mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-14 08:10:26 +00:00
rcourtman
a17882458a
The variable signs hosted entitlement leases; the trial-activation name is left over from the retired trial era and reads as trial machinery to an operator generating their licensing root key. The provider MSP bundle has no installed base yet, so the canonical rename is free today and frozen the moment the first design partner installs. - Control plane reads CP_ENTITLEMENT_SIGNING_PRIVATE_KEY first and falls back to CP_TRIAL_ACTIVATION_PRIVATE_KEY, so existing Pulse-hosted cloud deployments (deploy/cloud, hibernated snapshot) keep working unchanged. - deploy/provider-msp (.env.example, compose, setup.sh), MSP.md, and the install-test pins use the canonical name; error messages name it too. - deploy/cloud intentionally keeps the legacy name: that stack historically signed hosted trial activations, and its snapshot predates the rename.
114 lines
4.7 KiB
YAML
114 lines
4.7 KiB
YAML
services:
|
|
traefik:
|
|
image: ${TRAEFIK_IMAGE:?TRAEFIK_IMAGE must be set to a digest-pinned image}
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ${PULSE_PROVIDER_MSP_DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
|
|
- ./traefik.yml:/etc/traefik/traefik.yml:ro
|
|
- ./traefik-dynamic.yml:/etc/traefik/traefik-dynamic.yml:ro
|
|
- acme-data:/etc/traefik/acme
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
- CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
|
|
- TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL=${ACME_EMAIL}
|
|
- TRAEFIK_CERTIFICATESRESOLVERS_LE_ACME_EMAIL=${ACME_EMAIL}
|
|
networks:
|
|
- pulse-provider-msp
|
|
restart: unless-stopped
|
|
labels:
|
|
- pulse.provider-msp.role=traefik
|
|
|
|
docker-socket-proxy:
|
|
image: ${DOCKER_SOCKET_PROXY_IMAGE:?DOCKER_SOCKET_PROXY_IMAGE must be set to a digest-pinned image}
|
|
volumes:
|
|
- ${PULSE_PROVIDER_MSP_DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
|
|
environment:
|
|
- LOG_LEVEL=warning
|
|
- PING=1
|
|
- VERSION=1
|
|
- INFO=1
|
|
- CONTAINERS=1
|
|
- IMAGES=1
|
|
- NETWORKS=1
|
|
- SYSTEM=1
|
|
- VOLUMES=1
|
|
- POST=1
|
|
networks:
|
|
- pulse-provider-msp
|
|
restart: unless-stopped
|
|
|
|
control-plane:
|
|
image: ${CONTROL_PLANE_IMAGE:?CONTROL_PLANE_IMAGE must be set to a digest-pinned image}
|
|
volumes:
|
|
- ${PULSE_PROVIDER_MSP_DATA_DIR:-/data}:${PULSE_PROVIDER_MSP_DATA_DIR:-/data}
|
|
- ${PULSE_PROVIDER_MSP_ROOT_SPACECHECK_DIR:-/var/lib/pulse-provider-msp/spacecheck/root}:/storage-root-spacecheck:ro
|
|
- ${PULSE_PROVIDER_MSP_DOCKER_SPACECHECK_DIR:-/var/lib/docker/.pulse-provider-msp-spacecheck}:/storage-docker-spacecheck:ro
|
|
secrets:
|
|
- provider_msp_license
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
- CP_DATA_DIR=${PULSE_PROVIDER_MSP_DATA_DIR:-/data}
|
|
- CP_ENV=${CP_ENV}
|
|
