feature(tailscale) : add-tailnet-access #1
31
docker-compose.override.yml
Normal file
31
docker-compose.override.yml
Normal file
@@ -0,0 +1,31 @@
|
|||||||
|
services:
|
||||||
|
# === TAILSCALE ===
|
||||||
|
tailscale:
|
||||||
|
image: tailscale/tailscale:latest
|
||||||
|
container_name: infrahub-tailscale
|
||||||
|
hostname: infrahub
|
||||||
|
environment:
|
||||||
|
- TS_AUTHKEY=${TS_AUTHKEY}
|
||||||
|
- TS_STATE_DIR=/var/lib/tailscale
|
||||||
|
- TS_SERVE_CONFIG=/config/serve-config.json
|
||||||
|
volumes:
|
||||||
|
- tailscale-state:/var/lib/tailscale
|
||||||
|
- ./serve-config.json:/config/serve-config.json:ro
|
||||||
|
cap_add:
|
||||||
|
- NET_ADMIN
|
||||||
|
- SYS_MODULE
|
||||||
|
restart: unless-stopped
|
||||||
|
|
||||||
|
# === Infrahub ===
|
||||||
|
message-queue:
|
||||||
|
ports: !override
|
||||||
|
[]
|
||||||
|
database:
|
||||||
|
ports: !override
|
||||||
|
[]
|
||||||
|
infrahub-server:
|
||||||
|
ports: !override
|
||||||
|
[]
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
tailscale-state:
|
||||||
@@ -1,135 +1,316 @@
|
|||||||
|
---
|
||||||
|
# yamllint disable rule:line-length
|
||||||
|
# The following environment variables are part of the Infrahub configuration options.
|
||||||
|
# For detailed information on these configuration options, please refer to the Infrahub documentation:
|
||||||
|
# https://docs.infrahub.app/reference/configuration
|
||||||
|
x-infrahub-config: &infrahub_config
|
||||||
|
AWS_ACCESS_KEY_ID:
|
||||||
|
AWS_DEFAULT_ACL: ${AWS_DEFAULT_ACL:-private}
|
||||||
|
AWS_QUERYSTRING_AUTH: ${AWS_QUERYSTRING_AUTH:-false}
|
||||||
|
AWS_S3_BUCKET_NAME:
|
||||||
|
AWS_S3_CUSTOM_DOMAIN:
|
||||||
|
AWS_S3_ENDPOINT_URL:
|
||||||
|
AWS_S3_USE_SSL: ${AWS_S3_USE_SSL:-true}
|
||||||
|
AWS_SECRET_ACCESS_KEY:
|
||||||
|
DB_TYPE: ${DB_TYPE:-neo4j}
|
||||||
|
INFRAHUB_ADDRESS:
|
||||||
|
INFRAHUB_ALLOW_ANONYMOUS_ACCESS: ${INFRAHUB_ALLOW_ANONYMOUS_ACCESS:-true}
|
||||||
|
INFRAHUB_ANALYTICS_ADDRESS:
|
||||||
|
INFRAHUB_ANALYTICS_API_KEY:
|
||||||
|
INFRAHUB_ANALYTICS_ENABLE: ${INFRAHUB_ANALYTICS_ENABLE:-true}
|
||||||
|
INFRAHUB_ANONYMOUS_ACCESS_ROLE: ${INFRAHUB_ANONYMOUS_ACCESS_ROLE:-Anonymous User}
|
||||||
|
INFRAHUB_API_CORS_ALLOW_CREDENTIALS: ${INFRAHUB_API_CORS_ALLOW_CREDENTIALS:-true}
|
||||||
|
INFRAHUB_API_CORS_ALLOW_HEADERS:
|
||||||
|
INFRAHUB_API_CORS_ALLOW_METHODS:
|
||||||
|
INFRAHUB_API_CORS_ALLOW_ORIGINS:
|
||||||
|
INFRAHUB_BROKER_ADDRESS: ${INFRAHUB_BROKER_ADDRESS:-localhost}
|
||||||
|
INFRAHUB_BROKER_DRIVER: ${INFRAHUB_BROKER_DRIVER:-rabbitmq}
|
||||||
|
INFRAHUB_BROKER_ENABLE: ${INFRAHUB_BROKER_ENABLE:-true}
|
||||||
|
INFRAHUB_BROKER_MAXIMUM_CONCURRENT_MESSAGES: ${INFRAHUB_BROKER_MAXIMUM_CONCURRENT_MESSAGES:-2}
|
||||||
|
INFRAHUB_BROKER_MAXIMUM_MESSAGE_RETRIES: ${INFRAHUB_BROKER_MAXIMUM_MESSAGE_RETRIES:-10}
|
||||||
|
INFRAHUB_BROKER_NAMESPACE: ${INFRAHUB_BROKER_NAMESPACE:-infrahub}
|
||||||
|
INFRAHUB_BROKER_PASSWORD: &broker_password ${INFRAHUB_BROKER_PASSWORD:-infrahub}
|
||||||
|
INFRAHUB_BROKER_PORT:
|
||||||
|
INFRAHUB_BROKER_RABBITMQ_HTTP_PORT:
|
||||||
|
INFRAHUB_BROKER_TLS_CA_FILE:
|
||||||
|
INFRAHUB_BROKER_TLS_ENABLED: ${INFRAHUB_BROKER_TLS_ENABLED:-false}
|
||||||
|
INFRAHUB_BROKER_TLS_INSECURE: ${INFRAHUB_BROKER_TLS_INSECURE:-false}
|
||||||
|
INFRAHUB_BROKER_USERNAME: &broker_username ${INFRAHUB_BROKER_USERNAME:-infrahub}
|
||||||
|
INFRAHUB_BROKER_VIRTUALHOST: ${INFRAHUB_BROKER_VIRTUALHOST:-/}
|
||||||
|
INFRAHUB_CACHE_ADDRESS: ${INFRAHUB_CACHE_ADDRESS:-localhost}
|
||||||
|
INFRAHUB_CACHE_CLEAN_UP_DEADLOCKS_INTERVAL_MINS: ${INFRAHUB_CACHE_CLEAN_UP_DEADLOCKS_INTERVAL_MINS:-15}
|
||||||
|
INFRAHUB_CACHE_DATABASE: ${INFRAHUB_CACHE_DATABASE:-0}
|
||||||
|
INFRAHUB_CACHE_DRIVER: ${INFRAHUB_CACHE_DRIVER:-redis}
|
||||||
|
INFRAHUB_CACHE_ENABLE: ${INFRAHUB_CACHE_ENABLE:-true}
|
||||||
|
INFRAHUB_CACHE_PASSWORD: &cache_password ${INFRAHUB_CACHE_PASSWORD:-}
|
||||||
|
INFRAHUB_CACHE_PORT:
|
||||||
|
INFRAHUB_CACHE_TLS_CA_FILE:
|
||||||
|
INFRAHUB_CACHE_TLS_ENABLED: ${INFRAHUB_CACHE_TLS_ENABLED:-false}
|
||||||
|
INFRAHUB_CACHE_TLS_INSECURE: ${INFRAHUB_CACHE_TLS_INSECURE:-false}
|
||||||
|
INFRAHUB_CACHE_USERNAME: &cache_username ${INFRAHUB_CACHE_USERNAME:-}
|
||||||
|
INFRAHUB_CONFIG:
|
||||||
|
INFRAHUB_DB_ADDRESS: ${INFRAHUB_DB_ADDRESS:-localhost}
|
||||||
|
INFRAHUB_DB_DATABASE:
|
||||||
|
INFRAHUB_DB_MAX_CONCURRENT_QUERIES: ${INFRAHUB_DB_MAX_CONCURRENT_QUERIES:-0}
|
||||||
|
INFRAHUB_DB_MAX_CONCURRENT_QUERIES_DELAY: ${INFRAHUB_DB_MAX_CONCURRENT_QUERIES_DELAY:-0.01}
|
||||||
|
INFRAHUB_DB_MAX_DEPTH_SEARCH_HIERARCHY: ${INFRAHUB_DB_MAX_DEPTH_SEARCH_HIERARCHY:-5}
|
||||||
|
INFRAHUB_DB_PASSWORD: ${INFRAHUB_DB_PASSWORD:-admin}
|
||||||
|
INFRAHUB_DB_POLICY:
|
||||||
|
INFRAHUB_DB_PORT: ${INFRAHUB_DB_PORT:-7687}
|
||||||
|
INFRAHUB_DB_PROTOCOL: ${INFRAHUB_DB_PROTOCOL:-bolt}
|
||||||
|
INFRAHUB_DB_QUERY_SIZE_LIMIT: ${INFRAHUB_DB_QUERY_SIZE_LIMIT:-5000}
|
||||||
|
INFRAHUB_DB_RETRY_LIMIT: ${INFRAHUB_DB_RETRY_LIMIT:-3}
|
||||||
|
INFRAHUB_DB_TLS_CA_FILE:
|
||||||
|
INFRAHUB_DB_TLS_ENABLED: ${INFRAHUB_DB_TLS_ENABLED:-false}
|
||||||
|
INFRAHUB_DB_TLS_INSECURE: ${INFRAHUB_DB_TLS_INSECURE:-false}
|
||||||
|
INFRAHUB_DB_TYPE: ${INFRAHUB_DB_TYPE:-neo4j}
|
||||||
|
INFRAHUB_DB_USERNAME: ${INFRAHUB_DB_USERNAME:-neo4j}
|
||||||
|
INFRAHUB_DOCS_INDEX_PATH: ${INFRAHUB_DOCS_INDEX_PATH:-/opt/infrahub/docs/build/search-index.json}
|
||||||
|
INFRAHUB_EXPERIMENTAL_GRAPHQL_ENUMS: ${INFRAHUB_EXPERIMENTAL_GRAPHQL_ENUMS:-false}
|
||||||
|
INFRAHUB_EXPERIMENTAL_VALUE_DB_INDEX: ${INFRAHUB_EXPERIMENTAL_VALUE_DB_INDEX:-false}
|
||||||
|
INFRAHUB_GIT_APPEND_GIT_SUFFIX:
|
||||||
|
INFRAHUB_GIT_GLOBAL_CONFIG_FILE: ${INFRAHUB_GIT_GLOBAL_CONFIG_FILE:-/opt/infrahub/.gitconfig}
|
||||||
|
INFRAHUB_GIT_IMPORT_SYNC_BRANCH_NAMES:
|
||||||
|
INFRAHUB_GIT_REPOSITORIES_DIRECTORY: ${INFRAHUB_GIT_REPOSITORIES_DIRECTORY:-repositories}
|
||||||
|
INFRAHUB_GIT_SYNC_INTERVAL: ${INFRAHUB_GIT_SYNC_INTERVAL:-10}
|
||||||
|
INFRAHUB_GIT_USER_EMAIL: ${INFRAHUB_GIT_USER_EMAIL:-infrahub@opsmill.com}
|
||||||
|
INFRAHUB_GIT_USER_NAME: ${INFRAHUB_GIT_USER_NAME:-Infrahub}
|
||||||
|
INFRAHUB_GIT_USE_EXPLICIT_MERGE_COMMIT: ${INFRAHUB_GIT_USE_EXPLICIT_MERGE_COMMIT:-false}
|
||||||
|
INFRAHUB_HTTP_TIMEOUT: ${INFRAHUB_HTTP_TIMEOUT:-10}
|
||||||
|
INFRAHUB_HTTP_TLS_CA_BUNDLE:
|
||||||
|
INFRAHUB_HTTP_TLS_INSECURE: ${INFRAHUB_HTTP_TLS_INSECURE:-false}
|
||||||
|
INFRAHUB_INITIAL_ADMIN_PASSWORD: ${INFRAHUB_INITIAL_ADMIN_PASSWORD:-infrahub}
|
||||||
|
INFRAHUB_INITIAL_ADMIN_TOKEN:
|
||||||
|
INFRAHUB_INITIAL_AGENT_PASSWORD:
|
||||||
|
INFRAHUB_INITIAL_AGENT_TOKEN:
|
||||||
|
INFRAHUB_INITIAL_DEFAULT_BRANCH: ${INFRAHUB_INITIAL_DEFAULT_BRANCH:-main}
|
||||||
|
INFRAHUB_INTERNAL_ADDRESS:
|
||||||
|
INFRAHUB_LOGGING_REMOTE_API_SERVER_DSN:
|
||||||
|
INFRAHUB_LOGGING_REMOTE_ENABLE: ${INFRAHUB_LOGGING_REMOTE_ENABLE:-false}
|
||||||
|
INFRAHUB_LOGGING_REMOTE_FRONTEND_DSN:
|
||||||
|
INFRAHUB_LOGGING_REMOTE_GIT_AGENT_DSN:
|
||||||
|
INFRAHUB_LOG_LEVEL:
|
||||||
|
INFRAHUB_MISC_MAXIMUM_VALIDATOR_EXECUTION_TIME: ${INFRAHUB_MISC_MAXIMUM_VALIDATOR_EXECUTION_TIME:-1800}
|
||||||
|
INFRAHUB_MISC_PRINT_QUERY_DETAILS: ${INFRAHUB_MISC_PRINT_QUERY_DETAILS:-false}
|
||||||
|
INFRAHUB_MISC_RESPONSE_DELAY: ${INFRAHUB_MISC_RESPONSE_DELAY:-0}
|
||||||
|
INFRAHUB_MISC_START_BACKGROUND_RUNNER: ${INFRAHUB_MISC_START_BACKGROUND_RUNNER:-true}
|
||||||
|
INFRAHUB_PERMISSION_BACKENDS: ${INFRAHUB_PERMISSION_BACKENDS:-["infrahub.permissions.LocalPermissionBackend"]}
|
||||||
|
INFRAHUB_POLICY_REQUIRED_PROPOSED_CHANGE_APPROVALS: ${INFRAHUB_POLICY_REQUIRED_PROPOSED_CHANGE_APPROVALS:-0}
|
||||||
|
INFRAHUB_POLICY_REVOKE_PROPOSED_CHANGE_APPROVALS: ${INFRAHUB_POLICY_REVOKE_PROPOSED_CHANGE_APPROVALS:-false}
|
||||||
|
INFRAHUB_PRODUCTION:
|
||||||
|
INFRAHUB_PUBLIC_URL:
|
||||||
|
INFRAHUB_SCHEMA_STRICT_MODE: ${INFRAHUB_SCHEMA_STRICT_MODE:-true}
|
||||||
|
INFRAHUB_SECURITY_ACCESS_TOKEN_LIFETIME: ${INFRAHUB_SECURITY_ACCESS_TOKEN_LIFETIME:-3600}
|
||||||
|
INFRAHUB_SECURITY_REFRESH_TOKEN_LIFETIME: ${INFRAHUB_SECURITY_REFRESH_TOKEN_LIFETIME:-2592000}
|
||||||
|
INFRAHUB_SECURITY_RESTRICT_UNTRUSTED_JINJA2_FILTERS: ${INFRAHUB_SECURITY_RESTRICT_UNTRUSTED_JINJA2_FILTERS:-true}
|
||||||
|
INFRAHUB_SECURITY_SECRET_KEY:
|
||||||
|
INFRAHUB_STORAGE_BUCKET_NAME:
|
||||||
|
INFRAHUB_STORAGE_CUSTOM_DOMAIN:
|
||||||
|
INFRAHUB_STORAGE_DEFAULT_ACL: ${INFRAHUB_STORAGE_DEFAULT_ACL:-private}
|
||||||
|
INFRAHUB_STORAGE_DRIVER: ${INFRAHUB_STORAGE_DRIVER:-local}
|
||||||
|
INFRAHUB_STORAGE_ENDPOINT_URL:
|
||||||
|
INFRAHUB_STORAGE_LOCAL_PATH: ${INFRAHUB_STORAGE_LOCAL_PATH:-/opt/infrahub/storage}
|
||||||
|
INFRAHUB_STORAGE_QUERYSTRING_AUTH: ${INFRAHUB_STORAGE_QUERYSTRING_AUTH:-false}
|
||||||
|
INFRAHUB_STORAGE_USE_SSL: ${INFRAHUB_STORAGE_USE_SSL:-true}
|
||||||
|
INFRAHUB_TELEMETRY_ENDPOINT: ${INFRAHUB_TELEMETRY_ENDPOINT:-https://telemetry.opsmill.cloud/infrahub}
|
||||||
|
INFRAHUB_TELEMETRY_INTERVAL:
|
||||||
|
INFRAHUB_TELEMETRY_OPTOUT: ${INFRAHUB_TELEMETRY_OPTOUT:-false}
|
||||||
|
INFRAHUB_TIMEOUT:
|
||||||
|
INFRAHUB_TRACE_ENABLE: ${INFRAHUB_TRACE_ENABLE:-false}
|
||||||
|
INFRAHUB_TRACE_EXPORTER_ENDPOINT:
|
||||||
|
INFRAHUB_TRACE_EXPORTER_PROTOCOL: ${INFRAHUB_TRACE_EXPORTER_PROTOCOL:-grpc}
|
||||||
|
INFRAHUB_TRACE_EXPORTER_TYPE: ${INFRAHUB_TRACE_EXPORTER_TYPE:-console}
|
||||||
|
INFRAHUB_TRACE_INSECURE: ${INFRAHUB_TRACE_INSECURE:-true}
|
||||||
|
INFRAHUB_WORKFLOW_ADDRESS: ${INFRAHUB_WORKFLOW_ADDRESS:-localhost}
|
||||||
|
INFRAHUB_WORKFLOW_DEFAULT_WORKER_TYPE: ${INFRAHUB_WORKFLOW_DEFAULT_WORKER_TYPE:-infrahubasync}
|
||||||
|
INFRAHUB_WORKFLOW_DRIVER: ${INFRAHUB_WORKFLOW_DRIVER:-worker}
|
||||||
|
INFRAHUB_WORKFLOW_ENABLE: ${INFRAHUB_WORKFLOW_ENABLE:-true}
|
||||||
|
INFRAHUB_WORKFLOW_EXTRA_LOGGERS:
|
||||||
|
INFRAHUB_WORKFLOW_EXTRA_LOG_LEVEL: ${INFRAHUB_WORKFLOW_EXTRA_LOG_LEVEL:-INFO}
|
||||||
|
INFRAHUB_WORKFLOW_FLOW_RUN_COUNT_CACHE_THRESHOLD: ${INFRAHUB_WORKFLOW_FLOW_RUN_COUNT_CACHE_THRESHOLD:-100000}
|
||||||
|
INFRAHUB_WORKFLOW_PORT:
|
||||||
|
INFRAHUB_WORKFLOW_TLS_ENABLED: ${INFRAHUB_WORKFLOW_TLS_ENABLED:-false}
|
||||||
|
INFRAHUB_WORKFLOW_WORKER_POLLING_INTERVAL: ${INFRAHUB_WORKFLOW_WORKER_POLLING_INTERVAL:-2}
|
||||||
|
OTEL_RESOURCE_ATTRIBUTES:
|
||||||
|
|
||||||
|
x-infrahub-sso: &infrahub_sso
|
||||||
|
INFRAHUB_SECURITY_SSO_USER_DEFAULT_GROUP:
|
||||||
|
INFRAHUB_SECURITY_OAUTH2_PROVIDERS:
|
||||||
|
INFRAHUB_SECURITY_OAUTH2_PROVIDER_SETTINGS:
|
||||||
|
INFRAHUB_SECURITY_OIDC_PROVIDERS:
|
||||||
|
INFRAHUB_SECURITY_OIDC_PROVIDER_SETTINGS:
|
||||||
|
# Provider related settings
|
||||||
|
## OAUTH2 Provider 1
|
||||||
|
INFRAHUB_OAUTH2_PROVIDER1_CLIENT_ID:
|
||||||
|
INFRAHUB_OAUTH2_PROVIDER1_CLIENT_SECRET:
|
||||||
|
INFRAHUB_OAUTH2_PROVIDER1_AUTHORIZATION_URL:
|
||||||
|
INFRAHUB_OAUTH2_PROVIDER1_TOKEN_URL:
|
||||||
|
INFRAHUB_OAUTH2_PROVIDER1_USERINFO_URL:
|
||||||
|
INFRAHUB_OAUTH2_PROVIDER1_DISPLAY_LABEL:
|
||||||
|
INFRAHUB_OAUTH2_PROVIDER1_ICON:
|
||||||
|
## OIDC Provider 1
|
||||||
|
INFRAHUB_OIDC_PROVIDER1_CLIENT_ID:
|
||||||
|
INFRAHUB_OIDC_PROVIDER1_CLIENT_SECRET:
|
||||||
|
INFRAHUB_OIDC_PROVIDER1_DISCOVERY_URL:
|
||||||
|
INFRAHUB_OIDC_PROVIDER1_DISPLAY_LABEL:
|
||||||
|
INFRAHUB_OIDC_PROVIDER1_ICON:
|
||||||
|
|
||||||
|
x-task-manager-config:
|
||||||
|
INFRAHUB_TASKMANAGER_DB_USER: ${INFRAHUB_TASKMANAGER_DB_USER:-postgres}
|
||||||
|
INFRAHUB_TASKMANAGER_DB_PASSWORD: ${INFRAHUB_TASKMANAGER_DB_PASSWORD:-postgres}
|
||||||
|
INFRAHUB_TASKMANAGER_DB_DATABASE: ${INFRAHUB_TASKMANAGER_DB_DATABASE:-prefect}
|
||||||
|
|
||||||
services:
|
services:
|
||||||
# === TAILSCALE ===
|
message-queue:
|
||||||
tailscale:
|
image: ${MESSAGE_QUEUE_DOCKER_IMAGE:-rabbitmq:4.2.1-management}
|
||||||
image: tailscale/tailscale:latest
|
|
||||||
container_name: infrahub-tailscale
|
|
||||||
hostname: infrahub
|
|
||||||
environment:
|
|
||||||
- TS_AUTHKEY=${TS_AUTHKEY}
|
|
||||||
- TS_STATE_DIR=/var/lib/tailscale
|
|
||||||
- TS_SERVE_CONFIG=/config/serve-config.json
|
|
||||||
volumes:
|
|
||||||
- tailscale-state:/var/lib/tailscale
|
|
||||||
- ./serve-config.json:/config/serve-config.json:ro
|
|
||||||
cap_add:
|
|
||||||
- NET_ADMIN
|
|
||||||
- SYS_MODULE
|
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
|
|
||||||
# === NEO4J (Graph Database) ===
|
|
||||||
database:
|
|
||||||
image: neo4j:5.23-community
|
|
||||||
container_name: infrahub-database
|
|
||||||
environment:
|
environment:
|
||||||
- NEO4J_AUTH=neo4j/${NEO4J_PASSWORD:-infrahub}
|
RABBITMQ_DEFAULT_USER: *broker_username
|
||||||
- NEO4J_PLUGINS=["apoc"]
|
RABBITMQ_DEFAULT_PASS: *broker_password
|
||||||
- NEO4J_dbms_security_procedures_unrestricted=apoc.*
|
|
||||||
- NEO4J_dbms_security_procedures_allowlist=apoc.*
|
|
||||||
- NEO4J_server_memory_heap_initial__size=1G
|
|
||||||
- NEO4J_server_memory_heap_max__size=2G
|
|
||||||
- NEO4J_server_memory_pagecache_size=1G
|
|
||||||
volumes:
|
|
||||||
- neo4j-data:/data
|
|
||||||
- neo4j-logs:/logs
|
|
||||||
healthcheck:
|
healthcheck:
|
||||||
test: ["CMD", "wget", "-q", "--spider", "http://localhost:7474"]
|
test: rabbitmq-diagnostics -q check_port_connectivity
|
||||||
interval: 30s
|
interval: 5s
|
||||||
timeout: 10s
|
timeout: 30s
|
||||||
retries: 5
|
retries: 10
|
||||||
start_period: 60s
|
start_period: 3s
|
||||||
restart: unless-stopped
|
ports:
|
||||||
|
- 15692:15692
|
||||||
|
|
||||||
# === REDIS (Cache) ===
|
|
||||||
cache:
|
cache:
|
||||||
image: redis:7-alpine
|
image: ${CACHE_DOCKER_IMAGE:-redis:8.4.0}
|
||||||
container_name: infrahub-cache
|
restart: unless-stopped
|
||||||
command: redis-server --appendonly yes
|
|
||||||
volumes:
|
|
||||||
- redis-data:/data
|
|
||||||
healthcheck:
|
healthcheck:
|
||||||
test: ["CMD", "redis-cli", "ping"]
|
test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
|
||||||
interval: 10s
|
interval: 5s
|
||||||
timeout: 5s
|
timeout: 5s
|
||||||
retries: 3
|
retries: 3
|
||||||
restart: unless-stopped
|
|
||||||
|
|
||||||
# === RABBITMQ (Message Queue) ===
|
database:
|
||||||
message-queue:
|
image: ${NEO4J_DOCKER_IMAGE:-neo4j:2025.10.1-community}
|
||||||
image: rabbitmq:3-management-alpine
|
restart: unless-stopped
|
||||||
container_name: infrahub-message-queue
|
|
||||||
environment:
|
environment:
|
||||||
- RABBITMQ_DEFAULT_USER=${RABBITMQ_USER:-infrahub}
|
NEO4J_AUTH: ${INFRAHUB_DB_USERNAME:-neo4j}/${INFRAHUB_DB_PASSWORD:-admin}
|
||||||
- RABBITMQ_DEFAULT_PASS=${RABBITMQ_PASSWORD:-infrahub}
|
NEO4J_dbms_security_procedures_unrestricted: "apoc.*"
|
||||||
|
NEO4J_dbms_security_auth__minimum__password__length: 4
|
||||||
volumes:
|
volumes:
|
||||||
- rabbitmq-data:/var/lib/rabbitmq
|
- "database_data:/data"
|
||||||
|
- "database_logs:/logs"
|
||||||
healthcheck:
|
healthcheck:
|
||||||
test: ["CMD", "rabbitmq-diagnostics", "check_running"]
|
test: wget -O /dev/null http://localhost:7474 || exit 1
|
||||||
interval: 30s
|
interval: 2s
|
||||||
timeout: 10s
|
timeout: 10s
|
||||||
retries: 5
|
retries: 20
|
||||||
start_period: 30s
|
start_period: 3s
|
||||||
restart: unless-stopped
|
ports:
|
||||||
|
- 2004:2004
|
||||||
|
- 6362:6362
|
||||||
|
|
||||||
# === INFRAHUB SERVER ===
|
task-manager:
|
||||||
infrahub-server:
|
image: "${INFRAHUB_DOCKER_IMAGE:-registry.opsmill.io/opsmill/infrahub}:${VERSION:-1.7.4}"
|
||||||
image: registry.opsmill.io/opsmill/infrahub:${VERSION:-latest}
|
command: uvicorn --host 0.0.0.0 --port 4200 --factory infrahub.prefect_server.app:create_infrahub_prefect
|
||||||
container_name: infrahub-server
|
restart: unless-stopped
|
||||||
network_mode: service:tailscale
|
|
||||||
depends_on:
|
depends_on:
|
||||||
tailscale:
|
task-manager-db:
|
||||||
condition: service_started
|
|
||||||
database:
|
|
||||||
condition: service_healthy
|
condition: service_healthy
|
||||||
cache:
|
environment:
|
||||||
|
PREFECT_API_DATABASE_CONNECTION_URL: postgresql+asyncpg://${INFRAHUB_TASKMANAGER_DB_USER:-postgres}:${INFRAHUB_TASKMANAGER_DB_PASSWORD:-postgres}@task-manager-db:5432/${INFRAHUB_TASKMANAGER_DB_DATABASE:-prefect}
|
||||||
|
healthcheck:
|
||||||
|
test: curl -s -f -o /dev/null http://localhost:4200/api/health || exit 1
|
||||||
|
interval: 5s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 20
|
||||||
|
start_period: 10s
|
||||||
|
|
||||||
|
task-manager-db:
|
||||||
|
image: "${POSTGRES_DOCKER_IMAGE:-pgautoupgrade/pgautoupgrade:18-alpine}"
|
||||||
|
restart: unless-stopped
|
||||||
|
environment:
|
||||||
|
- POSTGRES_USER=${INFRAHUB_TASKMANAGER_DB_USER:-postgres}
|
||||||
|
- POSTGRES_PASSWORD=${INFRAHUB_TASKMANAGER_DB_PASSWORD:-postgres}
|
||||||
|
- POSTGRES_DB=${INFRAHUB_TASKMANAGER_DB_DATABASE:-prefect}
|
||||||
|
volumes:
|
||||||
|
- workflow_db:/var/lib/postgresql/18/docker
|
||||||
|
healthcheck:
|
||||||
|
test:
|
||||||
|
- "CMD-SHELL"
|
||||||
|
- "pg_isready -q -d ${INFRAHUB_TASKMANAGER_DB_DATABASE:-prefect} -U ${INFRAHUB_TASKMANAGER_DB_USER:-postgres}"
|
||||||
|
interval: 10s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 5
|
||||||
|
|
||||||
|
infrahub-server:
|
||||||
|
image: "${INFRAHUB_DOCKER_IMAGE:-registry.opsmill.io/opsmill/infrahub}:${VERSION:-1.7.4}"
|
||||||
|
restart: unless-stopped
|
||||||
|
command: >
|
||||||
|
gunicorn --config backend/infrahub/serve/gunicorn_config.py
|
||||||
|
-w ${WEB_CONCURRENCY:-4}
|
||||||
|
--logger-class infrahub.serve.log.GunicornLogger
|
||||||
|
infrahub.server:app
|
||||||
|
depends_on:
|
||||||
|
database:
|
||||||
condition: service_healthy
|
condition: service_healthy
|
||||||
message-queue:
|
message-queue:
|
||||||
condition: service_healthy
|
condition: service_healthy
|
||||||
|
cache:
|
||||||
|
condition: service_healthy
|
||||||
|
task-manager:
|
||||||
|
condition: service_healthy
|
||||||
environment:
|
environment:
|
||||||
- INFRAHUB_DB_TYPE=neo4j
|
<<: [*infrahub_config, *infrahub_sso]
|
||||||
- INFRAHUB_DB_ADDRESS=database
|
INFRAHUB_PRODUCTION: ${INFRAHUB_PRODUCTION:-false}
|
||||||
- INFRAHUB_DB_PORT=7687
|
INFRAHUB_LOG_LEVEL: ${INFRAHUB_LOG_LEVEL:-INFO}
|
||||||
- INFRAHUB_DB_USERNAME=neo4j
|
INFRAHUB_BROKER_ADDRESS: ${INFRAHUB_BROKER_ADDRESS:-message-queue}
|
||||||
- INFRAHUB_DB_PASSWORD=${NEO4J_PASSWORD:-infrahub}
|
INFRAHUB_CACHE_ADDRESS: ${INFRAHUB_CACHE_ADDRESS:-cache}
|
||||||
- INFRAHUB_CACHE_ADDRESS=cache
|
INFRAHUB_DB_ADDRESS: ${INFRAHUB_DB_ADDRESS:-database}
|
||||||
- INFRAHUB_CACHE_PORT=6379
|
INFRAHUB_WORKFLOW_ADDRESS: ${INFRAHUB_WORKFLOW_ADDRESS:-task-manager}
|
||||||
- INFRAHUB_BROKER_ADDRESS=message-queue
|
INFRAHUB_INITIAL_ADMIN_TOKEN: ${INFRAHUB_INITIAL_ADMIN_TOKEN:-06438eb2-8019-4776-878c-0941b1f1d1ec}
|
||||||
- INFRAHUB_BROKER_PORT=5672
|
INFRAHUB_INITIAL_AGENT_TOKEN: ${INFRAHUB_INITIAL_AGENT_TOKEN:-44af444d-3b26-410d-9546-b758657e026c}
|
||||||
- INFRAHUB_BROKER_USERNAME=${RABBITMQ_USER:-infrahub}
|
INFRAHUB_SECURITY_SECRET_KEY: ${INFRAHUB_SECURITY_SECRET_KEY:-327f747f-efac-42be-9e73-999f08f86b92"}
|
||||||
- INFRAHUB_BROKER_PASSWORD=${RABBITMQ_PASSWORD:-infrahub}
|
INFRAHUB_WORKFLOW_PORT: ${INFRAHUB_WORKFLOW_PORT:-4200}
|
||||||
- INFRAHUB_INITIAL_ADMIN_TOKEN=${INFRAHUB_ADMIN_TOKEN}
|
PREFECT_API_URL: http://${INFRAHUB_WORKFLOW_ADDRESS:-task-manager}:${INFRAHUB_WORKFLOW_PORT:-4200}/api
|
||||||
- INFRAHUB_SECURITY_SECRET_KEY=${INFRAHUB_SECRET_KEY}
|
ports:
|
||||||
- INFRAHUB_ALLOW_ANONYMOUS_ACCESS=${INFRAHUB_ALLOW_ANONYMOUS:-false}
|
- 8000:8000
|
||||||
- INFRAHUB_LOG_LEVEL=${INFRAHUB_LOG_LEVEL:-INFO}
|
volumes:
|
||||||
- INFRAHUB_API_HOST=0.0.0.0
|
- "storage_data:${INFRAHUB_STORAGE_LOCAL_PATH:-/opt/infrahub/storage}"
|
||||||
- INFRAHUB_API_PORT=8000
|
- "workflow_data:/opt/infrahub/workflow"
|
||||||
command: infrahub server start
|
tty: true
|
||||||
restart: unless-stopped
