69 lines
2.1 KiB
YAML
69 lines
2.1 KiB
YAML
|
# Runnable Topaz example for the flex-auth alignment spike.
|
||
|
|
#
|
||
|
|
# Boot order:
|
||
|
|
# 1. topaz — runs topazd with the spike config; serves authorizer
|
||
|
|
# on :8282 (gRPC) and :8383 (REST), directory on :9292
|
||
|
|
# (gRPC) and :9393 (REST), health on :9494.
|
||
|
|
# 2. seed — one-shot container that pushes the manifest and seeds
|
||
|
|
# directory objects/relations via REST. Exits on success.
|
||
|
|
# 3. probe — one-shot container that runs three authorizer checks
|
||
|
|
# (steward allow, reader allow, outsider deny) and exits
|
||
|
|
# non-zero if any decision is unexpected.
|
||
|
|
#
|
||
|
|
# Usage:
|
||
|
|
# docker compose up --abort-on-container-exit --exit-code-from probe
|
||
|
|
#
|
||
|
|
# See docs/topaz-mapping-spike.md and README.md.
|
||
|
|
|
||
|
|
services:
|
||
|
|
topaz:
|
||
|
|
image: ghcr.io/aserto-dev/topaz:latest
|
||
|
|
command: ["run", "--config-file", "/cfg/config.yaml", "--bundle", "/bundle"]
|
||
|
|
ports:
|
||
|
|
- "127.0.0.1:8282:8282" # authorizer gRPC
|
||
|
|
- "127.0.0.1:8383:8383" # authorizer REST
|
||
|
|
- "127.0.0.1:9292:9292" # directory gRPC
|
||
|
|
- "127.0.0.1:9393:9393" # directory REST
|
||
|
|
- "127.0.0.1:9494:9494" # health
|
||
|
|
volumes:
|
||
|
|
- ./cfg:/cfg:ro
|
||
|
|
- ./bundle:/bundle:ro
|
||
|
|
- topaz-db:/db
|
||
|
|
- topaz-certs:/certs
|
||
|
|
healthcheck:
|
||
|
|
# Topaz's image has no curl/wget; nc is in busybox. Probe TCP on
|
||
|
|
# the authorizer REST port — the gateway only listens once the
|
||
|
|
# backing gRPC service is ready.
|
||
|
|
test: ["CMD-SHELL", "nc -z 127.0.0.1 8383 || exit 1"]
|
||
|
|
interval: 2s
|
||
|
|
timeout: 2s
|
||
|
|
retries: 30
|
||
|
|
|
||
|
|
seed:
|
||
|
|
image: alpine:3.20
|
||
|
|
depends_on:
|
||
|
|
topaz:
|
||
|
|
condition: service_healthy
|
||
|
|
volumes:
|
||
|
|
- ./data:/data:ro
|
||
|
|
- ./scripts:/scripts:ro
|
||
|
|
- ./manifest.yaml:/manifest.yaml:ro
|
||
|
|
entrypoint: ["/bin/sh", "/scripts/seed.sh"]
|
||
|
|
environment:
|
||
|
|
DIRECTORY_REST: "http://topaz:9393"
|
||
|
|
|
||
|
|
probe:
|
||
|
|
image: alpine:3.20
|
||
|
|
depends_on:
|
||
|
|
seed:
|
||
|
|
condition: service_completed_successfully
|
||
|
|
volumes:
|
||
|
|
- ./scripts:/scripts:ro
|
||
|
|
entrypoint: ["/bin/sh", "/scripts/probe.sh"]
|
||
|
|
environment:
|
||
|
|
AUTHORIZER_REST: "http://topaz:8383"
|
||
|
|
|
||
|
|
volumes:
|
||
|
|
topaz-db:
|
||
|
|
topaz-certs:
|