Organize local infrastructure and Vault secrets by service ownership

2026-09-12 23:30:18 +02:00
1 parent 1b8800ee73
commit 9dbf0bd80c
@@ -0,0 +1,148 @@
+name: sxchnge-local
+
+x-agent: &agent
+  restart: unless-stopped
+  environment:
+    VAULT_ADDR: http://vault:8200
+  tmpfs:
+    - /run/sxchnge:uid=100,gid=1000,mode=0700
+
+x-backend-build: &backend-build
+  context: .
+  dockerfile: infra/images/backend.Dockerfile
+
+services:
+  vault:
+    image: ${VAULT_IMAGE:?Run make build first}
+    user: root
+    entrypoint: [/bin/sh, /etc/vault/start.sh]
+    restart: unless-stopped
+    ports: ['127.0.0.1:18200:8200']
+    volumes:
+      - vault-data:/vault/file
+      - ./infra/local/vault/server.hcl:/etc/vault/server.hcl:ro
+      - ./infra/local/vault/start.sh:/etc/vault/start.sh:ro
+      - ./.local/dev/vault:/bootstrap:ro
+    healthcheck:
+      test: [CMD-SHELL, 'VAULT_ADDR=http://127.0.0.1:8200 vault status >/dev/null']
+      interval: 3s
+      timeout: 3s
+      retries: 40
+
+  mongo:
+    image: ${MONGO_IMAGE:?Run make build first}
+    entrypoint: [/bin/sh, /etc/mongo/start.sh]
+    command: [mongod, --replSet, rs0, --bind_ip_all, --keyFile, /tmp/mongo-keyfile]
+    restart: unless-stopped
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: local-admin
+      MONGO_INITDB_ROOT_PASSWORD_FILE: /run/mongo/password
+    volumes:
+      - ./infra/local/mongo/start.sh:/etc/mongo/start.sh:ro
+      - mongo-data:/data/db
+      - ./.local/dev/mongo:/run/mongo:ro
+    healthcheck:
+      test: [CMD, mongosh, --quiet, --eval, 'quit(db.hello().isWritablePrimary ? 0 : 1)']
+      interval: 3s
+      timeout: 5s
+      retries: 40
+
+  nats:
+    <<: *agent
+    image: sxchnge-local/nats:dev
+    build:
+      context: .
+      dockerfile: infra/images/nats.Dockerfile
+      args:
+        NATS_IMAGE: ${NATS_IMAGE:?Run make build first}
+        VAULT_IMAGE: ${VAULT_IMAGE:?Run make build first}
+    volumes:
+      - nats-data:/data
+      - ./.local/dev/agents/nats:/etc/agent:ro
+    depends_on:
+      vault: {condition: service_healthy}
+    healthcheck:
+      test: [CMD, wget, -q, -O, /dev/null, 'http://127.0.0.1:8222/healthz?js-enabled-only=true']
+      interval: 3s
+      timeout: 3s
+      retries: 40
+
+  notifications:
+    <<: *agent
+    image: sxchnge-local/notifications:dev
+    build:
+      <<: *backend-build
+      args:
+        GO_IMAGE: ${GO_IMAGE:?Run make build first}
+        VAULT_IMAGE: ${VAULT_IMAGE:?Run make build first}
+        MODULE: notifications
+    environment:
+      VAULT_ADDR: http://vault:8200
+      SXCHNGE_SERVICE: notifications
+    volumes:
+      - ./.local/dev/agents/notifications:/etc/agent:ro
+    depends_on:
+      vault: {condition: service_healthy}
+      mongo: {condition: service_healthy}
+      nats: {condition: service_healthy}
+    healthcheck:
+      test: [CMD, nc, -z, 127.0.0.1, '8083']
+      interval: 3s
+      timeout: 3s
+      retries: 40
+
+  bff:
+    <<: *agent
+    image: sxchnge-local/bff:dev
+    build:
+      <<: *backend-build
+      args:
+        GO_IMAGE: ${GO_IMAGE:?Run make build first}
+        VAULT_IMAGE: ${VAULT_IMAGE:?Run make build first}
+        MODULE: product
+    environment:
+      VAULT_ADDR: http://vault:8200
+      SXCHNGE_SERVICE: bff
+      SXCHNGE_DOMAIN: localhost:5126
+      SXCHNGE_API_PROTOCOL: https
+      SXCHNGE_API_ENDPOINT: /api/v1
+    volumes:
+      - ./.local/dev/agents/bff:/etc/agent:ro
+    depends_on:
+      notifications: {condition: service_healthy}
+      mongo: {condition: service_healthy}
+    healthcheck:
+      test: [CMD, wget, -q, -O, /dev/null, 'http://127.0.0.1:8082/api/v1/health']
+      interval: 3s
+      timeout: 3s
+      retries: 40
+
+  frontend:
+    image: sxchnge-local/frontend:dev
+    build:
+      context: .
+      dockerfile: infra/images/frontend.Dockerfile
+      args:
+        UBUNTU_IMAGE: ${UBUNTU_IMAGE:?Run make build first}
+        CADDY_IMAGE: ${CADDY_IMAGE:?Run make build first}
+        FLUTTER_VERSION: ${FLUTTER_VERSION:?Run make build first}
+        FLUTTER_COMMIT: ${FLUTTER_COMMIT:?Run make build first}
+    restart: unless-stopped
+    ports: ['127.0.0.1:5126:8443']
+    volumes:
+      - caddy-data:/data
+      - caddy-config:/config
+    depends_on:
+      bff: {condition: service_healthy}
+    healthcheck:
+      test: [CMD, wget, -q, --no-check-certificate, -O, /dev/null, 'https://localhost:8443/']
+      interval: 3s
+      timeout: 3s
+      retries: 40
+
+volumes:
+  vault-data:
+  mongo-data:
+  nats-data:
+  caddy-data:
+  caddy-config: