ced4568
9b28d786de
Removes the old identity service/volume, adds the api service (host networking, Postgres URL, Provisioner shared secret, ADMIN_PASSWORD, both required via :?). gateway now points PLATFORM_API_URL at it instead of the old IDENTITY_BACKEND_URL.
90 lines
3.6 KiB
YAML
90 lines
3.6 KiB
YAML
# Phase 2B full-stack local dev/test — Postgres + egress-proxy + Provisioner + the lightweight
|
|
# Platform API + the Gateway, all on one machine (the documented Phase 1/2A/2B dev exception;
|
|
# production is the two-VM Proxmox split, see docs/LAB_ARCHITECTURE.md §1).
|
|
#
|
|
# `api` (platform/api) replaces Phase 2A's "identity" service — that was a full, --privileged
|
|
# Lab image booting an unused k3s cluster just to serve roster/curriculum/progress APIs. This
|
|
# is a plain Node process: no k3s, no --privileged, no terminal runtime. It owns
|
|
# students/cohorts/enrollments/curriculum/progress/scenario_attempts in Postgres and is the
|
|
# only service that talks to the Provisioner (student launch/reset AND instructor/admin
|
|
# actions) — see docs/PHASE2B_ADMIN_AND_PLATFORM_DATA.md.
|
|
#
|
|
# gateway, provisioner, and api's egress-adjacent needs aside, `api` does NOT need
|
|
# network_mode: host — it never touches Docker networking or firewall rules itself, it only
|
|
# calls the Provisioner's HTTP API and Postgres. gateway and provisioner keep network_mode:
|
|
# host because they need to reach ephemeral per-student Lab containers by internal IP /
|
|
# manage firewall rules on the host network namespace.
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: postgres
|
|
POSTGRES_DB: rootnode_platform
|
|
ports:
|
|
- "5433:5432"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U postgres"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
|
|
egress-proxy:
|
|
build: ./egress-proxy
|
|
network_mode: host
|
|
|
|
provisioner:
|
|
build: ./provisioner
|
|
network_mode: host
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
environment:
|
|
PLATFORM_DB_URL: postgres://postgres:postgres@localhost:5433/rootnode_platform
|
|
PROVISIONER_SHARED_SECRET: ${PROVISIONER_SHARED_SECRET:?set a real secret, do not use a default}
|
|
PROVISIONER_PORT: "4100"
|
|
LAB_IMAGE_REF: ${LAB_IMAGE_REF:-rootnode-academy:test}
|
|
EGRESS_PROXY_PORT: "3128"
|
|
DNS_RESOLVER: "127.0.0.11"
|
|
NO_PROXY_CIDRS: "10.42.0.0/16,10.43.0.0/16"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
|
|
api:
|
|
build:
|
|
context: ..
|
|
dockerfile: platform/api/Dockerfile
|
|
network_mode: host # needs to reach the Provisioner at localhost:4100 (host-networked);
|
|
# port 4300 is directly the host's port under host networking, no
|
|
# `ports:` mapping needed (and compose rejects one with this mode).
|
|
environment:
|
|
# localhost:5433, not the "postgres" compose hostname — network_mode: host means this
|
|
# container is on the host's network namespace, not the compose bridge network, so
|
|
# compose's internal DNS doesn't resolve here (same reason Provisioner uses localhost too).
|
|
PLATFORM_DB_URL: postgres://postgres:postgres@localhost:5433/rootnode_platform
|
|
PROVISIONER_URL: "http://localhost:4100"
|
|
PROVISIONER_SHARED_SECRET: ${PROVISIONER_SHARED_SECRET:?set a real secret, do not use a default}
|
|
ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set an instructor password, do not use a default}
|
|
PLATFORM_API_PORT: "4300"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
provisioner:
|
|
condition: service_started
|
|
|
|
gateway:
|
|
build: ./gateway
|
|
network_mode: host
|
|
environment:
|
|
GATEWAY_PORT: "4200"
|
|
PROVISIONER_URL: "http://localhost:4100"
|
|
PROVISIONER_SHARED_SECRET: ${PROVISIONER_SHARED_SECRET:?set a real secret, do not use a default}
|
|
PLATFORM_API_URL: "http://localhost:4300"
|
|
depends_on:
|
|
- provisioner
|
|
- api
|