openshield/docker-compose.yml at dev · openshield-org/openshield · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
services:
  db:
    profiles: ["local"]
    image: postgres:16-alpine
    read_only: true
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp
      - /var/run/postgresql
    environment:
      POSTGRES_DB: openshield
      POSTGRES_USER: openshield
      POSTGRES_PASSWORD: openshield
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "127.0.0.1:5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 10s
      timeout: 5s
      retries: 5

  api:
    profiles: ["local"]
    build: .
    ports:
      - "127.0.0.1:8000:8000"
    environment:
      PORT: "8000"
      OPENSHIELD_ENV: development
      DATABASE_URL: postgresql://openshield:openshield@db:5432/openshield
      JWT_SECRET: local-development-only-secret-change-me
      ALLOWED_ORIGINS: http://localhost:5173
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      NVD_API_KEY: ${NVD_API_KEY:-}
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - >-
          import json, urllib.request;
          payload = json.load(urllib.request.urlopen('http://127.0.0.1:8000/ready', timeout=5));
          assert payload.get('status') == 'ready'
      interval: 10s
      timeout: 6s
      retries: 6
      start_period: 30s

  worker:
    profiles: ["local"]
    build: .
    command: ["python", "-m", "scanner.worker"]
    environment:
      OPENSHIELD_ENV: development
      DATABASE_URL: postgresql://openshield:openshield@db:5432/openshield
      AZURE_SUBSCRIPTION_ID: ${AZURE_SUBSCRIPTION_ID:-}
      AZURE_CLIENT_ID: ${AZURE_CLIENT_ID:-}
      AZURE_CLIENT_SECRET: ${AZURE_CLIENT_SECRET:-}
      AZURE_TENANT_ID: ${AZURE_TENANT_ID:-}
      AZURE_DEVOPS_ORG_URL: ${AZURE_DEVOPS_ORG_URL:-}
      AZURE_DEVOPS_PROJECT: ${AZURE_DEVOPS_PROJECT:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      NVD_API_KEY: ${NVD_API_KEY:-}
    depends_on:
      api:
        condition: service_healthy

  frontend:
    profiles: ["local"]
    image: node:22.22.0-alpine
    read_only: true
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp
    working_dir: /app
    volumes:
      - ./frontend:/app
      - frontend_node_modules:/app/node_modules
    command: ["sh", "-c", "npm ci && npm run dev -- --host 0.0.0.0"]
    ports:
      - "127.0.0.1:5173:5173"
    environment:
      VITE_API_URL: http://localhost:8000
      NPM_CONFIG_CACHE: /tmp/.npm
    depends_on:
      api:
        condition: service_healthy

volumes:
  postgres_data:
  frontend_node_modules: