ChainShield/docker-compose.yml at main · AnkanMisra/ChainShield · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
# `docker compose up --build` brings the full stack online:
#
#   - api: the Bun + Fastify risk-gate server on http://127.0.0.1:8787
#   - web: the Astro static frontend on http://127.0.0.1:4321
#
# The browser talks to both directly (cross-origin); the api image
# registers @fastify/cors for the web origin via WEB_ORIGIN so the
# Astro UI can hit /policies and /evaluate from :4321.
#
# Sponsor adapters opt in via .env.local (compose reads it automatically):
#   ZERO_G_PRIVATE_KEY    -> ZeroGStore anchors policies + decisions
#   KEEPERHUB_API_KEY     -> KeeperHubRunner fires real workflows
#   NOTIFY_DISCORD_WEBHOOK-> Discord notification channel

services:
  api:
    build:
      context: .
      dockerfile: Dockerfile
    image: chainshield-api:dev
    container_name: chainshield-api
    ports:
      - "${PORT:-8787}:8787"
    environment:
      # Container-only knobs. Sponsor adapter keys must NOT be repeated here:
      # values in `environment:` override values from `env_file:` in compose,
      # so listing them here would shadow `.env.local` whenever the host shell
      # doesn't export the same name. Server-side defaults (in `server.ts`)
      # cover the `ZERO_G_*_URL` / `KEEPERHUB_API_URL` fallbacks anyway.
      HOST: "0.0.0.0"
      PORT: "8787"
      # Allow the Astro container's host-mapped port (4321) plus localhost
      # variants. WEB_ORIGIN can be a comma-separated list.
      WEB_ORIGIN: "http://127.0.0.1:4321,http://localhost:4321"
    env_file:
      # Pulls KEEPERHUB_API_KEY, ZERO_G_PRIVATE_KEY, NOTIFY_DISCORD_WEBHOOK,
      # and any URL overrides directly into the container env. `required: false`
      # so the stack still boots on a fresh clone without a `.env.local`
      # (server falls back to InMemoryStore + MockRunner).
      - path: .env.local
        required: false
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8787/health"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 3s
    networks:
      - chainshield

  web:
    build:
      context: ./web
      dockerfile: Dockerfile
    image: chainshield-web:dev
    container_name: chainshield-web
    ports:
      - "${WEB_PORT:-4321}:80"
    depends_on:
      api:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1/healthz"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 2s
    networks:
      - chainshield

networks:
  chainshield:
    name: chainshield
    driver: bridge