Monorepo for Tangled
tangled.org
1services:
2 redis:
3 image: redis:7-alpine
4 restart: unless-stopped
5 networks: [tngl]
6
7 postgres:
8 image: postgres:14-alpine
9 restart: unless-stopped
10 environment:
11 POSTGRES_USER: tnglr
12 POSTGRES_PASSWORD: tnglr
13 volumes:
14 - postgres-data:/var/lib/postgresql/data
15 - ./localinfra/postgres-init.sql:/docker-entrypoint-initdb.d/init.sql
16 healthcheck:
17 test: ["CMD-SHELL", "pg_isready -U tnglr -d plc"]
18 interval: 2s
19 timeout: 2s
20 retries: 30
21 start_period: 5s
22 networks: [tngl]
23
24 pds:
25 image: ghcr.io/bluesky-social/pds:0.4.219
26 restart: unless-stopped
27 env_file: localinfra/pds.env
28 environment:
29 PDS_DID_PLC_URL: http://plc:8080
30 NODE_EXTRA_CA_CERTS: /caddy-ca/root.crt
31 volumes:
32 - pds-data:/pds
33 - ./localinfra/certs/root.crt:/caddy-ca/root.crt:ro
34 healthcheck:
35 test: ["CMD", "wget", "-qO-", "http://localhost:3000/xrpc/_health"]
36 interval: 2s
37 timeout: 2s
38 retries: 30
39 start_period: 5s
40 depends_on:
41 plc:
42 condition: service_started
43 networks: [tngl]
44
45 init-accounts:
46 image: alpine:3.22
47 restart: "no"
48 env_file: localinfra/pds.env
49 environment:
50 PDS_URL: http://pds:3000
51 OWNER_USER: alice
52 KNOT_HOSTNAME: knot.tngl.boltless.dev
53 SPINDLE_HOSTNAME: spindle.tngl.boltless.dev
54 volumes:
55 - ./localinfra/scripts/init-accounts.sh:/init.sh:ro
56 - init-state:/shared
57 command: sh -c "apk add --no-cache curl jq >/dev/null && sh /init.sh"
58 depends_on:
59 pds:
60 condition: service_healthy
61 networks: [tngl]
62
63 plc:
64 platform: linux/amd64
65 image: ghcr.io/bluesky-social/did-method-plc:plc-f2ab7516bac5bc0f3f86842fa94e996bd1b3815b
66 restart: unless-stopped
67 environment:
68 DEBUG_MODE: "1"
69 LOG_ENABLED: "true"
70 LOG_LEVEL: debug
71 LOG_DESTINATION: "1"
72 PLC_VERSION: 0.0.1
73 PORT: "8080"
74 DB_CREDS_JSON: &DB_CREDS_JSON '{"username":"tnglr","password":"tnglr","host":"postgres","port":5432}'
75 DB_MIGRATE_CREDS_JSON: *DB_CREDS_JSON
76 depends_on: [postgres]
77 networks: [tngl]
78
79 jetstream:
80 platform: linux/amd64
81 image: ghcr.io/bluesky-social/jetstream:sha-d5a3b62
82 restart: unless-stopped
83 environment:
84 JETSTREAM_DATA_DIR: /data
85 JETSTREAM_LIVENESS_TTL: 300s
86 JETSTREAM_WS_URL: wss://pds.tngl.boltless.dev/xrpc/com.atproto.sync.subscribeRepos
87 volumes:
88 - jetstream-data:/data
89 - ./localinfra/certs/root.crt:/etc/ssl/certs/ca-certificates.crt:ro
90 depends_on:
91 pds:
92 condition: service_healthy
93 networks: [tngl]
94
95 knot:
96 build:
97 context: .
98 dockerfile: localinfra/knot.Dockerfile
99 restart: unless-stopped
100 environment:
101 KNOT_SERVER_HOSTNAME: knot.tngl.boltless.dev
102 KNOT_SERVER_LISTEN_ADDR: 0.0.0.0:5555
103 KNOT_SERVER_INTERNAL_LISTEN_ADDR: 127.0.0.1:5444
104 KNOT_SERVER_DB_PATH: /home/git/knotserver.db
105 KNOT_SERVER_PLC_URL: https://plc.tngl.boltless.dev
106 KNOT_SERVER_JETSTREAM_ENDPOINT: wss://jetstream.tngl.boltless.dev/subscribe
107 KNOT_SERVER_DEV: "false"
108 KNOT_REPO_SCAN_PATH: /home/git/repositories
109 APPVIEW_ENDPOINT: https://tangled.org
110 KNOT_MIRRORS: https://mirror.tngl.boltless.dev
111 ports:
112 - "2222:22"
113 volumes:
114 - knot-data:/home/git
115 - knot-ssh-keys:/etc/ssh/keys
116 - init-state:/shared:ro
117 - ./localinfra/certs/root.crt:/usr/local/share/ca-certificates/caddy.crt:ro
118 healthcheck:
119 test: ["CMD", "wget", "-qO-", "http://localhost:5555/"]
120 interval: 2s
121 timeout: 2s
122 retries: 60
123 start_period: 30s
124 depends_on:
125 plc:
126 condition: service_started
127 jetstream:
128 condition: service_started
129 knotmirror:
130 condition: service_healthy
131 init-accounts:
132 condition: service_completed_successfully
133 networks: [tngl]
134
135 spindle:
136 build:
137 context: .
138 dockerfile: localinfra/spindle.Dockerfile
139 restart: unless-stopped
140 environment:
141 SPINDLE_SERVER_HOSTNAME: spindle.tngl.boltless.dev
142 SPINDLE_SERVER_LISTEN_ADDR: 0.0.0.0:6555
143 SPINDLE_SERVER_DB_PATH: /var/lib/spindle/spindle.db
144 SPINDLE_SERVER_PLC_URL: https://plc.tngl.boltless.dev
145 SPINDLE_SERVER_JETSTREAM_ENDPOINT: wss://jetstream.tngl.boltless.dev/subscribe
146 SPINDLE_SERVER_DEV: "true"
147 SPINDLE_SERVER_DEV_EXTRA_HOSTS: knot.tngl.boltless.dev,mirror.tngl.boltless.dev
148 SPINDLE_SERVER_TAP_DB_PATH: /var/lib/spindle/tap.db
149 SPINDLE_SERVER_TAP_RELAY_URL: https://pds.tngl.boltless.dev
150 SPINDLE_MICROVM_PIPELINES_IMAGE_DIR: /var/lib/spindle/images
151 SPINDLE_MICROVM_PIPELINES_OVERLAY_DIR: /var/lib/spindle/overlays
152 SPINDLE_MICROVM_PIPELINES_AGENT_PORT: "11240"
153 SPINDLE_S3_LOG_BUCKET: ""
154 devices:
155 - /dev/vsock:/dev/vsock
156 - /dev/kvm:/dev/kvm
157 - /dev/vhost-vsock:/dev/vhost-vsock
158 - /dev/net/tun:/dev/net/tun
159 cap_add:
160 - NET_ADMIN
161 - SYS_ADMIN
162 security_opt:
163 - label=disable
164 - seccomp=unconfined
165 volumes:
166 - spindle-data:/var/lib/spindle
167 - spindle-logs:/var/log/spindle
168 - ./out/localinfra-spindle-images:/var/lib/spindle/images:ro
169 - init-state:/shared:ro
170 - ./localinfra/certs/root.crt:/usr/local/share/ca-certificates/caddy.crt:ro
171 healthcheck:
172 test: ["CMD", "wget", "-qO-", "http://localhost:6555/"]
173 interval: 2s
174 timeout: 2s
175 retries: 30
176 start_period: 5s
177 depends_on:
178 plc:
179 condition: service_started
180 jetstream:
181 condition: service_started
182 init-accounts:
183 condition: service_completed_successfully
184 networks: [tngl]
185
186 knotmirror-tap:
187 image: ghcr.io/bluesky-social/indigo/tap:sha-4f47add43060c27e8a37d9d76482ecddf001fcd8 # 0.1.10
188 restart: unless-stopped
189 environment:
190 TAP_BIND: ":2480"
191 TAP_PLC_URL: https://plc.tngl.boltless.dev
192 TAP_RELAY_URL: https://pds.tngl.boltless.dev # PDS can be used as basic relay without collectiondir.
193 TAP_DATABASE_URL: postgres://tnglr:tnglr@postgres:5432/mirror_tap?sslmode=disable
194 TAP_COLLECTION_FILTERS: sh.tangled.repo
195 TAP_SIGNAL_COLLECTION: sh.tangled.repo
196 TAP_RESYNC_PARALLELISM: "10"
197 TAP_RETRY_TIMEOUT: 60s
198 volumes:
199 - ./localinfra/certs/root.crt:/etc/ssl/certs/ca-certificates.crt:ro
200 depends_on:
201 postgres:
202 condition: service_started
203 pds:
204 condition: service_healthy
205 networks: [tngl]
206
207 knotmirror:
208 build:
209 context: .
