docker-compose.yml

version: '3.3'

# Setup network
networks:
  default:
    name: fedn_default

services:
  # Base services
  minio:
    image: minio/minio:latest
    # hostname: minio
    environment:
      # - GET_HOSTS_FROM=dns
      - MINIO_HOST=localhost
      - MINIO_PORT=9000
      - MINIO_ROOT_USER=fedn_admin
      - MINIO_ROOT_PASSWORD=password
    command: server /data --console-address localhost:9001
    healthcheck:
      test:
        [
          "CMD",
          "curl",
          "-f",
          "http://localhost:9000/minio/health/live"
        ]
      interval: 30s
      timeout: 20s
      retries: 3
    # ports:
    #   - 9000:9000
    #   - 9001:9001
    network_mode: "host" # TODO: configure network in enclave to avoid this

  mongo:
    image: mongo:5.0.2
    restart: always
    environment:
      - MONGO_INITDB_ROOT_USERNAME=fedn_admin
      - MONGO_INITDB_ROOT_PASSWORD=password
    # ports:
    #   - 6534:6534
    command: mongod --port 6534
    network_mode: "host" # TODO: configure network in enclave to avoid this

  mongo-express:
    image: mongo-express:latest
    restart: always
    depends_on:
      - "mongo"
    environment:
      - ME_CONFIG_MONGODB_SERVER=mongo
      - ME_CONFIG_MONGODB_PORT=6534
      - ME_CONFIG_MONGODB_ADMINUSERNAME=fedn_admin
      - ME_CONFIG_MONGODB_ADMINPASSWORD=password
      - ME_CONFIG_BASICAUTH_USERNAME=fedn_admin
      - ME_CONFIG_BASICAUTH_PASSWORD=password
    # ports:
    #   - 8081:8081
    network_mode: "host" # TODO: configure network in enclave to avoid this

  # Attestation
  attestation:
    build: .
    environment:
      # - GET_HOSTS_FROM=dns
      - RA_TLS_ALLOW_DEBUG_ENCLAVE_INSECURE=1
      - RA_TLS_ALLOW_OUTDATED_TCB_INSECURE=1
      - RA_TLS_EPID_API_KEY=${RA_TLS_EPID_API_KEY}
      - RA_CLIENT_SPID=${RA_CLIENT_SPID}
      - RA_CLIENT_LINKABLE=0
    entrypoint: /app/server mongodb://fedn_admin:password@localhost:6534
    depends_on:
      - "mongo"
      - "reducer"
    privileged: true
    # ports:
    #   - 4433:4433
    volumes:
      - /var/run/aesmd/aesm.socket:/var/run/aesmd/aesm.socket
    network_mode: "host" # TODO: configure network in enclave to avoid this

  # Reducer
  reducer:
    build: .
    environment:
      # - GET_HOSTS_FROM=dns
      - USER=test
      - PROJECT=project
    command: fedn run reducer -n reducer --init=/app/config/settings-reducer.yaml --secret-key secret
    # ports:
    #   - 8090:8090
    network_mode: "host" # TODO: configure network in enclave to avoid this

  # Combiner
  combiner:
    build: .
    environment:
      # - GET_HOSTS_FROM=dns
      - PYTHONUNBUFFERED=0
      - RA_TLS_ALLOW_DEBUG_ENCLAVE_INSECURE=1
      - RA_TLS_ALLOW_OUTDATED_TCB_INSECURE=1
      - RA_TLS_EPID_API_KEY=${RA_TLS_EPID_API_KEY}
      - RA_CLIENT_SPID=${RA_CLIENT_SPID}
      - RA_CLIENT_LINKABLE=0
    command: sleep 10 && ./fedn-enclave combiner # TODO: find a better way to wait for the attestation server to start
    depends_on:
      - "attestation"
    privileged: true # to access SGX devices
    # ports:
    #   - 12080:12080
    volumes:
      - /var/run/aesmd/aesm.socket:/var/run/aesmd/aesm.socket
    network_mode: "host" # TODO: configure network in enclave to avoid this

  # Client
  client:
    build: .
    environment:
      # - GET_HOSTS_FROM=dns
      - TMPDIR=/tmp
      - RA_TLS_ALLOW_DEBUG_ENCLAVE_INSECURE=1
      - RA_TLS_ALLOW_OUTDATED_TCB_INSECURE=1
      - RA_TLS_EPID_API_KEY=${RA_TLS_EPID_API_KEY}
      - RA_CLIENT_SPID=${RA_CLIENT_SPID}
      - RA_CLIENT_LINKABLE=0
    command: sleep 10 && ./fedn-enclave client # TODO: find a better way to wait for the attestation server to start
    deploy:
      replicas: 2
    depends_on:
      - "attestation"
    privileged: true # to access SGX devices
    volumes:
      - /var/run/aesmd/aesm.socket:/var/run/aesmd/aesm.socket
    network_mode: "host" # TODO: configure network in enclave to avoid this