getbased-relay/docker-compose.yml at main · elkimek/getbased-relay · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
services:
  relay:
    build: .
    ports:
      # Caddy is the only public entrypoint. Binding the relay to loopback
      # prevents bypassing TLS, headers, and host-level request controls.
      - "127.0.0.1:4000:4000"
      # Self-service endpoints (HMAC-authed). Bind 127.0.0.1 on the host
      # so they only expose through the reverse proxy (Caddy), not
      # directly to the public IP. Set SELF_ENABLED=0 to turn them off.
      - "127.0.0.1:4003:4003"
    volumes:
      - relay-data:/data
      - context-verifier-socket:/run/getbased-verifier
    environment:
      - RELAY_PORT=4000
      - ADMIN_PORT=4002
      - SELF_PORT=4003
      - SELF_BIND=0.0.0.0
      - SELF_ENABLED=true
      - CONTEXT_VERIFIER_ENABLED=true
      - CONTEXT_VERIFIER_SOCKET=/run/getbased-verifier/verifier.sock
      - CONTEXT_VERIFIER_TOKEN=${CONTEXT_VERIFIER_TOKEN:?set CONTEXT_VERIFIER_TOKEN in .env}
      - QUOTA_PER_OWNER_MB=10
      - QUOTA_GLOBAL_MB=1000
      - LOG_FORMAT=json
      - LOG_LEVEL=info
    restart: unless-stopped
    init: true
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=64m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 128
    mem_limit: 1g
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://localhost:4002/health').then(r=>{if(!r.ok)throw 1}).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3

  context-gateway:
    build: ./context-gateway
    ports:
      # Bind the host side to loopback; Caddy/reverse proxy should be the
      # only public entrypoint. CONTEXT_BIND remains 0.0.0.0 so Docker can
      # reach the service inside the container network.
      - "127.0.0.1:4001:4001"
    volumes:
      - context-data:/opt/context-gateway/data
      - context-verifier-socket:/run/getbased-verifier:ro
    environment:
      - CONTEXT_BIND=0.0.0.0
      - CONTEXT_VERIFIER_SOCKET=/run/getbased-verifier/verifier.sock
      - CONTEXT_VERIFIER_TOKEN=${CONTEXT_VERIFIER_TOKEN:?set CONTEXT_VERIFIER_TOKEN in .env}
      # Caddy overwrites this dedicated header from the socket peer. Ordinary
      # X-Forwarded-For is ignored so callers cannot mint rate-limit buckets.
      - CONTEXT_CLIENT_IP_HEADER=x-getbased-client-ip
      - CONTEXT_RATE_LIMIT_PER_MINUTE=300
      - AGENT_CONTEXT_OWNER_QUOTA_BYTES=5242880
      - AGENT_CONTEXT_MAX_PROFILE_BYTES=524288
      - AGENT_CONTEXT_MAX_PROFILES=20
      - AGENT_CONTEXT_MAX_TOKENS=3
    restart: unless-stopped
    init: true
    user: node
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=32m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 64
    mem_limit: 256m
    depends_on:
      relay:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:4001/health').then(r=>{if(!r.ok)throw 1}).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3

volumes:
  relay-data:
  context-data:
  context-verifier-socket: