Rocky
405a2cfc0f
Enforce mTLS and least-privilege runtime boundaries while adding repeatable MySQL 8.4 and Docker smoke checks that require no production secrets.
122 lines
3.1 KiB
YAML
122 lines
3.1 KiB
YAML
services:
|
|
mysql:
|
|
image: mysql:8.4
|
|
environment:
|
|
MYSQL_DATABASE: osg_account_smoke
|
|
MYSQL_ROOT_PASSWORD: ${SMOKE_MYSQL_ROOT_PASSWORD:?generated by deploy/smoke-local.sh}
|
|
TZ: UTC
|
|
volumes:
|
|
- smoke-mysql-data:/var/lib/mysql
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"MYSQL_PWD=$$MYSQL_ROOT_PASSWORD mysqladmin ping --host=127.0.0.1 --user=root --silent",
|
|
]
|
|
interval: 2s
|
|
timeout: 3s
|
|
retries: 60
|
|
networks:
|
|
- smoke-internal
|
|
|
|
schema-migrator:
|
|
profiles: ["setup"]
|
|
image: osg-account-server-smoke:${SMOKE_RUN_ID:?generated by deploy/smoke-local.sh}
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
init: true
|
|
user: "10001:10001"
|
|
env_file:
|
|
- ${SMOKE_RUNTIME_ENV:?generated by deploy/smoke-local.sh}
|
|
environment:
|
|
ADMIN_ENABLED: "false"
|
|
ADMIN_BOOTSTRAP_ENABLED: "false"
|
|
DATABASE_USER: osg_smoke_migrator
|
|
DATABASE_PASSWORD: ${SMOKE_MYSQL_MIGRATION_PASSWORD:?generated by deploy/smoke-local.sh}
|
|
depends_on:
|
|
mysql:
|
|
condition: service_healthy
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=64m,mode=1777,noexec,nosuid,nodev
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
networks:
|
|
- smoke-internal
|
|
|
|
credential-generator:
|
|
profiles: ["setup"]
|
|
image: osg-account-server-smoke:${SMOKE_RUN_ID:?generated by deploy/smoke-local.sh}
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
entrypoint:
|
|
- java
|
|
- -cp
|
|
- /app/lib/*
|
|
- com.osglab.account.tools.AdminCredentialGenerator
|
|
command:
|
|
- smoke-admin
|
|
- /run/smoke/admin.generated.env
|
|
- /run/smoke/admin-handoff.txt
|
|
user: "${SMOKE_HOST_UID:?generated by deploy/smoke-local.sh}:${SMOKE_HOST_GID:?generated by deploy/smoke-local.sh}"
|
|
volumes:
|
|
- ${SMOKE_SECRET_DIR:?generated by deploy/smoke-local.sh}:/run/smoke
|
|
read_only: true
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
network_mode: none
|
|
|
|
account-server:
|
|
image: osg-account-server-smoke:${SMOKE_RUN_ID:?generated by deploy/smoke-local.sh}
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
init: true
|
|
user: "10001:10001"
|
|
env_file:
|
|
- ${SMOKE_RUNTIME_ENV:?generated by deploy/smoke-local.sh}
|
|
- ${SMOKE_ADMIN_ENV:?generated by deploy/smoke-local.sh}
|
|
depends_on:
|
|
mysql:
|
|
condition: service_healthy
|
|
ports:
|
|
- "127.0.0.1:${SMOKE_APP_PORT:?generated by deploy/smoke-local.sh}:8080"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:size=64m,mode=1777,noexec,nosuid,nodev
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD",
|
|
"wget",
|
|
"-q",
|
|
"-O",
|
|
"/dev/null",
|
|
"http://127.0.0.1:8080/health/ready",
|
|
]
|
|
interval: 2s
|
|
timeout: 3s
|
|
retries: 60
|
|
networks:
|
|
- smoke-internal
|
|
- smoke-loopback
|
|
|
|
volumes:
|
|
smoke-mysql-data:
|
|
|
|
networks:
|
|
smoke-internal:
|
|
internal: true
|
|
smoke-loopback:
|
|
driver: bridge
|