AntiFlock/docker-compose.yml at main · AetherAI3/AntiFlock · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: antiflock

services:
  core:
    build:
      context: .
      dockerfile: deploy/docker/core.Dockerfile
    command: ["antiflock-core", "serve", "--config", "/etc/antiflock/config.yaml"]
    environment:
      ANTIFLOCK_LISTEN: 172.30.0.10:8787
      ANTIFLOCK_DATA_DIR: /var/lib/antiflock
      ANTIFLOCK_DEMO_MODE: "true"
      ANTIFLOCK_DEMO_ALLOW_INSECURE_PRIVATE_HTTP: "true"
      ANTIFLOCK_ALLOW_PUBLIC_BIND: "true"
      ANTIFLOCK_OPERATOR_TOKEN: ${ANTIFLOCK_OPERATOR_TOKEN:?run node scripts/dev-env.mjs first}
      ANTIFLOCK_SDK_TOKEN: ${ANTIFLOCK_SDK_TOKEN:?run node scripts/dev-env.mjs first}
      ANTIFLOCK_AGENT_TOKEN: ${ANTIFLOCK_AGENT_TOKEN:?run node scripts/dev-env.mjs first}
      ANTIFLOCK_SDK_APPLICATION_ID: ${ANTIFLOCK_SDK_APPLICATION_ID:?run node scripts/dev-env.mjs first}
      # The demo SDK acts for the same node that the simulator enrolls.
      ANTIFLOCK_SDK_NODE_ID: ${ANTIFLOCK_AGENT_NODE_ID:?run node scripts/dev-env.mjs first}
      ANTIFLOCK_AGENT_NODE_ID: ${ANTIFLOCK_AGENT_NODE_ID:?run node scripts/dev-env.mjs first}
    expose:
      - "8787"
    volumes:
      # SQLite state is the Core container's only persistent writable path.
      - antiflock-data:/var/lib/antiflock
      - ./configs/demo.yaml:/etc/antiflock/config.yaml:ro
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 128
    tmpfs:
      - /tmp:size=16m,mode=1777,noexec,nosuid,nodev
    networks:
      antiflock-demo:
        ipv4_address: 172.30.0.10
    healthcheck:
      test: ["CMD", "antiflockctl", "health", "--url", "http://172.30.0.10:8787"]
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 5s
    restart: unless-stopped

  simulator:
    build:
      context: .
      dockerfile: deploy/docker/core.Dockerfile
    command: ["antiflock-sim", "stream"]
    environment: &simulator-environment
      ANTIFLOCK_CORE_URL: http://172.30.0.10:8787
      ANTIFLOCK_DEMO_MODE: "true"
      ANTIFLOCK_OPERATOR_TOKEN: ${ANTIFLOCK_OPERATOR_TOKEN:?run node scripts/dev-env.mjs first}
      ANTIFLOCK_AGENT_TOKEN: ${ANTIFLOCK_AGENT_TOKEN:?run node scripts/dev-env.mjs first}
      ANTIFLOCK_SDK_TOKEN: ${ANTIFLOCK_SDK_TOKEN:?run node scripts/dev-env.mjs first}
      ANTIFLOCK_SIM_NODE_ID: ${ANTIFLOCK_AGENT_NODE_ID:?run node scripts/dev-env.mjs first}
      ANTIFLOCK_SIM_APPLICATION_ID: ${ANTIFLOCK_SDK_APPLICATION_ID:?run node scripts/dev-env.mjs first}
      ANTIFLOCK_SIM_STATE_DIR: /var/lib/antiflock/simulator
    volumes:
      # Enrollment keys and stream checkpoints remain writable across restarts.
      - antiflock-simulator-data:/var/lib/antiflock
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 64
    tmpfs:
      - /tmp:size=8m,mode=1777,noexec,nosuid,nodev
    depends_on:
      core:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - antiflock-demo

  web:
    build:
      context: apps/web
      dockerfile: Dockerfile
    environment:
      ANTIFLOCK_API_ORIGIN: http://172.30.0.10:8787
      ANTIFLOCK_OPERATOR_TOKEN: ${ANTIFLOCK_OPERATOR_TOKEN:?run node scripts/dev-env.mjs first}
      ANTIFLOCK_DASHBOARD_TOKEN: ${ANTIFLOCK_DASHBOARD_TOKEN:?run node scripts/dev-env.mjs first}
    ports:
      - "127.0.0.1:4173:4173"
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 128
    tmpfs:
      - /tmp:size=16m,mode=1777,noexec,nosuid,nodev
    depends_on:
      core:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - antiflock-demo
      # Docker does not publish host ports from an internal-only network. Keep
      # Core on the isolated network and give only the authenticated dashboard
      # a host-facing bridge, still bound exclusively to 127.0.0.1 above.
      - dashboard-host

  lab:
    profiles: ["lab"]
    build:
      context: .
      dockerfile: deploy/docker/core.Dockerfile
    command: ["antiflock-sim", "coffee-shop", "--verify"]
    environment: *simulator-environment
    volumes:
      # The one-shot lab reuses the simulator's durable enrollment identity.
      - antiflock-simulator-data:/var/lib/antiflock
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 64
    tmpfs:
      - /tmp:size=8m,mode=1777,noexec,nosuid,nodev
    depends_on:
      core:
        condition: service_healthy
    networks:
      - antiflock-demo

volumes:
  antiflock-data:
  antiflock-simulator-data:

networks:
  antiflock-demo:
    internal: true
    ipam:
      config:
        - subnet: 172.30.0.0/24
  dashboard-host:
    driver: bridge