mirror of
https://github.com/turnstonelabs/turnstone.git
synced 2026-08-12 23:12:23 -06:00
Patrick Buckley
631f1b0021
`docker compose up` from a clone builds one image and brings up the whole stack — PostgreSQL, console, Caddy, channel, and 10 server nodes — sharing one Postgres so the console discovers every node. The dashboard is reachable only through Caddy (HTTP/2 avoids the browser's 6-connection cap on the dashboard's SSE streams); the console's plain-HTTP port is no longer published. Postgres binds 127.0.0.1 so a bare-metal turnstone-server can join the cluster — the bare-metal overlay is folded in and removed. Insecure dev defaults keep it zero-config; the bundled production stack mirrors the shape but pulls ghcr images and requires real secrets. Move the Caddyfile under turnstone/deploy so it ships in the wheel; update docs, QUICKSTART, and .env.example to match.
87 lines
2.5 KiB
YAML
87 lines
2.5 KiB
YAML
# TLS overlay — enables mTLS across the turnstone deployment.
|
|
#
|
|
# Layers on the production stack (it patches the `server`, `console`, and
|
|
# `channel` services that file defines):
|
|
# docker compose -f turnstone/deploy/compose.yaml -f deploy/docker-compose.tls.yml up
|
|
#
|
|
# The tls-init service bootstraps a CA and issues certs.
|
|
# All turnstone services auto-provision their own certs via the
|
|
# console's ACME endpoint.
|
|
|
|
services:
|
|
# Bootstrap: create CA before anything starts.
|
|
# Runs as root to create directories in the volume, then chowns
|
|
# to turnstone:turnstone with restrictive perms (keys 0600).
|
|
tls-init:
|
|
image: ghcr.io/turnstonelabs/turnstone:${TURNSTONE_IMAGE_TAG:-latest}
|
|
user: root
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
turnstone-admin tls-bootstrap --out /certs
|
|
chown -R turnstone:turnstone /certs
|
|
find /certs -type d -exec chmod 750 {} +
|
|
find /certs -type f -name '*key.pem' -exec chmod 600 {} +
|
|
find /certs -type f ! -name '*key.pem' -exec chmod 640 {} +
|
|
volumes:
|
|
- tls-certs:/certs
|
|
networks:
|
|
- turnstone-net
|
|
restart: "no"
|
|
|
|
# Console: runs the internal CA + ACME server
|
|
console:
|
|
depends_on:
|
|
tls-init:
|
|
condition: service_completed_successfully
|
|
volumes:
|
|
- tls-certs:/certs:ro
|
|
environment:
|
|
TURNSTONE_TLS_ENABLED: "true"
|
|
TURNSTONE_TLS_SANS: "console"
|
|
TURNSTONE_CONSOLE_URL: "http://console:8090"
|
|
command:
|
|
- turnstone-console
|
|
- --host=0.0.0.0
|
|
- --port=8090
|
|
- --poll-interval=${CONSOLE_POLL_INTERVAL:-10}
|
|
|
|
# Server: auto-provisions certs via console ACME, serves HTTPS
|
|
server:
|
|
depends_on:
|
|
console:
|
|
condition: service_healthy
|
|
volumes:
|
|
- tls-certs:/certs:ro
|
|
environment:
|
|
TURNSTONE_TLS_ENABLED: "true"
|
|
TURNSTONE_TLS_SANS: "server"
|
|
# Disable healthcheck — server serves HTTPS with mTLS which the
|
|
# stdlib healthcheck script can't satisfy. The base compose
|
|
# healthcheck uses plain HTTP which won't work on an HTTPS listener.
|
|
healthcheck:
|
|
disable: true
|
|
|
|
# Channel: TLS
|
|
channel:
|
|
depends_on:
|
|
console:
|
|
condition: service_healthy
|
|
volumes:
|
|
- tls-certs:/certs:ro
|
|
environment:
|
|
TURNSTONE_TLS_ENABLED: "true"
|
|
TURNSTONE_TLS_SANS: "channel"
|
|
command:
|
|
- sh
|
|
- -c
|
|
- >-
|
|
turnstone-channel
|
|
--http-host=0.0.0.0
|
|
$${TURNSTONE_DISCORD_GUILD:+--discord-guild $$TURNSTONE_DISCORD_GUILD}
|
|
|
|
volumes:
|
|
tls-certs:
|