docker-compose.yml

Rama main · réplica de lectura del repositorio original.

# Pull-first, build-fallback:
#
# Every service below declares both `image:` and `build:`. Per the Compose
# Build Specification, when both are present and `pull_policy` is left unset,
# Compose tries to pull the named image first and only builds from source if
# that image isn't found in the registry or the local platform cache
# (https://docs.docker.com/reference/compose-file/build/, "When Compose is
# confronted with both a build subsection for a service and an image
# attribute..."). Concretely:
#   - After a GHCR release exists: `docker compose up -d` pulls the published
#     image and never compiles anything.
#   - Before the first release, or offline with no cached image: the pull
#     fails to resolve and Compose builds locally from `build:`, exactly like
#     today. Contributors can still force a rebuild with `docker compose build`
#     or `docker compose up -d --build`.
# Do not add an explicit `pull_policy:` here; it would remove this fallback.
services:
  # -------------------------------------------------------------------------
  # CORE (Combined controlplane + dataplane)
  # -------------------------------------------------------------------------
  core:
    image: ghcr.io/hydradns/core:${HYDRA_VERSION:-latest}
    build:
      context: ./apps/core
      dockerfile: Dockerfile
    restart: unless-stopped
    ports:
      - "8080:8080"     # Control plane API
      - "53:1053/udp"   # DNS (UDP)
      - "53:1053/tcp"   # DNS (TCP)
    environment:
      - HYDRA_CONFIG=/app/configs/config.yaml
      - HYDRA_DB=/app/data/hydradns.db
      - HYDRA_POLICIES=/app/configs/policies.json
      # CORS_ORIGINS is the explicit allowlist (comma-separated), always
      # checked first. On top of it, the API automatically allows a request
      # whose Origin hostname matches the Host header it was reached on
      # (ports ignored), as long as that hostname is an IP literal or
      # "localhost". This is what lets a dashboard opened at
      # http://192.168.1.53:3000 call the API at http://192.168.1.53:8080
      # with no config changes. Named hosts (pi.local, hydra.lan, a
      # reverse-proxy domain) are not covered by that automatic rule and
      # need an explicit entry here. Set CORS_ALLOW_SAME_HOST=false to turn
      # the automatic rule off.
      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:3000}
      - CORS_ALLOW_SAME_HOST=${CORS_ALLOW_SAME_HOST:-true}
      # Runtime settings an operator is expected to change. Defaults below
      # match the code's own defaults (see .env.example for what each does).
      # DNS_LISTEN_ADDR is intentionally not passed through: the dataplane
      # binds it inside the container, but the host-facing port mapping
      # above ("53:1053/...") is fixed, so changing this here would only
      # break the mapping, not move it.
      - BLOCK_RESPONSE=${BLOCK_RESPONSE:-zero}
      - BLOCKLIST_UPDATE_INTERVAL=${BLOCKLIST_UPDATE_INTERVAL:-6h}
      - BLOCKLIST_POLL_INTERVAL=${BLOCKLIST_POLL_INTERVAL:-5s}
      - QUERY_LOG_RETENTION_DAYS=${QUERY_LOG_RETENTION_DAYS:-7}
      - QUERY_LOG_MAX_ROWS=${QUERY_LOG_MAX_ROWS:-1000000}
      - QUERY_LOG_CLEANUP_INTERVAL=${QUERY_LOG_CLEANUP_INTERVAL:-1h}
      - HYDRA_ANONYMIZE_CLIENT_IPS=${HYDRA_ANONYMIZE_CLIENT_IPS:-false}
      - HYDRA_ANON_SECRET=${HYDRA_ANON_SECRET:-}
      - TRUSTED_PROXIES=${TRUSTED_PROXIES:-}
    volumes:
      - core-data:/app/data
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/health"]
      interval: 10s
      timeout: 5s
      retries: 3
    networks:
      - hydra-net

  # -------------------------------------------------------------------------
  # ADMIN UI (Dashboard)
  # -------------------------------------------------------------------------
  ui:
    image: ghcr.io/hydradns/ui:${HYDRA_VERSION:-latest}
    build:
      context: ./apps/ui
      dockerfile: Dockerfile
      args:
        # The dashboard derives the API's host from the page's own URL at
        # runtime (protocol + hostname, port 8080), so opening it at
        # http://192.168.1.53:3000 calls http://192.168.1.53:8080 with no
        # build changes. NEXT_PUBLIC_API_URL only needs to be set for an
        # override: a reverse proxy, or an API on a different host/port
        # than the dashboard. Next.js still inlines this value at build
        # time, so a runtime env var alone won't change it in an
        # already-built image; set it here and rebuild.
        - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL:-http://localhost:8080}
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL:-http://localhost:8080}
    depends_on:
      core:
        condition: service_healthy
    networks:
      - hydra-net

  # -------------------------------------------------------------------------
  # SCANNER (Network Scanner Worker), optional, not required for demo
  # Not part of the published release (no GHCR image, no CI job for it), so
  # this stays build-only. Uncomment to run it locally.
  # -------------------------------------------------------------------------
  # scanner:
  #   build:
  #     context: ./apps/scanner
  #     dockerfile: Dockerfile
  #   depends_on:
  #     - core
  #   networks:
  #     - hydra-net

networks:
  hydra-net:
    driver: bridge

volumes:
  core-data: