Monorepo for Tangled
tangled.org
1services:
2 redis:
3 image: redis:7-alpine
4 restart: unless-stopped
5 networks: [tngl]
6
7 postgres:
8 image: postgres:14-alpine
9 restart: unless-stopped
10 environment:
11 POSTGRES_USER: tnglr
12 POSTGRES_PASSWORD: tnglr
13 volumes:
14 - postgres-data:/var/lib/postgresql/data
15 - ./localinfra/postgres-init.sql:/docker-entrypoint-initdb.d/init.sql
16 healthcheck:
17 test: ["CMD-SHELL", "pg_isready -U tnglr -d plc"]
18 interval: 2s
19 timeout: 2s
20 retries: 30
21 start_period: 5s
22 networks: [tngl]
23
24 pds:
25 image: ghcr.io/bluesky-social/pds:0.4.219
26 restart: unless-stopped
27 env_file: localinfra/pds.env
28 environment:
29 PDS_DID_PLC_URL: http://plc:8080
30 NODE_EXTRA_CA_CERTS: /caddy-ca/root.crt
31 volumes:
32 - pds-data:/pds
33 - ./localinfra/certs/root.crt:/caddy-ca/root.crt:ro
34 healthcheck:
35 test: ["CMD", "wget", "-qO-", "http://localhost:3000/xrpc/_health"]
36 interval: 2s
37 timeout: 2s
38 retries: 30
39 start_period: 5s
40 depends_on:
41 plc:
42 condition: service_started
43 networks: [tngl]
44
45 init-accounts:
46 image: alpine:3.22
47 restart: "no"
48 env_file: localinfra/pds.env
49 environment:
50 PDS_URL: http://pds:3000
51 OWNER_USER: alice
52 KNOT_HOSTNAME: knot.tngl.boltless.dev
53 volumes:
54 - ./localinfra/scripts/init-accounts.sh:/init.sh:ro
55 - init-state:/shared
56 command: sh -c "apk add --no-cache curl jq >/dev/null && sh /init.sh"
57 depends_on:
58 pds:
59 condition: service_healthy
60 networks: [tngl]
61
62 plc:
63 platform: linux/amd64
64 image: ghcr.io/bluesky-social/did-method-plc:plc-f2ab7516bac5bc0f3f86842fa94e996bd1b3815b
65 restart: unless-stopped
66 environment:
67 DEBUG_MODE: "1"
68 LOG_ENABLED: "true"
69 LOG_LEVEL: debug
70 LOG_DESTINATION: "1"
71 PLC_VERSION: 0.0.1
72 PORT: "8080"
73 DB_CREDS_JSON: &DB_CREDS_JSON '{"username":"tnglr","password":"tnglr","host":"postgres","port":5432}'
74 DB_MIGRATE_CREDS_JSON: *DB_CREDS_JSON
75 depends_on: [postgres]
76 networks: [tngl]
77
78 jetstream:
79 platform: linux/amd64
80 image: ghcr.io/bluesky-social/jetstream:sha-d5a3b62
81 restart: unless-stopped
82 environment:
83 JETSTREAM_DATA_DIR: /data
84 JETSTREAM_LIVENESS_TTL: 300s
85 JETSTREAM_WS_URL: wss://pds.tngl.boltless.dev/xrpc/com.atproto.sync.subscribeRepos
86 volumes:
87 - jetstream-data:/data
88 - ./localinfra/certs/root.crt:/etc/ssl/certs/caddy.crt:ro
89 depends_on:
90 pds:
91 condition: service_healthy
92 networks: [tngl]
93
94 knot:
95 build:
96 context: .
97 dockerfile: localinfra/knot.Dockerfile
98 restart: unless-stopped
99 environment:
100 KNOT_SERVER_HOSTNAME: knot.tngl.boltless.dev
101 KNOT_SERVER_LISTEN_ADDR: 0.0.0.0:5555
102 KNOT_SERVER_INTERNAL_LISTEN_ADDR: 127.0.0.1:5444
103 KNOT_SERVER_DB_PATH: /home/git/knotserver.db
104 KNOT_SERVER_PLC_URL: https://plc.tngl.boltless.dev
105 KNOT_SERVER_JETSTREAM_ENDPOINT: wss://jetstream.tngl.boltless.dev/subscribe
106 KNOT_SERVER_DEV: "false"
107 KNOT_REPO_SCAN_PATH: /home/git/repositories
108 APPVIEW_ENDPOINT: https://tangled.org
109 KNOT_MIRRORS: https://mirror.tngl.boltless.dev
110 ports:
111 - "2222:22"
112 volumes:
113 - knot-data:/home/git
114 - knot-ssh-keys:/etc/ssh/keys
115 - init-state:/shared:ro
116 - ./localinfra/certs/root.crt:/etc/ssl/certs/caddy.crt:ro
117 healthcheck:
118 test: ["CMD", "wget", "-qO-", "http://localhost:5555/"]
119 interval: 2s
120 timeout: 2s
121 retries: 60
122 start_period: 30s
123 depends_on:
124 plc:
125 condition: service_started
126 jetstream:
127 condition: service_started
128 knotmirror:
129 condition: service_healthy
130 init-accounts:
131 condition: service_completed_successfully
132 networks: [tngl]
133
134 knotmirror-tap:
135 image: ghcr.io/bluesky-social/indigo/tap:sha-4f47add43060c27e8a37d9d76482ecddf001fcd8 # 0.1.10
136 restart: unless-stopped
137 environment:
138 TAP_BIND: ":2480"
139 TAP_PLC_URL: https://plc.tngl.boltless.dev
140 TAP_RELAY_URL: https://pds.tngl.boltless.dev # PDS can be used as basic relay without collectiondir.
141 TAP_DATABASE_URL: postgres://tnglr:tnglr@postgres:5432/mirror_tap?sslmode=disable
142 TAP_COLLECTION_FILTERS: sh.tangled.repo
143 TAP_SIGNAL_COLLECTION: sh.tangled.repo
144 TAP_RESYNC_PARALLELISM: "10"
145 TAP_RETRY_TIMEOUT: 60s
146 volumes:
147 - ./localinfra/certs/root.crt:/etc/ssl/certs/caddy.crt:ro
148 depends_on:
149 postgres:
150 condition: service_started
151 pds:
152 condition: service_healthy
153 networks: [tngl]
154
155 knotmirror:
156 build:
157 context: .
158 dockerfile: localinfra/knotmirror.Dockerfile
159 restart: unless-stopped
160 environment:
161 MIRROR_LISTEN: 0.0.0.0:7000
162 MIRROR_ADMIN_LISTEN: 0.0.0.0:7200
163 MIRROR_HOSTNAME: mirror.tngl.boltless.dev
164 MIRROR_TAP_URL: http://knotmirror-tap:2480
165 MIRROR_DB_URL: postgres://tnglr:tnglr@postgres:5432/mirror?sslmode=disable
166 MIRROR_REDIS_ADDR: redis:6379
167 MIRROR_PLC_URL: https://plc.tngl.boltless.dev
168 MIRROR_GIT_BASEPATH: /data/repos
169 MIRROR_KNOT_USE_SSL: "true"
170 MIRROR_KNOT_SSRF: "true"
171 MIRROR_RESYNC_PARALLELISM: "4"
172 volumes:
173 - knotmirror-data:/data
174 - ./localinfra/certs/root.crt:/etc/ssl/certs/caddy.crt:ro
175 healthcheck:
176 test: ["CMD", "wget", "-qO-", "http://localhost:7000/"]
177 interval: 2s
178 timeout: 2s
179 retries: 30
180 start_period: 5s
181 ports:
182 - "7201:7200"
183 depends_on:
184 postgres:
185 condition: service_started
186 knotmirror-tap:
187 condition: service_started
188 networks: [tngl]
189
190 tailwind:
191 image: d3fk/tailwindcss:v3
192 restart: unless-stopped
193 working_dir: /build
194 init: true
195 environment:
196 BROWSERSLIST_IGNORE_OLD_DATA: "true"
197 volumes:
198 - ./tailwind.config.js:/build/tailwind.config.js:ro
199 - ./input.css:/build/input.css:ro
200 - ./appview/pages/templates:/build/appview/pages/templates:ro
201 - ./docs:/build/docs:ro
202 - ./blog/templates:/build/blog/templates:ro
203 - ./blog/posts:/build/blog/posts:ro
204 - ./appview/pages/static:/build/appview/pages/static
205 command: ["-i", "input.css", "-o", "appview/pages/static/tw.css", "--watch=always"]
206 network_mode: none
207
208 appview:
209 build:
210 context: .
211 dockerfile: localinfra/appview.Dockerfile
212 restart: unless-stopped
213 environment:
214 TANGLED_DEV: "true"
215 TANGLED_APPVIEW_HOST: 127.0.0.1:3000
216 TANGLED_DB_PATH: /var/lib/appview/appview.db
217 TANGLED_PLC_URL: https://plc.tngl.boltless.dev
218 TANGLED_JETSTREAM_ENDPOINT: wss://jetstream.tngl.boltless.dev/subscribe
219 TANGLED_REDIS_ADDR: redis:6379
220 TANGLED_KNOTMIRROR_URL: https://mirror.tngl.boltless.dev
221 ports:
222 - "3000:3000"
223 volumes:
224 - .:/src:cached
225 - go-cache:/go/cache
226 - go-mod-cache:/go/mod
227 - appview-data:/var/lib/appview
228 - init-state:/shared:ro
229 - ./localinfra/certs/root.crt:/etc/ssl/certs/caddy.crt:ro
230 depends_on:
231 redis:
232 condition: service_started
233 pds:
234 condition: service_healthy
235 init-accounts:
236 condition: service_completed_successfully
237 networks: [tngl]
238
239 caddy:
240 image: caddy:2-alpine
241 restart: unless-stopped
242 ports:
243 - "80:80"
244 - "443:443"
245 volumes:
246 - ./localinfra/Caddyfile:/etc/caddy/Caddyfile
247 - ./localinfra/certs:/etc/caddy/certs:ro
248 - caddy-data:/data
249 networks:
250 tngl:
251 aliases:
252 - plc.tngl.boltless.dev
253 - pds.tngl.boltless.dev
254 - alice.pds.tngl.boltless.dev
255 - bob.pds.tngl.boltless.dev
256 - jetstream.tngl.boltless.dev
257 - knot.tngl.boltless.dev
258 - spindle.tngl.boltless.dev
259 - tngl.boltless.dev
260 - mirror.tngl.boltless.dev
261
262volumes:
263 caddy-data:
264 postgres-data:
265 pds-data:
266 jetstream-data:
267 knot-data:
268 knot-ssh-keys:
269 knotmirror-data:
270 init-state:
271 go-cache:
272 go-mod-cache:
273 appview-data:
274
275networks:
276 tngl:
277 driver: bridge
278 # Public-looking subnet so SSRF checks see container IPs as "public".
279 # RFC1918 + doc/benchmark ranges are blocklisted; 11.x is unrouted on
280 # the public internet, so it passes the check and won't collide.
281 ipam:
282 config:
283 - subnet: 11.0.0.0/24