docker-compose.yml

#
# Copyright 2021 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

version: '3.2'
services:
  fulcio-server:
    build:
      context: .
      target: "deploy"
    command: [
      "fulcio-server",
      "serve",
      "--host=0.0.0.0",
      "--port=5555",
      "--grpc-port=5554",
      "--ca=ephemeralca",
      "--ct-log-url=https://ct_server:6962/test",
      "--ct-log.tls-ca-cert=/config/tls/ca.crt",
      # Uncomment this for production logging
      # "--log_type=prod",
      ]
    restart: always # keep the server running
    ports:
      - "5555:5555"
      - "5554:5554"
      - "${FULCIO_METRICS_PORT:-2112}:2112"
    volumes:
      - ~/.config/gcloud:/root/.config/gcloud/:z # for GCP authentication
      - ${FULCIO_CONFIG:-./config/identity/config.yaml}:/etc/fulcio-config/config.yaml:z
      - ./config/tls:/config/tls:z
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5555/healthz"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 5s
    depends_on:
      - dex-idp
    read_only: true
  dex-idp:
    image: dexidp/dex:v2.30.0
    user: root
    command: [
      "dex",
      "serve",
      "/etc/config/docker-compose-config.yaml",
      ]
    restart: always # keep the server running
    ports:
      - "8888:8888"
    volumes:
      - ./config/dex:/etc/config/:ro
    healthcheck:
      test: ["CMD", "wget", "-O", "/dev/null", "http://localhost:8888/auth/healthz"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 5s
  ctfe_init:
    build:
      context: .
      dockerfile: Dockerfile.ctfe_init
    depends_on:
      - trillian-log-server
      - fulcio-server
    volumes:
      - ctfeConfig:/etc/config/:rw
  ct_server:
    image: gcr.io/trillian-opensource-ci/ctfe
    volumes:
      - ctfeConfig:/etc/config/:ro
      - ./config/tls:/config/tls:z
    command: [
        "--log_config" ,"/etc/config/ct_server.cfg",
        "--log_rpc_server", "trillian-log-server:8096",
        "--http_endpoint", "0.0.0.0:6962",
        "--tls_certificate", "/config/tls/tls.crt",
        "--tls_key", "/config/tls/tls.key",
        "--alsologtostderr",
    ]
    restart: always # retry while ctfe_init is running
    depends_on:
      trillian-log-server:
        condition: service_started
      trillian-log-signer:
        condition: service_started
      ctfe_init:
        condition: service_completed_successfully
    ports:
      - "6962:6962"
  mysql:
    image: gcr.io/trillian-opensource-ci/db_server:3c8193ebb2d7fedb44d18e9c810d0d2e4dbb7e4d
    environment:
      - MYSQL_ROOT_PASSWORD=zaphod
      - MYSQL_DATABASE=test
      - MYSQL_USER=test
      - MYSQL_PASSWORD=zaphod
    restart: always # keep the MySQL server running
    healthcheck:
      test: ["CMD", "/etc/init.d/mysql", "status"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 10s
    volumes:
      - mysql:/var/lib/mysql
  trillian-log-server:
    image: gcr.io/trillian-opensource-ci/log_server
    command: [
      "--storage_system=mysql",
      "--mysql_uri=test:zaphod@tcp(mysql:3306)/test",
      "--rpc_endpoint=0.0.0.0:8096",
      "--http_endpoint=0.0.0.0:8095",
      "--alsologtostderr",
    ]
    restart: always # retry while mysql is starting up
    ports:
      - "8095:8090"
      - "8096:8091"
    depends_on:
      - mysql
  trillian-log-signer:
    image: gcr.io/trillian-opensource-ci/log_signer
    command: [
      "--storage_system=mysql",
      "--mysql_uri=test:zaphod@tcp(mysql:3306)/test",
      "--rpc_endpoint=0.0.0.0:8095",
      "--http_endpoint=0.0.0.0:8096",
      "--force_master",
      "--alsologtostderr",
    ]
    restart: always # retry while mysql is starting up
    ports:
      - "8097:8096"
    depends_on:
      - mysql
volumes:
  ctfeConfig: {}
  mysql: {}