moq-wasm/docker-compose.yml at master · nttcom/moq-wasm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
services:
  redis:
    image: redis:8.8.0@sha256:2838d5524559494f6f1cd66e97e76b200d64a633a8614200620755ed395daf32
    ports:
      - "6379:6379"
    # Relays connect to redis once at startup with no retry, so gate them on health.
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 2s
      timeout: 3s
      retries: 10

  relay-common:
    image: moqt-relay:local
    build:
      context: .
      dockerfile: crates/relay/Dockerfile
    profiles:
      - build
    command: ["true"]

  vts:
    image: moqt-vts:local
    build:
      context: .
      dockerfile: crates/vts/Dockerfile
    environment:
      VTS_PORT: "8081"
      VTS_APPS_FILE: /etc/vts/apps.json
    volumes:
      - ${VTS_APPS_FILE:-./crates/vts/apps.example.json}:/etc/vts/apps.json:ro

  relay-a:
    image: moqt-relay:local
    env_file:
      - path: .env
        required: false
    environment:
      RELAY_ID: relay-a
      RELAY_ADVERTISE_HOST: relay-a
      RELAY_PUBLIC_HOST: localhost:4433
      RELAY_PORT: "443"
      RELAY_INNER_PORT: "444"
      REDIS_URL: redis://redis:6379
      AUTH_VTS_URL: ${AUTH_VTS_URL:-http://vts:8081/verify}
      # Development relay token minted from apps.example.json (see crates/vts/README.md).
      AUTH_RELAY_TOKEN: ${AUTH_RELAY_TOKEN:-eyJhbGciOiJIUzI1NiJ9.eyJhcHBJZCI6IjExMTExMTExLTIyMjItMzMzMy00NDQ0LTU1NTU1NTU1NTU1NSIsInB1Ymxpc2giOiIiLCJzdWJzY3JpYmUiOiIiLCJpYXQiOjE3ODkwOTMzMzMsImV4cCI6MjEwNDQ1MzMzM30.F_vveCJktf2C5cAnojDN_wLUZm6ILQpCACOvXxezqD4}
      OTEL_SDK_DISABLED: ${OTEL_SDK_DISABLED:-true}
      RELAY_STDOUT_FILTER: ${RELAY_STDOUT_FILTER:-relay=info,moqt=info}
      RELAY_OTEL_FILTER: ${RELAY_OTEL_FILTER:-relay=info,moqt=info}
      RELAY_LOG_FILTER: ${RELAY_LOG_FILTER:-relay=info,moqt=info}
      RELAY_CACHE_TTL_SECS: ${RELAY_CACHE_TTL_SECS:-}
      RELAY_CACHE_EVICT_INTERVAL_SECS: ${RELAY_CACHE_EVICT_INTERVAL_SECS:-}
    ports:
      - "4433:443/udp"
    # Playwright pins the host certificate SPKI; relay must serve the same keypair.
    volumes:
      - ./crates/relay/keys:/workspace/crates/relay/keys:ro
    depends_on:
      redis:
        condition: service_healthy
      vts:
        condition: service_started

  relay-b:
    image: moqt-relay:local
    env_file:
      - path: .env
        required: false
    environment:
      RELAY_ID: relay-b
      RELAY_ADVERTISE_HOST: relay-b
      RELAY_PUBLIC_HOST: localhost:4434
      RELAY_PORT: "443"
      RELAY_INNER_PORT: "444"
      REDIS_URL: redis://redis:6379
      AUTH_VTS_URL: ${AUTH_VTS_URL:-http://vts:8081/verify}
      # Development relay token minted from apps.example.json (see crates/vts/README.md).
      AUTH_RELAY_TOKEN: ${AUTH_RELAY_TOKEN:-eyJhbGciOiJIUzI1NiJ9.eyJhcHBJZCI6IjExMTExMTExLTIyMjItMzMzMy00NDQ0LTU1NTU1NTU1NTU1NSIsInB1Ymxpc2giOiIiLCJzdWJzY3JpYmUiOiIiLCJpYXQiOjE3ODkwOTMzMzMsImV4cCI6MjEwNDQ1MzMzM30.F_vveCJktf2C5cAnojDN_wLUZm6ILQpCACOvXxezqD4}
      OTEL_SDK_DISABLED: ${OTEL_SDK_DISABLED:-true}
      RELAY_STDOUT_FILTER: ${RELAY_STDOUT_FILTER:-relay=info,moqt=info}
      RELAY_OTEL_FILTER: ${RELAY_OTEL_FILTER:-relay=info,moqt=info}
      RELAY_LOG_FILTER: ${RELAY_LOG_FILTER:-relay=info,moqt=info}
      RELAY_CACHE_TTL_SECS: ${RELAY_CACHE_TTL_SECS:-}
      RELAY_CACHE_EVICT_INTERVAL_SECS: ${RELAY_CACHE_EVICT_INTERVAL_SECS:-}
    ports:
      - "4434:443/udp"
    # Playwright pins the host certificate SPKI; relay must serve the same keypair.
    volumes:
      - ./crates/relay/keys:/workspace/crates/relay/keys:ro
    depends_on:
      redis:
        condition: service_healthy
      vts:
        condition: service_started

  clickhouse:
    image: clickhouse/clickhouse-server:25.8@sha256:0152dd511befe6a2c2ef53e930726179669b08116da78500b37c51c96ff5ee77
    environment:
      CLICKHOUSE_USER: observability
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-observability}
      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"
    ulimits:
      nofile:
        soft: 262144
        hard: 262144
    volumes:
      - clickhouse-data:/var/lib/clickhouse
    healthcheck:
      test: ["CMD", "clickhouse-client", "--user", "observability", "--password", "${CLICKHOUSE_PASSWORD:-observability}", "--query", "SELECT 1"]
      interval: 2s
      timeout: 3s
      retries: 20

  observability:
    image: moqt-observability:local
    build:
      context: .
      dockerfile: crates/observability/Dockerfile
    environment:
      OBSERVABILITY_RELAYS: relay-a=moqt://relay-a:444,relay-b=moqt://relay-b:444
      # The relay token opens the inner endpoint without expiring; see docs/architecture/observability/architecture.md.
      OBSERVABILITY_AUTH_TOKEN: ${AUTH_RELAY_TOKEN:-eyJhbGciOiJIUzI1NiJ9.eyJhcHBJZCI6IjExMTExMTExLTIyMjItMzMzMy00NDQ0LTU1NTU1NTU1NTU1NSIsInB1Ymxpc2giOiIiLCJzdWJzY3JpYmUiOiIiLCJpYXQiOjE3ODkwOTMzMzMsImV4cCI6MjEwNDQ1MzMzM30.F_vveCJktf2C5cAnojDN_wLUZm6ILQpCACOvXxezqD4}
      OBSERVABILITY_INSECURE: "1"
      CLICKHOUSE_URL: http://clickhouse:8123
      CLICKHOUSE_USER: observability
      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-observability}
    ports:
      - "8095:8095"
    depends_on:
      clickhouse:
        condition: service_healthy
      relay-a:
        condition: service_started
      relay-b:
        condition: service_started

volumes:
  clickhouse-data: