Meridian/docker-compose.yml at main · felipeofdev-ai/Meridian · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
version: '3.9'
services:
  postgres:
    image: postgres:16
    environment:
      POSTGRES_USER: meridian
      POSTGRES_PASSWORD: meridian
      POSTGRES_DB: meridian
    ports:
      - '5432:5432'
    volumes:
      - pgdata:/var/lib/postgresql/data
      - ./apps/collector/sql/001_init.sql:/docker-entrypoint-initdb.d/001_init.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U meridian -d meridian"]
      interval: 10s
      timeout: 5s
      retries: 10

  redis:
    image: redis:7-alpine
    ports:
      - '6379:6379'

  zookeeper:
    image: confluentinc/cp-zookeeper:7.5.3
    environment:
      ZOOKEEPER_CLIENT_PORT: 2181

  kafka:
    image: confluentinc/cp-kafka:7.5.3
    depends_on:
      - zookeeper
    ports:
      - '9092:9092'
    environment:
      KAFKA_BROKER_ID: 1
      KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9092
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1

  opa:
    image: openpolicyagent/opa:0.69.0-static
    command: ["run", "--server", "/policies"]
    volumes:
      - ./.meridian/policies:/policies:ro
    ports:
      - '8181:8181'

  collector:
    build:
      context: .
      dockerfile: apps/collector/Dockerfile
    depends_on:
      postgres:
        condition: service_healthy
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    environment:
      PORT: 8080
      DATABASE_URL: postgres://meridian:meridian@postgres:5432/meridian
      GITHUB_WEBHOOK_SECRET: dev-github-secret
      GITLAB_WEBHOOK_TOKEN: dev-gitlab-token
      TENANT_API_KEYS: '{"acme":"acme-key"}'
      TENANT_GITHUB_SECRETS: '{"acme":"acme-github-secret"}'
      TENANT_GITLAB_TOKENS: '{"acme":"dev-gitlab-token"}'
      EXPORT_SIGNING_ALGORITHM: HMAC-SHA256
      EXPORT_SIGNING_KEY_ID: local-dev-key-v1
      KEY_PROVIDER: env
      KEY_REFERENCE: local://export-signing-key
      EXPORT_SIGNING_KEY: dev-export-signing-key
    ports:
      - '8080:8080'

  policy-engine:
    build:
      context: .
      dockerfile: apps/policy-engine/Dockerfile
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    environment:
      PORT: 8081
    ports:
      - '8081:8081'

volumes:
  pgdata: