From 6583eba3ff588fdad83ad636a1b1ad759b51ce34 Mon Sep 17 00:00:00 2001 From: Andreas Motl Date: Sun, 16 Feb 2025 12:07:59 +0100 Subject: [PATCH] Docker/Podman: Add basic runnable Docker Compose example for CrateDB+SSL --- operation/docker/ssl/README.md | 25 +++++++++++++++++++++++++ operation/docker/ssl/compose.yml | 28 ++++++++++++++++++++++++++++ operation/docker/ssl/crate.yml | 24 ++++++++++++++++++++++++ operation/docker/ssl/keystore | Bin 0 -> 4261 bytes operation/docker/ssl/truststore | Bin 0 -> 1049 bytes 5 files changed, 77 insertions(+) create mode 100644 operation/docker/ssl/README.md create mode 100644 operation/docker/ssl/compose.yml create mode 100644 operation/docker/ssl/crate.yml create mode 100644 operation/docker/ssl/keystore create mode 100644 operation/docker/ssl/truststore diff --git a/operation/docker/ssl/README.md b/operation/docker/ssl/README.md new file mode 100644 index 00000000..517a9acd --- /dev/null +++ b/operation/docker/ssl/README.md @@ -0,0 +1,25 @@ +# CrateDB with SSL on Docker + +## About + +A service composition file (Docker or Podman) for running CrateDB +with SSL enabled. + +## Usage +```shell +docker compose up +``` + +## Rationale + +Void of relevant ready-to-run examples. + +- https://cratedb.com/docs/guide/install/container/ +- https://cratedb.com/docs/guide/install/container/docker.html +- https://cratedb.com/docs/crate/reference/en/latest/admin/ssl.html + +## Blueprint + +`crate-pdo` includes an example setup using Docker Compose. + +- https://github.com/crate/crate-pdo/tree/2.2.2/test/provisioning diff --git a/operation/docker/ssl/compose.yml b/operation/docker/ssl/compose.yml new file mode 100644 index 00000000..b7673b71 --- /dev/null +++ b/operation/docker/ssl/compose.yml @@ -0,0 +1,28 @@ +# Purpose: +# Start CrateDB with custom parameters and wait for the service being available, +# even when invoked through `docker compose up --detach`. + +services: + + cratedb: + image: crate/crate:nightly + command: ["crate", "-Cstats.enabled=true"] + ports: + - 4200:4200 + volumes: + - ./crate.yml:/crate/config/crate.yml + - ./keystore:/crate/config/keystore + - ./truststore:/crate/config/truststore + healthcheck: + test: ["CMD", "curl", "--fail", "--insecure", "https://localhost:4200"] + start_period: 3s + interval: 0.5s + retries: 30 + timeout: 30s + + # https://marcopeg.com/2019/docker-compose-healthcheck/ + start_dependencies: + image: dadarek/wait-for-dependencies + depends_on: + cratedb: + condition: service_healthy diff --git a/operation/docker/ssl/crate.yml b/operation/docker/ssl/crate.yml new file mode 100644 index 00000000..a6a23db7 --- /dev/null +++ b/operation/docker/ssl/crate.yml @@ -0,0 +1,24 @@ +auth.host_based.enabled: true +auth: + host_based: + config: + 1: + user: crate + method: trust + + 99: + method: password + +ssl.http.enabled: true +ssl.psql.enabled: true +ssl.keystore_filepath: /crate/config/keystore +ssl.keystore_password: crate.io +ssl.keystore_key_password: crate.io +ssl.truststore_filepath: /crate/config/truststore +ssl.truststore_password: crate.io + +path: + logs: /var/log/crate + data: /data/crate + +network.bind_host: 0.0.0.0 diff --git a/operation/docker/ssl/keystore b/operation/docker/ssl/keystore new file mode 100644 index 0000000000000000000000000000000000000000..5843e1d4023c86373db78b4a46c288cc92639029 GIT binary patch literal 4261 zcmeH~c{J4PAIIlw#xRU6%*dXU5Y1o|A)%`*Q%HtnAI;bslO+^$L(P>TTO?VM%9efK zvX77o*&=IP`;wiX`rX^Pw{y?A|NPGH{&W9${&?Qc=Q-y&pY#5l=k?y1*_i=>Kn&j( zj7-4WT9aH|$siD5y~XSE3dD$$#h{cxAaFN|0)B_0Fq9>N82|K2+61%rZ(Ay94xtuttjz4N^dGaRacCpi&aeixX&3kVd?*9sOm zn3POp}ql+L?tev(i%(!;uF3sk(o2uQhr!hW-W5IY0`;h7$!J*PYS>bD2Ds2yKFF8zp^@Ej$wX8@st5Iz*b|E~++ zUkkV)j3_Vw?EbOmdsf}+IRIjqjz)&f3(5{(Y7jh9^TJO=hfiUC*HB7gV?f_Hci0N^ z%m5Q#dBAWY3RHI)?3COQL$uW00ChztEit*~KWgsVbxRY67hUg!+=1U}mQ0=-|48BP z?P|#>G*&X5@B~R~9=>~YHRMg*4QUN=s(~kb-4a&I3n3GYF z>{QfXn?ib@AGxKvA(^-pnaM)QAg#N*rC_OeHL&w>ft1 zChccV9DY_t5J>WOp7-oT>#`I~B~L5O-giG;RWTyNlxbTy)wO+L(x*ooAT}*{51YGR zzHJawY)V#;_f=TJ7TB(zz=sfL`A~ZNpU3M7=%?OaviW=MPXJ8nA<$kPT_TQ|x^d}U zMb@(5Wh3&448QXQT18;@4d;RgZ7FkV&8iI{ zxkR`2Rh^G)YgQ3&Uga1*Lh(f&`qkB3u^ZuiNtdqTr?$d zS~8q`n&Y)vU%2k}3pk$NTBCo|^_sWvFIJPUg9efE;^i(&@I*h^mh|Oaon) zrToUVIuZwE@})MZRhBFvHQB3C9uBsB?L3CD&UU+{O>@4HT+G=00f3XPWA3pJywTjm zSZnJhmqYAbJyws^ReUsj6A@3DLR=3D1#TxZUE|lv3uA6iaS0xgm;%x!3uKV=x&xl6 zX`2=OnlK`q(!}qgw17sL*YPO$XIrP!tFOq)lZypwNWuP^gPKIPl!lPV$eI~ zV0X0njA&H5SKFD|zULXb;B184P5y(ymp-#wsKQ)u#;@|H(D81INhus=i2`OEF_=wd z2gX9NA|H23c`aQiqv1jB=183+P|p)NHT0A@RAH-ht-y<7TiG5n8L|vMalkm`pv((e z+6t7VOgY|DkS$f=P}JXFXQ|!J-#iavHM*Ulpkz(ebn$=IC;!U;mDVq9 z$n|LhyFy>d)Ef%8#6vl&ZQ!z3ejr*4Hu(xi^eG_J-m|pwbpaAI3 zazg|Gx^qs%Xt zrh_yLEn?G4%hFBlevh7guGTTe@Yd?uE4^4X04{Hw^PqPWn}|W-$I66@AAa${zmQ+`}LHJ@QH4(f07^$m;&#JNf6a;!otGaQp}I z*%MF!{(ntp+&|LUcj0$B+<;FU?NK%p}EGU(RN}xu#hH91_WUy;{nGM!dRB7LBhXgul%M+23;u3z|JnO-HUo>tt8dV5 z4vWSXc@mM8a0=|#q5=%9n14o6-jUh6T6I=AFSFHq90zaK5LuBMj#H^0Xy8fSTIQtn zc8!-fNf^{179R23I9hL{h1J(6E3v{e!6F5m!NwCZ{h4F^ncvvw2Wx#JmFFvL3^JK? zAhPo&*Ieb5mqEu1X<}Q7ou5bJI9Tn3d3KsB+>IUxsvS}FeBKQSO+hZ7w9-GDvSDIn z**R`d8=99tl>vH4U6huw;f^Zj5(VikML**o)j#MPB9+$cHmki>fSv6WQ68T8iFB74 zRVrj+fHg1A6H}0=x;A&3N^Xb5@y*OytelVz)7G;zR&Vi8yb{r1k=2NUQFDv{8e@{8 z0J3TK^tl~%y=?pAox-|-i-e%Vl$Sib(~cK*#G-}2M%1Npy- mOMf?y|7MYYv&jD`i)?5vr1ia(&$~TQM%)%SaMIL!Iqg4DvERl3 literal 0 HcmV?d00001 diff --git a/operation/docker/ssl/truststore b/operation/docker/ssl/truststore new file mode 100644 index 0000000000000000000000000000000000000000..b75fce13d1ffe8ad42ae2744a7861cad721826d0 GIT binary patch literal 1049 zcmezO_TO6u1_mY|W(3omB^jy7iADMOB|wqHKcd^27+53pObsj<7?`gcG%;T`XkyyE zfSHMriHVb;<)q$%idW1(4S3l&wc0$|zVk9NaYUCZ)6A* zFfufN3Jkmxn;4algN>1ufw_s1pTVGsk&CH`k&)qmQQ_%xwc6X4Zu#cECFj85|L^~- z6LN~4E%wVsF`?^cl&rkco%82e&%R{;{qFqq+cC%f-aj?<^76C;P3)_G^p`Dq_vKt- z=nqbjDxjyrw_T>6mQS)BMZ92iLOOwAaT5|H?Ud(k?Sek3szA#P$v)-#`Al zbvAt~dcd+fzog^gt!aLL&WO246@O^`e15r1X=#w$Z=gFSPb};4+JCFHQsetC<^&HJ zndX#*;;JWN#QaXR1#WTzz>`R zWcgUcSVZ33?_YT;x5oE;W1gM)Pjl_L92qMOcW=6*U z$YBmls=zR3WMFzTO?<)!8NEkg$7D1PuBw&yk}&!3KS)dc*InPxO^*^xR|J~Q*{2xv zd@93{Xy%+n7pG^&d;em%Hf`Z&_WUh#Pu~7tuv~>_d+Ak{4xajxnv32)yVoRq>)Pp! z+d?fPpO-UeJF9i-eDAq%q)OY%G$iZsff-kJ)I4A-i`a2ot?W&9!=7VS5%W#0r%vH> zQO@FX)$XXf67&7D>l!oXNBcTtp0EAIdey5&K5~uwjSrFjch;64{CGV)^Ma1?L#yxW zC8poE=i%8Hk(*P_625~`ZOP<`jS?T6X4W_IO<&qSVZE89qLZNQE~{C!Q)l?U*;ZB1 t(^ZwC#@7F-b7suEwG0z)R8%}j%{-yvH>*2W=Z@bd)uqx?3|4;i0RZZdjP3vc literal 0 HcmV?d00001