edge-stack/docker-compose.yaml at main · dnstapir/edge-stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
networks:
  internal:
    ipam:
      driver: default
      config:
        - subnet: "10.53.0.0/24"

services:
  resolver:
    image: ghcr.io/dnstapir/unbound:latest
    ports:
      - 53:53/tcp
      - 53:53/udp
      - 443:443/tcp
      - 443:443/udp
      - 853:853/tcp
    volumes:
      - ./unbound/local.d/access-control.conf:/etc/unbound/local.d/access-control.conf:ro
      - ./unbound/conf.d/dnstap.conf:/etc/unbound/conf.d/dnstap.conf:ro
    networks:
      internal:
        ipv4_address: 10.53.0.10
    deploy:
      resources:
        limits:
          memory: 4G
  edm-init:
    image: busybox
    volumes:
      - edm-data:/var/lib/edm
    command: chown -v 65532:65532 /var/lib/edm
  edm:
    image: ghcr.io/dnstapir/edm:latest
    volumes:
      - ./keys:/etc/dnstapir/keys:ro
      - ./edm/config:/etc/dnstapir/edm:ro
      - edm-data:/var/lib/edm
    networks:
      internal:
        ipv4_address: 10.53.0.11
    deploy:
      resources:
        limits:
          memory: 4G
    command:
     - run
     - --input-tcp=10.53.0.11:53535
     - --minimiser-workers=3
     - --disable-session-files
     - --disable-histogram-sender
     - --config-file=/etc/dnstapir/edm/edm.toml
     - --well-known-domains-file=/etc/dnstapir/edm/well-known-domains.dawg
     - --mqtt-signing-key-file=/etc/dnstapir/keys/jws.key
     - --mqtt-signing-key-id=${NAME}
     - --mqtt-ca-file=/etc/dnstapir/keys/ca.crt
     - --mqtt-client-cert-file=/etc/dnstapir/keys/tls.crt
     - --mqtt-client-key-file=/etc/dnstapir/keys/tls.key
     - --mqtt-server=tls://mqtt.dev.dnstapir.se:8883
     - --mqtt-topic=events/up/${NAME}/edm
     - --mqtt-client-id=${NAME}-edm-pub
     - --http-url=https://aggregates.dev.dnstapir.se
     - --http-signing-key-file=/etc/dnstapir/keys/jws.key
     - --http-client-cert-file=/etc/dnstapir/keys/tls.crt
     - --http-client-key-file=/etc/dnstapir/keys/tls.key
     - --http-signing-key-id=${NAME}
    depends_on:
     edm-init:
       condition: service_completed_successfully

volumes:
  edm-data: