (legitimate client verified, rogue client correctly rejected with verify code 19).
69 lines
2.8 KiB
YAML
69 lines
2.8 KiB
YAML
# Production compose for rn-lab-host-01. Deployed by infra/ansible/roles/lab-host/ to
|
|
# /opt/rootnode/lab-host/docker-compose.yml, run as a systemd unit
|
|
# (rootnode-lab-host.service.j2). Runs exactly one long-lived service: the shared egress proxy
|
|
# every student Lab's outbound traffic passes through (platform/egress-proxy/, unchanged since
|
|
# Phase 1). Student Lab containers themselves are NOT part of this compose file — they're
|
|
# created/destroyed individually by the Provisioner over the remote Docker TLS endpoint
|
|
# (dockerd itself, not compose), same mechanism as dev, just remote.
|
|
|
|
networks:
|
|
rn-egress:
|
|
driver: bridge
|
|
|
|
services:
|
|
egress-proxy:
|
|
image: "{{ registry }}/rootnode/egress-proxy:{{ image_tag }}"
|
|
restart: unless-stopped
|
|
ports:
|
|
- "3128:3128" # reachable from every per-Lab Docker network on this host — restricted
|
|
# to those networks by the Provisioner's per-environment DOCKER-USER
|
|
# chains, not by a published-port firewall rule (there is no sensible
|
|
# single source IP to restrict this to; the egress proxy's OWN allowlist
|
|
# is the actual control, see platform/egress-proxy/allowlist.txt)
|
|
networks: [rn-egress]
|
|
|
|
node-exporter:
|
|
image: prom/node-exporter:latest
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
pid: host
|
|
volumes:
|
|
- /proc:/host/proc:ro
|
|
- /sys:/host/sys:ro
|
|
- /:/rootfs:ro
|
|
command:
|
|
- "--path.procfs=/host/proc"
|
|
- "--path.sysfs=/host/sys"
|
|
- "--path.rootfs=/rootfs"
|
|
- "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
|
|
|
|
cadvisor:
|
|
image: gcr.io/cadvisor/cadvisor:latest
|
|
restart: unless-stopped
|
|
privileged: true
|
|
devices:
|
|
- /dev/kmsg
|
|
volumes:
|
|
- /:/rootfs:ro
|
|
- /var/run:/var/run:ro
|
|
- /sys:/sys:ro
|
|
- /var/lib/docker/:/var/lib/docker:ro
|
|
ports:
|
|
- "8080:8080" # scraped remotely by Prometheus on rn-platform-01 — restricted to that
|
|
# one source IP by the host firewall (rn-lab-host-01.rules), not by
|
|
# binding to localhost, since Prometheus isn't local on this host.
|
|
|
|
promtail:
|
|
image: grafana/promtail:latest
|
|
restart: unless-stopped
|
|
volumes:
|
|
- /opt/rootnode/lab-host/promtail-config.yml:/etc/promtail/config.yml:ro
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- /var/log/journal:/var/log/journal:ro
|
|
- /etc/machine-id:/etc/machine-id:ro
|
|
command: ["-config.file=/etc/promtail/config.yml"]
|
|
# host networking so promtail can reach Loki on rn-platform-01 over the network — this
|
|
# traffic is OUTBOUND from rn-lab-host-01 (log push, client-initiated), which the host
|
|
# firewall's default-ACCEPT OUTPUT chain already allows; nothing new needed there.
|
|
network_mode: host
|