210 dockerfile: localinfra/knotmirror.Dockerfile
211 restart: unless-stopped
212 environment:
213 MIRROR_LISTEN: 0.0.0.0:7000
214 MIRROR_ADMIN_LISTEN: 0.0.0.0:7200
215 MIRROR_HOSTNAME: mirror.tngl.boltless.dev
216 MIRROR_TAP_URL: http://knotmirror-tap:2480
217 MIRROR_DB_URL: postgres://tnglr:tnglr@postgres:5432/mirror?sslmode=disable
218 MIRROR_REDIS_ADDR: redis:6379
219 MIRROR_PLC_URL: https://plc.tngl.boltless.dev
220 MIRROR_GIT_BASEPATH: /data/repos
221 MIRROR_KNOT_USE_SSL: "true"
222 MIRROR_KNOT_SSRF: "true"
223 MIRROR_RESYNC_PARALLELISM: "4"
224 volumes:
225 - knotmirror-data:/data
226 - ./localinfra/certs/root.crt:/usr/local/share/ca-certificates/caddy.crt:ro
227 healthcheck:
228 test: ["CMD", "wget", "-qO-", "http://localhost:7000/"]
229 interval: 2s
230 timeout: 2s
231 retries: 30
232 start_period: 5s
233 ports:
234 - "7201:7200"
235 depends_on:
236 postgres:
237 condition: service_started
238 knotmirror-tap:
239 condition: service_started
240 networks: [tngl]
241
242 tailwind:
243 image: d3fk/tailwindcss:v3
244 restart: unless-stopped
245 working_dir: /build
246 init: true
247 environment:
248 BROWSERSLIST_IGNORE_OLD_DATA: "true"
249 volumes:
250 - ./tailwind.config.js:/build/tailwind.config.js:ro
251 - ./input.css:/build/input.css:ro
252 - ./appview/pages/templates:/build/appview/pages/templates:ro
253 - ./docs:/build/docs:ro
254 - ./blog/templates:/build/blog/templates:ro
255 - ./blog/posts:/build/blog/posts:ro
256 - ./appview/pages/static:/build/appview/pages/static
257 command:
258 ["-i", "input.css", "-o", "appview/pages/static/tw.css", "--watch=always"]
259 network_mode: none
260
261 appview:
262 build:
263 context: .
264 dockerfile: localinfra/appview.Dockerfile
265 restart: unless-stopped
266 environment:
267 TANGLED_DEV: "true"
268 TANGLED_APPVIEW_HOST: 127.0.0.1:3000
269 TANGLED_DB_PATH: /var/lib/appview/appview.db
270 TANGLED_PLC_URL: https://plc.tngl.boltless.dev
271 TANGLED_JETSTREAM_ENDPOINT: wss://jetstream.tngl.boltless.dev/subscribe
272 TANGLED_REDIS_ADDR: redis:6379
273 TANGLED_KNOTMIRROR_URL: https://mirror.tngl.boltless.dev
274 ports:
275 - "3000:3000"
276 volumes:
277 - .:/src:cached
278 - go-cache:/go/cache
279 - go-mod-cache:/go/mod
280 - appview-data:/var/lib/appview
281 - init-state:/shared:ro
282 - ./localinfra/certs/root.crt:/usr/local/share/ca-certificates/caddy.crt:ro
283 depends_on:
284 redis:
285 condition: service_started
286 pds:
287 condition: service_healthy
288 init-accounts:
289 condition: service_completed_successfully
290 networks: [tngl]
291
292 caddy:
293 image: caddy:2-alpine
294 restart: unless-stopped
295 ports:
296 - "80:80"
297 - "443:443"
298 volumes:
299 - ./localinfra/Caddyfile:/etc/caddy/Caddyfile
300 - ./localinfra/certs:/etc/caddy/certs:ro
301 - caddy-data:/data
302 networks:
303 tngl:
304 aliases:
305 - plc.tngl.boltless.dev
306 - pds.tngl.boltless.dev
307 - alice.pds.tngl.boltless.dev
308 - bob.pds.tngl.boltless.dev
309 - jetstream.tngl.boltless.dev
310 - knot.tngl.boltless.dev
311 - spindle.tngl.boltless.dev
312 - tngl.boltless.dev
313 - mirror.tngl.boltless.dev
314
315volumes:
316 caddy-data:
317 postgres-data:
318 pds-data:
319 jetstream-data:
320 knot-data:
321 knot-ssh-keys:
322 knotmirror-data:
323 spindle-data:
324 spindle-logs:
325 init-state:
326 go-cache:
327 go-mod-cache:
328 appview-data:
329
330networks:
331 tngl:
332 driver: bridge
333 # Public-looking subnet so SSRF checks see container IPs as "public".
334 # RFC1918 + doc/benchmark ranges are blocklisted; 11.x is unrouted on
335 # the public internet, so it passes the check and won't collide.
336 ipam:
337 config:
338 - subnet: 11.0.0.0/24