# AccessHub 0.2.0-alpha.2 — thin patched PostgreSQL; five explicit services.
name: accesshub-five
x-logging: &bounded-logging
  driver: json-file
  options:
    max-size: 5m
    max-file: '2'
services:
  web:
    logging: *bounded-logging
    depends_on:
      api:
        condition: service_healthy
      console-gateway:
        condition: service_healthy
    image: ${ACCESSHUB_PROXY_IMAGE:-ghcr.io/saiedawad/accesshub-proxy:0.1.0-alpha.1}
    networks:
      console-session-proxy:
        ipv4_address: ${ACCESSHUB_CONSOLE_PROXY_IP:-10.243.0.2}
        aliases: [console-https]
      frontend:
        aliases: [console-https]
    ports:
    - ${ACCESSHUB_WEB_BIND_ADDRESS:-${ACCESSHUB_PRIVATE_ADDRESS:-127.0.0.1}}:${ACCESSHUB_WEB_PORT:-8444}:8443
    restart: unless-stopped
    security_opt:
    - no-new-privileges:true
    volumes:
    - console-https-data:/data
    - console-https-config:/config
    environment:
      ACCESSHUB_WEB_HOST: ${ACCESSHUB_WEB_HOST:-${ACCESSHUB_PRIVATE_ADDRESS:-localhost}}
    configs:
    - source: website-proxy
      target: /etc/caddy/Caddyfile
  api:
    logging: *bounded-logging
    image: ${ACCESSHUB_API_IMAGE:-ghcr.io/saiedawad/accesshub-api:0.2.0-alpha.2}
    restart: unless-stopped
    read_only: true
    tmpfs:
    - /tmp
    - /run/five
    - /run/accesshub
    - /run/broker
    environment:
      ACCESSHUB_PRIVATE_ADDRESS: ${ACCESSHUB_PRIVATE_ADDRESS:-}
      ACCESSHUB_WEB_HOST: ${ACCESSHUB_WEB_HOST:-${ACCESSHUB_PRIVATE_ADDRESS:-localhost}}
      ACCESSHUB_WEB_PORT: ${ACCESSHUB_WEB_PORT:-8444}
      ACCESSHUB_WEB_ORIGIN: ${ACCESSHUB_WEB_ORIGIN:-}
      ACCESSHUB_CLIENT_NETWORKS: ${ACCESSHUB_CLIENT_NETWORKS:-}
      ACCESSHUB_ENROLLMENT_DOCKER_NETWORK: ${ACCESSHUB_ENROLLMENT_DOCKER_NETWORK:-10.244.240.0/24}
      ACCESSHUB_TRUSTED_PROXY_IPS: ${ACCESSHUB_CONSOLE_PROXY_IP:-10.243.0.2}
    depends_on:
      database:
        condition: service_started
    volumes:
    - api-credentials:/run/secrets:ro
    - tls-trust:/run/trust:ro
    - console-public:/var/lib/accesshub-console-public
    - console-public:/run/console-public:ro
    - console-state:/var/lib/accesshub-console
    - console-provision-socket:/run/accesshub-console-provision
    - console-broker-credentials:/run/console-broker
    - console-gateway-config:/initialize-gateway
    - console-session-socket:/run/accesshub-console-session
    - console-database-credentials:/run/console-database:ro
    - enrollment-credentials:/run/enrollment-secrets:ro
    - enrollment-tls:/run/tls:ro
    - enrollment-state:/var/lib/accesshub-enrollment
    - init-state:/initialize/state
    - database-credentials:/initialize/database
    - api-credentials:/initialize/api
    - directory-credentials:/initialize/directory
    - writer-credentials:/initialize/writer
    - enrollment-credentials:/initialize/enrollment
    - console-database-credentials:/initialize/console
    - postgres-init:/initialize/postgres-init
    - tls-state:/initialize-tls/state
    - tls-authority:/initialize-tls/authority
    - directory-tls:/initialize-tls/directory
    - enrollment-tls:/initialize-tls/enrollment
    - tls-trust:/initialize-tls/trust
    networks:
      backend: null
      console-session-proxy:
        aliases:
        - api-console-upstream
      directory-network: null
      enrollment-api:
        aliases: [enrollment]
      frontend: null
      private-ingress: null
      console-private-egress: null
    ports:
    - ${ACCESSHUB_PRIVATE_ADDRESS:-127.0.0.1}:8443:8443
    security_opt:
    - no-new-privileges:true
    cap_drop:
    - ALL
    cap_add:
    - CHOWN
    - DAC_OVERRIDE
    - FOWNER
    - SETUID
    - SETGID
    - KILL
    healthcheck:
      test:
      - CMD
      - python
      - -c
      - from pathlib import Path; import urllib.request; assert Path('/run/five/ready').is_file(); urllib.request.urlopen('http://127.0.0.1:8000/health/ready',timeout=2)
      interval: 5s
      timeout: 3s
      retries: 60
      start_period: 20s
    stop_grace_period: 30s
  database:
    logging: *bounded-logging
    environment:
      POSTGRES_DB: accesshub
      POSTGRES_USER: postgres
      POSTGRES_INITDB_ARGS: --data-checksums
    entrypoint: [/bin/sh, -ec]
    command:
    - |
      if [ ! -s "$$PGDATA/PG_VERSION" ]; then
        until [ -s /docker-entrypoint-initdb.d/00-accesshub.sql ]; do sleep 1; done
      fi
      export POSTGRES_PASSWORD="$$(od -vAn -N32 -tx1 /dev/urandom | tr -d ' \n')"
      exec docker-entrypoint.sh postgres -c hba_file=/etc/postgresql/accesshub-pg_hba.conf
    healthcheck:
      test:
      - CMD-SHELL
      - pg_isready -h 127.0.0.1 -U accesshub -d accesshub
      interval: 5s
      timeout: 3s
      retries: 60
    image: ${ACCESSHUB_DATABASE_IMAGE:-ghcr.io/saiedawad/accesshub-database:0.1.0-alpha.1@sha256:d23b0e091f04139d367c276eb743042356005d400c9f696f08c1241943a21148}
    networks:
      backend: null
    restart: unless-stopped
    volumes:
    - database-data:/var/lib/postgresql
    - postgres-init:/docker-entrypoint-initdb.d:ro
    configs:
    - source: database-hba
      target: /etc/postgresql/accesshub-pg_hba.conf
    security_opt:
    - no-new-privileges:true
    stop_grace_period: 30s
  directory:
    logging: *bounded-logging
    depends_on:
      database:
        condition: service_healthy
    environment: {}
    healthcheck:
      interval: 5s
      retries: 60
      test:
      - CMD-SHELL
      - test -f /run/accesshub-five-directory-ready && LDAPTLS_CACERT=/run/trust/ca.pem LDAPTLS_REQCERT=demand ldapwhoami
        -x -H ldaps://127.0.0.1:636 -D cn=admin,dc=accesshub,dc=test -y /run/secrets/ldap_admin_password >/dev/null
      timeout: 3s
    image: ${ACCESSHUB_DIRECTORY_IMAGE:-ghcr.io/saiedawad/accesshub-directory:0.2.0-alpha.1}
    networks:
      directory-network: null
      private-ingress: null
    ports:
    - ${ACCESSHUB_PRIVATE_ADDRESS:-127.0.0.1}:389:389
    restart: unless-stopped
    volumes:
    - directory-data:/var/lib/ldap
    - directory-config:/etc/ldap/slapd.d
    - directory-credentials:/run/secrets:ro
    - directory-tls:/run/tls:ro
    - tls-trust:/run/trust:ro
    - writer-credentials:/run/writer:ro
    - enrollment-credentials:/run/enrollment:ro
    security_opt:
    - no-new-privileges:true
  console-gateway:
    logging: *bounded-logging
    cap_drop:
    - ALL
    depends_on:
      api:
        condition: service_healthy
    entrypoint:
    - python
    - -m
    - accesshub_api.console_runtime
    - gateway
    - --config
    - /run/console-gateway/config.json
    healthcheck:
      interval: 5s
      retries: 10
      test:
      - CMD
      - python
      - -c
      - import socket; socket.create_connection(('127.0.0.1',8010),timeout=2).close()
      timeout: 3s
    image: ${ACCESSHUB_CONSOLE_IMAGE:-ghcr.io/saiedawad/accesshub-console:0.1.0-alpha.1}
    networks:
      console-private-egress: null
      console-session-proxy: null
    read_only: true
    restart: unless-stopped
    security_opt:
    - no-new-privileges:true
    tmpfs:
    - /tmp
    user: 12002:12000
    volumes:
    - console-gateway-config:/run/console-gateway:ro
    - console-session-socket:/run/accesshub-console-session:ro
    environment: {}
networks:
  backend:
    internal: true
  console-private-egress: {}
  console-session-proxy:
    internal: true
    ipam:
      config:
      - ip_range: ${ACCESSHUB_CONSOLE_PROXY_DYNAMIC_RANGE:-10.243.0.128/25}
        subnet: ${ACCESSHUB_CONSOLE_PROXY_SUBNET:-10.243.0.0/24}
  directory-network:
    internal: true
  enrollment-api:
    internal: true
  frontend: {}
  private-ingress:
    ipam:
      config:
      - subnet: ${ACCESSHUB_ENROLLMENT_DOCKER_NETWORK:-10.244.240.0/24}
volumes:
  api-credentials: {}
  console-broker-credentials: {}
  console-gateway-config: {}
  console-https-config: {}
  console-https-data: {}
  console-provision-socket: {}
  console-public: {}
  console-session-socket: {}
  console-state: {}
  database-credentials: {}
  database-data: {}
  postgres-init: {}
  directory-config: {}
  directory-credentials: {}
  directory-data: {}
  directory-tls: {}
  enrollment-credentials: {}
  enrollment-state: {}
  enrollment-tls: {}
  init-state: {}
  tls-authority: {}
  tls-state: {}
  tls-trust: {}
  writer-credentials: {}
  console-database-credentials: {}
configs:
  database-hba:
    content: |
      local all all trust
      host all postgres all reject
      host all all all scram-sha-256
  website-proxy:
    content: "{\n admin off\n}\nhttps://{$$ACCESSHUB_WEB_HOST}:8443 {\n tls internal\n handle /console/session {\n\
      \  reverse_proxy console-gateway:8010\n }\n handle {\n  reverse_proxy api-console-upstream:8000\n }\n}\n"