Eduardo David Paredes Vara
227 lines
7.7 KiB
YAML
227 lines
7.7 KiB
YAML
services:
|
|
db:
|
|
image: kasmweb/postgres:${KASM_VERSION}
|
|
container_name: kasm_db
|
|
restart: unless-stopped
|
|
stop_signal: SIGTERM
|
|
stop_grace_period: 60s
|
|
environment:
|
|
POSTGRES_PASSWORD: ${KASM_DB_PASSWORD}
|
|
POSTGRES_USER: kasmapp
|
|
POSTGRES_DB: kasm
|
|
command: postgres -c ssl=on -c ssl_cert_file=/etc/ssl/certs/db_server.crt -c ssl_key_file=/etc/ssl/certs/db_server.key -c config_file=/var/lib/postgresql/conf/postgresql.conf -c hba_file=/var/lib/postgresql/conf/pg_hba.conf
|
|
healthcheck:
|
|
test: "pg_isready --username=$$POSTGRES_USER --dbname=$$POSTGRES_DB && cat /proc/1/cmdline | grep -q '^postgres'"
|
|
timeout: 5s
|
|
retries: 20
|
|
volumes:
|
|
- ${KASM_DB_INIT_SQL}:/docker-entrypoint-initdb.d/current.sql:ro,Z
|
|
- ${KASM_ROOT_PATH}/conf/database/pg_hba.conf:/var/lib/postgresql/conf/pg_hba.conf:ro,Z
|
|
- ${KASM_ROOT_PATH}/conf/database/postgresql.conf:/var/lib/postgresql/conf/postgresql.conf:ro,Z
|
|
- ${KASM_ROOT_PATH}/certs/db_server.crt:/etc/ssl/certs/db_server.crt:ro,Z
|
|
- ${KASM_ROOT_PATH}/certs/db_server.key:/etc/ssl/certs/db_server.key:ro,Z
|
|
- ${KASM_ROOT_PATH}/log/postgres:/var/log/postgres:Z
|
|
- ${KASM_ROOT_PATH}/tmp/kasm_db:/tmp:Z
|
|
- ${KASM_DB_DATA_PATH}:/var/lib/postgresql/data:Z
|
|
networks:
|
|
- kasm_default_network
|
|
labels:
|
|
prune.protect: "true"
|
|
|
|
kasm_api:
|
|
image: kasmweb/api:${KASM_VERSION}
|
|
container_name: kasm_api
|
|
user: "${KASM_UID}:${KASM_GID}"
|
|
read_only: true
|
|
restart: unless-stopped
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: "/usr/bin/healthcheck.sh http://localhost:8080/api/__healthcheck \"\" 5 60"
|
|
timeout: 30s
|
|
interval: 10s
|
|
retries: 3
|
|
start_period: 60s
|
|
volumes:
|
|
- ${KASM_ROOT_PATH}:/opt/kasm/current:Z
|
|
- ${KASM_ROOT_PATH}/healthcheck/kasm_api:/healthcheck:Z
|
|
- ${KASM_ROOT_PATH}/tmp/api:/tmp:Z
|
|
networks:
|
|
- kasm_default_network
|
|
labels:
|
|
prune.protect: "true"
|
|
|
|
kasm_manager:
|
|
image: kasmweb/manager:${KASM_VERSION}
|
|
container_name: kasm_manager
|
|
user: "${KASM_UID}:${KASM_GID}"
|
|
read_only: true
|
|
restart: unless-stopped
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: "/usr/bin/healthcheck.sh http://localhost:8181/__healthcheck \"\" 5 60"
|
|
timeout: 30s
|
|
interval: 10s
|
|
retries: 3
|
|
volumes:
|
|
- ${KASM_ROOT_PATH}:/opt/kasm/current:Z
|
|
- ${KASM_ROOT_PATH}/healthcheck/kasm_manager:/healthcheck:Z
|
|
- ${KASM_ROOT_PATH}/tmp/manager:/tmp:Z
|
|
networks:
|
|
- kasm_default_network
|
|
labels:
|
|
prune.protect: "true"
|
|
|
|
kasm_agent:
|
|
image: kasmweb/agent:${KASM_VERSION}
|
|
container_name: kasm_agent
|
|
user: root
|
|
read_only: true
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- kasm_manager
|
|
healthcheck:
|
|
test: "/usr/bin/healthcheck.sh http://localhost:4444/__healthcheck \"\" 30 90 15"
|
|
timeout: 30s
|
|
interval: 30s
|
|
retries: 3
|
|
volumes:
|
|
- ${KASM_ROOT_PATH}:/opt/kasm/current:Z
|
|
- ${KASM_ROOT_PATH}/healthcheck/kasm_agent:/healthcheck:Z
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- ${KASM_ROOT_PATH}/conf/nginx:/etc/nginx/conf.d:Z
|
|
networks:
|
|
- kasm_default_network
|
|
labels:
|
|
prune.protect: "true"
|
|
|
|
kasm_guac:
|
|
image: kasmweb/kasm-guac:${KASM_VERSION}
|
|
container_name: kasm_guac
|
|
user: "${KASM_UID}:${KASM_GID}"
|
|
read_only: true
|
|
init: true
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: "/usr/bin/healthcheck.sh http://localhost:3000/__healthcheck \"\" 30 90"
|
|
interval: 60s
|
|
timeout: 30s
|
|
retries: 3
|
|
volumes:
|
|
- ${KASM_ROOT_PATH}/log:/opt/kasm/current/log:Z
|
|
- ${KASM_ROOT_PATH}/tmp/guac:/opt/kasm/current/tmp/guac:Z
|
|
- ${KASM_ROOT_PATH}/conf/app/guac:/opt/kasm/current/conf/app/guac:Z
|
|
- ${KASM_ROOT_PATH}/tmp/guac:/tmp:Z
|
|
- ${KASM_ROOT_PATH}/healthcheck/kasm_guac:/healthcheck:Z
|
|
networks:
|
|
- kasm_default_network
|
|
labels:
|
|
prune.protect: "true"
|
|
|
|
rdp_gateway:
|
|
image: kasmweb/rdp-gateway:${KASM_VERSION}
|
|
container_name: kasm_rdp_gateway
|
|
user: "${KASM_UID}:${KASM_GID}"
|
|
read_only: true
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- kasm_api
|
|
healthcheck:
|
|
test: "/usr/bin/healthcheck.sh http://localhost:5555/__healthcheck 3389 1 30"
|
|
interval: 60s
|
|
timeout: 30s
|
|
start_period: 30s
|
|
volumes:
|
|
- ${KASM_ROOT_PATH}/log:/opt/kasm/current/log:Z
|
|
- ${KASM_ROOT_PATH}/conf/app/rdp_gateway:/usr/local/etc/rdpproxy/conf:Z
|
|
- ${KASM_ROOT_PATH}/certs/kasm_nginx.key:/usr/local/etc/rdpproxy/rdpproxy.key:ro,Z
|
|
- ${KASM_ROOT_PATH}/certs/kasm_nginx.crt:/usr/local/etc/rdpproxy/rdpproxy.crt:ro,Z
|
|
- ${KASM_ROOT_PATH}/tmp/rdpgw/var:/usr/local/etc/rdpproxy/var:Z
|
|
- ${KASM_ROOT_PATH}/tmp/rdpgw/tmp:/tmp:Z
|
|
- ${KASM_ROOT_PATH}/healthcheck/rdp_gateway:/healthcheck:Z
|
|
networks:
|
|
- kasm_default_network
|
|
labels:
|
|
prune.protect: "true"
|
|
|
|
kasm_rdp_https_gateway:
|
|
image: kasmweb/rdp-https-gateway:${KASM_VERSION}
|
|
container_name: kasm_rdp_https_gateway
|
|
user: "${KASM_UID}:${KASM_GID}"
|
|
read_only: true
|
|
restart: unless-stopped
|
|
depends_on:
|
|
proxy:
|
|
condition: service_started
|
|
healthcheck:
|
|
test: "/usr/bin/healthcheck.sh https://localhost:9443/rdp-https-gateway/__healthcheck \"\" 1 30"
|
|
interval: 60s
|
|
timeout: 30s
|
|
start_period: 30s
|
|
volumes:
|
|
- ${KASM_ROOT_PATH}/log:/opt/kasm/current/log:Z
|
|
- ${KASM_ROOT_PATH}/conf/app/rdp_https_gateway:/opt/rdpgw/conf:Z
|
|
- ${KASM_ROOT_PATH}/certs/kasm_nginx.key:/opt/rdpgw/key.pem:ro,Z
|
|
- ${KASM_ROOT_PATH}/certs/kasm_nginx.crt:/opt/rdpgw/server.pem:ro,Z
|
|
- ${KASM_ROOT_PATH}/healthcheck/rdp_https_gateway:/healthcheck:Z
|
|
networks:
|
|
- kasm_default_network
|
|
labels:
|
|
prune.protect: "true"
|
|
|
|
proxy:
|
|
image: kasmweb/proxy:${KASM_VERSION}
|
|
container_name: kasm_proxy
|
|
restart: unless-stopped
|
|
depends_on:
|
|
kasm_manager:
|
|
condition: service_healthy
|
|
kasm_api:
|
|
condition: service_healthy
|
|
kasm_agent:
|
|
condition: service_started
|
|
kasm_guac:
|
|
condition: service_started
|
|
volumes:
|
|
- ${KASM_ROOT_PATH}/conf/nginx:/etc/nginx/conf.d:ro,Z
|
|
- ${KASM_ROOT_PATH}/certs/kasm_nginx.key:/etc/ssl/private/kasm_nginx.key:ro,Z
|
|
- ${KASM_ROOT_PATH}/certs/kasm_nginx.crt:/etc/ssl/certs/kasm_nginx.crt:ro,Z
|
|
- ${KASM_ROOT_PATH}/log/nginx:/var/log/external/nginx:Z
|
|
- ${KASM_ROOT_PATH}/log/logrotate:/var/log/external/logrotate:Z
|
|
networks:
|
|
- kasm_default_network
|
|
- kasm_sidecar_network
|
|
- proxy
|
|
labels:
|
|
prune.protect: "true"
|
|
traefik.enable: "true"
|
|
traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
|
|
traefik.http.routers.kasm.rule: "Host(`${KASM_DOMAIN}`)"
|
|
traefik.http.routers.kasm.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
|
|
traefik.http.routers.kasm.tls: "true"
|
|
traefik.http.routers.kasm.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
|
|
traefik.http.routers.kasm.middlewares: "crowdsec-bouncer@file,${TRAEFIK_AUTH_MIDDLEWARE}"
|
|
traefik.http.services.kasm.loadbalancer.server.port: "3000"
|
|
traefik.http.services.kasm.loadbalancer.server.scheme: "https"
|
|
traefik.http.services.kasm.loadbalancer.passhostheader: "true"
|
|
homepage.group: "Infraestructura"
|
|
homepage.name: "Kasm"
|
|
homepage.icon: "https://www.kasmweb.com/favicon.ico"
|
|
homepage.description: "Workspaces en navegador"
|
|
homepage.href: "https://${KASM_DOMAIN}"
|
|
homepage.siteMonitor: "https://kasm_proxy:3000/"
|
|
homepage.weight: "350"
|
|
|
|
networks:
|
|
kasm_default_network:
|
|
name: kasm_default_network
|
|
driver: bridge
|
|
kasm_sidecar_network:
|
|
name: kasm_sidecar_network
|
|
driver: bridge
|
|
proxy:
|
|
external: true
|