|
healthcheck:
|
||||||
|
test: curl -s -f -o /dev/null http://localhost:8000/api/config || exit 1
|
||||||
|
interval: 5s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 20
|
||||||
|
start_period: 10s
|
||||||
|
|
||||||
# === INFRAHUB TASK WORKER ===
|
|
||||||
task-worker:
|
task-worker:
|
||||||
image: registry.opsmill.io/opsmill/infrahub:${VERSION:-latest}
|
deploy:
|
||||||
container_name: infrahub-task-worker
|
mode: replicated
|
||||||
|
replicas: 2
|
||||||
|
image: "${INFRAHUB_DOCKER_IMAGE:-registry.opsmill.io/opsmill/infrahub}:${VERSION:-1.7.4}"
|
||||||
|
command: prefect worker start --type infrahubasync --pool infrahub-worker --with-healthcheck
|
||||||
|
restart: unless-stopped
|
||||||
depends_on:
|
depends_on:
|
||||||
- infrahub-server
|
- infrahub-server
|
||||||
environment:
|
environment:
|
||||||
- INFRAHUB_DB_TYPE=neo4j
|
<<: *infrahub_config
|
||||||
- INFRAHUB_DB_ADDRESS=database
|
INFRAHUB_PRODUCTION: ${INFRAHUB_PRODUCTION:-false}
|
||||||
- INFRAHUB_DB_PORT=7687
|
INFRAHUB_LOG_LEVEL: ${INFRAHUB_LOG_LEVEL:-DEBUG}
|
||||||
- INFRAHUB_DB_USERNAME=neo4j
|
INFRAHUB_GIT_REPOSITORIES_DIRECTORY: ${INFRAHUB_GIT_REPOSITORIES_DIRECTORY:-/opt/infrahub/git}
|
||||||
- INFRAHUB_DB_PASSWORD=${NEO4J_PASSWORD:-infrahub}
|
INFRAHUB_API_TOKEN: ${INFRAHUB_INITIAL_AGENT_TOKEN:-44af444d-3b26-410d-9546-b758657e026c}
|
||||||
- INFRAHUB_CACHE_ADDRESS=cache
|
INFRAHUB_SECURITY_SECRET_KEY: ${INFRAHUB_SECURITY_SECRET_KEY:-327f747f-efac-42be-9e73-999f08f86b92"}
|
||||||
- INFRAHUB_CACHE_PORT=6379
|
INFRAHUB_ADDRESS: ${INFRAHUB_ADDRESS:-http://infrahub-server:8000}
|
||||||
- INFRAHUB_BROKER_ADDRESS=message-queue
|
INFRAHUB_INTERNAL_ADDRESS: ${INFRAHUB_INTERNAL_ADDRESS:-http://infrahub-server:8000}
|
||||||
- INFRAHUB_BROKER_PORT=5672
|
INFRAHUB_BROKER_ADDRESS: ${INFRAHUB_BROKER_ADDRESS:-message-queue}
|
||||||
- INFRAHUB_BROKER_USERNAME=${RABBITMQ_USER:-infrahub}
|
INFRAHUB_CACHE_ADDRESS: ${INFRAHUB_CACHE_ADDRESS:-cache}
|
||||||
- INFRAHUB_BROKER_PASSWORD=${RABBITMQ_PASSWORD:-infrahub}
|
INFRAHUB_DB_ADDRESS: ${INFRAHUB_DB_ADDRESS:-database}
|
||||||
- INFRAHUB_LOG_LEVEL=${INFRAHUB_LOG_LEVEL:-INFO}
|
INFRAHUB_WORKFLOW_ADDRESS: ${INFRAHUB_WORKFLOW_ADDRESS:-task-manager}
|
||||||
command: infrahub server start --worker
|
INFRAHUB_TIMEOUT: ${INFRAHUB_TIMEOUT:-60}
|
||||||
restart: unless-stopped
|
INFRAHUB_WORKFLOW_PORT: ${INFRAHUB_WORKFLOW_PORT:-4200}
|
||||||
|
PREFECT_API_URL: http://${INFRAHUB_WORKFLOW_ADDRESS:-task-manager}:${INFRAHUB_WORKFLOW_PORT:-4200}/api
|
||||||
|
tty: true
|
||||||
|
|
||||||
volumes:
|
volumes:
|
||||||
tailscale-state:
|
database_data:
|
||||||
neo4j-data:
|
database_logs:
|
||||||
neo4j-logs:
|
storage_data:
|
||||||
redis-data:
|
workflow_db:
|
||||||
rabbitmq-data:
|
workflow_data:
|
||||||
Reference in New Issue
Block a user