# Standalone advanced candidate. Same defaults and volumes as compose.yaml. # New image tags are not published yet. name: accesshub-five services: web: restart: unless-stopped security_opt: &id001 - no-new-privileges:true logging: &id002 driver: json-file options: max-size: 5m max-file: '2' image: ${ACCESSHUB_PROXY_IMAGE:-ghcr.io/saiedawad/accesshub-proxy:0.3.0-alpha.1} environment: ACCESSHUB_WEB_HOST: ${ACCESSHUB_WEB_HOST:-${ACCESSHUB_PRIVATE_ADDRESS:-localhost}} ports: - ${ACCESSHUB_WEB_BIND_ADDRESS:-${ACCESSHUB_PRIVATE_ADDRESS:-127.0.0.1}}:${ACCESSHUB_WEB_PORT:-8444}:8443 volumes: - console-https-data:/data - console-https-config:/config networks: console-session-proxy: ipv4_address: 10.243.0.2 aliases: - console-https frontend: aliases: - console-https depends_on: api: condition: service_healthy console-gateway: condition: service_healthy configs: - source: website-proxy target: /etc/caddy/Caddyfile api: restart: unless-stopped security_opt: *id001 logging: *id002 image: ${ACCESSHUB_API_IMAGE:-ghcr.io/saiedawad/accesshub-api:0.3.0-alpha.1} environment: ACCESSHUB_PRIVATE_ADDRESS: ${ACCESSHUB_PRIVATE_ADDRESS:-} ACCESSHUB_WEB_HOST: ${ACCESSHUB_WEB_HOST:-${ACCESSHUB_PRIVATE_ADDRESS:-localhost}} ACCESSHUB_WEB_PORT: ${ACCESSHUB_WEB_PORT:-8444} ACCESSHUB_CLIENT_NETWORKS: ${ACCESSHUB_CLIENT_NETWORKS:-} ACCESSHUB_WEB_ORIGIN: ${ACCESSHUB_WEB_ORIGIN:-} ACCESSHUB_ENROLLMENT_DOCKER_NETWORK: 10.244.240.0/24 ACCESSHUB_TRUSTED_PROXY_IPS: 10.243.0.2 ports: - ${ACCESSHUB_PRIVATE_ADDRESS:-127.0.0.1}:8443:8443 read_only: true tmpfs: - /tmp - /run/five - /run/accesshub - /run/broker cap_drop: - ALL cap_add: - CHOWN - DAC_OVERRIDE - FOWNER - SETUID - SETGID - KILL stop_grace_period: 30s networks: backend: {} console-session-proxy: aliases: - api-console-upstream directory-network: {} enrollment-api: aliases: - enrollment frontend: {} private-ingress: {} console-private-egress: {} volumes: - accesshub-data:/initialize - {type: volume, source: accesshub-data, target: /run/secrets, read_only: true, volume: {subpath: api}} - {type: volume, source: accesshub-data, target: /run/trust, read_only: true, volume: {subpath: tls/trust}} - {type: volume, source: accesshub-data, target: /var/lib/accesshub-console-public, volume: {subpath: console-public}} - {type: volume, source: accesshub-data, target: /run/console-public, read_only: true, volume: {subpath: console-public}} - {type: volume, source: accesshub-data, target: /var/lib/accesshub-console, volume: {subpath: console-state}} - {type: volume, source: accesshub-data, target: /run/accesshub-console-provision, volume: {subpath: console-provision-socket}} - {type: volume, source: accesshub-data, target: /run/console-broker, volume: {subpath: console-broker}} - {type: volume, source: accesshub-data, target: /initialize-gateway, volume: {subpath: console-gateway}} - {type: volume, source: accesshub-data, target: /run/accesshub-console-session, volume: {subpath: console-session-socket}} - {type: volume, source: accesshub-data, target: /run/console-database, read_only: true, volume: {subpath: console}} - {type: volume, source: accesshub-data, target: /run/enrollment-secrets, read_only: true, volume: {subpath: enrollment}} - {type: volume, source: accesshub-data, target: /run/tls, read_only: true, volume: {subpath: tls/enrollment}} - {type: volume, source: accesshub-data, target: /var/lib/accesshub-enrollment, volume: {subpath: enrollment-state}} healthcheck: test: - CMD - python - -c - from pathlib import Path; import urllib.request; assert