DRS/docker-compose.yml at main · bigdatasciencegroup/DRS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
# Zero-config public quickstart for the DRS verification service.
#
#   cp .env.example .env        # review the defaults
#   docker compose up -d        # pull the published image and start
#   curl http://localhost:8080/healthz
#
# Image: ghcr.io/okeyamy/drs-verify:latest (published from this repo).
# For custom builds, see drs-verify/Dockerfile or set build.context.

services:
  drs-verify:
    image: ghcr.io/okeyamy/drs-verify:${DRS_VERIFY_TAG:-latest}
    container_name: drs-verify
    restart: unless-stopped
    ports:
      - "${DRS_VERIFY_PORT:-8080}:8080"
      # Metrics port — uncomment when METRICS_ADDR=:9090 is set in .env.
      # In production, leave this commented out and restrict port 9090 to
      # your monitoring network via firewall or Kubernetes NetworkPolicy.
      # - "${DRS_METRICS_PORT:-9090}:9090"
    environment:
      LISTEN_ADDR: ":8080"
      LOG_LEVEL: "${LOG_LEVEL:-info}"
      LOG_FORMAT: "${LOG_FORMAT:-text}"

      # Revocation
      STATUS_LIST_BASE_URL: "${STATUS_LIST_BASE_URL:-}"
      STATUS_CACHE_TTL_SECS: "${STATUS_CACHE_TTL_SECS:-300}"
      DRS_ADMIN_TOKEN: "${DRS_ADMIN_TOKEN:-}"
      REVOCATION_STORE_PATH: "${REVOCATION_STORE_PATH:-}"

      # Replay protection
      NONCE_STORE_BACKEND: "${NONCE_STORE_BACKEND:-memory}"
      REDIS_URL: "${REDIS_URL:-}"
      NONCE_STORE_MAX_ENTRIES: "${NONCE_STORE_MAX_ENTRIES:-100000}"
      NONCE_STORE_TTL_SECS: "${NONCE_STORE_TTL_SECS:-900}"

      # Server identity (unsets invocation.tool_server binding when empty)
      SERVER_IDENTITY: "${SERVER_IDENTITY:-}"

      # Body size cap (bytes)
      MAX_BODY_BYTES: "${MAX_BODY_BYTES:-1048576}"

      # Rate limiting
      RATE_LIMIT_PER_IP: "${RATE_LIMIT_PER_IP:-100}"
      RATE_LIMIT_GLOBAL: "${RATE_LIMIT_GLOBAL:-1000}"
      TRUST_PROXY: "${TRUST_PROXY:-false}"

      # Metrics listener — empty disables /metrics (safe default).
      # Set to :9090 and uncomment the port mapping below for local monitoring.
      METRICS_ADDR: "${METRICS_ADDR:-}"

      # Circuit breaker for did:web
      CIRCUIT_BREAKER_THRESHOLD: "${CIRCUIT_BREAKER_THRESHOLD:-5}"
      CIRCUIT_BREAKER_COOLDOWN_SECS: "${CIRCUIT_BREAKER_COOLDOWN_SECS:-60}"

      # Storage (optional)
      STORE_DIR: "${STORE_DIR:-}"
      TSA_URL: "${TSA_URL:-}"

    # The image is distroless/static — no shell, no curl — so Compose's
    # built-in healthcheck can't probe /healthz from inside the container.
    # Operators should probe http://<host>:${DRS_VERIFY_PORT}/healthz from
    # their orchestrator (Kubernetes livenessProbe, Nomad check, etc.).
    # /readyz is the right probe for traffic-gating; it waits for status-list
    # warm-up when STATUS_LIST_BASE_URL is configured.

    # Dropped capabilities and read-only rootfs — the verifier only needs
    # to listen and read its tmpfs. Adjust if STORE_DIR is a bind mount.
    read_only: true
    tmpfs:
      - /tmp:size=64M
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true

    # Named volume for durable local revocation state. Active only if
    # REVOCATION_STORE_PATH points inside /var/lib/drs-verify (the default
    # recommendation). Safe to mount unconditionally — unused if no path
    # is set.
    volumes:
      - drs-revocation:/var/lib/drs-verify

volumes:
  drs-revocation: