OPC # 0001: Extract OPC into standalone repo

2026-04-25 17:26:42 -04:00
commit 42383bdc03
170 changed files with 21365 additions and 0 deletions
@@ -0,0 +1,172 @@
+name: clarity-platform
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Platform Infrastructure — run once, always on.
+# This is NOT part of Aspire orchestration.
+#
+# Usage:
+#   docker compose up -d
+#   docker compose down        (keeps volumes)
+#   docker compose down -v     (destroys all data — careful!)
+#
+# Hardcoded dev credentials — do not use in production.
+# ─────────────────────────────────────────────────────────────────────────────
+
+networks:
+  clarity-net:
+    name: clarity-net
+    external: true
+
+volumes:
+  postgres-data:
+  minio-data:
+
+services:
+
+  # ── Postgres ──────────────────────────────────────────────────────────────
+  # Single server for all platform databases.
+  # Databases: keycloakdb, giteadb, controlplanedb
+  # Tenant databases (clarity_{subdomain}) are created at provisioning time by ControlPlane.Worker.
+  postgres:
+    image: postgres:17.6
+    container_name: clarity-postgres
+    restart: unless-stopped
+    ports:
+      - "5432:5432"
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: postgres
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+      - ./postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
+    networks:
+      clarity-net:
+        aliases:
+          - postgres
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  # ── Keycloak ──────────────────────────────────────────────────────────────
+  keycloak:
+    image: quay.io/keycloak/keycloak:26.2
+    container_name: clarity-keycloak
+    restart: unless-stopped
+    ports:
+      - "8080:8080"
+    environment:
+      KC_DB: postgres
+      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloakdb
+      KC_DB_USERNAME: postgres
+      KC_DB_PASSWORD: postgres
+      KC_BOOTSTRAP_ADMIN_USERNAME: admin
+      KC_BOOTSTRAP_ADMIN_PASSWORD: Admin1234!
+      KC_HOSTNAME: keycloak.clarity.test
+      KC_HOSTNAME_URL: https://keycloak.clarity.test
+      KC_HOSTNAME_PORT: "443"
+      KC_HOSTNAME_STRICT: "false"
+      KC_PROXY_HEADERS: xforwarded
+    volumes:
+      - ./keycloak:/opt/keycloak/data/import:ro
+    command: start-dev --import-realm
+    depends_on:
+      postgres:
+        condition: service_healthy
+    networks:
+      clarity-net:
+        aliases:
+          - keycloak
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://localhost:8080/health/ready || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 15
+
+  # ── Vault ─────────────────────────────────────────────────────────────────
+  vault:
+    image: hashicorp/vault:latest
+    container_name: clarity-vault
+    restart: unless-stopped
+    ports:
+      - "8200:8200"
+    cap_add:
+      - IPC_LOCK
+    user: root
+    entrypoint: ["sh", "/vault/entrypoint.sh"]
+    volumes:
+      - ./vault/config/vault.hcl:/vault/config/vault.hcl:ro
+      - ./vault/entrypoint.sh:/vault/entrypoint.sh:ro
+      - ./vault/data:/vault/file
+    networks:
+      clarity-net:
+        aliases:
+          - vault
+    healthcheck:
+      test: ["CMD-SHELL", "vault status -address=http://127.0.0.1:8200 | grep -q 'Sealed' || vault status -address=http://127.0.0.1:8200 | grep -q 'false'"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
+  # ── MinIO ─────────────────────────────────────────────────────────────────
+  minio:
+    image: minio/minio:latest
+    container_name: clarity-minio
+    restart: unless-stopped
+    ports:
+      - "9000:9000"
+      - "9001:9001"
+    environment:
+      MINIO_ROOT_USER: minioadmin
+      MINIO_ROOT_PASSWORD: minioadmin
+    command: server /data --console-address ":9001"
+    volumes:
+      - minio-data:/data
+    networks:
+      clarity-net:
+        aliases:
+          - minio
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://localhost:9000/minio/health/live || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
+  # ── Nginx (wildcard reverse proxy) ────────────────────────────────────────
+  # Routes {subdomain}.clarity.test → correct tenant container via Docker DNS.
+  # ControlPlane.Worker writes per-tenant configs into conf.d/ at provisioning time.
+  nginx:
+    image: nginx:alpine
+    container_name: clarity-nginx
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./nginx/conf.d:/etc/nginx/conf.d
+      - ./nginx/clarity.test.crt:/etc/nginx/certs/clarity.test.crt:ro
+      - ./nginx/clarity.test.key:/etc/nginx/certs/clarity.test.key:ro
+    networks:
+      clarity-net:
+        aliases:
+          - nginx
+
+  # ── Dnsmasq ───────────────────────────────────────────────────────────────
+  # Resolves *.clarity.test → 127.0.0.1 so browser requests hit nginx on the host.
+  dnsmasq:
+    image: andyshinn/dnsmasq
+    container_name: clarity-dnsmasq
+    restart: unless-stopped
+    ports:
+      - "53:53/udp"
+    cap_add:
+      - NET_ADMIN
+    volumes:
+      - ./dnsmasq/dnsmasq.conf:/etc/dnsmasq.conf:ro
+    networks:
+      clarity-net:
+        aliases:
+          - dnsmasq