docker-compose.yaml

#file: noinspection ComposeUnknownKeys,ComposeUnknownValues
---
name: ecs-shuttle

volumes:
  data:
    name: ecs-shuttle
    external: false
    labels:
      used-by: ecs-shuttle
      dev.shuttle.description: >-
        semi-ephemeral volume for the local `ecs-shuttle` instance's persistent data
  step-ca:
    name: step-ca-data
    external: false
    driver: local
    driver_opts:
      o: bind,rw
      type: none
      device: ${PWD}/.local/step-ca
    labels:
      used-by: ecs-shuttle
      dev.shuttle.description: >-
        persistent volume for the local `ecs-shuttle` instance's
        `step-ca` ACME server certificates and configuration data
  localstack-data:
    name: localstack-data
    labels:
      used-by: localstack,control
      dev.shuttle.description: >-
        Localstack shared volume to persist resource ids to services

networks:
  shuttle:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 10.30.50.0/24
    labels:
      description: >-
        The default network used locally by the various platform "components"
  ecs:
    driver: bridge
    ipam:
      config:
        - subnet: 169.254.170.0/24
          gateway: 169.254.170.1
    labels:
      description: >-
        A special network that allows the local metadata service to bind
        to the same "well-known" IP address that ECS uses in production

services:
  init:
    image: docker.io/library/alpine:latest
    entrypoint: sh
    container_name: ecs-shuttle-init
    working_dir: /target
    command:
      - -c
      - --
      - >-
        mkdir -p
        proxy
        control
        step-ca/data
        localstack/terraform
        && chown -R 1000:1000 .
    volumes:
      - type: volume
        source: data
        target: /target
        read_only: false
      - type: volume
        source: step-ca
        target: /target/step-ca
        read_only: false
    networks:
      - shuttle

  step-ca:
    build:
      context: .
      dockerfile_inline: |
        FROM docker.io/smallstep/step-ca:latest AS step-ca
        USER root
        RUN apk add --update --no-cache sudo bind-tools ca-certificates \
            && echo 'step ALL=(root) NOPASSWD: /usr/local/bin/step certificate install --all *' \
            > /etc/sudoers.d/99-step-install
        USER step

    hostname: step-ca
    container_name: step-ca
    labels:
      dev.orbstack.http-port: 14000
    entrypoint: /shuttle-acme-ca.sh
    env_file:
      - path: ../.env
        required: false
      - path: ./.env
        required: false
    environment:
      STEPDEBUG: ${STEP_CA_DEBUG:-0}
      DOCKER_STEPCA_INIT_ACME: "true"
      DOCKER_STEPCA_INIT_NAME: shuttle-local-ca
      DOCKER_STEPCA_INIT_ADDRESS: :14000
      DOCKER_STEPCA_INIT_ADMIN_SUBJECT: shuttle-local-admin
      DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT: "true"
      DOCKER_STEPCA_INIT_PROVISIONER_NAME: shuttle-local-provisioner
      DOCKER_STEPCA_INIT_DNS_NAMES: >-
        ca.local.shuttle.dev,localhost,127.0.0.1,10.30.50.5
    dns:
      - 10.30.50.2
    # yamllint disable rule:quoted-strings
    ports:
      - "14000:14000" # HTTPS Management + ACME API
    # yamllint enable rule:quoted-strings
    volumes:
      - type: volume
        source: step-ca
        target: /home/step
        read_only: false
        volume:
          nocopy: true
          subpath: data/
      - type: bind
        source: ./.local/step-ca/shuttle-acme-ca.sh
        target: /shuttle-acme-ca.sh
        read_only: true
    networks:
      shuttle:
        ipv4_address: 10.30.50.5
    extra_hosts:
      - ca.local.shuttle.dev:10.30.50.5
    depends_on:
      init:
        condition: service_completed_successfully
    healthcheck:
      test: >-
        test "$(step ca health)" = 'ok'
      timeout: 2s
      start_interval: 5s
      interval: 60s
      start_period: 10s

  localstack:
    build:
      context: .
      dockerfile_inline: |
        FROM docker.io/localstack/localstack-pro:${LOCALSTACK_IMAGE_TAG:-4} AS localstack

    image: docker.io/localstack/localstack-pro:${LOCALSTACK_IMAGE_TAG:-4}
    hostname: localstack
    stop_grace_period: 2m30s
    container_name: &LS_CONTAINER_NAME ${LOCALSTACK_DOCKER_NAME:-localstack-main}
    labels:
      dev.orbstack.http-port: 4566
    env_file:
      - path: ./.env
        required: false
    environment:
      DEBUG: ${LOCALSTACK_DEBUG:-0}
      DNS_ADDRESS: ${LOCALSTACK_DNS_ADDRESS:-0.0.0.0}
      DNS_SERVER: ${LOCALSTACK_DNS_SERVER:-1.1.1.1}
      DNS_RESOLVE_IP: ${LOCALSTACK_DNS_RESOLVE_IP:-10.30.50.2}
      ENFORCE_IAM: ${LOCALSTACK_ACTIVATE_PRO:-1}
      PERSISTENCE: ${LOCALSTACK_ACTIVATE_PRO:-1}
      ACTIVATE_PRO: ${LOCALSTACK_ACTIVATE_PRO:-1}
      IAM_SOFT_MODE: ${LOCALSTACK_ACTIVATE_PRO:-1}
      SHUTDOWN_TIMEOUT: ${LOCALSTACK_SHUTDOWN_TIMEOUT:-300}
      TERRAFORM_VERSION: ${LOCALSTACK_TERRAFORM_VERSION:-1.9.5}
      ECS_TASK_EXECUTOR: ${LOCALSTACK_ECS_TASK_EXECUTOR:-docker}
      AWS_DEFAULT_REGION: ${AWS_DEFAULT_REGION:-eu-west-2}
      MAIN_CONTAINER_NAME: *LS_CONTAINER_NAME
      ENABLE_CONFIG_UPDATES: 1
      LOCALSTACK_AUTH_TOKEN: ${LOCALSTACK_AUTH_TOKEN}
      SNAPSHOT_LOAD_STRATEGY: MANUAL
      SNAPSHOT_SAVE_STRATEGY: ON_SHUTDOWN
      PROVIDER_OVERRIDE_EVENTS: v2
      EXTRA_CORS_ALLOWED_ORIGINS: |-
        app://.,https://aws-replicator.localhost:4566,https://aws-replicator.localhost.localstack.cloud:4566
      EXTENSION_AUTO_INSTALL: |-
        localstack-extension-stripe,localstack-extension-aws-replicator,localstack-extension-terraform-init,localstack-extension-ecs-container-endpoints
      ECS_LOCAL_CONTAINER_ENDPOINTS_TASK_ARN: >-
        arn:aws:ecs:eu-west-2:000000000000:task/local-user-cluster-fargate-1/01234567-89ab-cdef-0123-456789abcdef
      ECS_LOCAL_CONTAINER_ENDPOINTS_CLUSTER_ARN: local-user-cluster-fargate-1
      ECS_LOCAL_CONTAINER_ENDPOINTS_TASK_DEFINITION_FAMILY: proj_012345678901234567890123456
      ECS_LOCAL_CONTAINER_ENDPOINTS_TASK_DEFINITION_REVISION: 1
      ECS_LOCAL_CONTAINER_ENDPOINTS_SHARED_TOKEN_EXPIRATION: 28800s
    # yamllint disable rule:quoted-strings
    ports:
      - "127.0.0.1:53:53"
      - "127.0.0.1:53:53/udp"
      - "127.0.0.1:4566:4566"
      - "127.0.0.1:4510-4559:4510-4559"
    # yamllint enable rule:quoted-strings
    volumes:
      - type: volume
        source: data
        target: /var/lib/localstack
        read_only: false
        volume:
          nocopy: true
          subpath: localstack
      - type: volume
        source: data
        target: /etc/localstack/init/ready.d/
        read_only: false
        volume:
          nocopy: false
          subpath: localstack/terraform
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock
        read_only: false
      - type: bind
        source: ./.local/localstack/healthcheck.py
        target: /etc/localstack/bin/healthcheck.py
        read_only: true
      - type: bind
        source: ./.local/localstack/init.tf
        target: /etc/localstack/init/ready.d/main.tf
        read_only: true
      - type: bind
        source: ./.local/localstack/init.sh
        target: /etc/localstack/init/ready.d/01-init.sh
        read_only: true
      - type: bind
        source: ./.local/localstack/hosted-config.json
        target: /tmp/hosted-config.json
        read_only: true
      - type: bind
        source: ./.local/localstack/secret-config.json
        target: /tmp/secret-config.json
        read_only: true
      - localstack-data:/var/lib/appconfig
      - type: volume
        source: step-ca
        target: /usr/local/share/ca-certificates/stepca-root_ca.crt
        read_only: true
        volume:
          nocopy: true
          subpath: data/certs/root_ca.crt
    networks:
      ecs:
        # The "well-known" IP address is recognized by the AWS SDKs and AWS CLI
        ipv4_address: 169.254.170.2
      shuttle:
        ipv4_address: 10.30.50.2
    healthcheck:
      test: >-
        python3 /etc/localstack/bin/healthcheck.py
      timeout: 4s
      interval: 60s
      start_period: 45s
    depends_on:
      step-ca:
        condition: service_healthy
    develop:
      watch:
        - path: ./.local/localstack
          target: /etc/localstack/init/ready.d
          action: sync+restart

  otel-tui:
    build:
      context: .
      # Normally, we would just point directly to the upstream `otel-tui` image in DockerHub, but
      # the official otel-tui image(s) are distroless and don't contain anything we need for health
      # checks to work, and we need the health checks to control the order in which the containers
      # start up
      dockerfile_inline: |
        FROM docker.io/ymtdzzz/otel-tui:latest AS otel-tui
        FROM docker.io/library/alpine:latest
        COPY --from=otel-tui /otel-tui /usr/bin/otel-tui
        USER 0
        ENTRYPOINT ["/usr/bin/otel-tui"]
    tty: true
    stdin_open: true
    container_name: otel-tui
    labels:
      dev.orbstack.http-port: 44318
    # yamllint disable rule:quoted-strings
    ports:
      - "44317:4317"
      - "44318:4318"
    hostname: otel-tui
    # yamllint enable rule:quoted-strings
    networks:
      shuttle:
        ipv4_address: 10.30.50.4
    healthcheck:
      test: >-
        nc -z -w1 127.0.0.1 4318
      timeout: 2s
      interval: 5s
      start_period: 30s

  control:
    build:
      context: .
      dockerfile: Dockerfile
      target: shuttle-control
      args:
        - BUILD_ENV=${CONTROL_SHUTTLE_ENV:-local}
    hostname: control
    container_name: control
    stop_grace_period: 1m
    labels:
      dev.orbstack.http-port: 8001
    post_start:
      - privileged: false
        working_dir: /run/init
        environment:
          PGPASSWORD: &POSTGRES_PASSWORD shuttle
        command:
          - /run/init/init.sh
    env_file:
      - path: .env
        required: false
      - path: control/.env
        required: false
    environment:
      # Rust Settings
      RUST_BACKTRACE: ${CONTROL_RUST_BACKTRACE:-1}
      RUST_LOG: ${CONTROL_RUST_LOG:-info,tower_http=debug,axum::rejection=trace,shuttle=trace,auth0=trace}

      # AWS-Related Settings
      AWS_DEFAULT_REGION: ${CONTROL_AWS_DEFAULT_REGION:-eu-west-2}
      AWS_ACCESS_KEY_ID: localstack
      AWS_SECRET_ACCESS_KEY: localstack
      AWS_ENDPOINT_URL: http://localstack:4566

      # Postgres Settings - needed due to init.sh in local bootstrap,
      # for Control itself this is sourced from AppConfig
      POSTGRES_DB: control-rds
      POSTGRES_HOST: localhost.localstack.cloud
      POSTGRES_PORT: 4515
      POSTGRES_USER: shuttle
      POSTGRES_PASSWORD: *POSTGRES_PASSWORD

    dns:
      - 10.30.50.2
      - 1.1.1.1
    # yamllint disable rule:quoted-strings
    ports:
      - "7999:80"  # ACME HTTP port
      - "8001:8000"  # `shuttle-control` API port
      - "9091:9090"  # Prometheus Metrics port
    # yamllint enable rule:quoted-strings
    volumes:
      - type: bind
        source: .local/control
        target: /run/init
        read_only: true
      - type: volume
        source: step-ca
        target: /etc/ssl/certs/ca-certificates.crt
        read_only: true
        volume:
          nocopy: true
          subpath: data/certs/ca-bundle.crt
      - localstack-data:/var/lib/appconfig
    networks:
      shuttle:
        ipv4_address: 10.30.50.7
    extra_hosts:
      - ca.local.shuttle.dev:10.30.50.5
      - localhost.localstack.cloud:10.30.50.2
      - auth.local.internal.shuttle.dev:10.30.50.2
      - sharedpg-rds.local.shuttle.dev:10.30.50.2
      - control.local.internal.shuttle.dev:10.30.50.2
      - stripe.localhost.localstack.cloud:10.30.50.2
    depends_on:
      otel-tui:
        condition: service_healthy
      localstack:
        condition: service_healthy
    healthcheck:
      test: curl -f http://localhost:8000/.healthz || exit 1
      interval: 5s
      timeout: 30s
      retries: 3
      start_period: 30s
    develop:
      watch:
        - path: control/src
          action: rebuild
        - path: Cargo.lock
          action: rebuild
        - path: Dockerfile
          action: rebuild

  proxy:
    build:
      context: .
      dockerfile: Dockerfile
      target: shuttle-proxy
      args:
        - BUILD_ENV=${PROXY_SHUTTLE_ENV:-local}
    hostname: proxy
    container_name: proxy
    stop_grace_period: 30s
    labels:
      dev.orbstack.http-port: 8002
      dev.orbstack.https-port: 8002
    command:
      - --proxy-port
      - "8000"
      - --wildcard-fqdn
      - local.shuttle.app
      - --wildcard-cert-full-chain
      - /mnt/certs/shuttle-proxy-wildcard.crt
      - --wildcard-cert-private-key
      - /mnt/certs/shuttle-proxy-wildcard.key
    env_file:
      - path: .env
        required: false
      - path: proxy/.env
        required: false
    environment:
      SHUTTLE_ENV: ${PROXY_SHUTTLE_ENV:-local}
      RUST_BACKTRACE: ${PROXY_RUST_BACKTRACE:-1}
      RUST_LOG: ${PROXY_RUST_LOG:-info,shuttle_proxy=trace}
      OTLP_ADDRESS: http://otel-tui:4318
      AWS_DEFAULT_REGION: ${PROXY_AWS_DEFAULT_REGION:-eu-west-2}
      AWS_ACCESS_KEY_ID: localstack
      AWS_SECRET_ACCESS_KEY: localstack
      AWS_ENDPOINT_URL: http://localstack:4566
      # postgres
      POSTGRES_DB: control-rds
      POSTGRES_HOST: localhost.localstack.cloud
      POSTGRES_PORT: 4515
      POSTGRES_USER: shuttle  # TODO: add read-only user for proxy to localstack init
      POSTGRES_PASSWORD: shuttle
    # yamllint disable rule:quoted-strings
    ports:
      - "443:8000"
      - "5002:5002"
      - "8002:8000"
      - "9092:9090"
    # yamllint enable rule:quoted-strings
    volumes:
      - type: bind
        source: proxy/conf.yaml
        target: /app/conf.yaml
        read_only: true
      - type: volume
        source: step-ca
        target: /mnt/certs/shuttle-proxy-wildcard.crt
        read_only: true
        volume:
          nocopy: true
          subpath: data/certs/wildcard.local.shuttle.app.crt
      - type: volume
        source: step-ca
        target: /mnt/certs/shuttle-proxy-wildcard.key
        read_only: true
        volume:
          nocopy: true
          subpath: data/secrets/wildcard_local_shuttle_app_key
      - type: volume
        source: step-ca
        target: /etc/ssl/certs/ca-certificates.crt
        read_only: true
        volume:
          nocopy: true
          subpath: data/certs/ca-bundle.crt
    dns:
      - 10.30.50.2
      - 1.1.1.1
    networks:
      shuttle:
        ipv4_address: 10.30.50.8
    extra_hosts:
      # Step CA
      - ca.local.shuttle.dev:10.30.50.5
      # Localstack
      - data.localstack:10.30.50.2
      - data-localstack:10.30.50.2
      - localhost.localstack.cloud:10.30.50.2
      - data.localhost.localstack.cloud:10.30.50.2
      - data-localhost.localstack.cloud:10.30.50.2
    depends_on:
      otel-tui:
        condition: service_healthy
      localstack:
        condition: service_healthy
    develop:
      watch:
        - path: proxy/src
          action: rebuild
        - path: Cargo.lock
          action: rebuild
        - path: Dockerfile
          action: rebuild

  test-openapi:
    profiles:
      - tests
    image: schemathesis/schemathesis:v4.0.0-alpha.10
    entrypoint:
      - schemathesis
      - run
      - --checks=status_code_conformance,response_schema_conformance
      - --url=http://control:8000
      - --phases=stateful
      - --max-examples=15
      - --exclude-tag=skip-contract-tests
      - --generation-allow-x00=false
      - --generation-codec=ascii
      - -H
      - "Authorization: Bearer SHU77L3ADMIN0000"
      - http://control:8000/openapi.json
    networks:
      shuttle:
        ipv4_address: 10.30.50.90
    depends_on:
      control:
        condition: service_healthy