docker-compose.acra-haproxy-pgsql.yml

version: "3"

services:

    #===== Keymakers ===========================================================

    acra-keymaker_writer:
        image: "cossacklabs/acra-keymaker:${ACRA_DOCKER_IMAGE_TAG:-0.95.0}"
        network_mode: "none"
        environment:
            ACRA_MASTER_KEY: ${ACRA_SERVER_MASTER_KEY:-N0MyZEVCRGY1cHA4ODRSVHp3c3BNeGtDekxaV3BhTHI=}
        volumes:
            - ./.acrakeys:/keys
            - ./ssl/acra-client/:/ssl:ro
        command: >-
            --client_id=""
            --tls_cert=/ssl/acra-client.crt
            --generate_acrawriter_keys
            --generate_symmetric_storage_key
            --keys_output_dir=/keys/acra-server
            --keys_public_output_dir=/keys/acra-writer
            --keystore=v1


    #===== Databases ===========================================================

    pgsql-master:
        build:
            context: ./
            dockerfile: pgsql-replication.dockerfile
        environment:
            POSTGRES_USER: ${POSTGRES_USER:-postgres}
            POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-test}
            POSTGRES_DB: ${POSTGRES_DB:-test}
            POSTGRES_REPLICATION_USER: ${POSTGRES_REPLICATION_USER:-replica}
            POSTGRES_REPLICATION_PASSWORD: ${POSTGRES_REPLICATION_PASSWORD:-2QTkGNGuxEC25viP}
        ports:
            - "5434:5432"
        networks:
            - haproxy-pgsql
            - world
            - acraserver-haproxy

    pgsql-replication-setup:
        depends_on:
            - pgsql-master
        build:
            context: ./
            dockerfile: replication-setup.dockerfile
        environment:
            POSTGRES_HOST: ${POSTGRES_HOST:-pgsql-master}
            POSTGRES_PORT: ${POSTGRES_PORT:-5432}
            POSTGRES_USER: ${POSTGRES_USER:-postgres}
            POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-test}
            POSTGRES_REPLICATION_USER: ${POSTGRES_REPLICATION_USER:-replica}
            POSTGRES_REPLICATION_PASSWORD: ${POSTGRES_REPLICATION_PASSWORD:-2QTkGNGuxEC25viP}
            POSTGRES_REPLICATION_MASTER_HOST: pgsql-master
        volumes:
            - ./pgdata:/var/lib/postgresql/data/
        networks:
            - haproxy-pgsql


    pgsql-slave:
        depends_on:
            pgsql-replication-setup:
              condition:
                  service_completed_successfully
        build:
            context: ./
            dockerfile: pgsql-slave.dockerfile
        volumes:
            - ./pgdata:/var/lib/postgresql/data/
        environment:
            POSTGRES_USER: ${POSTGRES_USER:-postgres}
            POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-test}
            POSTGRES_REPLICATION_USER: ${POSTGRES_REPLICATION_USER:-replica}
            POSTGRES_REPLICATION_PASSWORD: ${POSTGRES_REPLICATION_PASSWORD:-2QTkGNGuxEC25viP}
            POSTGRES_REPLICATION_MASTER_HOST: pgsql-master
            DATABASE_ALREADY_EXISTS: "true"
        ports:
            - "5435:5432"
        networks:
            - haproxy-pgsql
            - world


    #===== HAProxy =============================================================

    haproxy:
        depends_on:
          - pgsql-slave
        build:
            context: ./
            dockerfile: haproxy-pgsql.dockerfile
        ports:
            # RW
            - "5432:5432"
            # RO
            - "5433:5433"
        networks:
            - haproxy-pgsql
            - world
            - acraserver-haproxy


    #===== Acra ================================================================

    acra-server:
        image: "cossacklabs/acra-server:${ACRA_DOCKER_IMAGE_TAG:-0.95.0}"
        restart: always
        depends_on:
            - haproxy
        environment:
            ACRA_MASTER_KEY: ${ACRA_SERVER_MASTER_KEY:-N0MyZEVCRGY1cHA4ODRSVHp3c3BNeGtDekxaV3BhTHI=}
        networks:
            - acraserver-haproxy
            - python-acraserver
        volumes:
            - ./.acrakeys/acra-server:/keys
            - ./.acraconfigs/acra-server:/config
            - ./ssl/acra-server/:/ssl
        # explicitly specify PostgreSQL's SNI (tls_database_sni) due to acra connects to the haproxy by domain
        # and it will proxy pgsql's TLS handshake as is with pgsql's certificate
        command: >-
            --db_host=haproxy
            --db_port=5432
            --keys_dir=/keys
            --tls_auth=4
            --tls_ca=/ssl/root.crt
            --tls_cert=/ssl/acra-server.crt
            --tls_key=/ssl/acra-server.key
            --tls_client_id_from_cert
            --tls_database_sni=pgsql
            --tls_identifier_extractor_type=distinguished_name
            --config_file=/config/acra-server.yaml
            --v
            --d


    #===== Example client ==========================================================

    python:
        depends_on:
            - acra-keymaker_writer
            - haproxy
        build:
            context: ./
            dockerfile: acra-python-example.dockerfile
        environment:
#            # Direct connection to DB
#            DB_HOST: haproxy
#            DB_PORT: 5432
            # Demo script default cofiguration
            EXAMPLE_ACRA_SERVER_API_ADDRESS: http://acra-server:9090
            EXAMPLE_HOST: acra-server
            EXAMPLE_PORT: 9393
            EXAMPLE_DB_USER: ${POSTGRES_USER:-postgres}
            EXAMPLE_DB_PASSWORD: ${POSTGRES_PASSWORD:-test}
            EXAMPLE_DB_NAME: ${POSTGRES_DB:-test}
            # sha512 of the certificate's distinguished name
            EXAMPLE_PUBLIC_KEY: "/app.acrakeys/28fa1ef8aa3184d7ce0621341299d74b5b561a95aecdee3b46b847d63495f800d276cdd1233f5950efb348113f2892ceef4b354abed383d8afc026901854ca28_storage.pub"
            EXAMPLE_SSL_MODE: verify-full
            EXAMPLE_TLS_ROOT_CERT: /ssl/root.crt
            EXAMPLE_TLS_KEY: /ssl/acra-client.key
            EXAMPLE_TLS_CERT: /ssl/acra-client.crt
            EXAMPLE_POSTGRESQL: !!str 'true'
        networks:
            - python-haproxy
            - python-acraserver
        volumes:
            - ./.acrakeys/acra-writer:/app.acrakeys:ro


networks:
    world:
    haproxy-pgsql:
        internal: true
    acraserver-haproxy:
        internal: true
    python-haproxy:
        internal: true
    python-acraserver:
        internal: true