ThemisDB/docker-compose.qnap.yml at develop · makr-code/ThemisDB · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
# ============================================================================
# ThemisDB — QNAP Container Station Deployment
# ============================================================================
#
# Phase 1 MVP: ThemisDB + Sidecar Admin UI
# Designed for QNAP NAS running Container Station (Docker Engine).
#
# USAGE
# ─────
# 1. Copy this file to your QNAP shared folder (e.g. /Container/themisdb/).
# 2. In Container Station → "Create Application" → upload this compose file.
# 3. Or via SSH:
#      cd /share/Container/themisdb
#      docker compose -f docker-compose.qnap.yml up -d
#
# ACCESS
# ──────
#   ThemisDB HTTP API : http://<QNAP-IP>:18765
#   ThemisDB gRPC     : <QNAP-IP>:18081
#   Prometheus Metrics: http://<QNAP-IP>:19090
#   Admin UI          : http://<QNAP-IP>:18766
#
# SECURITY NOTE
# ─────────────
# The admin UI is exposed on the local network only. For production use:
#   - Enable HTTPS via a reverse proxy (e.g. QNAP's built-in Station Manager
#     or an nginx proxy in front of this stack).
#   - Set THEMIS_AUTH_ENABLED=true and configure strong credentials.
#   - Restrict port 18766 to trusted subnets via QNAP firewall rules.
#
# IMAGE SOURCE
# ────────────
# ThemisDB: pulled from Docker Hub (makrcode/themisdb:latest).
# Admin UI: built locally from docker/admin-ui/ in the ThemisDB repository,
#           or pulled from Docker Hub once a pre-built image is published.
# ============================================================================

services:

  # ==========================================================================
  # ThemisDB Server (COMMUNITY Edition — Docker Hub image)
  # ==========================================================================
  themis:
    image: makrcode/themisdb:latest
    container_name: themisdb
    restart: unless-stopped
    ports:
      - "18765:8080"   # HTTP REST / AQL API
      - "18081:8081"   # gRPC
      - "19090:9090"   # Prometheus metrics
    volumes:
      # Persistent data — stored on QNAP shared folder
      - themis-data:/var/lib/themis/data
      # Optional: mount a custom config file from the host
      # - ./config/config.yaml:/etc/themis/config/config.yaml:ro
      - themis-logs:/var/log/themis
    environment:
      - THEMIS_EDITION=COMMUNITY
      - THEMIS_LOG_LEVEL=info
      - THEMIS_DATA_DIR=/var/lib/themis/data
      - THEMIS_METRICS_ENABLED=true
      - THEMIS_TRACING_ENABLED=false
      # Uncomment to require authentication (Phase 2):
      # - THEMIS_AUTH_ENABLED=true
      # - THEMIS_ADMIN_USER=admin
      # - THEMIS_ADMIN_PASSWORD=changeme
      # MFA enforcement for admin role (Phase 2):
      # - THEMIS_MFA_REQUIRED_ROLES=admin,operator
    healthcheck:
      test: ["CMD", "curl", "-fL", "http://localhost:8080/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    networks:
      - themis-net
    deploy:
      resources:
        limits:
          cpus: '4'
          memory: 4G
        reservations:
          cpus: '1'
          memory: 512M

  # ==========================================================================
  # Admin UI — Sidecar Container (Phase 1 MVP)
  # Serves a lightweight web dashboard that talks to ThemisDB via REST.
  # nginx proxies /api/* → ThemisDB:8080 to avoid CORS issues.
  # ==========================================================================
  admin-ui:
    build:
      context: ./docker/admin-ui
      dockerfile: Dockerfile
    image: themisdb-admin-ui:1.1.0
    container_name: themisdb-admin-ui
    restart: unless-stopped
    ports:
      - "18766:80"     # Admin UI web interface (HTTP)
      # Uncomment for direct TLS (Phase 2 Option B — see docker/admin-ui/nginx.ssl.conf):
      # - "18767:443"
    depends_on:
      themis:
        condition: service_healthy
    volumes:
      # Audit log read-only mount (Phase 2) — lets the admin UI serve log
      # download links without needing write access to the data directory.
      - themis-logs:/var/log/themis:ro
      # TLS certificates (Phase 2 Option B — uncomment and set real paths):
      # - /share/certs/admin.crt:/etc/nginx/ssl/cert.crt:ro
      # - /share/certs/admin.key:/etc/nginx/ssl/cert.key:ro
    networks:
      - themis-net
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost/health-ui"]
      interval: 30s
      timeout: 5s
      retries: 3
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 128M
        reservations:
          cpus: '0.1'
          memory: 32M

# ============================================================================
# Networks
# ============================================================================
networks:
  themis-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.30.0.0/24

# ============================================================================
# Volumes (persistent data on QNAP storage)
# ============================================================================
volumes:
  themis-data:
    driver: local
  themis-logs:
    driver: local