pulse/deploy/provider-msp/docker-compose.yml

services:
  traefik:
    image: ${TRAEFIK_IMAGE:?TRAEFIK_IMAGE must be set to a digest-pinned image}
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ${PULSE_PROVIDER_MSP_DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
      - ./traefik-dynamic.yml:/etc/traefik/traefik-dynamic.yml:ro
      - acme-data:/etc/traefik/acme
    env_file:
      - .env
    environment:
      - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
      - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL=${ACME_EMAIL}
      - TRAEFIK_CERTIFICATESRESOLVERS_LE_ACME_EMAIL=${ACME_EMAIL}
    networks:
      - pulse-provider-msp
    restart: unless-stopped
    labels:
      - pulse.provider-msp.role=traefik

  docker-socket-proxy:
    image: ${DOCKER_SOCKET_PROXY_IMAGE:?DOCKER_SOCKET_PROXY_IMAGE must be set to a digest-pinned image}
    volumes:
      - ${PULSE_PROVIDER_MSP_DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
    environment:
      - LOG_LEVEL=warning
      - PING=1
      - VERSION=1
      - INFO=1
      - CONTAINERS=1
      - IMAGES=1
      - NETWORKS=1
      - SYSTEM=1
      - VOLUMES=1
      - POST=1
    networks:
      - pulse-provider-msp
    restart: unless-stopped

  control-plane:
    image: ${CONTROL_PLANE_IMAGE:?CONTROL_PLANE_IMAGE must be set to a digest-pinned image}
    volumes:
      - ${PULSE_PROVIDER_MSP_DATA_DIR:-/data}:${PULSE_PROVIDER_MSP_DATA_DIR:-/data}
      - ${PULSE_PROVIDER_MSP_ROOT_SPACECHECK_DIR:-/var/lib/pulse-provider-msp/spacecheck/root}:/storage-root-spacecheck:ro
      - ${PULSE_PROVIDER_MSP_DOCKER_SPACECHECK_DIR:-/var/lib/docker/.pulse-provider-msp-spacecheck}:/storage-docker-spacecheck:ro
    secrets:
      - provider_msp_license
    env_file:
      - .env
    environment:
      - CP_DATA_DIR=${PULSE_PROVIDER_MSP_DATA_DIR:-/data}
      - CP_ENV=${CP_ENV}
      - CP_CONTROL_PLANE_MODE=${CP_CONTROL_PLANE_MODE:-provider_hosted_msp}
      - CP_BIND_ADDRESS=0.0.0.0
      - CP_PORT=8443
      - CP_ADMIN_KEY=${CP_ADMIN_KEY}
      - CP_BASE_URL=https://${DOMAIN}
      - CP_PULSE_IMAGE=${CP_PULSE_IMAGE}
      - DOCKER_HOST=tcp://docker-socket-proxy:2375
      - CP_DOCKER_NETWORK=${PULSE_PROVIDER_MSP_DOCKER_NETWORK:-pulse-provider-msp}
      - CP_TRUSTED_PROXY_CIDRS=${CP_TRUSTED_PROXY_CIDRS}
      - CP_PROVIDER_MSP_LICENSE_FILE=/run/secrets/provider_msp_license
      - CP_TENANT_MEMORY_LIMIT=${CP_TENANT_MEMORY_LIMIT:-536870912}
      - CP_ALLOW_DOCKERLESS_PROVISIONING=${CP_ALLOW_DOCKERLESS_PROVISIONING:-false}
      - CP_STORAGE_GUARDRAILS_ENABLED=${CP_STORAGE_GUARDRAILS_ENABLED:-true}
      - CP_STORAGE_ROOT_PATH=/storage-root-spacecheck
      - CP_STORAGE_DATA_PATH=${PULSE_PROVIDER_MSP_DATA_DIR:-/data}
      - CP_STORAGE_DOCKER_PATH=/storage-docker-spacecheck
      - CP_STORAGE_MIN_ROOT_AVAILABLE=${CP_STORAGE_MIN_ROOT_AVAILABLE:-10GiB}
      - CP_STORAGE_MIN_DATA_AVAILABLE=${CP_STORAGE_MIN_DATA_AVAILABLE:-5GiB}
      - CP_STORAGE_MIN_DOCKER_AVAILABLE=${CP_STORAGE_MIN_DOCKER_AVAILABLE:-10GiB}
      - CP_STORAGE_MAX_DOCKER_BUILD_CACHE=${CP_STORAGE_MAX_DOCKER_BUILD_CACHE:-2GiB}
      - CP_PROOF_TENANT_MAX_AGE=${CP_PROOF_TENANT_MAX_AGE:-24h}
      - CP_PROOF_TENANT_MATCHERS=${CP_PROOF_TENANT_MATCHERS:-proof,canary,rehearsal,msp_prod,ownerseed,owner_seed}
      - CP_REQUIRE_EMAIL_PROVIDER=${CP_REQUIRE_EMAIL_PROVIDER:-false}
      - CP_TRIAL_ACTIVATION_PRIVATE_KEY=${CP_TRIAL_ACTIVATION_PRIVATE_KEY}
      - RESEND_API_KEY=${RESEND_API_KEY}
      - PULSE_EMAIL_FROM=${PULSE_EMAIL_FROM}
      - PULSE_EMAIL_REPLY_TO=${PULSE_EMAIL_REPLY_TO}
    networks:
      - pulse-provider-msp
    depends_on:
      - traefik
      - docker-socket-proxy
    restart: unless-stopped
    labels:
      - pulse.provider-msp.role=control-plane
      - traefik.enable=true
      - traefik.docker.network=${PULSE_PROVIDER_MSP_DOCKER_NETWORK:-pulse-provider-msp}
      - traefik.http.routers.provider-control-plane.rule=Host(`${DOMAIN}`)
      - traefik.http.routers.provider-control-plane.entrypoints=websecure
      - traefik.http.routers.provider-control-plane.tls=true
      - traefik.http.routers.provider-control-plane.tls.certresolver=letsencrypt
      - traefik.http.routers.provider-control-plane.tls.domains[0].main=${DOMAIN}
      - traefik.http.routers.provider-control-plane.tls.domains[0].sans=*.${DOMAIN}
      - traefik.http.services.provider-control-plane.loadbalancer.server.port=8443

secrets:
  provider_msp_license:
    file: ${CP_PROVIDER_MSP_LICENSE_FILE:?CP_PROVIDER_MSP_LICENSE_FILE must point to the signed provider MSP license file}

networks:
  pulse-provider-msp:
    name: ${PULSE_PROVIDER_MSP_DOCKER_NETWORK:-pulse-provider-msp}
    ipam:
      config:
        - subnet: ${PULSE_PROVIDER_MSP_DOCKER_SUBNET:-172.30.0.0/24}

volumes:
  acme-data: