docker-compose-edgex-spiffe-spire.yml

########################################################################
 # Copyright (c) Intel Corporation 2023
 # SPDX-License-Identifier: BSD-3-Clause
########################################################################

version: '3.7'
networks:
  edgex-network:
    driver: bridge
services:
  oem-ssh-proxy:
    build:
      context: edgex-res/oem-ssh-proxy
    command: docker-entrypoint.sh
    container_name: edgex-oem-ssh-proxy
    depends_on:
      - edgex-core-consul
      - edgex-security-bootstrapper
    entrypoint:
      - /edgex-init/ready_to_run_wait_install.sh
    environment:
      EDGEX_SECURITY_SECRET_STORE: "true"
      MESSAGEQUEUE_HOST: edgex-redis
      REGISTRY_HOST: edgex-core-consul
      SECRETSTORE_HOST: edgex-vault
      SECRETSTORE_PORT: '8200'
      STAGEGATE_BOOTSTRAPPER_HOST: edgex-security-bootstrapper
      STAGEGATE_READY_TORUNPORT: '54329'
      STAGEGATE_WAITFOR_TIMEOUT: '60s'
      # Unique for ssh-proxy
      TUNNEL_HOST: <OEM_IP_ADDRESS>
      TUNNEL_SSH_PORT: 2223
      JOB_REPO_HOST: job-repository
      JOB_REPO_PORT: 59784
      FILE_SENDER_GATEWAY_HOST: file-sender-gateway
      FILE_SENDER_GATEWAY_PORT: 59786
      TASK_LAUNCHER_HOST: task-launcher
      TASK_LAUNCHER_PORT: 59785
      FILE_RECEIVER_GATEWAY_HOST: file-receiver-gateway
      FILE_RECEIVER_GATEWAY_PORT: 59783
      SECRETSTORE_RUNTIMETOKENPROVIDER_HOST: edgex-security-spiffe-token-provider
      SECRETSTORE_RUNTIMETOKENPROVIDER_PORT: 59841
      SECURITY_SPIRE_SERVER_HOST: edgex-security-spire-server
      SECURITY_SPIRE_SERVER_PORT: 59840
    hostname: edgex-oem-ssh-proxy
    image: oem-ssh-proxy:latest
    networks:
      edgex-network:
        aliases:
          - file-watcher
          - data-organizer
          - file-sender-oem
          - file-receiver-oem
    ports:
      - 127.0.0.1:59781:59781/tcp
      - 127.0.0.1:59782:59782/tcp
      - 127.0.0.1:59780:59780/tcp
      - 127.0.0.1:59787:59787/tcp
    read_only: true
    restart: always
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /run
    volumes:
      - edgex-init:/edgex-init:ro,z
      - spire-ca:/srv/spiffe/ca:z
      - spire-remote-agent:/srv/spiffe/remote-agent:z
      - /tmp/edgex/secrets/spiffe/trust:/tmp/edgex/secrets/spiffe/trust:ro,z
      - $PWD/edgex-res/ssh_keys:/root/.ssh
  edgex-security-spiffe-token-provider:
    command: /security-spiffe-token-provider -cp=consul.http://edgex-core-consul:8500
      --registry --confdir=/res
    depends_on:
      edgex-core-consul:
        condition: service_started
      edgex-security-bootstrapper:
        condition: service_started
      edgex-security-spire-agent:
        condition: service_started
    entrypoint:
      - /edgex-init/ready_to_run_wait_install.sh
    environment:
      API_GATEWAY_HOST: edgex-kong
      API_GATEWAY_STATUS_PORT: '8100'
      DATABASES_PRIMARY_HOST: edgex-redis
      EDGEX_SECURITY_SECRET_STORE: "true"
      MESSAGEQUEUE_HOST: edgex-redis
      PROXY_SETUP_HOST: edgex-security-proxy-setup
      REGISTRY_HOST: edgex-core-consul
      SECRETSTORE_HOST: edgex-vault
      SECRETSTORE_PORT: '8200'
      SERVICE_HOST: edgex-security-spiffe-token-provider
      SPIFFE_ENDPOINTSOCKET: /tmp/edgex/secrets/spiffe/public/api.sock
      SPIFFE_TRUSTBUNDLE_PATH: /tmp/edgex/secrets/spiffe/trust/bundle
      SPIFFE_TRUSTDOMAIN: edgexfoundry.org
      STAGEGATE_BOOTSTRAPPER_HOST: edgex-security-bootstrapper
      STAGEGATE_BOOTSTRAPPER_STARTPORT: '54321'
      STAGEGATE_DATABASE_HOST: edgex-redis
      STAGEGATE_DATABASE_PORT: '6379'
      STAGEGATE_DATABASE_READYPORT: '6379'
      STAGEGATE_KONGDB_HOST: edgex-kong-db
      STAGEGATE_KONGDB_PORT: '5432'
      STAGEGATE_KONGDB_READYPORT: '54325'
      STAGEGATE_READY_TORUNPORT: '54329'
      STAGEGATE_REGISTRY_HOST: edgex-core-consul
      STAGEGATE_REGISTRY_PORT: '8500'
      STAGEGATE_REGISTRY_READYPORT: '54324'
      STAGEGATE_SECRETSTORESETUP_HOST: edgex-security-secretstore-setup
      STAGEGATE_SECRETSTORESETUP_TOKENS_READYPORT: '54322'
      STAGEGATE_WAITFOR_TIMEOUT: 60s
    hostname: edgex-security-spiffe-token-provider
    image: edgexfoundry/security-spiffe-token-provider:2.3.0
    networks:
      edgex-network: { }
    ports:
      - 127.0.0.1:59841:59841/tcp
    read_only: true
    restart: always
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /run
    user: root:root
    volumes:
      - edgex-init:/edgex-init:z
      - /tmp/edgex/secrets/security-spiffe-token-provider:/tmp/edgex/secrets/security-spiffe-token-provider:z
      - /tmp/edgex/secrets/spiffe:/tmp/edgex/secrets/spiffe:z
  edgex-security-spire-agent:
    command: docker-entrypoint.sh
    depends_on:
      edgex-security-spire-server:
        condition: service_started
    entrypoint:
      - /edgex-init/ready_to_run_wait_install.sh
    environment:
      API_GATEWAY_HOST: edgex-kong
      API_GATEWAY_STATUS_PORT: '8100'
      DATABASES_PRIMARY_HOST: edgex-redis
      EDGEX_SECURITY_SECRET_STORE: "true"
      MESSAGEQUEUE_HOST: edgex-redis
      PROXY_SETUP_HOST: edgex-security-proxy-setup
      REGISTRY_HOST: edgex-core-consul
      SECRETSTORE_HOST: edgex-vault
      SECRETSTORE_PORT: '8200'
      SPIFFE_ENDPOINTSOCKET: /tmp/edgex/secrets/spiffe/public/api.sock
      SPIFFE_TRUSTBUNDLE_PATH: /tmp/edgex/secrets/spiffe/trust/bundle
      SPIFFE_TRUSTDOMAIN: edgexfoundry.org
      STAGEGATE_BOOTSTRAPPER_HOST: edgex-security-bootstrapper
      STAGEGATE_BOOTSTRAPPER_STARTPORT: '54321'
      STAGEGATE_DATABASE_HOST: edgex-redis
      STAGEGATE_DATABASE_PORT: '6379'
      STAGEGATE_DATABASE_READYPORT: '6379'
      STAGEGATE_KONGDB_HOST: edgex-kong-db
      STAGEGATE_KONGDB_PORT: '5432'
      STAGEGATE_KONGDB_READYPORT: '54325'
      STAGEGATE_READY_TORUNPORT: '54329'
      STAGEGATE_REGISTRY_HOST: edgex-core-consul
      STAGEGATE_REGISTRY_PORT: '8500'
      STAGEGATE_REGISTRY_READYPORT: '54324'
      STAGEGATE_SECRETSTORESETUP_HOST: edgex-security-secretstore-setup
      STAGEGATE_SECRETSTORESETUP_TOKENS_READYPORT: '54322'
      STAGEGATE_WAITFOR_TIMEOUT: 60s
    hostname: edgex-security-spire-agent
    image: edgexfoundry/security-spire-agent:2.3.0
    networks:
      edgex-network: { }
    pid: host
    privileged: true
    read_only: true
    restart: always
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /run
    user: root:root
    volumes:
      - edgex-init:/edgex-init:z
      - spire-agent:/srv/spiffe/agent:z
      - spire-ca:/srv/spiffe/ca:z
      - /tmp/edgex/secrets/spiffe:/tmp/edgex/secrets/spiffe:z
      - /var/run/docker.sock:/var/run/docker.sock:rw
  edgex-security-spire-config:
    command: docker-entrypoint.sh
    container_name: edgex-security-spire-config
    depends_on:
      edgex-security-spire-agent:
        condition: service_started
    entrypoint:
      - /edgex-init/ready_to_run_wait_install.sh
    environment:
      API_GATEWAY_HOST: edgex-kong
      API_GATEWAY_STATUS_PORT: '8100'
      DATABASES_PRIMARY_HOST: edgex-redis
      EDGEX_SECURITY_SECRET_STORE: "true"
      MESSAGEQUEUE_HOST: edgex-redis
      PROXY_SETUP_HOST: edgex-security-proxy-setup
      REGISTRY_HOST: edgex-core-consul
      SECRETSTORE_HOST: edgex-vault
      SECRETSTORE_PORT: '8200'
      SPIFFE_CUSTOM_SERVICES: 'app-file-watcher app-data-organizer app-file-sender-oem app-file-receiver-oem'
      SPIFFE_ENDPOINTSOCKET: /tmp/edgex/secrets/spiffe/public/api.sock
      SPIFFE_TRUSTBUNDLE_PATH: /tmp/edgex/secrets/spiffe/trust/bundle
      SPIFFE_TRUSTDOMAIN: edgexfoundry.org
      STAGEGATE_BOOTSTRAPPER_HOST: edgex-security-bootstrapper
      STAGEGATE_BOOTSTRAPPER_STARTPORT: '54321'
      STAGEGATE_DATABASE_HOST: edgex-redis
      STAGEGATE_DATABASE_PORT: '6379'
      STAGEGATE_DATABASE_READYPORT: '6379'
      STAGEGATE_KONGDB_HOST: edgex-kong-db
      STAGEGATE_KONGDB_PORT: '5432'
      STAGEGATE_KONGDB_READYPORT: '54325'
      STAGEGATE_READY_TORUNPORT: '54329'
      STAGEGATE_REGISTRY_HOST: edgex-core-consul
      STAGEGATE_REGISTRY_PORT: '8500'
      STAGEGATE_REGISTRY_READYPORT: '54324'
      STAGEGATE_SECRETSTORESETUP_HOST: edgex-security-secretstore-setup
      STAGEGATE_SECRETSTORESETUP_TOKENS_READYPORT: '54322'
      STAGEGATE_WAITFOR_TIMEOUT: 60s
    hostname: edgex-security-spire-config
    image: edgexfoundry/security-spire-config:2.3.0
    networks:
      edgex-network: { }
    read_only: true
    restart: always
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /run
    user: root:root
    volumes:
      - edgex-init:/edgex-init:z
      - /tmp/edgex/secrets/spiffe:/tmp/edgex/secrets/spiffe:z
      - ./edgex-res/seed_builtin_entries.sh:/usr/local/etc/spiffe-scripts.d/seed_builtin_entries.sh
  edgex-security-spire-server:
    command: docker-entrypoint.sh
    depends_on:
      edgex-security-bootstrapper:
        condition: service_started
    entrypoint:
      - /edgex-init/ready_to_run_wait_install.sh
    environment:
      API_GATEWAY_HOST: edgex-kong
      API_GATEWAY_STATUS_PORT: '8100'
      DATABASES_PRIMARY_HOST: edgex-redis
      EDGEX_SECURITY_SECRET_STORE: "true"
      MESSAGEQUEUE_HOST: edgex-redis
      PROXY_SETUP_HOST: edgex-security-proxy-setup
      REGISTRY_HOST: edgex-core-consul
      SECRETSTORE_HOST: edgex-vault
      SECRETSTORE_PORT: '8200'
      SPIFFE_ENDPOINTSOCKET: /tmp/edgex/secrets/spiffe/public/api.sock
      SPIFFE_TRUSTBUNDLE_PATH: /tmp/edgex/secrets/spiffe/trust/bundle
      SPIFFE_TRUSTDOMAIN: edgexfoundry.org
      STAGEGATE_BOOTSTRAPPER_HOST: edgex-security-bootstrapper
      STAGEGATE_BOOTSTRAPPER_STARTPORT: '54321'
      STAGEGATE_DATABASE_HOST: edgex-redis
      STAGEGATE_DATABASE_PORT: '6379'
      STAGEGATE_DATABASE_READYPORT: '6379'
      STAGEGATE_KONGDB_HOST: edgex-kong-db
      STAGEGATE_KONGDB_PORT: '5432'
      STAGEGATE_KONGDB_READYPORT: '54325'
      STAGEGATE_READY_TORUNPORT: '54329'
      STAGEGATE_REGISTRY_HOST: edgex-core-consul
      STAGEGATE_REGISTRY_PORT: '8500'
      STAGEGATE_REGISTRY_READYPORT: '54324'
      STAGEGATE_SECRETSTORESETUP_HOST: edgex-security-secretstore-setup
      STAGEGATE_SECRETSTORESETUP_TOKENS_READYPORT: '54322'
      STAGEGATE_WAITFOR_TIMEOUT: 60s
    hostname: edgex-security-spire-server
    image: edgexfoundry/security-spire-server:2.3.0
    networks:
      edgex-network: { }
    pid: host
    ports:
      - 127.0.0.1:59840:59840/tcp
    read_only: true
    restart: always
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /run
    user: root:root
    volumes:
      - edgex-init:/edgex-init:z
      - spire-ca:/srv/spiffe/ca:z
      - spire-server:/srv/spiffe/server:z
      - /tmp/edgex/secrets/spiffe:/tmp/edgex/secrets/spiffe:z
volumes:
  spire-agent: {}
  spire-remote-agent: {}
  spire-ca: {}
  spire-server: {}