Skip to content

Commit 4ec1f54

Browse files
kchudykchudy
authored
Added compose file for testing 2.0 (#120)
* Added compose files for testing 2.0 * Added additional gateways * Added load balancer based on envoy * Removed redundant configuration * Removed redundant setting * Fixed secret env variable * Upgraded postgres
1 parent ee79e86 commit 4ec1f54

4 files changed

Lines changed: 187 additions & 0 deletions

File tree

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
docker-compose/.env
22
docker-compose/.volumes
3+
docker-compose2.0/.volumes
34
.idea
45
terraform/**/terraform.tfstate
56
terraform/**/terraform.tfstate.backup

‎docker-compose2.0/docker-compose.yaml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
services:
2+
core:
3+
image: ghcr.io/defguard/defguard:dev
4+
environment:
5+
DEFGUARD_COOKIE_INSECURE: "true"
6+
DEFGUARD_SECRET_KEY: defguard-secret-key-defguard-secret-key-defguard-secret-key-defguard-secret-key
7+
DEFGUARD_AUTH_SECRET: defguard-auth-secret
8+
DEFGUARD_GATEWAY_SECRET: defguard-gateway-secret
9+
DEFGUARD_YUBIBRIDGE_SECRET: defguard-yubibridge-secret
10+
DEFGUARD_DB_HOST: db
11+
DEFGUARD_DB_PORT: 5432
12+
DEFGUARD_DB_USER: defguard
13+
DEFGUARD_DB_PASSWORD: defguard
14+
DEFGUARD_DB_NAME: defguard
15+
RUST_BACKTRACE: 1
16+
depends_on:
17+
- db
18+
ports:
19+
- "8000:8000"
20+
21+
edge1:
22+
image: ghcr.io/defguard/defguard-proxy:dev
23+
volumes:
24+
- ./.volumes/certs2.0-ha/edge1:/etc/defguard/certs
25+
depends_on:
26+
- core
27+
28+
edge2:
29+
image: ghcr.io/defguard/defguard-proxy:dev
30+
volumes:
31+
- ./.volumes/certs2.0-ha/edge2:/etc/defguard/certs
32+
depends_on:
33+
- core
34+
35+
edge-lb:
36+
image: nginx:1.25-alpine
37+
depends_on:
38+
- edge1
39+
- edge2
40+
ports:
41+
- "8080:8080"
42+
volumes:
43+
- ./nginx/edge.conf:/etc/nginx/conf.d/default.conf:ro
44+
45+
gateway1:
46+
image: ghcr.io/defguard/gateway:dev
47+
depends_on:
48+
- core
49+
cap_add:
50+
- NET_ADMIN
51+
volumes:
52+
- ./.volumes/certs2.0-ha/gateway1:/etc/defguard/certs
53+
environment:
54+
DEFGUARD_STATS_PERIOD: 10
55+
HEALTH_PORT: 55003
56+
57+
gateway2:
58+
image: ghcr.io/defguard/gateway:dev
59+
depends_on:
60+
- core
61+
cap_add:
62+
- NET_ADMIN
63+
volumes:
64+
- ./.volumes/certs2.0-ha/gateway2:/etc/defguard/certs
65+
environment:
66+
DEFGUARD_STATS_PERIOD: 10
67+
HEALTH_PORT: 55003
68+
69+
gateway-lb:
70+
image: envoyproxy/envoy:v1.33-latest
71+
ports:
72+
- "50051:50051/udp"
73+
volumes:
74+
- ./envoy/envoy.yaml:/etc/envoy/envoy.yaml:ro
75+
depends_on:
76+
- gateway1
77+
- gateway2
78+
79+
db:
80+
image: postgres:18-alpine
81+
environment:
82+
POSTGRES_DB: defguard
83+
POSTGRES_USER: defguard
84+
POSTGRES_PASSWORD: defguard
85+
volumes:
86+
- ./.volumes/db2.0-ha:/var/lib/postgresql/data
87+
ports:
88+
- "5432:5432"

‎docker-compose2.0/envoy/envoy.yaml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
static_resources:
2+
listeners:
3+
- name: udp_listener
4+
address:
5+
socket_address:
6+
address: 0.0.0.0
7+
port_value: 50051
8+
protocol: UDP
9+
10+
# UDP listeners use udp_listener_config + listener_filters (not filter_chains)
11+
udp_listener_config:
12+
downstream_socket_config:
13+
# Optional: enable GRO/GSO if kernel supports it, otherwise omit
14+
prefer_gro: true
15+
16+
listener_filters:
17+
- name: envoy.filters.udp_listener.udp_proxy
18+
typed_config:
19+
"@type": type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.UdpProxyConfig
20+
stat_prefix: udp_lb
21+
cluster: defguard_gateway_cluster
22+
idle_timeout: 60s
23+
24+
clusters:
25+
- name: defguard_gateway_cluster
26+
type: STRICT_DNS
27+
connect_timeout: 1s
28+
lb_policy: ROUND_ROBIN
29+
dns_lookup_family: V4_ONLY
30+
31+
health_checks:
32+
- timeout: 2s
33+
interval: 5s
34+
unhealthy_threshold: 2
35+
healthy_threshold: 2
36+
http_health_check:
37+
path: /health
38+
host: gateway_health
39+
expected_statuses:
40+
start: 200
41+
end: 300
42+
43+
load_assignment:
44+
cluster_name: defguard_gateway_cluster
45+
endpoints:
46+
- lb_endpoints:
47+
- endpoint:
48+
address:
49+
socket_address:
50+
address: gateway1
51+
port_value: 50051
52+
health_check_config:
53+
port_value: 55003
54+
- endpoint:
55+
address:
56+
socket_address:
57+
address: gateway2
58+
port_value: 50051
59+
health_check_config:
60+
port_value: 55003

‎docker-compose2.0/nginx/edge.conf‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
upstream defguard_edge {
2+
# For HTTP, round-robin is the default
3+
server edge1:8080 max_fails=2 fail_timeout=10s;
4+
server edge2:8080 max_fails=2 fail_timeout=10s;
5+
6+
# Optional: keepalive connections to backends
7+
keepalive 64;
8+
}
9+
10+
server {
11+
listen 8080;
12+
13+
# Preserve original client information
14+
proxy_set_header Host $host;
15+
proxy_set_header X-Real-IP $remote_addr;
16+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
17+
proxy_set_header X-Forwarded-Proto $scheme;
18+
19+
# WebSockets support (if used)
20+
proxy_http_version 1.1;
21+
proxy_set_header Upgrade $http_upgrade;
22+
proxy_set_header Connection $connection_upgrade;
23+
24+
location / {
25+
proxy_pass http://defguard_edge;
26+
27+
# Reasonable timeouts for long requests / SSE
28+
proxy_connect_timeout 5s;
29+
proxy_send_timeout 60s;
30+
proxy_read_timeout 60s;
31+
}
32+
}
33+
34+
# Map used by WebSocket upgrade header handling
35+
map $http_upgrade $connection_upgrade {
36+
default upgrade;
37+
'' close;
38+
}

0 commit comments

Comments
 (0)