Skip to content

Commit 2ef97ad

Browse files
jeremijeremi
committed
Split Solmara Coolify deployment by authority
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
1 parent 9c00e85 commit 2ef97ad

25 files changed

Lines changed: 2746 additions & 294 deletions

‎README.md‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -85,11 +85,28 @@ Stack `v0.8.4` Relay requirements.
8585

8686
## Hosted Deployment
8787

88-
Coolify should use `compose.coolify.yaml`. It removes host port bindings and
89-
avoids repo bind mounts because Coolify does not seed bind-mount sources from
90-
the Git checkout. The `release-candidate` workflow builds digest-pinned
91-
Solmara-owned images for the hosted wrappers and app services, then writes the
92-
digest refs to the workflow summary for Coolify env vars:
88+
Coolify uses one hosted compose file for the lab edge plus one compose file per
89+
pseudo-government authority:
90+
91+
- `compose.coolify.yaml` for the Visitor Center, portal, scenario runner, and
92+
static metadata.
93+
- `compose.coolify.interior.yaml` for CRA, NIA, and the NIA Postgres store.
94+
- `compose.coolify.social-development.yaml` for SRO, MoSD programme MIS, and
95+
the child benefit notary.
96+
- `compose.coolify.labour-pensions.yaml` for SIPF and the pension notary.
97+
- `compose.coolify.agriculture.yaml` for NAgDI and the agriculture notary.
98+
- `compose.coolify.citizen-services.yaml` for the citizen services notary.
99+
100+
The hosted compose files remove host port bindings and avoid repo bind mounts
101+
because Coolify does not seed bind-mount sources from the Git checkout. They do
102+
not define custom Docker networks; cross-authority calls use the public
103+
`*.solmara.registrystack.org` TLS endpoints. Run
104+
`uv run scripts/render-hosted-configs.py` after editing Relay or Notary configs
105+
so the hosted config overlays stay current.
106+
107+
The `release-candidate` workflow builds digest-pinned Solmara-owned images for
108+
the hosted wrappers and app services, then writes the digest refs to the
109+
workflow summary for Coolify env vars:
93110
`SOLMARA_RELAY_IMAGE`, `SOLMARA_NOTARY_IMAGE`, `SOLMARA_POSTGRES_IMAGE`,
94111
`SOLMARA_STATIC_METADATA_IMAGE`, `SOLMARA_HOME_IMAGE`,
95112
`SOLMARA_PORTAL_IMAGE`, and `SOLMARA_SCENARIO_RUNNER_IMAGE`.

‎compose.coolify.agriculture.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: solmara-lab-agriculture
2+
3+
x-relay-environment: &relay-environment
4+
RUST_LOG: ${RUST_LOG:-info}
5+
REGISTRY_RELAY_AUDIT_HASH_SECRET: ${REGISTRY_RELAY_AUDIT_HASH_SECRET:?set REGISTRY_RELAY_AUDIT_HASH_SECRET}
6+
7+
x-notary-environment: &notary-environment
8+
RUST_LOG: ${RUST_LOG:-info}
9+
REGISTRY_NOTARY_AUDIT_HASH_SECRET: ${REGISTRY_NOTARY_AUDIT_HASH_SECRET:?set REGISTRY_NOTARY_AUDIT_HASH_SECRET}
10+
REGISTRY_NOTARY_REDIS_URL: redis://redis:6379/
11+
REGISTRY_NOTARY_REPLAY_REDIS_URL: ${REGISTRY_NOTARY_REPLAY_REDIS_URL:-redis://redis:6379/0}
12+
REGISTRY_PLATFORM_REDIS_TEST_URL: redis://redis:6379/
13+
14+
x-relay-common: &relay-common
15+
image: ${SOLMARA_RELAY_IMAGE:?set digest-pinned Solmara relay image}
16+
platform: ${REGISTRY_STACK_PLATFORM:-linux/amd64}
17+
restart: unless-stopped
18+
environment: *relay-environment
19+
healthcheck:
20+
test: ["CMD", "/usr/local/bin/registry-relay", "healthcheck"]
21+
interval: 30s
22+
timeout: 10s
23+
retries: 3
24+
25+
x-notary-common: &notary-common
26+
image: ${SOLMARA_NOTARY_IMAGE:?set digest-pinned Solmara notary image}
27+
platform: ${REGISTRY_STACK_PLATFORM:-linux/amd64}
28+
restart: unless-stopped
29+
environment: *notary-environment
30+
healthcheck:
31+
test: ["CMD", "/usr/local/bin/registry-notary", "healthcheck"]
32+
interval: 30s
33+
timeout: 10s
34+
retries: 3
35+
depends_on:
36+
redis:
37+
condition: service_healthy
38+
39+
services:
40+
redis:
41+
image: ${REDIS_IMAGE:-redis:7.4-alpine}
42+
command: ["redis-server", "--save", "", "--appendonly", "no"]
43+
healthcheck:
44+
test: ["CMD", "redis-cli", "ping"]
45+
interval: 5s
46+
timeout: 3s
47+
retries: 10
48+
49+
nagdi-agriculture-relay:
50+
<<: *relay-common
51+
command: ["--config", "/var/lib/solmara/ministries/agriculture-nagdi/config/relay.yaml"]
52+
environment:
53+
<<: *relay-environment
54+
NAGDI_NOTARY_SOURCE_HASH: ${NAGDI_NOTARY_SOURCE_HASH}
55+
NAGDI_CITIZEN_SOURCE_HASH: ${NAGDI_CITIZEN_SOURCE_HASH}
56+
PORTAL_RELAY_TOKEN_HASH: ${PORTAL_RELAY_TOKEN_HASH}
57+
labels:
58+
solmara.lab.host: nagdi-relay.solmara.registrystack.org
59+
60+
nagdi-notary:
61+
<<: *notary-common
62+
command: ["--config", "/etc/registry-notary/nagdi.yaml"]
63+
environment:
64+
<<: *notary-environment
65+
NAGDI_CLIENT_TOKEN_HASH: ${NAGDI_CLIENT_TOKEN_HASH}
66+
NAGDI_NOTARY_ISSUER_JWK: ${NAGDI_NOTARY_ISSUER_JWK}
67+
NAGDI_NOTARY_SOURCE_RAW: ${NAGDI_NOTARY_SOURCE_RAW}
68+
labels:
69+
solmara.lab.host: nagdi-notary.solmara.registrystack.org

‎compose.coolify.citizen-services.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: solmara-lab-citizen-services
2+
3+
x-notary-environment: &notary-environment
4+
RUST_LOG: ${RUST_LOG:-info}
5+
REGISTRY_NOTARY_AUDIT_HASH_SECRET: ${REGISTRY_NOTARY_AUDIT_HASH_SECRET:?set REGISTRY_NOTARY_AUDIT_HASH_SECRET}
6+
REGISTRY_NOTARY_REDIS_URL: redis://redis:6379/
7+
REGISTRY_NOTARY_REPLAY_REDIS_URL: ${REGISTRY_NOTARY_REPLAY_REDIS_URL:-redis://redis:6379/0}
8+
REGISTRY_PLATFORM_REDIS_TEST_URL: redis://redis:6379/
9+
10+
x-notary-common: &notary-common
11+
image: ${SOLMARA_NOTARY_IMAGE:?set digest-pinned Solmara notary image}
12+
platform: ${REGISTRY_STACK_PLATFORM:-linux/amd64}
13+
restart: unless-stopped
14+
environment: *notary-environment
15+
healthcheck:
16+
test: ["CMD", "/usr/local/bin/registry-notary", "healthcheck"]
17+
interval: 30s
18+
timeout: 10s
19+
retries: 3
20+
depends_on:
21+
redis:
22+
condition: service_healthy
23+
24+
services:
25+
redis:
26+
image: ${REDIS_IMAGE:-redis:7.4-alpine}
27+
command: ["redis-server", "--save", "", "--appendonly", "no"]
28+
healthcheck:
29+
test: ["CMD", "redis-cli", "ping"]
30+
interval: 5s
31+
timeout: 3s
32+
retries: 10
33+
34+
citizen-notary:
35+
<<: *notary-common
36+
command: ["--config", "/etc/registry-notary/citizen.yaml"]
37+
environment:
38+
<<: *notary-environment
39+
CITIZEN_NOTARY_ISSUER_JWK: ${CITIZEN_NOTARY_ISSUER_JWK}
40+
CITIZEN_PORTAL_BFF_TOKEN_HASH: ${CITIZEN_PORTAL_BFF_TOKEN_HASH}
41+
CRA_CITIZEN_SOURCE_RAW: ${CRA_CITIZEN_SOURCE_RAW}
42+
NIA_CITIZEN_SOURCE_RAW: ${NIA_CITIZEN_SOURCE_RAW}
43+
SRO_CITIZEN_SOURCE_RAW: ${SRO_CITIZEN_SOURCE_RAW}
44+
PROGRAMME_CITIZEN_SOURCE_RAW: ${PROGRAMME_CITIZEN_SOURCE_RAW}
45+
SIPF_CITIZEN_SOURCE_RAW: ${SIPF_CITIZEN_SOURCE_RAW}
46+
NAGDI_CITIZEN_SOURCE_RAW: ${NAGDI_CITIZEN_SOURCE_RAW}
47+
labels:
48+
solmara.lab.host: citizen-notary.solmara.registrystack.org

‎compose.coolify.interior.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: solmara-lab-interior
2+
3+
x-relay-environment: &relay-environment
4+
RUST_LOG: ${RUST_LOG:-info}
5+
REGISTRY_RELAY_AUDIT_HASH_SECRET: ${REGISTRY_RELAY_AUDIT_HASH_SECRET:?set REGISTRY_RELAY_AUDIT_HASH_SECRET}
6+
7+
x-relay-common: &relay-common
8+
image: ${SOLMARA_RELAY_IMAGE:?set digest-pinned Solmara relay image}
9+
platform: ${REGISTRY_STACK_PLATFORM:-linux/amd64}
10+
restart: unless-stopped
11+
environment: *relay-environment
12+
healthcheck:
13+
test: ["CMD", "/usr/local/bin/registry-relay", "healthcheck"]
14+
interval: 30s
15+
timeout: 10s
16+
retries: 3
17+
18+
services:
19+
postgres:
20+
image: ${SOLMARA_POSTGRES_IMAGE:?set digest-pinned Solmara Postgres image}
21+
entrypoint: ["/bin/sh", "/usr/local/bin/solmara-postgres-entrypoint.sh"]
22+
command:
23+
- postgres
24+
- -c
25+
- ssl=on
26+
- -c
27+
- ssl_cert_file=/var/lib/postgresql/server-ssl/server.crt
28+
- -c
29+
- ssl_key_file=/var/lib/postgresql/server-ssl/server.key
30+
environment:
31+
POSTGRES_USER: ${SOLMARA_POSTGRES_USER:-solmara_registry}
32+
POSTGRES_PASSWORD: ${SOLMARA_POSTGRES_PASSWORD}
33+
POSTGRES_DB: ${SOLMARA_POSTGRES_DB:-solmara_lab}
34+
volumes:
35+
- postgres-data:/var/lib/postgresql/data
36+
healthcheck:
37+
test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
38+
interval: 5s
39+
timeout: 5s
40+
retries: 10
41+
42+
cra-civil-relay:
43+
<<: *relay-common
44+
command: ["--config", "/var/lib/solmara/ministries/interior-civil/config/relay.yaml"]
45+
environment:
46+
<<: *relay-environment
47+
CRA_CHILD_BENEFIT_SOURCE_HASH: ${CRA_CHILD_BENEFIT_SOURCE_HASH}
48+
CRA_PENSION_SOURCE_HASH: ${CRA_PENSION_SOURCE_HASH}
49+
CRA_CITIZEN_SOURCE_HASH: ${CRA_CITIZEN_SOURCE_HASH}
50+
PORTAL_RELAY_TOKEN_HASH: ${PORTAL_RELAY_TOKEN_HASH}
51+
labels:
52+
solmara.lab.host: cra-relay.solmara.registrystack.org
53+
54+
nia-population-relay:
55+
<<: *relay-common
56+
command: ["--config", "/var/lib/solmara/ministries/interior-population/config/relay.yaml"]
57+
environment:
58+
<<: *relay-environment
59+
SOLMARA_NIA_DATABASE_URL: ${SOLMARA_NIA_DATABASE_URL}
60+
DATA_GATE_POSTGRES_ROOT_CERT_PATH: /etc/solmara/postgres/root.crt
61+
NIA_CHILD_BENEFIT_SOURCE_HASH: ${NIA_CHILD_BENEFIT_SOURCE_HASH}
62+
NIA_PENSION_SOURCE_HASH: ${NIA_PENSION_SOURCE_HASH}
63+
NIA_CITIZEN_SOURCE_HASH: ${NIA_CITIZEN_SOURCE_HASH}
64+
PORTAL_RELAY_TOKEN_HASH: ${PORTAL_RELAY_TOKEN_HASH}
65+
depends_on:
66+
postgres:
67+
condition: service_healthy
68+
labels:
69+
solmara.lab.host: nia-relay.solmara.registrystack.org
70+
71+
volumes:
72+
postgres-data:

