110 lines
3.7 KiB
YAML
Executable File
110 lines
3.7 KiB
YAML
Executable File
# Persistent LOCAL testnet sandbox. Separate stack/data from existing single/three-node compose files.
|
|
# Invoke this file explicitly. Never combine it with the disposable PostgreSQL test fixture.
|
|
services:
|
|
provision:
|
|
build:
|
|
context: .
|
|
dockerfile: deploy/postgres/Dockerfile
|
|
volumes:
|
|
- pg-admin:/secrets/admin
|
|
- pg-owner:/secrets/owner
|
|
- pg-runtime:/secrets/runtime
|
|
- pg-backup:/secrets/backup
|
|
- pg-tls:/secrets/tls
|
|
network_mode: none
|
|
read_only: true
|
|
tmpfs: ["/tmp:mode=1777,size=16m"]
|
|
restart: "no"
|
|
database:
|
|
image: wikideck:postgres-sandbox
|
|
build:
|
|
context: .
|
|
dockerfile: deploy/postgres/database.Dockerfile
|
|
depends_on:
|
|
provision:
|
|
condition: service_completed_successfully
|
|
environment:
|
|
POSTGRES_DB: wikideck_custody
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD_FILE: /secrets/admin/password
|
|
POSTGRES_INITDB_ARGS: --auth-host=scram-sha-256
|
|
command: [postgres, -c, ssl=on, -c, ssl_min_protocol_version=TLSv1.2,
|
|
-c, ssl_cert_file=/tls/server.crt, -c, ssl_key_file=/tls/server.key,
|
|
-c, hba_file=/etc/wikideck/pg_hba.conf, -c, log_statement=none,
|
|
-c, log_min_error_statement=panic, -c, log_parameter_max_length_on_error=0]
|
|
volumes:
|
|
- pg-data:/var/lib/postgresql/data
|
|
- pg-admin:/secrets/admin:ro
|
|
- pg-tls:/tls:ro
|
|
networks: [financial]
|
|
healthcheck:
|
|
test: [CMD-SHELL, "pg_isready -U postgres -d wikideck_custody"]
|
|
interval: 3s
|
|
timeout: 3s
|
|
retries: 30
|
|
restart: unless-stopped
|
|
shm_size: 128m
|
|
stop_grace_period: 30s
|
|
migrate:
|
|
image: wikideck:custody-sandbox
|
|
build: {context: ., target: runtime}
|
|
depends_on:
|
|
database:
|
|
condition: service_healthy
|
|
environment:
|
|
WIKIDECK_NETWORK: testnet
|
|
WIKIDECK_LOCAL_PG_BOOTSTRAP: sandbox-only
|
|
command: [node, --experimental-strip-types, scripts/custody-deployment-init.ts]
|
|
volumes:
|
|
- pg-admin:/secrets/admin:ro
|
|
- pg-owner:/secrets/owner:ro
|
|
- pg-runtime:/secrets/runtime:ro
|
|
- pg-backup:/secrets/backup:ro
|
|
networks: [financial]
|
|
read_only: true
|
|
cap_drop: [ALL]
|
|
security_opt: [no-new-privileges:true]
|
|
restart: "no"
|
|
wikideck:
|
|
image: wikideck:custody-sandbox
|
|
build: {context: ., target: runtime}
|
|
depends_on:
|
|
migrate:
|
|
condition: service_completed_successfully
|
|
ports: ["127.0.0.1:${WIKIDECK_CUSTODY_PORT:-3422}:3001"]
|
|
environment:
|
|
WIKIDECK_NETWORK: testnet
|
|
WIKIDECK_PAYMENT_MODE: mock
|
|
WIKIDECK_MARKET_ENABLED: "${WIKIDECK_MARKET_ENABLED:-1}"
|
|
WIKIDECK_MARKET_TRADING_ENABLED: "${WIKIDECK_MARKET_TRADING_ENABLED:-1}"
|
|
WIKIDECK_MARKET_HOST_FEE_ADDRESS: "${WIKIDECK_MARKET_HOST_FEE_ADDRESS:-44xHcCdFhW4b951yBHpkTPdLSJ85qTCnFQ8N7m96TtqqRL3dbhzbEH4fe2SJ3a6ESHcNyzCYH5nYJ9ActR1JtkeA7QYGbQv}"
|
|
WIKIDECK_CUSTODY_MODE: sandbox
|
|
WIKIDECK_CUSTODY_STORAGE: postgres
|
|
WIKIDECK_CUSTODY_PG_URL_FILE: /secrets/runtime/url
|
|
WIKIDECK_CUSTODY_PG_CA_FILE: /secrets/runtime/ca.crt
|
|
PUBLIC_ORIGIN: "http://127.0.0.1:${WIKIDECK_CUSTODY_PORT:-3422}"
|
|
volumes:
|
|
- custody-node:/app/data
|
|
- pg-runtime:/secrets/runtime:ro
|
|
networks: [financial, web]
|
|
init: true
|
|
restart: unless-stopped
|
|
read_only: true
|
|
tmpfs: ["/tmp:mode=1777,size=32m,noexec,nosuid"]
|
|
cap_drop: [ALL]
|
|
security_opt: [no-new-privileges:true]
|
|
pids_limit: 128
|
|
mem_limit: 1g
|
|
stop_grace_period: 30s
|
|
networks:
|
|
financial: {internal: true}
|
|
web: {}
|
|
volumes:
|
|
pg-data:
|
|
pg-admin:
|
|
pg-owner:
|
|
pg-runtime:
|
|
pg-backup:
|
|
pg-tls:
|
|
custody-node:
|