Fail-fast secrets in stage/prod via EVENTHUB_ENV. Refs EventHub/EventHubBack#25
This commit is contained in:
+229
-225
@@ -1,226 +1,230 @@
|
||||
# docker/docker-compose.swarm.yml
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
# ================== Балансировщик ==================
|
||||
traefik:
|
||||
image: traefik:latest
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
# - "--providers.swarm.endpoint=unix:///var/run/docker.sock" # провайдер Swarm
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--providers.file.filename=/etc/traefik/dynamic_conf.yml"
|
||||
- "--entrypoints.web.address=:80"
|
||||
- "--entrypoints.websecure.address=:443"
|
||||
- "--metrics.prometheus=true"
|
||||
- "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
|
||||
- "--metrics.prometheus.addEntryPointsLabels=true"
|
||||
- "--metrics.prometheus.addServicesLabels=true"
|
||||
- "--accesslog=true"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--accesslog.format=json"
|
||||
- "--experimental.plugins.coraza.modulename=github.com/jcchavezs/coraza-http-wasm-traefik"
|
||||
- "--experimental.plugins.coraza.version=v0.3.0"
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
- "8080:8080"
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "./traefik/certs:/etc/traefik/certs:ro"
|
||||
- "./traefik/dynamic_conf.yml:/etc/traefik/dynamic_conf.yml:ro"
|
||||
- "traefik-logs:/var/log/traefik"
|
||||
- "traefik-plugins:/plugins-storage"
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Сервис заглушка ==================
|
||||
fallback:
|
||||
image: fallback:latest
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Кластер EventHub ==================
|
||||
eventhub:
|
||||
image: eventhub:latest
|
||||
hostname: "eventhub-node{{.Task.Slot}}"
|
||||
environment:
|
||||
- NODE_NAME=eventhub-node{{.Task.Slot}}
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE:-eventhub_cookie}
|
||||
- JWT_SECRET=${JWT_SECRET:-eventhub_top_secret}
|
||||
- ADMIN_SUPER_EMAIL=${ADMIN_SUPER_EMAIL:-superadmin@eventhub.local}
|
||||
- ADMIN_SUPER_PASSWORD=${ADMIN_SUPER_PASSWORD:-123456}
|
||||
- ADMIN_MODER_EMAIL=${ADMIN_MODER_EMAIL:-moderator@eventhub.local}
|
||||
- ADMIN_MODER_PASSWORD=${ADMIN_MODER_PASSWORD:-123456}
|
||||
- ADMIN_SUPPORT_EMAIL=${ADMIN_SUPPORT_EMAIL:-support@eventhub.local}
|
||||
- ADMIN_SUPPORT_PASSWORD=${ADMIN_SUPPORT_PASSWORD:-123456}
|
||||
- CLUSTER_MODE=true
|
||||
- DNS_NAME=eventhub-node
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
- eventhub-node
|
||||
volumes:
|
||||
- type: volume
|
||||
source: eventhub-data
|
||||
target: /app/data
|
||||
deploy:
|
||||
replicas: 1
|
||||
endpoint_mode: dnsrr
|
||||
restart_policy:
|
||||
condition: any
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
|
||||
# ================== Admin UI ==================
|
||||
admin-ui:
|
||||
image: eventhub-admin-ui:latest
|
||||
networks:
|
||||
- eventhub-net
|
||||
depends_on:
|
||||
- eventhub
|
||||
deploy:
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
|
||||
# ================== Мониторинг ==================
|
||||
prometheus:
|
||||
image: prom/prometheus:latest
|
||||
command:
|
||||
- '--config.file=/etc/prometheus/prometheus.yml'
|
||||
- '--storage.tsdb.path=/prometheus'
|
||||
- '--web.console.libraries=/usr/share/prometheus/console_libraries'
|
||||
- '--web.console.templates=/usr/share/prometheus/consoles'
|
||||
- '--storage.tsdb.retention.time=30d'
|
||||
- '--storage.tsdb.retention.size=15GB'
|
||||
volumes:
|
||||
- ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
|
||||
- prometheus-data:/prometheus
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "9090:9090"
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
grafana:
|
||||
image: grafana/grafana:latest
|
||||
environment:
|
||||
- GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
|
||||
- GF_SECURITY_DISABLE_INITIAL_ADMIN_PASSWORD_CHANGE=false
|
||||
- GF_USERS_ALLOW_SIGN_UP=false
|
||||
- GF_AUTH_ANONYMOUS_ENABLED=false
|
||||
volumes:
|
||||
- ./grafana/provisioning:/etc/grafana/provisioning
|
||||
- ./grafana/dashboards:/etc/grafana/dashboards
|
||||
- grafana-data:/var/lib/grafana
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "3000:3000"
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Аналитика логов ==================
|
||||
loglynx:
|
||||
image: k0lin/loglynx:latest
|
||||
user: root
|
||||
ports:
|
||||
- "6123:6123"
|
||||
volumes:
|
||||
- traefik-logs:/app/traefik/logs:ro
|
||||
- loglynx-data:/app/data
|
||||
environment:
|
||||
- TRAEFIK_LOG_PATH=${TRAEFIK_LOG_PATH}
|
||||
- SERVER_PORT=6123
|
||||
- DATABASE_PATH=/app/data/loglynx.db
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Инструмент отладки ==================
|
||||
observer_web:
|
||||
image: observer_web:latest
|
||||
environment:
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "4000:4000"
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Ротация логов ==================
|
||||
logrotate:
|
||||
image: logrotate:latest
|
||||
volumes:
|
||||
- traefik-logs:/var/log/traefik:rw
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
bot-emulator-users:
|
||||
image: bot-emulator-users:latest
|
||||
environment:
|
||||
- ADMIN_API_HOST=http://eventhub-node:8445
|
||||
- CLIENT_API_HOST=http://eventhub-node:8080
|
||||
- ADMIN_EMAIL=admin@eventhub.local
|
||||
- ADMIN_PASSWORD=123456
|
||||
- BOT_PASSWORD=botpass123
|
||||
- MIN_DELAY=0.5
|
||||
- MAX_DELAY=3.0
|
||||
- LOOP_FOREVER=true
|
||||
- BOT_REFRESH_INTERVAL=300
|
||||
- TICKET_CHANCE=0.07
|
||||
- STARTUP_DELAY=30
|
||||
- DEBUG=false
|
||||
networks:
|
||||
- eventhub-net
|
||||
depends_on:
|
||||
- eventhub
|
||||
deploy:
|
||||
mode: replicated
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
delay: 5s
|
||||
max_attempts: 3
|
||||
window: 120s
|
||||
|
||||
networks:
|
||||
eventhub-net:
|
||||
driver: overlay
|
||||
|
||||
volumes:
|
||||
eventhub-data:
|
||||
# name: 'eventhub-data-{{.Task.Slot}}'
|
||||
prometheus-data:
|
||||
grafana-data:
|
||||
traefik-logs:
|
||||
loglynx-data:
|
||||
# docker/docker-compose.swarm.yml
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
# ================== Балансировщик ==================
|
||||
traefik:
|
||||
image: traefik:latest
|
||||
command:
|
||||
# - "--log.level=DEBUG"
|
||||
- "--api.insecure=true"
|
||||
- "--providers.docker=true"
|
||||
# - "--providers.swarm.endpoint=unix:///var/run/docker.sock" # провайдер Swarm
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--providers.file.filename=/etc/traefik/dynamic_conf.yml"
|
||||
- "--entrypoints.web.address=:80"
|
||||
- "--entrypoints.websecure.address=:443"
|
||||
- "--metrics.prometheus=true"
|
||||
- "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
|
||||
- "--metrics.prometheus.addEntryPointsLabels=true"
|
||||
- "--metrics.prometheus.addServicesLabels=true"
|
||||
- "--accesslog=true"
|
||||
- "--accesslog.filepath=/var/log/traefik/access.log"
|
||||
- "--accesslog.format=json"
|
||||
- "--experimental.plugins.coraza.modulename=github.com/jcchavezs/coraza-http-wasm-traefik"
|
||||
- "--experimental.plugins.coraza.version=v0.3.0"
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
- "8080:8080"
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "./traefik/certs:/etc/traefik/certs:ro"
|
||||
- "./traefik/dynamic_conf.yml:/etc/traefik/dynamic_conf.yml:ro"
|
||||
- "traefik-logs:/var/log/traefik"
|
||||
- "traefik-plugins:/plugins-storage"
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Сервис заглушка ==================
|
||||
fallback:
|
||||
image: fallback:latest
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Кластер EventHub ==================
|
||||
eventhub:
|
||||
image: eventhub:latest
|
||||
hostname: "eventhub-node{{.Task.Slot}}"
|
||||
environment:
|
||||
- EVENTHUB_ENV=prod
|
||||
- NODE_NAME=eventhub-node{{.Task.Slot}}
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
- ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
|
||||
- ADMIN_SUPER_EMAIL=${ADMIN_SUPER_EMAIL}
|
||||
- ADMIN_SUPER_PASSWORD=${ADMIN_SUPER_PASSWORD}
|
||||
- ADMIN_EMAIL=${ADMIN_EMAIL}
|
||||
- ADMIN_PASSWORD=${ADMIN_PASSWORD}
|
||||
- ADMIN_MODER_EMAIL=${ADMIN_MODER_EMAIL}
|
||||
- ADMIN_MODER_PASSWORD=${ADMIN_MODER_PASSWORD}
|
||||
- ADMIN_SUPPORT_EMAIL=${ADMIN_SUPPORT_EMAIL}
|
||||
- ADMIN_SUPPORT_PASSWORD=${ADMIN_SUPPORT_PASSWORD}
|
||||
- CLUSTER_MODE=true
|
||||
- DNS_NAME=eventhub-node
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
- eventhub-node
|
||||
volumes:
|
||||
- type: volume
|
||||
source: eventhub-data
|
||||
target: /app/data
|
||||
deploy:
|
||||
replicas: 1
|
||||
endpoint_mode: dnsrr
|
||||
restart_policy:
|
||||
condition: any
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
|
||||
# ================== Admin UI ==================
|
||||
admin-ui:
|
||||
image: eventhub-admin-ui:latest
|
||||
networks:
|
||||
- eventhub-net
|
||||
depends_on:
|
||||
- eventhub
|
||||
deploy:
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
|
||||
# ================== Мониторинг ==================
|
||||
prometheus:
|
||||
image: prom/prometheus:latest
|
||||
command:
|
||||
- '--config.file=/etc/prometheus/prometheus.yml'
|
||||
- '--storage.tsdb.path=/prometheus'
|
||||
- '--web.console.libraries=/usr/share/prometheus/console_libraries'
|
||||
- '--web.console.templates=/usr/share/prometheus/consoles'
|
||||
- '--storage.tsdb.retention.time=30d'
|
||||
- '--storage.tsdb.retention.size=15GB'
|
||||
volumes:
|
||||
- ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
|
||||
- prometheus-data:/prometheus
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "9090:9090"
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
grafana:
|
||||
image: grafana/grafana:latest
|
||||
environment:
|
||||
- GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
|
||||
- GF_SECURITY_DISABLE_INITIAL_ADMIN_PASSWORD_CHANGE=false
|
||||
- GF_USERS_ALLOW_SIGN_UP=false
|
||||
- GF_AUTH_ANONYMOUS_ENABLED=false
|
||||
volumes:
|
||||
- ./grafana/provisioning:/etc/grafana/provisioning
|
||||
- ./grafana/dashboards:/etc/grafana/dashboards
|
||||
- grafana-data:/var/lib/grafana
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "3000:3000"
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Аналитика логов ==================
|
||||
loglynx:
|
||||
image: k0lin/loglynx:latest
|
||||
user: root
|
||||
ports:
|
||||
- "6123:6123"
|
||||
volumes:
|
||||
- traefik-logs:/app/traefik/logs:ro
|
||||
- loglynx-data:/app/data
|
||||
environment:
|
||||
- TRAEFIK_LOG_PATH=${TRAEFIK_LOG_PATH}
|
||||
- SERVER_PORT=6123
|
||||
- DATABASE_PATH=/app/data/loglynx.db
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Инструмент отладки ==================
|
||||
observer_web:
|
||||
image: observer_web:latest
|
||||
environment:
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
networks:
|
||||
- eventhub-net
|
||||
ports:
|
||||
- "4000:4000"
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
# ================== Ротация логов ==================
|
||||
logrotate:
|
||||
image: logrotate:latest
|
||||
volumes:
|
||||
- traefik-logs:/var/log/traefik:rw
|
||||
networks:
|
||||
- eventhub-net
|
||||
deploy:
|
||||
replicas: 0
|
||||
restart_policy:
|
||||
condition: any
|
||||
|
||||
bot-emulator-users:
|
||||
image: bot-emulator-users:latest
|
||||
environment:
|
||||
- ADMIN_API_HOST=http://eventhub-node:8445
|
||||
- CLIENT_API_HOST=http://eventhub-node:8080
|
||||
- ADMIN_EMAIL=admin@eventhub.local
|
||||
- ADMIN_PASSWORD=123456
|
||||
- BOT_PASSWORD=botpass123
|
||||
- MIN_DELAY=0.5
|
||||
- MAX_DELAY=3.0
|
||||
- LOOP_FOREVER=true
|
||||
- BOT_REFRESH_INTERVAL=300
|
||||
- TICKET_CHANCE=0.07
|
||||
- STARTUP_DELAY=30
|
||||
- DEBUG=false
|
||||
networks:
|
||||
- eventhub-net
|
||||
depends_on:
|
||||
- eventhub
|
||||
deploy:
|
||||
mode: replicated
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
delay: 5s
|
||||
max_attempts: 3
|
||||
window: 120s
|
||||
|
||||
networks:
|
||||
eventhub-net:
|
||||
driver: overlay
|
||||
|
||||
volumes:
|
||||
eventhub-data:
|
||||
# name: 'eventhub-data-{{.Task.Slot}}'
|
||||
prometheus-data:
|
||||
grafana-data:
|
||||
traefik-logs:
|
||||
loglynx-data:
|
||||
traefik-plugins:
|
||||
Reference in New Issue
Block a user