‎compose.coolify.labour-pensions.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: solmara-lab-labour-pensions
2+
3+
x-relay-environment: &relay-environment
4+
RUST_LOG: ${RUST_LOG:-info}
5+
REGISTRY_RELAY_AUDIT_HASH_SECRET: ${REGISTRY_RELAY_AUDIT_HASH_SECRET:?set REGISTRY_RELAY_AUDIT_HASH_SECRET}
6+
7+
x-notary-environment: &notary-environment
8+
RUST_LOG: ${RUST_LOG:-info}
9+
REGISTRY_NOTARY_AUDIT_HASH_SECRET: ${REGISTRY_NOTARY_AUDIT_HASH_SECRET:?set REGISTRY_NOTARY_AUDIT_HASH_SECRET}
10+
REGISTRY_NOTARY_REDIS_URL: redis://redis:6379/
11+
REGISTRY_NOTARY_REPLAY_REDIS_URL: ${REGISTRY_NOTARY_REPLAY_REDIS_URL:-redis://redis:6379/0}
12+
REGISTRY_PLATFORM_REDIS_TEST_URL: redis://redis:6379/
13+
14+
x-relay-common: &relay-common
15+
image: ${SOLMARA_RELAY_IMAGE:?set digest-pinned Solmara relay image}
16+
platform: ${REGISTRY_STACK_PLATFORM:-linux/amd64}
17+
restart: unless-stopped
18+
environment: *relay-environment
19+
healthcheck:
20+
test: ["CMD", "/usr/local/bin/registry-relay", "healthcheck"]
21+
interval: 30s
22+
timeout: 10s
23+
retries: 3
24+
25+
x-notary-common: &notary-common
26+
image: ${SOLMARA_NOTARY_IMAGE:?set digest-pinned Solmara notary image}
27+
platform: ${REGISTRY_STACK_PLATFORM:-linux/amd64}
28+
restart: unless-stopped
29+
environment: *notary-environment
30+
healthcheck:
31+
test: ["CMD", "/usr/local/bin/registry-notary", "healthcheck"]
32+
interval: 30s
33+
timeout: 10s
34+
retries: 3
35+
depends_on:
36+
redis:
37+
condition: service_healthy
38+
39+
services:
40+
redis:
41+
image: ${REDIS_IMAGE:-redis:7.4-alpine}
42+
command: ["redis-server", "--save", "", "--appendonly", "no"]
43+
healthcheck:
44+
test: ["CMD", "redis-cli", "ping"]
45+
interval: 5s
46+
timeout: 3s
47+
retries: 10
48+
49+
sipf-pensions-relay:
50+
<<: *relay-common
51+
command: ["--config", "/var/lib/solmara/ministries/labour-pensions/config/relay.yaml"]
52+
environment:
53+
<<: *relay-environment
54+
SIPF_PENSION_SOURCE_HASH: ${SIPF_PENSION_SOURCE_HASH}
55+
SIPF_CITIZEN_SOURCE_HASH: ${SIPF_CITIZEN_SOURCE_HASH}
56+
PORTAL_RELAY_TOKEN_HASH: ${PORTAL_RELAY_TOKEN_HASH}
57+
labels:
58+
solmara.lab.host: sipf-relay.solmara.registrystack.org
59+
60+
pension-notary:
61+
<<: *notary-common
62+
command: ["--config", "/etc/registry-notary/pension.yaml"]
63+
environment:
64+
<<: *notary-environment
65+
PENSION_CLIENT_TOKEN_HASH: ${PENSION_CLIENT_TOKEN_HASH}
66+
PENSION_NOTARY_ISSUER_JWK: ${PENSION_NOTARY_ISSUER_JWK}
67+
CRA_PENSION_SOURCE_RAW: ${CRA_PENSION_SOURCE_RAW}
68+
NIA_PENSION_SOURCE_RAW: ${NIA_PENSION_SOURCE_RAW}
69+
SIPF_PENSION_SOURCE_RAW: ${SIPF_PENSION_SOURCE_RAW}
70+
PROGRAMME_PENSION_SOURCE_RAW: ${PROGRAMME_PENSION_SOURCE_RAW}
71+
labels:
72+
solmara.lab.host: pension-notary.solmara.registrystack.org

‎compose.coolify.social-development.yaml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
name: solmara-lab-social-development
2+
3+
x-relay-environment: &relay-environment
4+
RUST_LOG: ${RUST_LOG:-info}
5+
REGISTRY_RELAY_AUDIT_HASH_SECRET: ${REGISTRY_RELAY_AUDIT_HASH_SECRET:?set REGISTRY_RELAY_AUDIT_HASH_SECRET}
6+
7+
x-notary-environment: &notary-environment
8+
RUST_LOG: ${RUST_LOG:-info}
9+
REGISTRY_NOTARY_AUDIT_HASH_SECRET: ${REGISTRY_NOTARY_AUDIT_HASH_SECRET:?set REGISTRY_NOTARY_AUDIT_HASH_SECRET}
10+
REGISTRY_NOTARY_REDIS_URL: redis://redis:6379/
11+
REGISTRY_NOTARY_REPLAY_REDIS_URL: ${REGISTRY_NOTARY_REPLAY_REDIS_URL:-redis://redis:6379/0}
12+
REGISTRY_PLATFORM_REDIS_TEST_URL: redis://redis:6379/
13+
14+
x-relay-common: &relay-common
15+
image: ${SOLMARA_RELAY_IMAGE:?set digest-pinned Solmara relay image}
16+
platform: ${REGISTRY_STACK_PLATFORM:-linux/amd64}
17+
restart: unless-stopped
18+
environment: *relay-environment
19+
healthcheck:
20+
test: ["CMD", "/usr/local/bin/registry-relay", "healthcheck"]
21+
interval: 30s
22+
timeout: 10s
23+
retries: 3
24+
25+
x-notary-common: &notary-common
26+
image: ${SOLMARA_NOTARY_IMAGE:?set digest-pinned Solmara notary image}
27+
platform: ${REGISTRY_STACK_PLATFORM:-linux/amd64}
28+
restart: unless-stopped
29+
environment: *notary-environment
30+
healthcheck:
31+
test: ["CMD", "/usr/local/bin/registry-notary", "healthcheck"]
32+
interval: 30s
33+
timeout: 10s
34+
retries: 3
35+
depends_on:
36+
redis:
37+
condition: service_healthy
38+
39+
services:
40+
redis:
41+
image: ${REDIS_IMAGE:-redis:7.4-alpine}
42+
command: ["redis-server", "--save", "", "--appendonly", "no"]
43+
healthcheck:
44+
test: ["CMD", "redis-cli", "ping"]
45+
interval: 5s
46+
timeout: 3s
47+
retries: 10
48+
49+
sro-social-relay:
50+
<<: *relay-common
51+
command: ["--config", "/var/lib/solmara/ministries/social-development/config/sro-relay.yaml"]
52+
environment:
53+
<<: *relay-environment
54+
SRO_CHILD_BENEFIT_SOURCE_HASH: ${SRO_CHILD_BENEFIT_SOURCE_HASH}
55+
SRO_CITIZEN_SOURCE_HASH: ${SRO_CITIZEN_SOURCE_HASH}
56+
PORTAL_RELAY_TOKEN_HASH: ${PORTAL_RELAY_TOKEN_HASH}
57+
labels:
58+
solmara.lab.host: sro-relay.solmara.registrystack.org
59+
60+
programme-mis-relay:
61+
<<: *relay-common
62+
command: ["--config", "/var/lib/solmara/ministries/social-development/config/programme-mis-relay.yaml"]
63+
environment:
64+
<<: *relay-environment
65+
PROGRAMME_CHILD_BENEFIT_SOURCE_HASH: ${PROGRAMME_CHILD_BENEFIT_SOURCE_HASH}
66+
PROGRAMME_PENSION_SOURCE_HASH: ${PROGRAMME_PENSION_SOURCE_HASH}
67+
PROGRAMME_CITIZEN_SOURCE_HASH: ${PROGRAMME_CITIZEN_SOURCE_HASH}
68+
PORTAL_RELAY_TOKEN_HASH: ${PORTAL_RELAY_TOKEN_HASH}
69+
labels:
70+
solmara.lab.host: mosd-programme-relay.solmara.registrystack.org
71+
72+
child-benefit-notary:
73+
<<: *notary-common
74+
command: ["--config", "/etc/registry-notary/child-benefit.yaml"]
75+
environment:
76+
<<: *notary-environment
77+
CHILD_BENEFIT_CLIENT_TOKEN_HASH: ${CHILD_BENEFIT_CLIENT_TOKEN_HASH}
78+
CHILD_BENEFIT_NOTARY_ISSUER_JWK: ${CHILD_BENEFIT_NOTARY_ISSUER_JWK}
79+
CRA_CHILD_BENEFIT_SOURCE_RAW: ${CRA_CHILD_BENEFIT_SOURCE_RAW}
80+
NIA_CHILD_BENEFIT_SOURCE_RAW: ${NIA_CHILD_BENEFIT_SOURCE_RAW}
81+
SRO_CHILD_BENEFIT_SOURCE_RAW: ${SRO_CHILD_BENEFIT_SOURCE_RAW}
82+
PROGRAMME_CHILD_BENEFIT_SOURCE_RAW: ${PROGRAMME_CHILD_BENEFIT_SOURCE_RAW}
83+
labels:
84+
solmara.lab.host: child-benefit-notary.solmara.registrystack.org

0 commit comments

Comments
 (0)