labs64.io-auditflow/docker-compose.yml at master · Labs64/labs64.io-auditflow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
# AuditFlow — Local stack
#
# RabbitMQ + transformer + sink + backend — in-memory dedup.
# Pipelines and redaction configured via JAVA_OPTS system properties.
#
# Usage:
#   just up          # start stack
#   just down        # stop and remove containers
#   just logs        # tail all logs
#
# See .env.example for configurable variables.

services:

  # ─────────────────────────────────────────────────────────────────────────────
  # Infrastructure
  # ─────────────────────────────────────────────────────────────────────────────
  rabbitmq:
    image: rabbitmq:4-management-alpine
    container_name: auditflow-rabbitmq
    command: /bin/sh -c "rabbitmq-plugins enable rabbitmq_prometheus && docker-entrypoint.sh rabbitmq-server"
    ports:
      - "5673:5672"    # AMQP  (host 5673 → container 5672)
      - "15673:15672"  # Management UI  →  http://localhost:15673  (guest/guest)
    environment:
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_USERNAME:-guest}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD:-guest}
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s
    networks:
      - auditflow-net

  redis:
    image: redis:7-alpine
    container_name: auditflow-redis
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    networks:
      - auditflow-net
    profiles:
      - full

  # ─────────────────────────────────────────────────────────────────────────────
  # Transformer service
  # ─────────────────────────────────────────────────────────────────────────────
  transformer:
    build:
      context: ./auditflow-transformer
      dockerfile: Dockerfile
    image: auditflow-transformer:local
    container_name: auditflow-transformer
    ports:
      - "8081:8081"
    networks:
      - auditflow-net
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8081/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s

  # ─────────────────────────────────────────────────────────────────────────────
  # Sink service
  # ─────────────────────────────────────────────────────────────────────────────
  sink:
    build:
      context: ./auditflow-sink
      dockerfile: Dockerfile
    image: auditflow-sink:local
    container_name: auditflow-sink
    ports:
      - "8082:8082"
    networks:
      - auditflow-net
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8082/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s

  # ─────────────────────────────────────────────────────────────────────────────
  # Backend (Spring Boot)
  # ─────────────────────────────────────────────────────────────────────────────
  backend:
    build:
      context: ./auditflow-be
      dockerfile: Dockerfile
    image: auditflow-be:local
    container_name: auditflow-backend
    ports:
      - "8080:8080"
    environment:
      RABBITMQ_USERNAME: ${RABBITMQ_USERNAME:-guest}
      RABBITMQ_PASSWORD: ${RABBITMQ_PASSWORD:-guest}
      SPRING_RABBITMQ_HOST: rabbitmq
      TRANSFORMER_LOCAL_URL: http://transformer:8081
      SINK_LOCAL_URL: http://sink:8082
      # Local compose runs without the Traefik gateway, so no trusted X-Auth-*
      # headers exist — disable the fail-closed auth-context filter AND Cedar
      # enforcement here only (without also disabling Cedar, the @Authorize
      # interceptor still denies with 401/no-auth-context as defense in depth).
      # In Kubernetes the gateway supplies the headers and both stay enabled.
      LABS64_AUTHCONTEXT_ENABLED: "false"
      LABS64_CEDAR_ENABLED: "false"
      # Pipelines live in ./tenants/_platform.yaml (mounted below) — the tenant model replaced
      # the -Dauditflow.pipelines[N].* JAVA_OPTS, which now fail startup by design.
      JAVA_OPTS: >-
        -Dauditflow.idempotency.store=memory
        -Dspring.autoconfigure.exclude=org.springframework.boot.data.redis.autoconfigure.DataRedisAutoConfiguration,org.springframework.boot.data.redis.autoconfigure.DataRedisReactiveAutoConfiguration,org.springframework.boot.data.redis.autoconfigure.health.DataRedisHealthContributorAutoConfiguration,org.springframework.boot.data.redis.autoconfigure.health.DataRedisReactiveHealthContributorAutoConfiguration
        -Dauditflow.redaction.enabled=true
        -Dauditflow.redaction.rules[0].field=extra.userId
        -Dauditflow.redaction.rules[0].action=mask
        -Dauditflow.redaction.rules[1].field=extra.sessionId
        -Dauditflow.redaction.rules[1].action=drop
    volumes:
      - ./tenants:/config/tenants:ro
    depends_on:
      rabbitmq:
        condition: service_healthy
      transformer:
        condition: service_healthy
      sink:
        condition: service_healthy
    networks:
      - auditflow-net
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/actuator/health"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 60s

networks:
  auditflow-net:
    driver: bridge