name: kyon-coraza

x-python-image: &python-image
  build:
    context: .
    dockerfile: deploy/coraza/Python.Dockerfile
  image: kyon-python:local

x-caddy-image: &caddy-image
  build:
    context: .
    dockerfile: deploy/coraza/Dockerfile
    args:
      CADDY_VERSION: 2.11.4
      CORAZA_CADDY_VERSION: v2.5.0
  image: kyon-caddy-coraza:2.11.4-v2.5.0

x-hardened: &hardened
  init: true
  read_only: true
  cap_drop:
    - ALL
  security_opt:
    - no-new-privileges:true

services:
  policy-init:
    <<: [*python-image, *hardened]
    command:
      - kyon-coraza
      - render
      - --rules
      - /policy/rules.json
      - --exceptions
      - /policy/exceptions.json
      - --output
      - /etc/kyon/generated
      - --origin
      - http://issuer:8081
      - --listen
      - :8080
      - --profile
      - ${KYON_PROFILE:-observe}
      - --request-body-limit
      - ${KYON_MAX_BODY_BYTES:-1000000}
      - --request-body-no-files-limit
      - ${KYON_MAX_BODY_BYTES:-1000000}
      - --audit-log-type
      - "off"
    network_mode: none
    tmpfs:
      - /tmp
    volumes:
      - generated-policy:/etc/kyon/generated
      - ${KYON_RULES_FILE:-./src/kyon/rules/edge.json}:/policy/rules.json:ro
      - ${KYON_EXCEPTIONS_FILE:-./deploy/coraza/exceptions.json}:/policy/exceptions.json:ro
    restart: "no"

  caddy-validate:
    <<: [*caddy-image, *hardened]
    command: ["caddy", "validate", "--config", "/etc/kyon/generated/Caddyfile", "--adapter", "caddyfile"]
    depends_on:
      policy-init:
        condition: service_completed_successfully
    network_mode: none
    tmpfs:
      - /tmp
    volumes:
      - generated-policy:/etc/kyon/generated:ro
    restart: "no"

  caddy:
    <<: [*caddy-image, *hardened]
    command: ["caddy", "run", "--config", "/etc/kyon/generated/Caddyfile", "--adapter", "caddyfile"]
    depends_on:
      caddy-validate:
        condition: service_completed_successfully
      issuer:
        condition: service_started
    ports:
      - "${KYON_BIND_HOST:-127.0.0.1}:${KYON_HTTP_PORT:-8080}:8080"
    tmpfs:
      - /tmp
    volumes:
      - generated-policy:/etc/kyon/generated:ro
      - caddy-data:/data
      - caddy-config:/config
    networks:
      - ingress
      - edge
    restart: unless-stopped

  issuer:
    <<: *hardened
    cap_add:
      - DAC_READ_SEARCH
    build:
      context: .
      dockerfile: deploy/coraza/Go.Dockerfile
      target: gateway
    image: kyon-gateway:local
    command:
      - --mode
      - issuer
      - --listen
      - :8081
      - --upstream
      - http://verifier:8090
      - --grant-key-file
      - /run/secrets/grant-key
      - --allow-foreign-owned-grant-key
      - --service
      - ${KYON_SERVICE:-demo}
      - --release
      - ${KYON_RELEASE:-v1}
      - --policy-generation
      - ${KYON_POLICY_GENERATION:-1}
      - --audience
      - kyon-origin
      - --key-id
      - default
      - --grant-ttl
      - ${KYON_GRANT_TTL:-30s}
      - --max-body-bytes
      - ${KYON_MAX_BODY_BYTES:-1000000}
    depends_on:
      verifier:
        condition: service_started
    secrets:
      - source: grant-key
        target: grant-key
        mode: 0400
    tmpfs:
      - /tmp:size=${KYON_SPOOL_TMPFS_SIZE:-64m},mode=1777
    networks:
      - edge
      - admission
    restart: unless-stopped

  verifier:
    <<: *hardened
    cap_add:
      - DAC_READ_SEARCH
    build:
      context: .
      dockerfile: deploy/coraza/Go.Dockerfile
      target: gateway
    image: kyon-gateway:local
    command:
      - --mode
      - verifier
      - --listen
      - :8090
      - --upstream
      - http://demo-origin:9000
      - --grant-key-file
      - /run/secrets/grant-key
      - --allow-foreign-owned-grant-key
      - --service
      - ${KYON_SERVICE:-demo}
      - --release
      - ${KYON_RELEASE:-v1}
      - --policy-generation
      - ${KYON_POLICY_GENERATION:-1}
      - --audience
      - kyon-origin
      - --key-id
      - default
      - --max-body-bytes
      - ${KYON_MAX_BODY_BYTES:-1000000}
    depends_on:
      demo-origin:
        condition: service_started
    secrets:
      - source: grant-key
        target: grant-key
        mode: 0400
    tmpfs:
      - /tmp:size=${KYON_SPOOL_TMPFS_SIZE:-64m},mode=1777
    networks:
      - admission
      - origin
    restart: unless-stopped

  demo-origin:
    <<: *hardened
    build:
      context: .
      dockerfile: deploy/coraza/Go.Dockerfile
      target: demo
    image: kyon-demo-origin:local
    command: ["--listen", ":9000"]
    networks:
      - origin
    restart: unless-stopped

volumes:
  generated-policy:
  caddy-data:
  caddy-config:

networks:
  ingress:
  edge:
    internal: true
  admission:
    internal: true
  origin:
    internal: true
secrets:
  grant-key:
    file: ${KYON_GRANT_KEY_FILE:-./grant.key}