mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
a718cef8ce
Only the static family read FIPS_TEST_IMAGE; the firewall, ACL, nat, sidecar and both Tor compose files named the shared mutable tag directly, which is why the local CI runner has to retag its per-run image to that name. They now take the same defaulted form the static file already uses, so a harness run resolves the image it built and a bare hand run still resolves the shared tag exactly as before. Checked by rendering each file through `docker compose config` with the variables set: every service resolves to the supplied name and none is left naming the shared tag.
52 lines
1.5 KiB
YAML
52 lines
1.5 KiB
YAML
networks:
|
|
fips-net:
|
|
name: ${FIPS_NETWORK:-fips-sidecar-net}
|
|
driver: bridge
|
|
# Reap label: this harness uses fixed -p sidecar-{a,b,c} project names
|
|
# (the test execs containers by those derived names), so its resources are
|
|
# NOT covered by ci-local's fipsci_ project prefix. Label them directly so
|
|
# ci-cleanup.sh can still reap them after a preemption/SIGKILL.
|
|
labels:
|
|
- "com.corganlabs.fips-ci=1"
|
|
ipam:
|
|
config:
|
|
- subnet: ${FIPS_SUBNET:-172.20.1.0/24}
|
|
|
|
services:
|
|
fips:
|
|
image: ${FIPS_TEST_IMAGE:-fips-test:latest}
|
|
hostname: fips-sidecar
|
|
labels:
|
|
- "com.corganlabs.fips-ci=1"
|
|
cap_add:
|
|
- NET_ADMIN
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=0
|
|
restart: "no"
|
|
environment:
|
|
- RUST_LOG=${RUST_LOG:-info}
|
|
- FIPS_TEST_MODE=sidecar
|
|
- FIPS_NSEC=${FIPS_NSEC}
|
|
- FIPS_PEER_NPUB=${FIPS_PEER_NPUB:-}
|
|
- FIPS_PEER_ADDR=${FIPS_PEER_ADDR:-}
|
|
- FIPS_PEER_ALIAS=${FIPS_PEER_ALIAS:-peer}
|
|
- FIPS_UDP_BIND=${FIPS_UDP_BIND:-0.0.0.0:2121}
|
|
- FIPS_TUN_MTU=${FIPS_TUN_MTU:-1280}
|
|
- FIPS_PEER_TRANSPORT=${FIPS_PEER_TRANSPORT:-udp}
|
|
networks:
|
|
fips-net:
|
|
ipv4_address: ${FIPS_IPV4:-172.20.1.20}
|
|
|
|
app:
|
|
image: ${FIPS_TEST_APP_IMAGE:-fips-test-app:latest}
|
|
labels:
|
|
- "com.corganlabs.fips-ci=1"
|
|
network_mode: "service:fips"
|
|
depends_on:
|
|
- fips
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
command: ["sleep", "infinity"]
|