docker-compose.yml

version: '2.3'

services:
  dox-certs:
    image: nginx
    environment:
      - DESEC_NS_NAME
    volumes:
      - dox-certs:/etc/certs
      - ./dox-certs/entrypoint.sh:/usr/local/bin/entrypoint.sh
    command: entrypoint.sh
    restart: 'no'

  ns:
    build: ns
    image: ${DOCKER_REGISTRY}desec/desec-ns:latest
    init: true
    depends_on:
    - dox-certs
    cap_add:
    - NET_ADMIN
    ports:
    - "${DESEC_NS_PUBLIC_PORT:-53}:53"
    - "${DESEC_NS_PUBLIC_PORT:-53}:53/udp"
    - "0.0.0.0:${DESEC_NS_PUBLIC_PORT_DOT:-853}:853/udp"
    environment:
    - DESEC_NS_CARBONSERVER
    - DESEC_NS_CARBONOURNAME
    - DESEC_NS_APIKEY
    - DESEC_NS_NAME
    - DESEC_NS_SIGNALING_DOMAIN_ZONE_PRIVATE_KEY_B64
    - DESEC_NS_SIGNALING_DOMAIN_SOA_MNAME
    - DESEC_NS_SIGNALING_DOMAIN_SOA_RNAME
    - DESEC_NS_COOKIES_SECRET
    networks:
      nsfront:
        ipv4_address: 10.16.0.3
        ipv6_address: ${DESEC_NS_IPV6_ADDRESS}
      nsmiddle:
        ipv4_address: 10.16.2.2
      nsrearreplication:
        ipv4_address: 10.16.3.3
    sysctls:
      net.ipv4.icmp_echo_ignore_broadcasts: 0
    volumes:
    - ns:/storage
    - knotsocket:/rundir
    - dox-certs:/etc/knot/certs/
    logging:
      driver: "syslog"
      options:
        tag: "desec-ns/ns"
    restart: unless-stopped

  knot-exporter:
    build: knot-exporter
    image: ${DOCKER_REGISTRY}desec/desec-knot-exporter:latest
    init: true
    volumes:
    - knotsocket:/run/knot/
    logging:
      driver: "syslog"
      options:
        tag: "desec-ns/knot-exporter"
    restart: unless-stopped

  openvpn-client:
    build: openvpn-client
    image: desec/openvpn-client:latest
    init: true
    cap_add:
    - NET_ADMIN
    environment:
    - DESECSTACK_VPN_SERVER
    volumes:
    - ./openvpn-client/secrets:/etc/openvpn/secrets:ro
    - openvpn-client_logs:/var/log/openvpn
    networks:
      nsrearreplication:
        ipv4_address: 10.16.3.2
    logging:
      driver: "syslog"
      options:
        tag: "desec-ns/openvpn-client"
    restart: unless-stopped

  openvpn-client_monitor:
    image: kumina/openvpn-exporter:v0.2.2
    init: true
    depends_on:
    - openvpn-client
    volumes:
    - openvpn-client_logs:/var/log/openvpn:ro
    networks:
    - nsrearmonitoring_openvpn-client
    command: -openvpn.status_paths /var/log/openvpn/openvpn-status.log
    logging:
      driver: "syslog"
      options:
        tag: "desec-ns/openvpn-client_monitor"
    restart: unless-stopped

  replicator:
    build: replicator
    image: desec/replicator:latest
    init: true
    cap_add:
    - NET_ADMIN
    depends_on:
    - openvpn-client
    - ns
    environment:
    - DESEC_NS_APIKEY
    - DESECSTACK_VPN_SERVER
    volumes:
    - knotsocket:/rundir
    networks:
      nsrearreplication:
        ipv4_address: 10.16.3.4
    logging:
      driver: "syslog"
      options:
        tag: "desec-ns/replicator"
    restart: unless-stopped

  prometheus:
    image: prom/prometheus:latest
    init: true
    ports:
    - "127.0.0.1:9090:9090"
    volumes:
    - ./prometheus/conf:/etc/prometheus:ro
    - prometheus:/prometheus
    networks:
      nsrearmonitoring_openvpn-client:
    logging:
      driver: "syslog"
      options:
        tag: "desec-ns/prometheus"
    restart: unless-stopped


volumes:
  ns:
  prometheus:
  openvpn-client_logs:
  dox-certs:
  knotsocket:

networks:
  # Note that it is required that the front network ranks lower (in lexical order by
  # name) than the other networks. See https://github.com/docker/docker/issues/27101
  nsfront:
    enable_ipv6: true
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: 10.16.0.0/24
        gateway: 10.16.0.1
      - subnet: ${DESEC_NS_IPV6_SUBNET}
  nsmiddle:
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: 10.16.2.0/24
        gateway: 10.16.2.1
  nsrearreplication:
    driver: bridge
    ipam:
      driver: default
      config:
      - subnet: 10.16.3.0/24
        gateway: 10.16.3.1
  nsrearmonitoring_openvpn-client:
      driver: bridge
      ipam:
        driver: default
        config:
        - subnet: 10.16.4.0/29
          gateway: 10.16.4.1