docker-compose.yml

version: "3.3"
# Require docker-compose version 1.29
# version: "3.9"
services:
  ca:
    build:
      context: .
      dockerfile: containers/ca/Dockerfile
    ports:
      - "443:443"
    depends_on:
      - "postgres"
    restart: always
    read_only: true
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    # Require docker-compose version 1.29 and version: "3.3" in this file at the top
    # mem_limit: "512m"
    # mem_reservation: "128m"
    # cpus: "1.75"
    volumes:
      - ./data/hsm_tokens:/var/lib/softhsm/tokens
      - ./data/ca_root_certs:/etc/pkcs11_ca/ca_root_certs/
    tmpfs:
      - /dev/shm:ro,noexec,nosuid,nodev
    environment:
      - CA_URL=${CA_URL}
      - ACME_ROOT=${ACME_ROOT}
      - PKCS11_SIGN_API_TOKEN=${PKCS11_SIGN_API_TOKEN}
      - PKCS11_TOKEN=${PKCS11_TOKEN}
      - PKCS11_PIN=${PKCS11_PIN}
      - PKCS11_MODULE=${PKCS11_MODULE}
      - PKCS11_TOKEN_SUPPORT_RECREATE_SESSION=False
      - POSTGRES_HOST=${POSTGRES_HOST}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_PORT=${POSTGRES_PORT}
      - POSTGRES_DATABASE=${POSTGRES_DATABASE}
      - POSTGRES_TIMEOUT=${POSTGRES_TIMEOUT}
  postgres:
    # build:
    # context: .
    # dockerfile: containers/postgres/Dockerfile
    image: postgres:16.1-bookworm@sha256:06176e3fc141cc2fa178a0c9038453300738cce657c3844f1bd9478d282e28e4
    restart: always
    # read_only: true
    # cap_drop: [ALL]
    # security_opt:
    #   - no-new-privileges:true
    # Require docker-compose version 1.299 and version: "3.3" in this file at the top
    # mem_limit: "1g"
    # mem_reservation: "128m"
    # cpus: "1.75"
    volumes:
      - ./data/db_data:/var/lib/postgresql/data
    tmpfs:
      - /dev/shm:ro,noexec,nosuid,nodev
    environment:
      - POSTGRES_DB=${POSTGRES_DATABASE}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
  test1:
    build:
      context: .
      dockerfile: containers/test/Dockerfile
    depends_on:
      - "ca"
    restart: "no"
    # read_only: true
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    # Require docker-compose version 1.29 and version: "3.3" in this file at the top
    # mem_limit: "256m"
    # mem_reservation: "128m"
    # cpus: "1.0"
    tmpfs:
      - /dev/shm:ro,noexec,nosuid,nodev
    environment:
      - CA_URL=${CA_URL}
      - ACME_ROOT=${ACME_ROOT}
      - PKCS11_SIGN_API_TOKEN=${PKCS11_SIGN_API_TOKEN}
    entrypoint: ['true']