- CP_CONTROL_PLANE_MODE=${CP_CONTROL_PLANE_MODE:-provider_hosted_msp}
|
|
- CP_BIND_ADDRESS=0.0.0.0
|
|
- CP_PORT=8443
|
|
- CP_ADMIN_KEY=${CP_ADMIN_KEY}
|
|
- CP_BASE_URL=https://${DOMAIN}
|
|
- CP_PULSE_IMAGE=${CP_PULSE_IMAGE}
|
|
- DOCKER_HOST=tcp://docker-socket-proxy:2375
|
|
- CP_DOCKER_NETWORK=${PULSE_PROVIDER_MSP_DOCKER_NETWORK:-pulse-provider-msp}
|
|
- CP_TRUSTED_PROXY_CIDRS=${CP_TRUSTED_PROXY_CIDRS}
|
|
- CP_PROVIDER_MSP_LICENSE_FILE=/run/secrets/provider_msp_license
|
|
- CP_TENANT_MEMORY_LIMIT=${CP_TENANT_MEMORY_LIMIT:-536870912}
|
|
- CP_ALLOW_DOCKERLESS_PROVISIONING=${CP_ALLOW_DOCKERLESS_PROVISIONING:-false}
|
|
- CP_STORAGE_GUARDRAILS_ENABLED=${CP_STORAGE_GUARDRAILS_ENABLED:-true}
|
|
- CP_STORAGE_ROOT_PATH=/storage-root-spacecheck
|
|
- CP_STORAGE_DATA_PATH=${PULSE_PROVIDER_MSP_DATA_DIR:-/data}
|
|
- CP_STORAGE_DOCKER_PATH=/storage-docker-spacecheck
|
|
- CP_STORAGE_MIN_ROOT_AVAILABLE=${CP_STORAGE_MIN_ROOT_AVAILABLE:-10GiB}
|
|
- CP_STORAGE_MIN_DATA_AVAILABLE=${CP_STORAGE_MIN_DATA_AVAILABLE:-5GiB}
|
|
- CP_STORAGE_MIN_DOCKER_AVAILABLE=${CP_STORAGE_MIN_DOCKER_AVAILABLE:-10GiB}
|
|
- CP_STORAGE_MAX_DOCKER_BUILD_CACHE=${CP_STORAGE_MAX_DOCKER_BUILD_CACHE:-2GiB}
|
|
- CP_PROOF_TENANT_MAX_AGE=${CP_PROOF_TENANT_MAX_AGE:-24h}
|
|
- CP_PROOF_TENANT_MATCHERS=${CP_PROOF_TENANT_MATCHERS:-proof,canary,rehearsal,msp_prod,ownerseed,owner_seed}
|
|
- CP_REQUIRE_EMAIL_PROVIDER=${CP_REQUIRE_EMAIL_PROVIDER:-false}
|
|
- CP_ENTITLEMENT_SIGNING_PRIVATE_KEY=${CP_ENTITLEMENT_SIGNING_PRIVATE_KEY}
|
|
- RESEND_API_KEY=${RESEND_API_KEY}
|
|
- PULSE_EMAIL_FROM=${PULSE_EMAIL_FROM}
|
|
- PULSE_EMAIL_REPLY_TO=${PULSE_EMAIL_REPLY_TO}
|
|
networks:
|
|
- pulse-provider-msp
|
|
depends_on:
|
|
- traefik
|
|
- docker-socket-proxy
|
|
restart: unless-stopped
|
|
labels:
|
|
- pulse.provider-msp.role=control-plane
|
|
- traefik.enable=true
|
|
- traefik.docker.network=${PULSE_PROVIDER_MSP_DOCKER_NETWORK:-pulse-provider-msp}
|
|
- traefik.http.routers.provider-control-plane.rule=Host(`${DOMAIN}`)
|
|
- traefik.http.routers.provider-control-plane.entrypoints=websecure
|
|
- traefik.http.routers.provider-control-plane.tls=true
|
|
- traefik.http.routers.provider-control-plane.tls.certresolver=letsencrypt
|
|
- traefik.http.routers.provider-control-plane.tls.domains[0].main=${DOMAIN}
|
|
- traefik.http.routers.provider-control-plane.tls.domains[0].sans=*.${DOMAIN}
|
|
- traefik.http.services.provider-control-plane.loadbalancer.server.port=8443
|
|
|
|
secrets:
|
|
provider_msp_license:
|
|
file: ${CP_PROVIDER_MSP_LICENSE_FILE:?CP_PROVIDER_MSP_LICENSE_FILE must point to the signed provider MSP license file}
|
|
|
|
networks:
|
|
pulse-provider-msp:
|
|
name: ${PULSE_PROVIDER_MSP_DOCKER_NETWORK:-pulse-provider-msp}
|
|
ipam:
|
|
config:
|
|
- subnet: ${PULSE_PROVIDER_MSP_DOCKER_SUBNET:-172.30.0.0/24}
|
|
|
|
volumes:
|
|
acme-data:
|