Path('/run/five/ready').is_file(); urllib.request.urlopen('http://127.0.0.1:8000/health/ready',timeout=2) interval: 5s timeout: 3s retries: 60 start_period: 20s database: restart: unless-stopped security_opt: *id001 logging: *id002 image: postgres:18.6-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873 entrypoint: - /bin/sh - -ec command: - until test -s /docker-entrypoint-initdb.d/.accesshub-start; do sleep 1; done; exec sh /docker-entrypoint-initdb.d/.accesshub-start depends_on: api: condition: service_started volumes: - database-data:/var/lib/postgresql - {type: volume, source: accesshub-data, target: /docker-entrypoint-initdb.d, read_only: true, volume: {subpath: postgres-init}} networks: - backend healthcheck: test: - CMD-SHELL - pg_isready -h 127.0.0.1 -U accesshub -d accesshub interval: 5s timeout: 3s retries: 60 stop_grace_period: 30s directory: restart: unless-stopped security_opt: *id001 logging: *id002 image: ${ACCESSHUB_DIRECTORY_IMAGE:-ghcr.io/saiedawad/accesshub-directory:0.3.0-alpha.1} ports: - ${ACCESSHUB_PRIVATE_ADDRESS:-127.0.0.1}:389:389 depends_on: database: condition: service_healthy networks: - directory-network - private-ingress volumes: - directory-data:/var/lib/accesshub-directory - {type: volume, source: accesshub-data, target: /run/secrets, read_only: true, volume: {subpath: directory}} - {type: volume, source: accesshub-data, target: /run/tls, read_only: true, volume: {subpath: tls/directory}} - {type: volume, source: accesshub-data, target: /run/trust, read_only: true, volume: {subpath: tls/trust}} - {type: volume, source: accesshub-data, target: /run/writer, read_only: true, volume: {subpath: writer}} - {type: volume, source: accesshub-data, target: /run/enrollment, read_only: true, volume: {subpath: enrollment}} healthcheck: interval: 5s retries: 60 test: - CMD-SHELL - test -f /run/accesshub-five-directory-ready && LDAPTLS_CACERT=/run/trust/ca.pem LDAPTLS_REQCERT=demand ldapwhoami -x -H ldaps://127.0.0.1:636 -D cn=admin,dc=accesshub,dc=test -y /run/secrets/ldap_admin_password >/dev/null timeout: 3s console-gateway: restart: unless-stopped security_opt: *id001 logging: *id002 image: ${ACCESSHUB_CONSOLE_IMAGE:-ghcr.io/saiedawad/accesshub-console:0.3.0-alpha.1} depends_on: api: condition: service_healthy read_only: true tmpfs: - /tmp cap_drop: - ALL networks: - console-private-egress - console-session-proxy volumes: - {type: volume, source: accesshub-data, target: /run/console-gateway, read_only: true, volume: {subpath: console-gateway}} - {type: volume, source: accesshub-data, target: /run/accesshub-console-session, read_only: true, volume: {subpath: console-session-socket}} healthcheck: interval: 5s retries: 10 test: - CMD - python - -c - import socket; socket.create_connection(('127.0.0.1',8010),timeout=2).close() timeout: 3s entrypoint: - python - -m - accesshub_api.console_runtime - gateway - --config - /run/console-gateway/config.json user: 12002:12000 networks: backend: internal: true directory-network: internal: true enrollment-api: internal: true console-session-proxy: internal: true ipam: config: - subnet: 10.243.0.0/24 ip_range: 10.243.0.128/25 private-ingress: ipam: config: - subnet: 10.244.240.0/24 console-private-egress: {} frontend: {} volumes: accesshub-data: {} console-https-config: {} console-https-data: {} database-data: {} directory-data: {} configs: website-proxy: content: "{\n admin off\n}\nhttps://{$$ACCESSHUB_WEB_HOST}:8443 {\n tls internal\n\ \ handle /console/session {\n reverse_proxy console-gateway:8010\n }\n handle\ \ {\n reverse_proxy api-console-upstream:8000\n }\n}\n"