apme/compose.yaml at main · ansible/apme · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
# Six-container gRPC architecture: Primary, Native, OPA, Ansible, Gitleaks, Galaxy Proxy.
# All validators implement the unified Validator gRPC service (validate.proto).
# CLI is run on-the-fly with CWD mounted (see containers/podman/run-cli.sh for Podman).
# Docker: docker compose build && docker compose up -d
# Scan:    docker compose run --rm -v "$(pwd)":/workspace -w /workspace cli apme check .

services:
  primary:
    build:
      context: .
      dockerfile: containers/primary/Dockerfile
    ports:
      - "50051:50051"
    volumes:
      - sessions:/sessions
    environment:
      NATIVE_GRPC_ADDRESS: native:50055
      OPA_GRPC_ADDRESS: opa:50054
      ANSIBLE_GRPC_ADDRESS: ansible:50053
      GITLEAKS_GRPC_ADDRESS: gitleaks:50056
    depends_on:
      - native
      - opa
      - ansible
      - gitleaks

  native:
    build:
      context: .
      dockerfile: containers/native/Dockerfile
    ports:
      - "50055:50055"

  opa:
    build:
      context: .
      dockerfile: containers/opa/Dockerfile
    ports:
      - "50054:50054"

  ansible:
    build:
      context: .
      dockerfile: containers/ansible/Dockerfile
    volumes:
      - sessions:/sessions:ro
    ports:
      - "50053:50053"

  gitleaks:
    build:
      context: .
      dockerfile: containers/gitleaks/Dockerfile
    ports:
      - "50056:50056"

  # CLI: run on-the-fly only (never 'up'). Example: docker compose run --rm -v "$(pwd)":/workspace -w /workspace cli
  cli:
    build:
      context: .
      dockerfile: containers/cli/Dockerfile
    environment:
      APME_PRIMARY_ADDRESS: primary:50051
    volumes:
      - workspace:/workspace
    entrypoint: ["apme", "check"]
    command: ["."]
    profiles:
      - cli

volumes:
  sessions:
  workspace: