Fail-fast secrets in stage/prod via EVENTHUB_ENV. Refs EventHub/EventHubBack#25
This commit is contained in:
+21
-4
@@ -1,4 +1,21 @@
|
||||
# .env.example — закоммитьте этот файл, а реальный .env держите в .gitignore
|
||||
RELEASE_COOKIE=ваш-очень-длинный-секретный-куки
|
||||
GRAFANA_ADMIN_PASSWORD=сложный-уникальный-пароль
|
||||
JWT_SECRET=суперсекрет
|
||||
# Скопируйте в .env (файл .env в .gitignore). Для локальной разработки: EVENTHUB_ENV=dev
|
||||
|
||||
# Режим: dev | stage | prod (stage/prod — обязательные сильные секреты)
|
||||
EVENTHUB_ENV=dev
|
||||
|
||||
RELEASE_COOKIE=ваш-очень-длинный-секретный-куки-минимум-32-символа
|
||||
GRAFANA_ADMIN_PASSWORD=сложный-уникальный-пароль
|
||||
|
||||
# JWT (минимум 32 символа, не из denylist — см. infra_secrets)
|
||||
JWT_SECRET=замените-на-случайную-строку-минимум-32-символа-для-user-jwt
|
||||
ADMIN_JWT_SECRET=замените-на-другую-случайную-строку-минимум-32-символа
|
||||
|
||||
# Seed админов (обязательны в stage/prod при пустой таблице admin; в dev — опционально)
|
||||
ADMIN_SUPER_EMAIL=superadmin@eventhub.local
|
||||
ADMIN_SUPER_PASSWORD=замените-сильный-пароль-суперадмина
|
||||
ADMIN_EMAIL=admin@eventhub.local
|
||||
ADMIN_PASSWORD=замените-сильный-пароль-админа
|
||||
ADMIN_MODER_EMAIL=moderator@eventhub.local
|
||||
ADMIN_MODER_PASSWORD=замените-сильный-пароль-модератора
|
||||
ADMIN_SUPPORT_EMAIL=support@eventhub.local
|
||||
ADMIN_SUPPORT_PASSWORD=замените-сильный-пароль-поддержки
|
||||
|
||||
+14
-12
@@ -1,12 +1,14 @@
|
||||
RELEASE_COOKIE=FuNHSU3SIiW8ICu2XIbl0pvpxAhpBvO2Wki7CT6q2bpHDSlQ8p7gtUgjnyXpPJU5
|
||||
GRAFANA_ADMIN_PASSWORD=admin
|
||||
JWT_SECRET=IDhKNFRLZFDYgPvVXwg4T7hAviQ2I1VGeEn5vXufQXK3AAErZuhMWy8J1uxJ0kGF
|
||||
TRAEFIK_LOG_PATH=/app/traefik/logs/access.log
|
||||
ADMIN_SUPER_EMAIL=superadmin@eventhub.local
|
||||
ADMIN_SUPER_PASSWORD=123456
|
||||
ADMIN_EMAIL=admin@eventhub.local
|
||||
ADMIN_PASSWORD=123456
|
||||
ADMIN_MODER_EMAIL=moderator@eventhub.local
|
||||
ADMIN_MODER_PASSWORD=123456
|
||||
ADMIN_SUPPORT_EMAIL=support@eventhub.local
|
||||
ADMIN_SUPPORT_PASSWORD=123456
|
||||
EVENTHUB_ENV=stage
|
||||
RELEASE_COOKIE=FuNHSU3SIiW8ICu2XIbl0pvpxAhpBvO2Wki7CT6q2bpHDSlQ8p7gtUgjnyXpPJU5
|
||||
GRAFANA_ADMIN_PASSWORD=замените-сильный-пароль-grafana
|
||||
JWT_SECRET=IDhKNFRLZFDYgPvVXwg4T7hAviQ2I1VGeEn5vXufQXK3AAErZuhMWy8J1uxJ0kGF
|
||||
ADMIN_JWT_SECRET=K3AAErZuhMWy8J1uxJ0kGFIDhKNFRLZFDYgPvVXwg4T7hAviQ2I1VGeEn5vXufQ
|
||||
TRAEFIK_LOG_PATH=/app/traefik/logs/access.log
|
||||
ADMIN_SUPER_EMAIL=superadmin@eventhub.local
|
||||
ADMIN_SUPER_PASSWORD=замените-сильный-пароль-суперадмина-мин32
|
||||
ADMIN_EMAIL=admin@eventhub.local
|
||||
ADMIN_PASSWORD=замените-сильный-пароль-админа-минимум32
|
||||
ADMIN_MODER_EMAIL=moderator@eventhub.local
|
||||
ADMIN_MODER_PASSWORD=замените-сильный-пароль-модератора-мин32
|
||||
ADMIN_SUPPORT_EMAIL=support@eventhub.local
|
||||
ADMIN_SUPPORT_PASSWORD=замените-сильный-пароль-поддержки-мин32
|
||||
|
||||
@@ -1,81 +1,87 @@
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
# ================== Балансировщик ==================
|
||||
traefik:
|
||||
image: traefik:latest
|
||||
command:
|
||||
- "--log.level=DEBUG"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--entrypoints.web.address=:80"
|
||||
ports:
|
||||
- "80:80"
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Кластер EventHub ==================
|
||||
eventhub:
|
||||
image: git.sabilin.com/eventhub/eventhub:stage
|
||||
hostname: "eventhub-node{{.Task.Slot}}"
|
||||
environment:
|
||||
- NODE_NAME=eventhub-node{{.Task.Slot}}
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
- ADMIN_SUPER_EMAIL=${ADMIN_SUPER_EMAIL}
|
||||
- ADMIN_SUPER_PASSWORD=${ADMIN_SUPER_PASSWORD}
|
||||
- ADMIN_EMAIL=${ADMIN_EMAIL}
|
||||
- ADMIN_PASSWORD=${ADMIN_PASSWORD}
|
||||
- CLUSTER_MODE=true
|
||||
- DNS_NAME=eventhub-node
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
- eventhub-node
|
||||
volumes:
|
||||
- eventhub-data:/app/data
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 30s
|
||||
deploy:
|
||||
replicas: 1
|
||||
endpoint_mode: dnsrr
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Эмулятор ботов ==================
|
||||
bot-emulator-users:
|
||||
image: git.sabilin.com/eventhub/bot-emulator-users:stage
|
||||
environment:
|
||||
- ADMIN_API_HOST=http://eventhub-node:8445
|
||||
- CLIENT_API_HOST=http://eventhub-node:8080
|
||||
- ADMIN_EMAIL=${ADMIN_EMAIL}
|
||||
- ADMIN_PASSWORD=${ADMIN_PASSWORD}
|
||||
- BOT_PASSWORD=${BOT_PASSWORD}
|
||||
- STARTUP_DELAY=30
|
||||
- DEBUG=true
|
||||
networks:
|
||||
- eventhub-net
|
||||
depends_on:
|
||||
- eventhub
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
networks:
|
||||
eventhub-net:
|
||||
driver: overlay
|
||||
|
||||
volumes:
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
# ================== Балансировщик ==================
|
||||
traefik:
|
||||
image: traefik:latest
|
||||
command:
|
||||
- "--log.level=DEBUG"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--entrypoints.web.address=:80"
|
||||
ports:
|
||||
- "80:80"
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Кластер EventHub ==================
|
||||
eventhub:
|
||||
image: git.sabilin.com/eventhub/eventhub:stage
|
||||
hostname: "eventhub-node{{.Task.Slot}}"
|
||||
environment:
|
||||
- EVENTHUB_ENV=stage
|
||||
- NODE_NAME=eventhub-node{{.Task.Slot}}
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
- ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
|
||||
- ADMIN_SUPER_EMAIL=${ADMIN_SUPER_EMAIL}
|
||||
- ADMIN_SUPER_PASSWORD=${ADMIN_SUPER_PASSWORD}
|
||||
- ADMIN_EMAIL=${ADMIN_EMAIL}
|
||||
- ADMIN_PASSWORD=${ADMIN_PASSWORD}
|
||||
- ADMIN_MODER_EMAIL=${ADMIN_MODER_EMAIL}
|
||||
- ADMIN_MODER_PASSWORD=${ADMIN_MODER_PASSWORD}
|
||||
- ADMIN_SUPPORT_EMAIL=${ADMIN_SUPPORT_EMAIL}
|
||||
- ADMIN_SUPPORT_PASSWORD=${ADMIN_SUPPORT_PASSWORD}
|
||||
- CLUSTER_MODE=true
|
||||
- DNS_NAME=eventhub-node
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
- eventhub-node
|
||||
volumes:
|
||||
- eventhub-data:/app/data
|
||||
healthcheck:
|
||||
test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
start_period: 30s
|
||||
deploy:
|
||||
replicas: 1
|
||||
endpoint_mode: dnsrr
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Эмулятор ботов ==================
|
||||
bot-emulator-users:
|
||||
image: git.sabilin.com/eventhub/bot-emulator-users:stage
|
||||
environment:
|
||||
- ADMIN_API_HOST=http://eventhub-node:8445
|
||||
- CLIENT_API_HOST=http://eventhub-node:8080
|
||||
- ADMIN_EMAIL=${ADMIN_EMAIL}
|
||||
- ADMIN_PASSWORD=${ADMIN_PASSWORD}
|
||||
- BOT_PASSWORD=${BOT_PASSWORD}
|
||||
- STARTUP_DELAY=30
|
||||
- DEBUG=true
|
||||
networks:
|
||||
- eventhub-net
|
||||
depends_on:
|
||||
- eventhub
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
networks:
|
||||
eventhub-net:
|
||||
driver: overlay
|
||||
|
||||
volumes:
|
||||
eventhub-data:
|
||||
+229
-225
@@ -1,226 +1,230 @@
|
||||
# docker/docker-compose.swarm.yml
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
# ================== Балансировщик ==================
|
||||
traefik:
|
||||
image: traefik:latest
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
# - "--providers.swarm.endpoint=unix:///var/run/docker.sock" # провайдер Swarm
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--providers.file.filename=/etc/traefik/dynamic_conf.yml"
|
||||
- "--entrypoints.web.address=:80"
|
||||
- "--entrypoints.websecure.address=:443"
|
||||
- "--metrics.prometheus=true"
|
||||
- "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
|
||||
- "--metrics.prometheus.addEntryPointsLabels=true"
|
||||
- "--metrics.prometheus.addServicesLabels=true"
|
||||
- "--accesslog=true"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--accesslog.format=json"
|
||||
- "--experimental.plugins.coraza.modulename=github.com/jcchavezs/coraza-http-wasm-traefik"
|
||||
- "--experimental.plugins.coraza.version=v0.3.0"
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
- "8080:8080"
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "./traefik/certs:/etc/traefik/certs:ro"
|
||||
- "./traefik/dynamic_conf.yml:/etc/traefik/dynamic_conf.yml:ro"
|
||||
- "traefik-logs:/var/log/traefik"
|
||||
- "traefik-plugins:/plugins-storage"
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Сервис заглушка ==================
|
||||
fallback:
|
||||
image: fallback:latest
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Кластер EventHub ==================
|
||||
eventhub:
|
||||
image: eventhub:latest
|
||||
hostname: "eventhub-node{{.Task.Slot}}"
|
||||
environment:
|
||||
- NODE_NAME=eventhub-node{{.Task.Slot}}
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE:-eventhub_cookie}
|
||||
- JWT_SECRET=${JWT_SECRET:-eventhub_top_secret}
|
||||
- ADMIN_SUPER_EMAIL=${ADMIN_SUPER_EMAIL:-superadmin@eventhub.local}
|
||||
- ADMIN_SUPER_PASSWORD=${ADMIN_SUPER_PASSWORD:-123456}
|
||||
- ADMIN_MODER_EMAIL=${ADMIN_MODER_EMAIL:-moderator@eventhub.local}
|
||||
- ADMIN_MODER_PASSWORD=${ADMIN_MODER_PASSWORD:-123456}
|
||||
- ADMIN_SUPPORT_EMAIL=${ADMIN_SUPPORT_EMAIL:-support@eventhub.local}
|
||||
- ADMIN_SUPPORT_PASSWORD=${ADMIN_SUPPORT_PASSWORD:-123456}
|
||||
- CLUSTER_MODE=true
|
||||
- DNS_NAME=eventhub-node
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
- eventhub-node
|
||||
volumes:
|
||||
- type: volume
|
||||
source: eventhub-data
|
||||
target: /app/data
|
||||
deploy:
|
||||
replicas: 1
|
||||
endpoint_mode: dnsrr
|
||||
restart_policy:
|
||||
condition: any
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
|
||||
# ================== Admin UI ==================
|
||||
admin-ui:
|
||||
image: eventhub-admin-ui:latest
|
||||
networks:
|
||||
- eventhub-net
|
||||
depends_on:
|
||||
- eventhub
|
||||
deploy:
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
|
||||
# ================== Мониторинг ==================
|
||||
prometheus:
|
||||
image: prom/prometheus:latest
|
||||
command:
|
||||
- '--config.file=/etc/prometheus/prometheus.yml'
|
||||
- '--storage.tsdb.path=/prometheus'
|
||||
- '--web.console.libraries=/usr/share/prometheus/console_libraries'
|
||||
- '--web.console.templates=/usr/share/prometheus/consoles'
|
||||
- '--storage.tsdb.retention.time=30d'
|
||||
- '--storage.tsdb.retention.size=15GB'
|
||||
volumes:
|
||||
- ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
|
||||
- prometheus-data:/prometheus
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "9090:9090"
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
grafana:
|
||||
image: grafana/grafana:latest
|
||||
environment:
|
||||
- GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
|
||||
- GF_SECURITY_DISABLE_INITIAL_ADMIN_PASSWORD_CHANGE=false
|
||||
- GF_USERS_ALLOW_SIGN_UP=false
|
||||
- GF_AUTH_ANONYMOUS_ENABLED=false
|
||||
volumes:
|
||||
- ./grafana/provisioning:/etc/grafana/provisioning
|
||||
- ./grafana/dashboards:/etc/grafana/dashboards
|
||||
- grafana-data:/var/lib/grafana
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "3000:3000"
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Аналитика логов ==================
|
||||
loglynx:
|
||||
image: k0lin/loglynx:latest
|
||||
user: root
|
||||
ports:
|
||||
- "6123:6123"
|
||||
volumes:
|
||||
- traefik-logs:/app/traefik/logs:ro
|
||||
- loglynx-data:/app/data
|
||||
environment:
|
||||
- TRAEFIK_LOG_PATH=${TRAEFIK_LOG_PATH}
|
||||
- SERVER_PORT=6123
|
||||
- DATABASE_PATH=/app/data/loglynx.db
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Инструмент отладки ==================
|
||||
observer_web:
|
||||
image: observer_web:latest
|
||||
environment:
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "4000:4000"
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Ротация логов ==================
|
||||
logrotate:
|
||||
image: logrotate:latest
|
||||
volumes:
|
||||
- traefik-logs:/var/log/traefik:rw
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
bot-emulator-users:
|
||||
image: bot-emulator-users:latest
|
||||
environment:
|
||||
- ADMIN_API_HOST=http://eventhub-node:8445
|
||||
- CLIENT_API_HOST=http://eventhub-node:8080
|
||||
- ADMIN_EMAIL=admin@eventhub.local
|
||||
- ADMIN_PASSWORD=123456
|
||||
- BOT_PASSWORD=botpass123
|
||||
- MIN_DELAY=0.5
|
||||
- MAX_DELAY=3.0
|
||||
- LOOP_FOREVER=true
|
||||
- BOT_REFRESH_INTERVAL=300
|
||||
- TICKET_CHANCE=0.07
|
||||
- STARTUP_DELAY=30
|
||||
- DEBUG=false
|
||||
networks:
|
||||
- eventhub-net
|
||||
depends_on:
|
||||
- eventhub
|
||||
deploy:
|
||||
mode: replicated
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
delay: 5s
|
||||
max_attempts: 3
|
||||
window: 120s
|
||||
|
||||
networks:
|
||||
eventhub-net:
|
||||
driver: overlay
|
||||
|
||||
volumes:
|
||||
eventhub-data:
|
||||
# name: 'eventhub-data-{{.Task.Slot}}'
|
||||
prometheus-data:
|
||||
grafana-data:
|
||||
traefik-logs:
|
||||
loglynx-data:
|
||||
# docker/docker-compose.swarm.yml
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
# ================== Балансировщик ==================
|
||||
traefik:
|
||||
image: traefik:latest
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
# - "--providers.swarm.endpoint=unix:///var/run/docker.sock" # провайдер Swarm
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--providers.file.filename=/etc/traefik/dynamic_conf.yml"
|
||||
- "--entrypoints.web.address=:80"
|
||||
- "--entrypoints.websecure.address=:443"
|
||||
- "--metrics.prometheus=true"
|
||||
- "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
|
||||
- "--metrics.prometheus.addEntryPointsLabels=true"
|
||||
- "--metrics.prometheus.addServicesLabels=true"
|
||||
- "--accesslog=true"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--accesslog.format=json"
|
||||
- "--experimental.plugins.coraza.modulename=github.com/jcchavezs/coraza-http-wasm-traefik"
|
||||
- "--experimental.plugins.coraza.version=v0.3.0"
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
- "8080:8080"
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "./traefik/certs:/etc/traefik/certs:ro"
|
||||
- "./traefik/dynamic_conf.yml:/etc/traefik/dynamic_conf.yml:ro"
|
||||
- "traefik-logs:/var/log/traefik"
|
||||
- "traefik-plugins:/plugins-storage"
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Сервис заглушка ==================
|
||||
fallback:
|
||||
image: fallback:latest
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Кластер EventHub ==================
|
||||
eventhub:
|
||||
image: eventhub:latest
|
||||
hostname: "eventhub-node{{.Task.Slot}}"
|
||||
environment:
|
||||
- EVENTHUB_ENV=prod
|
||||
- NODE_NAME=eventhub-node{{.Task.Slot}}
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
- ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
|
||||
- ADMIN_SUPER_EMAIL=${ADMIN_SUPER_EMAIL}
|
||||
- ADMIN_SUPER_PASSWORD=${ADMIN_SUPER_PASSWORD}
|
||||
- ADMIN_EMAIL=${ADMIN_EMAIL}
|
||||
- ADMIN_PASSWORD=${ADMIN_PASSWORD}
|
||||
- ADMIN_MODER_EMAIL=${ADMIN_MODER_EMAIL}
|
||||
- ADMIN_MODER_PASSWORD=${ADMIN_MODER_PASSWORD}
|
||||
- ADMIN_SUPPORT_EMAIL=${ADMIN_SUPPORT_EMAIL}
|
||||
- ADMIN_SUPPORT_PASSWORD=${ADMIN_SUPPORT_PASSWORD}
|
||||
- CLUSTER_MODE=true
|
||||
- DNS_NAME=eventhub-node
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
- eventhub-node
|
||||
volumes:
|
||||
- type: volume
|
||||
source: eventhub-data
|
||||
target: /app/data
|
||||
deploy:
|
||||
replicas: 1
|
||||
endpoint_mode: dnsrr
|
||||
restart_policy:
|
||||
condition: any
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
|
||||
# ================== Admin UI ==================
|
||||
admin-ui:
|
||||
image: eventhub-admin-ui:latest
|
||||
networks:
|
||||
- eventhub-net
|
||||
depends_on:
|
||||
- eventhub
|
||||
deploy:
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
|
||||
# ================== Мониторинг ==================
|
||||
prometheus:
|
||||
image: prom/prometheus:latest
|
||||
command:
|
||||
- '--config.file=/etc/prometheus/prometheus.yml'
|
||||
- '--storage.tsdb.path=/prometheus'
|
||||
- '--web.console.libraries=/usr/share/prometheus/console_libraries'
|
||||
- '--web.console.templates=/usr/share/prometheus/consoles'
|
||||
- '--storage.tsdb.retention.time=30d'
|
||||
- '--storage.tsdb.retention.size=15GB'
|
||||
volumes:
|
||||
- ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
|
||||
- prometheus-data:/prometheus
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "9090:9090"
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
grafana:
|
||||
image: grafana/grafana:latest
|
||||
environment:
|
||||
- GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
|
||||
- GF_SECURITY_DISABLE_INITIAL_ADMIN_PASSWORD_CHANGE=false
|
||||
- GF_USERS_ALLOW_SIGN_UP=false
|
||||
- GF_AUTH_ANONYMOUS_ENABLED=false
|
||||
volumes:
|
||||
- ./grafana/provisioning:/etc/grafana/provisioning
|
||||
- ./grafana/dashboards:/etc/grafana/dashboards
|
||||
- grafana-data:/var/lib/grafana
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "3000:3000"
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Аналитика логов ==================
|
||||
loglynx:
|
||||
image: k0lin/loglynx:latest
|
||||
user: root
|
||||
ports:
|
||||
- "6123:6123"
|
||||
volumes:
|
||||
- traefik-logs:/app/traefik/logs:ro
|
||||
- loglynx-data:/app/data
|
||||
environment:
|
||||
- TRAEFIK_LOG_PATH=${TRAEFIK_LOG_PATH}
|
||||
- SERVER_PORT=6123
|
||||
- DATABASE_PATH=/app/data/loglynx.db
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Инструмент отладки ==================
|
||||
observer_web:
|
||||
image: observer_web:latest
|
||||
environment:
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "4000:4000"
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Ротация логов ==================
|
||||
logrotate:
|
||||
image: logrotate:latest
|
||||
volumes:
|
||||
- traefik-logs:/var/log/traefik:rw
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
bot-emulator-users:
|
||||
image: bot-emulator-users:latest
|
||||
environment:
|
||||
- ADMIN_API_HOST=http://eventhub-node:8445
|
||||
- CLIENT_API_HOST=http://eventhub-node:8080
|
||||
- ADMIN_EMAIL=admin@eventhub.local
|
||||
- ADMIN_PASSWORD=123456
|
||||
- BOT_PASSWORD=botpass123
|
||||
- MIN_DELAY=0.5
|
||||
- MAX_DELAY=3.0
|
||||
- LOOP_FOREVER=true
|
||||
- BOT_REFRESH_INTERVAL=300
|
||||
- TICKET_CHANCE=0.07
|
||||
- STARTUP_DELAY=30
|
||||
- DEBUG=false
|
||||
networks:
|
||||
- eventhub-net
|
||||
depends_on:
|
||||
- eventhub
|
||||
deploy:
|
||||
mode: replicated
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
delay: 5s
|
||||
max_attempts: 3
|
||||
window: 120s
|
||||
|
||||
networks:
|
||||
eventhub-net:
|
||||
driver: overlay
|
||||
|
||||
volumes:
|
||||
eventhub-data:
|
||||
# name: 'eventhub-data-{{.Task.Slot}}'
|
||||
prometheus-data:
|
||||
grafana-data:
|
||||
traefik-logs:
|
||||
loglynx-data:
|
||||
traefik-plugins:
|
||||
+218
-212
@@ -1,213 +1,219 @@
|
||||
# docker/docker-compose.yml
|
||||
services:
|
||||
# ================== Балансировщик (HTTPS/WSS, WAF, логи) ==================
|
||||
traefik:
|
||||
image: traefik:latest
|
||||
user: "0:1001" # группа docker на хосте
|
||||
command:
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--providers.file.filename=/etc/traefik/dynamic_conf.yml"
|
||||
- "--entrypoints.web.address=:80"
|
||||
- "--entrypoints.websecure.address=:443"
|
||||
# Метрики
|
||||
- "--metrics.prometheus=true"
|
||||
- "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
|
||||
- "--metrics.prometheus.addEntryPointsLabels=true"
|
||||
- "--metrics.prometheus.addServicesLabels=true"
|
||||
# Логи доступа (JSON)
|
||||
- "--accesslog=true"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--accesslog.format=json"
|
||||
# Coraza WAF
|
||||
- "--experimental.plugins.coraza.modulename=github.com/jcchavezs/coraza-http-wasm-traefik"
|
||||
- "--experimental.plugins.coraza.version=v0.2.0"
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
# порт дашборда (опционально)
|
||||
- "8080:8080"
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "./traefik/certs:/etc/traefik/certs:ro"
|
||||
- "./traefik/dynamic_conf.yml:/etc/traefik/dynamic_conf.yml:ro"
|
||||
- "traefik-logs:/var/log/traefik" # для LogLynx
|
||||
networks:
|
||||
- eventhub-net
|
||||
restart: unless-stopped
|
||||
|
||||
# ================== Сервис-заглушка (Failover) ==================
|
||||
fallback:
|
||||
build:
|
||||
context: ./fallback
|
||||
dockerfile: Dockerfile
|
||||
networks:
|
||||
- eventhub-net
|
||||
restart: unless-stopped
|
||||
profiles: ['ci']
|
||||
|
||||
# ================== Кластер EventHub (3 ноды) ==================
|
||||
eventhub-node1:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: docker/Dockerfile
|
||||
hostname: eventhub-node1.local
|
||||
environment:
|
||||
- NODE_NAME=eventhub-node1@eventhub-node1.local
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
- eventhub-node # ← общий алиас для DNS-лукапа
|
||||
volumes:
|
||||
- eventhub-node1-data:/app/data
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
restart: unless-stopped
|
||||
|
||||
eventhub-node2:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: docker/Dockerfile
|
||||
hostname: eventhub-node2.local
|
||||
environment:
|
||||
- NODE_NAME=eventhub-node2@eventhub-node2.local
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
- eventhub-node # ← общий алиас для DNS-лукапа
|
||||
volumes:
|
||||
- eventhub-node2-data:/app/data
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
restart: unless-stopped
|
||||
|
||||
eventhub-node3:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: docker/Dockerfile
|
||||
hostname: eventhub-node3.local
|
||||
environment:
|
||||
- NODE_NAME=eventhub-node3@eventhub-node3.local
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
- eventhub-node # ← общий алиас для DNS-лукапа
|
||||
volumes:
|
||||
- eventhub-node3-data:/app/data
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
restart: unless-stopped
|
||||
|
||||
# ================== Admin ui ==================
|
||||
admin-ui:
|
||||
build:
|
||||
context: ../../EventHubFrontAdmin # путь к проекту админки
|
||||
dockerfile: Dockerfile
|
||||
networks:
|
||||
- eventhub-net
|
||||
# restart: unless-stopped
|
||||
restart: no
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
profiles: ['ui']
|
||||
# ================== Мониторинг ==================
|
||||
prometheus:
|
||||
image: prom/prometheus:latest
|
||||
command:
|
||||
- '--config.file=/etc/prometheus/prometheus.yml'
|
||||
- '--storage.tsdb.path=/prometheus'
|
||||
- '--web.console.libraries=/usr/share/prometheus/console_libraries'
|
||||
- '--web.console.templates=/usr/share/prometheus/consoles'
|
||||
- '--storage.tsdb.retention.time=30d'
|
||||
- '--storage.tsdb.retention.size=15GB'
|
||||
volumes:
|
||||
- ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
|
||||
- prometheus-data:/prometheus
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "9090:9090"
|
||||
restart: unless-stopped
|
||||
profiles: ['ci']
|
||||
|
||||
grafana:
|
||||
image: grafana/grafana:latest
|
||||
environment:
|
||||
- GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
|
||||
- GF_SECURITY_DISABLE_INITIAL_ADMIN_PASSWORD_CHANGE=false
|
||||
- GF_USERS_ALLOW_SIGN_UP=false
|
||||
- GF_AUTH_ANONYMOUS_ENABLED=false
|
||||
volumes:
|
||||
- ./grafana/provisioning:/etc/grafana/provisioning
|
||||
- ./grafana/dashboards:/etc/grafana/dashboards
|
||||
- grafana-data:/var/lib/grafana
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "3000:3000"
|
||||
restart: unless-stopped
|
||||
profiles: ['ci']
|
||||
|
||||
# ================== Аналитика логов ==================
|
||||
loglynx:
|
||||
image: k0lin/loglynx:latest
|
||||
user: root
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "6123:6123"
|
||||
volumes:
|
||||
- traefik-logs:/app/traefik/logs:ro
|
||||
- loglynx-data:/app/data
|
||||
environment:
|
||||
- TRAEFIK_LOG_PATH=${TRAEFIK_LOG_PATH}
|
||||
- SERVER_PORT=6123
|
||||
- DATABASE_PATH=/app/data/loglynx.db
|
||||
networks:
|
||||
- eventhub-net
|
||||
profiles: ['ci']
|
||||
|
||||
# ================== Инструмент отладки ==================
|
||||
observer_web:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: docker/ObserverWeb.Dockerfile
|
||||
environment:
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "4000:4000"
|
||||
restart: unless-stopped
|
||||
profiles: ['ci']
|
||||
|
||||
# ================== Ротация логов Traefik ==================
|
||||
logrotate:
|
||||
build:
|
||||
context: ./logrotate
|
||||
dockerfile: Dockerfile
|
||||
volumes:
|
||||
- traefik-logs:/var/log/traefik:rw
|
||||
networks:
|
||||
- eventhub-net
|
||||
restart: unless-stopped
|
||||
profiles: ['ci']
|
||||
|
||||
networks:
|
||||
eventhub-net:
|
||||
driver: bridge
|
||||
|
||||
volumes:
|
||||
eventhub-node1-data:
|
||||
eventhub-node2-data:
|
||||
eventhub-node3-data:
|
||||
prometheus-data:
|
||||
grafana-data:
|
||||
traefik-logs:
|
||||
# docker/docker-compose.yml
|
||||
services:
|
||||
# ================== Балансировщик (HTTPS/WSS, WAF, логи) ==================
|
||||
traefik:
|
||||
image: traefik:latest
|
||||
user: "0:1001" # группа docker на хосте
|
||||
command:
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--providers.file.filename=/etc/traefik/dynamic_conf.yml"
|
||||
- "--entrypoints.web.address=:80"
|
||||
- "--entrypoints.websecure.address=:443"
|
||||
# Метрики
|
||||
- "--metrics.prometheus=true"
|
||||
- "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
|
||||
- "--metrics.prometheus.addEntryPointsLabels=true"
|
||||
- "--metrics.prometheus.addServicesLabels=true"
|
||||
# Логи доступа (JSON)
|
||||
- "--accesslog=true"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--accesslog.format=json"
|
||||
# Coraza WAF
|
||||
- "--experimental.plugins.coraza.modulename=github.com/jcchavezs/coraza-http-wasm-traefik"
|
||||
- "--experimental.plugins.coraza.version=v0.2.0"
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
# порт дашборда (опционально)
|
||||
- "8080:8080"
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "./traefik/certs:/etc/traefik/certs:ro"
|
||||
- "./traefik/dynamic_conf.yml:/etc/traefik/dynamic_conf.yml:ro"
|
||||
- "traefik-logs:/var/log/traefik" # для LogLynx
|
||||
networks:
|
||||
- eventhub-net
|
||||
restart: unless-stopped
|
||||
|
||||
# ================== Сервис-заглушка (Failover) ==================
|
||||
fallback:
|
||||
build:
|
||||
context: ./fallback
|
||||
dockerfile: Dockerfile
|
||||
networks:
|
||||
- eventhub-net
|
||||
restart: unless-stopped
|
||||
profiles: ['ci']
|
||||
|
||||
# ================== Кластер EventHub (3 ноды) ==================
|
||||
eventhub-node1:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: docker/Dockerfile
|
||||
hostname: eventhub-node1.local
|
||||
environment:
|
||||
- EVENTHUB_ENV=dev
|
||||
- NODE_NAME=eventhub-node1@eventhub-node1.local
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
- ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
- eventhub-node # ← общий алиас для DNS-лукапа
|
||||
volumes:
|
||||
- eventhub-node1-data:/app/data
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
restart: unless-stopped
|
||||
|
||||
eventhub-node2:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: docker/Dockerfile
|
||||
hostname: eventhub-node2.local
|
||||
environment:
|
||||
- EVENTHUB_ENV=dev
|
||||
- NODE_NAME=eventhub-node2@eventhub-node2.local
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
- ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
- eventhub-node # ← общий алиас для DNS-лукапа
|
||||
volumes:
|
||||
- eventhub-node2-data:/app/data
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
restart: unless-stopped
|
||||
|
||||
eventhub-node3:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: docker/Dockerfile
|
||||
hostname: eventhub-node3.local
|
||||
environment:
|
||||
- EVENTHUB_ENV=dev
|
||||
- NODE_NAME=eventhub-node3@eventhub-node3.local
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
- ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
- eventhub-node # ← общий алиас для DNS-лукапа
|
||||
volumes:
|
||||
- eventhub-node3-data:/app/data
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
restart: unless-stopped
|
||||
|
||||
# ================== Admin ui ==================
|
||||
admin-ui:
|
||||
build:
|
||||
context: ../../EventHubFrontAdmin # путь к проекту админки
|
||||
dockerfile: Dockerfile
|
||||
networks:
|
||||
- eventhub-net
|
||||
# restart: unless-stopped
|
||||
restart: no
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
profiles: ['ui']
|
||||
# ================== Мониторинг ==================
|
||||
prometheus:
|
||||
image: prom/prometheus:latest
|
||||
command:
|
||||
- '--config.file=/etc/prometheus/prometheus.yml'
|
||||
- '--storage.tsdb.path=/prometheus'
|
||||
- '--web.console.libraries=/usr/share/prometheus/console_libraries'
|
||||
- '--web.console.templates=/usr/share/prometheus/consoles'
|
||||
- '--storage.tsdb.retention.time=30d'
|
||||
- '--storage.tsdb.retention.size=15GB'
|
||||
volumes:
|
||||
- ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
|
||||
- prometheus-data:/prometheus
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "9090:9090"
|
||||
restart: unless-stopped
|
||||
profiles: ['ci']
|
||||
|
||||
grafana:
|
||||
image: grafana/grafana:latest
|
||||
environment:
|
||||
- GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
|
||||
- GF_SECURITY_DISABLE_INITIAL_ADMIN_PASSWORD_CHANGE=false
|
||||
- GF_USERS_ALLOW_SIGN_UP=false
|
||||
- GF_AUTH_ANONYMOUS_ENABLED=false
|
||||
volumes:
|
||||
- ./grafana/provisioning:/etc/grafana/provisioning
|
||||
- ./grafana/dashboards:/etc/grafana/dashboards
|
||||
- grafana-data:/var/lib/grafana
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "3000:3000"
|
||||
restart: unless-stopped
|
||||
profiles: ['ci']
|
||||
|
||||
# ================== Аналитика логов ==================
|
||||
loglynx:
|
||||
image: k0lin/loglynx:latest
|
||||
user: root
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "6123:6123"
|
||||
volumes:
|
||||
- traefik-logs:/app/traefik/logs:ro
|
||||
- loglynx-data:/app/data
|
||||
environment:
|
||||
- TRAEFIK_LOG_PATH=${TRAEFIK_LOG_PATH}
|
||||
- SERVER_PORT=6123
|
||||
- DATABASE_PATH=/app/data/loglynx.db
|
||||
networks:
|
||||
- eventhub-net
|
||||
profiles: ['ci']
|
||||
|
||||
# ================== Инструмент отладки ==================
|
||||
observer_web:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: docker/ObserverWeb.Dockerfile
|
||||
environment:
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "4000:4000"
|
||||
restart: unless-stopped
|
||||
profiles: ['ci']
|
||||
|
||||
# ================== Ротация логов Traefik ==================
|
||||
logrotate:
|
||||
build:
|
||||
context: ./logrotate
|
||||
dockerfile: Dockerfile
|
||||
volumes:
|
||||
- traefik-logs:/var/log/traefik:rw
|
||||
networks:
|
||||
- eventhub-net
|
||||
restart: unless-stopped
|
||||
profiles: ['ci']
|
||||
|
||||
networks:
|
||||
eventhub-net:
|
||||
driver: bridge
|
||||
|
||||
volumes:
|
||||
eventhub-node1-data:
|
||||
eventhub-node2-data:
|
||||
eventhub-node3-data:
|
||||
prometheus-data:
|
||||
grafana-data:
|
||||
traefik-logs:
|
||||
loglynx-data:
|
||||
Reference in New Issue
Block a user