76 lines
2.4 KiB
YAML
76 lines
2.4 KiB
YAML
# Production Control Panel deployment. This file intentionally has no build
|
|
# directives: production must run the digest-pinned images attested by CI.
|
|
# `production-preflight.sh` validates all files, endpoints, Object Lock and
|
|
# images before `docker compose up` is allowed.
|
|
#
|
|
# oauth2-proxy must emit X-Auth-Request-User and X-Auth-Request-Groups.
|
|
# Nginx overwrites X-CASAN-* headers before proxying to the API; the API maps
|
|
# groups such as casan-approver -> approver via rbac-check.py map-claim.
|
|
|
|
services:
|
|
control-panel-api:
|
|
image: ${CASAN_CP_API_IMAGE:?Set a digest-pinned CASAN_CP_API_IMAGE}
|
|
restart: unless-stopped
|
|
env_file:
|
|
- path: ${CASAN_CP_RUNTIME_ENV:?Set CASAN_CP_RUNTIME_ENV}
|
|
required: true
|
|
- path: ${CASAN_CP_VAULT_ENV:?Set CASAN_CP_VAULT_ENV}
|
|
required: true
|
|
environment:
|
|
CASAN_PROFILE: prod
|
|
CASAN_CP_STRICT: "1"
|
|
CASAN_CP_TRUST_AUTH_PROXY: "1"
|
|
CP_BIND: 0.0.0.0
|
|
CP_PORT: "3010"
|
|
CASAN_APP_ROOT: /app
|
|
# Browser-login CLIs are workstation-only. Production uses managed API
|
|
# credentials/workload identity and must not call a developer host bridge.
|
|
CASAN_PROVIDER_ACCOUNT_AUTH_ENABLED: "0"
|
|
volumes:
|
|
- ${CASAN_CP_STATE_DIR:?Set CASAN_CP_STATE_DIR}:/app/.specify
|
|
- ${CASAN_CP_OUTPUT_DIR:?Set CASAN_CP_OUTPUT_DIR}:/app/docs/output:ro
|
|
expose:
|
|
- "3010"
|
|
networks:
|
|
- casan-control
|
|
|
|
control-panel-ui:
|
|
image: ${CASAN_CP_UI_IMAGE:?Set a digest-pinned CASAN_CP_UI_IMAGE}
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- control-panel-api
|
|
- oauth2-proxy
|
|
ports:
|
|
- "${CASAN_CP_HTTPS_PORT:-443}:443"
|
|
volumes:
|
|
- ${CASAN_CP_TLS_DIR:?Set CASAN_CP_TLS_DIR}:/etc/nginx/tls:ro
|
|
networks:
|
|
- casan-control
|
|
|
|
oauth2-proxy:
|
|
image: ${CASAN_CP_OAUTH2_PROXY_IMAGE:?Set a digest-pinned CASAN_CP_OAUTH2_PROXY_IMAGE}
|
|
restart: unless-stopped
|
|
env_file:
|
|
- path: ${CASAN_CP_OAUTH_ENV:?Set CASAN_CP_OAUTH_ENV}
|
|
required: true
|
|
command:
|
|
- --http-address=0.0.0.0:4180
|
|
- --reverse-proxy=true
|
|
- --set-xauthrequest=true
|
|
- --pass-access-token=false
|
|
- --pass-authorization-header=false
|
|
- --skip-provider-button=true
|
|
- --cookie-secure=true
|
|
- --cookie-httponly=true
|
|
- --cookie-samesite=lax
|
|
- --cookie-expire=8h
|
|
- --cookie-refresh=1h
|
|
expose:
|
|
- "4180"
|
|
networks:
|
|
- casan-control
|
|
|
|
networks:
|
|
casan-control:
|
|
driver: bridge
|