docker-compose-combined.yml
Rama main · réplica de lectura del repositorio original.
# =============================================================================
# docker-compose-combined.yml - every topology in one stack.
#
# Demonstrates all three PDNS deployment shapes side-by-side so the admin
# UI shows them grouped under their backends + cluster:
#
# 1. Multi-primary cluster - 3 peers sharing one MariaDB backend.
# 2. Standalone primary - single PDNS, its own gsqlite3 store.
# 3. Primary + 3 Secondaries - classic AXFR replication, supermaster
# auto-secondary wiring.
#
# Plus 10 demo zones × 10 records each per topology = 30 zones / 300
# records seeded by the app's provisioning step (`demo_zones:` section in
# provisioning.combined.example.yaml).
#
# Network: shared `pdnsnet` /24 so the primary's `also-notify` + each
# secondary's `supermasters` row can use literal IPs. Cluster peers and
# the standalone don't need static IPs.
#
# Usage:
# cp .env.example .env
# # fill in APP_SECRET_KEY + APP_ENCRYPTION_KEY
# docker compose -f docker-compose-combined.yml up -d
# # app → http://localhost:3000
# # cluster peer APIs → http://localhost:8091, :8092, :8093
# # standalone primary API → http://localhost:8095
# # primary+sec primary API → http://localhost:8081
# # primary+sec secondary APIs→ http://localhost:8082, :8083, :8084
# =============================================================================
networks:
pdnsnet:
driver: bridge
ipam:
config:
- subnet: 172.30.0.0/24
# Dynamic addresses come only from the upper half. The primary and
# secondaries pin .10-.13 (their IPs are baked into ALLOW-AXFR /
# also-notify), and with two dozen containers dynamic allocation
# from .2 upwards reached them first: an intermittent "Address
# already in use" at start-up, depending on container order.
ip_range: 172.30.0.128/25
name: powerdns-authadmin-combined
services:
# ===========================================================================
# App-side: Postgres + Redis + the Next.js app
# ===========================================================================
postgres:
image: postgres:16-alpine
restart: unless-stopped
environment:
POSTGRES_USER: pdns
POSTGRES_PASSWORD: pdns
POSTGRES_DB: powerdns_authadmin
ports:
- "5432:5432"
volumes:
- postgres-data:/var/lib/postgresql/data
networks:
- pdnsnet
healthcheck:
test: ["CMD-SHELL", "pg_isready -U pdns -d powerdns_authadmin"]
interval: 5s
timeout: 5s
retries: 10
redis:
image: redis:7-alpine
restart: unless-stopped
command: ["redis-server", "--appendonly", "yes"]
ports:
- "6379:6379"
volumes:
- redis-data:/data
networks:
- pdnsnet
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 5s
timeout: 5s
retries: 10
# ===========================================================================
# Topology 1: Multi-primary cluster (3 peers + shared MariaDB)
# ===========================================================================
mariadb:
image: mariadb:11
restart: unless-stopped
environment:
MARIADB_ROOT_PASSWORD: pdns-root-pw
MARIADB_DATABASE: pdns
MARIADB_USER: pdns
MARIADB_PASSWORD: pdns-pw
volumes:
- mariadb-data:/var/lib/mysql
- ./docker/pdns/schema.mysql.sql:/docker-entrypoint-initdb.d/01-pdns-schema.sql:ro
networks:
- pdnsnet
healthcheck:
# Over TCP, not the socket: on first boot the image runs a socket-only
# temporary server while it loads the schema, and a socket check passes
# against it before PowerDNS can connect over the network.
test: ["CMD-SHELL", "mariadb -h 127.0.0.1 -updns -ppdns-pw -e 'SELECT 1' pdns"]
interval: 5s
timeout: 5s
retries: 20
pdns-peer-1:
image: ${PDNS_AUTH_IMAGE:-powerdns/pdns-auth-49:latest}
restart: unless-stopped
depends_on:
mariadb:
condition: service_healthy
ports:
- "8091:8081"
networks:
- pdnsnet
volumes:
- ./docker/pdns/peer.conf:/etc/powerdns/pdns.conf:ro
command: ["--api-key=peer-1-changeme"]
healthcheck:
test: ["CMD", "pdns_control", "rping"]
interval: 10s
timeout: 5s
retries: 5
start_period: 10s
pdns-peer-2:
image: ${PDNS_AUTH_IMAGE:-powerdns/pdns-auth-49:latest}
restart: unless-stopped
depends_on:
mariadb:
condition: service_healthy
ports:
- "8092:8081"
networks:
- pdnsnet
volumes:
- ./docker/pdns/peer.conf:/etc/powerdns/pdns.conf:ro
command: ["--api-key=peer-2-changeme"]
healthcheck:
test: ["CMD", "pdns_control", "rping"]
interval: 10s
timeout: 5s
retries: 5
start_period: 10s
pdns-peer-3:
image: ${PDNS_AUTH_IMAGE:-powerdns/pdns-auth-49:latest}
restart: unless-stopped
depends_on:
mariadb:
condition: service_healthy
ports:
- "8093:8081"
networks:
- pdnsnet
volumes:
- ./docker/pdns/peer.conf:/etc/powerdns/pdns.conf:ro
command: ["--api-key=peer-3-changeme"]
healthcheck:
test: ["CMD", "pdns_control", "rping"]
interval: 10s
timeout: 5s
retries: 5
start_period: 10s
# ===========================================================================
# Topology 2: Standalone primary (single PDNS, no replication)
# ===========================================================================
pdns-single-init:
image: alpine:3.20
restart: "no"
command:
- sh
- -c
- |
set -eu
apk add --no-cache sqlite >/dev/null
sh /init.sh
chown -R 953:953 /var/lib/powerdns
chmod -R u+rwX /var/lib/powerdns
environment:
DB: /var/lib/powerdns/pdns.sqlite
SCHEMA: /schema.sqlite3.sql
volumes:
- single-data:/var/lib/powerdns
- ./docker/pdns/init-primary.sh:/init.sh:ro
- ./docker/pdns/schema.sqlite3.sql:/schema.sqlite3.sql:ro
networks:
- pdnsnet
pdns-single:
image: ${PDNS_AUTH_IMAGE:-powerdns/pdns-auth-49:latest}
restart: unless-stopped
depends_on:
pdns-single-init:
condition: service_completed_successfully
ports:
- "5310:53"
- "5310:53/udp"
- "8095:8081"
networks:
- pdnsnet
volumes:
- single-data:/var/lib/powerdns
- ./docker/pdns/single.conf:/etc/powerdns/pdns.conf:ro
command: ["--api-key=single-changeme"]
healthcheck:
test: ["CMD", "pdns_control", "rping"]
interval: 10s
timeout: 5s
retries: 5
start_period: 10s
# ===========================================================================
# Topology 3: Primary + 3 Secondaries (NOTIFY + AXFR replication)
# ===========================================================================
pdns-ps-primary-init:
image: alpine:3.20
restart: "no"
command:
- sh
- -c
- |
set -eu
apk add --no-cache sqlite >/dev/null
sh /init.sh
chown -R 953:953 /var/lib/powerdns
chmod -R u+rwX /var/lib/powerdns
environment:
DB: /var/lib/powerdns/pdns.sqlite
SCHEMA: /schema.sqlite3.sql
volumes:
- ps-primary-data:/var/lib/powerdns
- ./docker/pdns/init-primary.sh:/init.sh:ro
- ./docker/pdns/schema.sqlite3.sql:/schema.sqlite3.sql:ro
networks:
- pdnsnet
pdns-ps-primary:
image: ${PDNS_AUTH_IMAGE:-powerdns/pdns-auth-49:latest}
restart: unless-stopped
depends_on:
pdns-ps-primary-init:
condition: service_completed_successfully
ports:
- "5300:53"
- "5300:53/udp"
- "8081:8081"
networks:
pdnsnet:
ipv4_address: 172.30.0.10
volumes:
- ps-primary-data:/var/lib/powerdns
- ./docker/pdns/primary.conf:/etc/powerdns/pdns.conf:ro
command: ["--api-key=ps-primary-changeme"]
healthcheck:
test: ["CMD", "pdns_control", "rping"]
interval: 10s
timeout: 5s
retries: 5
start_period: 10s
pdns-ps-secondary-1-init:
image: alpine:3.20
restart: "no"
command:
- sh
- -c
- |
set -eu
apk add --no-cache sqlite >/dev/null
sh /init.sh
chown -R 953:953 /var/lib/powerdns
chmod -R u+rwX /var/lib/powerdns
environment:
DB: /var/lib/powerdns/pdns.sqlite
SCHEMA: /schema.sqlite3.sql
PRIMARY_IPS: "172.30.0.10"
# PDNS auto-secondary verifies the supermasters row's `nameserver`
# column against the NS records the Primary advertises for the
# zone. Each Secondary registers itself under its own container
# hostname so the verification doesn't reject the auto-create.
SELF_NS: "pdns-ps-secondary-1"
volumes:
- ps-secondary-1-data:/var/lib/powerdns
- ./docker/pdns/init-secondary.sh:/init.sh:ro
- ./docker/pdns/schema.sqlite3.sql:/schema.sqlite3.sql:ro
networks:
- pdnsnet
pdns-ps-secondary-1:
image: ${PDNS_AUTH_IMAGE:-powerdns/pdns-auth-49:latest}
restart: unless-stopped
depends_on:
pdns-ps-secondary-1-init:
condition: service_completed_successfully
ports:
- "5301:53"
- "5301:53/udp"
- "8082:8081"
networks:
pdnsnet:
ipv4_address: 172.30.0.11
volumes:
- ps-secondary-1-data:/var/lib/powerdns
- ./docker/pdns/secondary.conf:/etc/powerdns/pdns.conf:ro
command: ["--api-key=ps-secondary-1-changeme"]
healthcheck:
test: ["CMD", "pdns_control", "rping"]
interval: 10s
timeout: 5s
retries: 5
start_period: 10s
pdns-ps-secondary-2-init:
image: alpine:3.20
restart: "no"
command:
- sh
- -c
- |
set -eu
apk add --no-cache sqlite >/dev/null
sh /init.sh
chown -R 953:953 /var/lib/powerdns
chmod -R u+rwX /var/lib/powerdns
environment:
DB: /var/lib/powerdns/pdns.sqlite
SCHEMA: /schema.sqlite3.sql
PRIMARY_IPS: "172.30.0.10"
SELF_NS: "pdns-ps-secondary-2"
volumes:
- ps-secondary-2-data:/var/lib/powerdns
- ./docker/pdns/init-secondary.sh:/init.sh:ro
- ./docker/pdns/schema.sqlite3.sql:/schema.sqlite3.sql:ro
networks:
- pdnsnet
pdns-ps-secondary-2:
image: ${PDNS_AUTH_IMAGE:-powerdns/pdns-auth-49:latest}
restart: unless-stopped
depends_on:
pdns-ps-secondary-2-init:
condition: service_completed_successfully
ports:
- "5302:53"
- "5302:53/udp"
- "8083:8081"
networks:
pdnsnet:
ipv4_address: 172.30.0.12
volumes:
- ps-secondary-2-data:/var/lib/powerdns
- ./docker/pdns/secondary.conf:/etc/powerdns/pdns.conf:ro
command: ["--api-key=ps-secondary-2-changeme"]
healthcheck:
test: ["CMD", "pdns_control", "rping"]
interval: 10s
timeout: 5s
retries: 5
start_period: 10s
pdns-ps-secondary-3-init:
image: alpine:3.20
restart: "no"
command:
- sh
- -c
- |
set -eu
apk add --no-cache sqlite >/dev/null
sh /init.sh
chown -R 953:953 /var/lib/powerdns
chmod -R u+rwX /var/lib/powerdns
environment:
DB: /var/lib/powerdns/pdns.sqlite
SCHEMA: /schema.sqlite3.sql
PRIMARY_IPS: "172.30.0.10"
SELF_NS: "pdns-ps-secondary-3"
volumes:
- ps-secondary-3-data:/var/lib/powerdns
- ./docker/pdns/init-secondary.sh:/init.sh:ro
- ./docker/pdns/schema.sqlite3.sql:/schema.sqlite3.sql:ro
networks:
- pdnsnet
pdns-ps-secondary-3:
image: ${PDNS_AUTH_IMAGE:-powerdns/pdns-auth-49:latest}
restart: unless-stopped
depends_on:
pdns-ps-secondary-3-init:
condition: service_completed_successfully
ports:
- "5303:53"
- "5303:53/udp"
- "8084:8081"
networks:
pdnsnet:
ipv4_address: 172.30.0.13
volumes:
- ps-secondary-3-data:/var/lib/powerdns
- ./docker/pdns/secondary.conf:/etc/powerdns/pdns.conf:ro
command: ["--api-key=ps-secondary-3-changeme"]
healthcheck:
test: ["CMD", "pdns_control", "rping"]
interval: 10s
timeout: 5s
retries: 5
start_period: 10s
# ===========================================================================
# The app
# ===========================================================================
app:
build:
context: .
dockerfile: Dockerfile
target: runner
restart: unless-stopped
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
pdns-peer-1:
condition: service_healthy
pdns-peer-2:
condition: service_healthy
pdns-peer-3:
condition: service_healthy
pdns-single:
condition: service_healthy
pdns-ps-primary:
condition: service_healthy
pdns-ps-secondary-1:
condition: service_healthy
pdns-ps-secondary-2:
condition: service_healthy
pdns-ps-secondary-3:
condition: service_healthy
ports:
- "3000:3000"
networks:
- pdnsnet
volumes:
- sqlite-data:/data
- ./provisioning.combined.example.yaml:/etc/powerdns-authadmin/provisioning.yaml:ro
environment:
NODE_ENV: ${NODE_ENV:-production}
PORT: 3000
APP_URL: ${APP_URL:-http://localhost:3000}
LOG_LEVEL: ${LOG_LEVEL:-info}
# Postgres-backed: the integration suite (host-side vitest) connects to
# this same Postgres over the published 5432 to reset state, so the app
# must use it (an in-container SQLite file isn't reachable from the host).
DATABASE_URL: postgres://pdns:pdns@postgres:5432/powerdns_authadmin
REDIS_URL: redis://redis:6379
APP_SECRET_KEY: ${APP_SECRET_KEY:?must be set; generate with openssl rand -base64 32}
APP_ENCRYPTION_KEY: ${APP_ENCRYPTION_KEY:?must be set; generate with openssl rand -base64 32}
BOOTSTRAP_ADMIN_EMAIL: ${BOOTSTRAP_ADMIN_EMAIL:-admin@example.com}
BOOTSTRAP_ADMIN_PASSWORD: ${BOOTSTRAP_ADMIN_PASSWORD:-bootstrap-admin-pw-changeme}
# This is the public demo stack: lock the shared admin's login so a
# visitor can't change the password/email/MFA or delete it out from under
# everyone. Override BOOTSTRAP_ADMIN_RO=false for a private deployment.
BOOTSTRAP_ADMIN_RO: ${BOOTSTRAP_ADMIN_RO:-true}
LOCAL_AUTH_ENABLED: "true"
APP_PDNS_ALLOW_PRIVATE_NETWORKS: "true"
# Enable the background poller so the dashboard's PDNS-statistics tab
# (per-backend query rate / latency / cache / response charts) renders -
# it's hidden when polling is off. Also what the demo graph backfill
# (scripts/demo-seed-graphs.ts) populates.
PDNS_BACKGROUND_POLLING: ${PDNS_BACKGROUND_POLLING:-true}
MIGRATE_ON_BOOT: ${MIGRATE_ON_BOOT:-true}
SEED_ON_BOOT: ${SEED_ON_BOOT:-true}
PROVISIONING_FILE: /etc/powerdns-authadmin/provisioning.yaml
PROVISION_ON_BOOT: ${PROVISION_ON_BOOT:-true}
APP_PDNS_ALLOW_INSECURE_HTTP: ${APP_PDNS_ALLOW_INSECURE_HTTP:-true}
healthcheck:
test:
[
"CMD",
"node",
"-e",
"fetch('http://localhost:3000/healthz').then(r=>r.ok?process.exit(0):process.exit(1)).catch(()=>process.exit(1))",
]
interval: 15s
timeout: 5s
retries: 5
start_period: 30s
volumes:
postgres-data:
redis-data:
mariadb-data:
single-data:
ps-primary-data:
ps-secondary-1-data:
ps-secondary-2-data:
ps-secondary-3-data:
sqlite-data: