4117ec6063
Stage 5 — make the cloud composition spin up in one command and add
the SensorThings (FROST) stack as a fully segregated tenant.
cloud/deploy.sh — idempotent, 7-step bring-up:
preflight → validate → up + wait → cert state → issue/renew →
service status → endpoint smoke test. Reissues LE cert only when
current issuer no longer matches ACME_CA_URI. Move-aside-then-
restore-on-failure so the bootstrap cert survives a failed certbot.
stacks/frost — new stack, segregated from shared sql/rabbitmq:
- dedicated postgis container (frost-db)
- dedicated internal mosquitto bus (frost-mosquitto)
- frost-http + frost-mqtt on a private frost-internal network,
joined to cloud-app only for nginx ingress at frost.wbd-rd.nl
- shared mosquitto stack deleted; rabbitmq remains the only public
MQTT broker (mqtt.wbd-rd.nl:8883 via stream proxy)
stacks/sql — pg_isready healthcheck so keycloak/gitea/mlflow can gate
on service_healthy via cloud-level depends_on overrides.
stacks/nginx-proxy:
- nginx-init service generates a self-signed bootstrap cert on
fresh deploy so nginx starts before certbot has issued a real one
- frost.wbd-rd.nl vhost (/FROST-Server → frost-http:8080,
/mqtt → frost-mqtt:9876 WebSocket)
stacks/mlflow — custom Dockerfile (upstream + psycopg2-binary) so the
official image can speak to the shared sql backend.
stacks/jupyterhub — DummyAuthenticator stub gated by
JUPYTERHUB_ADMIN_PASSWORD; TODO comments point at OIDC + DockerSpawner.
stacks/rabbitmq — config/{enabled_plugins,rabbitmq.conf} stubs
(management + mqtt plugins, MQTT auth required).
stacks/portainer — ports unpublished; nginx now the only ingress.
stacks/node-red — pin to 4.1 (the floating "4" tag does not exist).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
73 lines
2.2 KiB
YAML
73 lines
2.2 KiB
YAML
# Cloud / Central layer composition.
|
|
# Pulls in every stack that runs on the central hub and adds cross-stack
|
|
# dependencies (the per-stack composes stay standalone-runnable).
|
|
#
|
|
# Fresh-deploy procedure (see ../docs/architecture.md for the long version):
|
|
# 1. cp .env.example .env && fill secrets
|
|
# 2. Set DNS A records for the 10 short subdomains + vpn.wbd-rd.nl
|
|
# 3. docker compose up -d
|
|
# - nginx-init creates a self-signed bootstrap cert
|
|
# - sql comes up, init.d/01-databases.sh provisions per-app DBs
|
|
# - keycloak / gitea / mlflow wait on sql healthcheck before starting
|
|
# 4. ./deploy.sh — single command. Brings everything up, runs first-time cert
|
|
# issuance via certbot HTTP-01 (SAN over all *.wbd-rd.nl), reloads nginx,
|
|
# smoke-tests every vhost. Idempotent; safe to rerun.
|
|
# 5. Flip ACME_CA_URI from staging → prod in .env, ./deploy.sh again.
|
|
|
|
name: cloud
|
|
|
|
include:
|
|
# Foundation — ingress, DB, ops console
|
|
- ../stacks/nginx-proxy/compose.yml
|
|
- ../stacks/sql/compose.yml
|
|
- ../stacks/portainer/compose.yml
|
|
# Identity + VPN
|
|
- ../stacks/keycloak/compose.yml
|
|
- ../stacks/wireguard-server/compose.yml
|
|
# Data
|
|
- ../stacks/influxdb/compose.yml
|
|
# Apps
|
|
- ../stacks/node-red/compose.yml
|
|
- ../stacks/grafana/compose.yml
|
|
- ../stacks/gitea/compose.yml
|
|
- ../stacks/jenkins/compose.yml
|
|
# Messaging + mail
|
|
- ../stacks/rabbitmq/compose.yml
|
|
- ../stacks/postfix/compose.yml
|
|
# ML / notebooks
|
|
- ../stacks/mlflow/compose.yml
|
|
- ../stacks/jupyterhub/compose.yml
|
|
# SensorThings
|
|
- ../stacks/frost/compose.yml
|
|
|
|
# Cross-stack dependencies. Declared at the cloud level so each stack's
|
|
# own compose.yml stays standalone-runnable (no required peers).
|
|
services:
|
|
keycloak:
|
|
depends_on:
|
|
sql:
|
|
condition: service_healthy
|
|
gitea:
|
|
depends_on:
|
|
sql:
|
|
condition: service_healthy
|
|
mlflow:
|
|
depends_on:
|
|
sql:
|
|
condition: service_healthy
|
|
|
|
networks:
|
|
edge:
|
|
name: cloud-edge
|
|
driver: bridge
|
|
app:
|
|
name: cloud-app
|
|
driver: bridge
|
|
data:
|
|
name: cloud-data
|
|
driver: bridge
|
|
internal: true # databases — no internet egress
|
|
mgmt:
|
|
name: cloud-mgmt
|
|
driver: bridge
|