compose.yaml

services:
  #### init ####
  
  system_init:
    build:
      context: .
      dockerfile: Dockerfile
    entrypoint: /init.sh
    environment:
      - URL_PATTERN=${URL_PATTERN:-http://localhost:%s}
    volumes:
      - ./scripts/system.sh:/init.sh:ro
      - ./config/fulcio:/root/fulcio:ro
      - ./config/dex:/root/dex:ro
      - ./data/fulcio:/etc/fulcio/:rw
      - ./data/dex:/etc/dex/:rw
      - ./data/ctfe:/etc/ctfe/:rw
      - ./data/rekor:/etc/rekor/:rw

  ctfe_init:
    build:
      context: .
      dockerfile: Dockerfile
    entrypoint: /init.sh
    environment:
      - TRILLIAN_LOG_SERVER_HTTP=trillian-log-server:8091
      - TRILLIAN_LOG_SERVER_RPC=trillian-log-server:8090
    depends_on:
      - trillian-log-server
      - system_init
    volumes:
      - ./scripts/ctfe.sh:/init.sh:ro
      - ./config/ctfe:/root/ctfe:ro
      - ./data/ctfe:/etc/config/:rw

  rekor_init:
    build:
      context: .
      dockerfile: Dockerfile
    entrypoint: /init.sh
    environment:
      - TRILLIAN_LOG_SERVER_HTTP=trillian-log-server:8091
      - TRILLIAN_LOG_SERVER_RPC=trillian-log-server:8090
    depends_on:
      - trillian-log-server
      - system_init
    volumes:
      - ./scripts/rekor.sh:/init.sh:ro
      - ./data/rekor:/etc/config/:rw
    
  tuf_init:
    build:
      context: .
      dockerfile: Dockerfile
    entrypoint: /init.sh
    environment:
      - URL_PATTERN=${URL_PATTERN:-http://localhost:%s}
      - TUF_ROOT_PASSPHRASE=root
      - TUF_TARGETS_PASSPHRASE=targets
      - TUF_SNAPSHOT_PASSPHRASE=snapshot
      - TUF_TIMESTAMP_PASSPHRASE=timestamp
    depends_on:
      - system_init
      - rekor
    volumes:
      - ./scripts/tuf.sh:/init.sh:ro
      - ./data/fulcio:/etc/fulcio/:ro
      - ./data/dex:/etc/dex/:ro
      - ./data/ctfe:/etc/ctfe/:ro
      - ./data/rekor:/etc/rekor/:ro
      - ./data/tuf:/etc/tuf/:rw

  #### fulcio ####
  fulcio:
    image: gcr.io/projectsigstore/fulcio:v1.4.0
    command:
      - serve
      - --port=5555
      - --grpc-port=5554
      - --ca=fileca
      - --fileca-key
      - /etc/fulcio-config/ca.key
      - --fileca-cert
      - /etc/fulcio-config/ca.crt
      - --fileca-key-passwd
      - $(cat /etc/fulcio-config/password.txt)
      - --ct-log-url=http://ct_server:6962/trillian
    volumes:
      - ./data/fulcio/:/etc/fulcio-config/:ro
    restart: always
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5555/healthz"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 5s
    ports:
      - "5555:5555"
    depends_on:
      - dex
      - ct_server
      - system_init

  #### rekor ####
  redis:
    image: redis:6.2-alpine
    restart: always
    expose:
      - '6379:6379'
    command: redis-server
    volumes:
        - redis:/data

  rekor:
    image: gcr.io/projectsigstore/rekor-server:v1.3.0
    entrypoint: sh
    command:
      - -c 
      - | 
        rekor-server \
        serve \
        --rekor_server.address=0.0.0.0 \
        --rekor_server.signer=/var/run/rekor-secrets/cert.pem \
        --rekor_server.signer-passwd=$(cat /var/run/rekor-secrets/password.txt) \
        --trillian_log_server.tlog_id=$(cat /var/run/rekor-secrets/logid)  \
        --trillian_log_server.address=trillian-log-server \
        --trillian_log_server.port=8090 \
        --redis_server.address=redis \
        --redis_server.port=6379 \
        --enable_attestation_storage=true \
        --attestation_storage_bucket=file:///var/run/attestations
    depends_on:
      - trillian-log-server
      - redis
      - system_init
      - rekor_init
    volumes:
      - attestations:/var/run/attestations:rw"
      - ./data/rekor:/var/run/rekor-secrets/:ro
    restart: always
    ports:
      - "3000:3000"

  #### trillian ####
  mysql:
    image: gcr.io/trillian-opensource-ci/db_server:v1.5.2
    environment:
      - MYSQL_ROOT_PASSWORD=zaphod
      - MYSQL_DATABASE=trillian
      - MYSQL_USER=user
      - MYSQL_PASSWORD=zaphod
    restart: always # keep the MySQL server running
    volumes:
      - mysql:/var/lib/mysql

  trillian-log-server:
    image: gcr.io/projectsigstore/trillian_log_server:v1.3.0
    command: [
      "--storage_system=mysql",
      "--mysql_uri=user:zaphod@tcp(mysql:3306)/trillian",
      "--rpc_endpoint=0.0.0.0:8090",
      "--http_endpoint=0.0.0.0:8091",
      "--alsologtostderr",
    ]
    restart: always # retry while mysql is starting up
    expose:
      - "8090:8090" # grpc
      - "8091:8091" # http
    depends_on:
      - mysql

  trillian-log-signer:
    image: gcr.io/projectsigstore/trillian_log_signer:v1.3.0
    command: [
      "--storage_system=mysql",
      "--mysql_uri=user:zaphod@tcp(mysql:3306)/trillian",
      "--rpc_endpoint=0.0.0.0:8090",
      "--http_endpoint=0.0.0.0:8091",
      "--force_master",
      "--alsologtostderr",
    ]
    restart: always # retry while mysql is starting up
    expose:
      - "8090:8090" # grpc
      - "8091:8091" # http
    depends_on:
      - mysql

  #### ctlog ####
  ct_server:
    image: gcr.io/trillian-opensource-ci/ctfe
    volumes:
      - ./data/ctfe:/etc/config/:ro
    command: [
        "--log_config" ,"/etc/config/ct_server.cfg",
        "--log_rpc_server", "trillian-log-server:8090",
        "--http_endpoint", "0.0.0.0:6962",
        "--alsologtostderr",
    ]
    restart: always # retry while ctfe_init is running
    depends_on:
      - trillian-log-server
      - trillian-log-signer
      - ctfe_init
    ports:
      - "6962:6962"

  #### dex ####

  dex:
    image: ghcr.io/dexidp/dex:v2.37.0
    restart: always
    command: 
      - dex
      - serve
      - --web-http-addr
      - 0.0.0.0:5556
      - --telemetry-addr
      - 0.0.0.0:5558
      - /var/run/dex/config.yaml
    ports:
      - "5556:5556"
    volumes:
      - ./data/dex:/var/run/dex/:ro
    depends_on:
      - system_init

  #### tuf ####

  tuf:
    image: httpd:latest
    ports:
    - '8080:80'
    volumes:
    - ./data/tuf/repository:/usr/local/apache2/htdocs
    depends_on:
      - tuf_init
  #### tsa ####

volumes:
  mysql:
  attestations:
  redis: