alexsun/compose-anything
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add OPA and update common services

Browse Source
This commit is contained in:
Sun-ZhenXing
2026-07-30 11:09:33 +08:00
parent 87a58d8d04
commit c3f378a6f5
44 changed files with 316 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+10 -9
View File
@@ -86,12 +86,12 @@ These services require building custom Docker images from source.
| [frpc](./src/frpc) | 0.68.1 |
| [frps](./src/frps) | 0.68.1 |
| [Gitea Runner](./src/gitea-runner) | 2.1.0 |
| [Gitea](./src/gitea) | 1.27.0-rootless |
| [Gitea](./src/gitea) | 1.27.1-rootless |
| [GitLab Runner](./src/gitlab-runner) | 17.10.1 |
| [GitLab](./src/gitlab) | 18.8.3-ce.0 |
| [GoModel](./src/gomodel) | v0.1.27 |
| [GPUStack](./src/gpustack) | v0.5.3 |
| [Grafana](./src/grafana) | 12.3.3 |
| [Grafana](./src/grafana) | 13.1.1 |
| [Grafana Loki](./src/loki) | 3.3.2 |
| [Grafana Tempo](./src/tempo) | 2.7.2 |
| [Halo](./src/halo) | 2.21.9 |
@@ -129,8 +129,8 @@ These services require building custom Docker images from source.
| [OpenClaw](./apps/openclaw) | 2026.2.3 |
| [MongoDB ReplicaSet Single](./src/mongodb-replicaset-single) | 8.2.3 |
| [MongoDB ReplicaSet](./src/mongodb-replicaset) | 8.2.3 |
| [MongoDB Standalone](./src/mongodb-standalone) | 8.3.4 |
| [MySQL](./src/mysql) | 9.7.1 |
| [MongoDB Standalone](./src/mongodb-standalone) | 8.3.7 |
| [MySQL](./src/mysql) | 9.7.2 |
| [n8n](./apps/n8n) | 1.114.0 |
| [Nanobot](./apps/nanobot) | v0.1.3.post4 |
| [Nacos](./src/nacos) | v3.1.0 |
@@ -138,7 +138,7 @@ These services require building custom Docker images from source.
| [NexaSDK](./src/nexa-sdk) | v0.2.62 |
| [Neo4j](./src/neo4j) | 5.27.4 |
| [Netdata](./src/netdata) | latest |
| [Nginx](./src/nginx) | 1.29.4 |
| [Nginx](./src/nginx) | 1.30.4 |
| [Node Exporter](./src/node-exporter) | v1.8.2 |
| [OceanBase](./src/oceanbase) | 4.4.2.1 |
| [Odoo](./src/odoo) | 19.0 |
@@ -159,6 +159,7 @@ These services require building custom Docker images from source.
| [OpenSearch](./src/opensearch) | 2.19.0 |
| [OpenTelemetry Collector](./src/otel-collector) | 0.115.1 |
| [OpenViking](./src/openviking) | 0.1.0 |
| [Open Policy Agent (OPA)](./src/opa) | 1.18.2 |
| [Overleaf](./src/overleaf) | 5.2.1 |
| [Paca](./apps/paca) | 0.5.2 |
| [PocketBase](./src/pocketbase) | 0.30.0 |
@@ -166,16 +167,16 @@ These services require building custom Docker images from source.
| [Pogocache](./src/pogocache) | 1.3.1 |
| [Portainer](./src/portainer) | 2.27.3-alpine |
| [Portkey AI Gateway](./src/portkey-gateway) | latest |
| [PostgreSQL](./src/postgres) | 17.10 |
| [Prometheus](./src/prometheus) | 3.5.1 |
| [PostgreSQL](./src/postgres) | 18.4 |
| [Prometheus](./src/prometheus) | 3.13.1 |
| [PyTorch](./src/pytorch) | 2.6.0 |
| [Qdrant](./src/qdrant) | 1.15.4 |
| [RabbitMQ](./src/rabbitmq) | 4.2.4 |
| [RabbitMQ](./src/rabbitmq) | 4.3.4 |
| [RAGFlow](./apps/ragflow) | v0.24.0 |
| [Ray](./src/ray) | 2.42.1 |
| [Redpanda](./src/redpanda) | v24.3.1 |
| [Redis Cluster](./src/redis-cluster) | 8.2.1 |
| [Redis](./src/redis) | 8.8.0 |
| [Redis](./src/redis) | 8.8.1 |
| [Renovate](./src/renovate) | 42.85.4-full |
| [Restate Cluster](./src/restate-cluster) | 1.5.3 |
| [Restate](./src/restate) | 1.5.3 |
README.zh.md
+10 -9
View File
@@ -86,12 +86,12 @@ docker compose exec redis redis-cli ping
| [frpc](./src/frpc) | 0.68.1 |
| [frps](./src/frps) | 0.68.1 |
| [Gitea Runner](./src/gitea-runner) | 2.1.0 |
| [Gitea](./src/gitea) | 1.27.0-rootless |
| [Gitea](./src/gitea) | 1.27.1-rootless |
| [GitLab Runner](./src/gitlab-runner) | 17.10.1 |
| [GitLab](./src/gitlab) | 18.8.3-ce.0 |
| [GoModel](./src/gomodel) | v0.1.27 |
| [GPUStack](./src/gpustack) | v0.5.3 |
| [Grafana](./src/grafana) | 12.3.3 |
| [Grafana](./src/grafana) | 13.1.1 |
| [Grafana Loki](./src/loki) | 3.3.2 |
| [Grafana Tempo](./src/tempo) | 2.7.2 |
| [Halo](./src/halo) | 2.21.9 |
@@ -129,8 +129,8 @@ docker compose exec redis redis-cli ping
| [OpenClaw](./apps/openclaw) | 2026.2.3 |
| [MongoDB ReplicaSet Single](./src/mongodb-replicaset-single) | 8.2.3 |
| [MongoDB ReplicaSet](./src/mongodb-replicaset) | 8.2.3 |
| [MongoDB Standalone](./src/mongodb-standalone) | 8.3.4 |
| [MySQL](./src/mysql) | 9.7.1 |
| [MongoDB Standalone](./src/mongodb-standalone) | 8.3.7 |
| [MySQL](./src/mysql) | 9.7.2 |
| [n8n](./apps/n8n) | 1.114.0 |
| [Nanobot](./apps/nanobot) | v0.1.3.post4 |
| [Nacos](./src/nacos) | v3.1.0 |
@@ -138,7 +138,7 @@ docker compose exec redis redis-cli ping
| [NexaSDK](./src/nexa-sdk) | v0.2.62 |
| [Neo4j](./src/neo4j) | 5.27.4 |
| [Netdata](./src/netdata) | latest |
| [Nginx](./src/nginx) | 1.29.4 |
| [Nginx](./src/nginx) | 1.30.4 |
| [Node Exporter](./src/node-exporter) | v1.8.2 |
| [OceanBase](./src/oceanbase) | 4.4.2.1 |
| [Odoo](./src/odoo) | 19.0 |
@@ -159,6 +159,7 @@ docker compose exec redis redis-cli ping
| [OpenSearch](./src/opensearch) | 2.19.0 |
| [OpenTelemetry Collector](./src/otel-collector) | 0.115.1 |
| [OpenViking](./src/openviking) | 0.1.0 |
| [Open Policy Agent (OPA)](./src/opa) | 1.18.2 |
| [Overleaf](./src/overleaf) | 5.2.1 |
| [Paca](./apps/paca) | 0.5.2 |
| [PocketBase](./src/pocketbase) | 0.30.0 |
@@ -166,16 +167,16 @@ docker compose exec redis redis-cli ping
| [Pogocache](./src/pogocache) | 1.3.1 |
| [Portainer](./src/portainer) | 2.27.3-alpine |
| [Portkey AI Gateway](./src/portkey-gateway) | latest |
| [PostgreSQL](./src/postgres) | 17.10 |
| [Prometheus](./src/prometheus) | 3.5.1 |
| [PostgreSQL](./src/postgres) | 18.4 |
| [Prometheus](./src/prometheus) | 3.13.1 |
| [PyTorch](./src/pytorch) | 2.6.0 |
| [Qdrant](./src/qdrant) | 1.15.4 |
| [RabbitMQ](./src/rabbitmq) | 4.2.4 |
| [RabbitMQ](./src/rabbitmq) | 4.3.4 |
| [RAGFlow](./apps/ragflow) | v0.24.0 |
| [Ray](./src/ray) | 2.42.1 |
| [Redpanda](./src/redpanda) | v24.3.1 |
| [Redis Cluster](./src/redis-cluster) | 8.2.1 |
| [Redis](./src/redis) | 8.8.0 |
| [Redis](./src/redis) | 8.8.1 |
| [Renovate](./src/renovate) | 42.85.4-full |
| [Restate Cluster](./src/restate-cluster) | 1.5.3 |
| [Restate](./src/restate) | 1.5.3 |
src/gitea/.env.example
+2 -2
View File
@@ -1,12 +1,12 @@
# Gitea Version
GITEA_VERSION=1.27.0-rootless
GITEA_VERSION=1.27.1-rootless
# Database configuration
GITEA_DB_TYPE=postgres
GITEA_POSTGRES_HOST=db:5432
# PostgreSQL settings
POSTGRES_VERSION=17.6
POSTGRES_VERSION=17.10
POSTGRES_USER=gitea
POSTGRES_PASSWORD=gitea
POSTGRES_DB=gitea
src/gitea/README.md
+3 -3
View File
@@ -2,7 +2,7 @@
[English](./README.md) | [中文](./README.zh.md)
This stack runs Gitea 1.27.0 with the rootless image and PostgreSQL 17.6.
This stack runs Gitea 1.27.1 with the rootless image and PostgreSQL 17.10.
## Services
@@ -37,10 +37,10 @@ The first registered user becomes an administrator.
| Variable | Default | Description |
| --- | --- | --- |
| `GITEA_VERSION` | `1.27.0-rootless` | Gitea image tag. |
| `GITEA_VERSION` | `1.27.1-rootless` | Gitea image tag. |
| `GITEA_DB_TYPE` | `postgres` | Gitea database type. |
| `GITEA_POSTGRES_HOST` | `db:5432` | PostgreSQL address inside the Compose network. |
| `POSTGRES_VERSION` | `17.6` | PostgreSQL image version. |
| `POSTGRES_VERSION` | `17.10` | PostgreSQL image version. |
| `POSTGRES_USER` | `gitea` | Database user. |
| `POSTGRES_PASSWORD` | `gitea` | Database password; change it for production. |
| `POSTGRES_DB` | `gitea` | Database name. |
src/gitea/README.zh.md
+3 -3
View File
@@ -2,7 +2,7 @@
[English](./README.md) | [中文](./README.zh.md)
此配置使用 rootless 镜像运行 Gitea 1.27.0，并使用 PostgreSQL 17.6 作为数据库。
此配置使用 rootless 镜像运行 Gitea 1.27.1，并使用 PostgreSQL 17.10 作为数据库。
## 服务
@@ -37,10 +37,10 @@ docker compose up -d
| 变量 | 默认值 | 说明 |
| --- | --- | --- |
| `GITEA_VERSION` | `1.27.0-rootless` | Gitea 镜像标签。 |
| `GITEA_VERSION` | `1.27.1-rootless` | Gitea 镜像标签。 |
| `GITEA_DB_TYPE` | `postgres` | Gitea 数据库类型。 |
| `GITEA_POSTGRES_HOST` | `db:5432` | Compose 网络内的 PostgreSQL 地址。 |
| `POSTGRES_VERSION` | `17.6` | PostgreSQL 镜像版本。 |
| `POSTGRES_VERSION` | `17.10` | PostgreSQL 镜像版本。 |
| `POSTGRES_USER` | `gitea` | 数据库用户。 |
| `POSTGRES_PASSWORD` | `gitea` | 数据库密码，生产环境必须修改。 |
| `POSTGRES_DB` | `gitea` | 数据库名称。 |
src/gitea/docker-compose.yaml
+2 -2
View File
@@ -9,7 +9,7 @@ x-defaults: &defaults
services:
gitea:
<<: *defaults
image: ${GLOBAL_REGISTRY:-}gitea/gitea:${GITEA_VERSION:-1.27.0-rootless}
image: ${GLOBAL_REGISTRY:-}gitea/gitea:${GITEA_VERSION:-1.27.1-rootless}
environment:
- USER_UID=1000
- USER_GID=1000
@@ -52,7 +52,7 @@ services:
db:
<<: *defaults
image: ${GLOBAL_REGISTRY:-}postgres:${POSTGRES_VERSION:-17.6}
image: ${GLOBAL_REGISTRY:-}postgres:${POSTGRES_VERSION:-17.10}
profiles:
- ${COMPOSE_PROFILES:-}
environment:
src/grafana/.env.example
+1 -1
View File
@@ -1,7 +1,7 @@
# Grafana Environment Variables
# Grafana image version
GRAFANA_VERSION=12.3.3
GRAFANA_VERSION=13.1.1
# Host port mapping (maps to Grafana port 3000 in container)
GRAFANA_PORT_OVERRIDE=3000
src/grafana/README.md
+5 -1
View File
@@ -12,7 +12,7 @@ This service deploys Grafana, an open-source analytics and monitoring platform f
| Variable Name | Description | Default Value |
| ---------------------- | ---------------------------------------------------------- | ----------------------- |
| GRAFANA_VERSION | Grafana image version | `12.3.3` |
| GRAFANA_VERSION | Grafana image version | `13.1.1` |
| GRAFANA_PORT_OVERRIDE | Host port mapping (maps to Grafana port 3000 in container) | `3000` |
| GRAFANA_ADMIN_USER | Admin username | `admin` |
| GRAFANA_ADMIN_PASSWORD | Admin password | `admin` |
@@ -42,6 +42,10 @@ Please modify the `.env` file as needed for your use case.
- Consider disabling sign-up (`GRAFANA_ALLOW_SIGN_UP=false`) in production.
- Use HTTPS in production by configuring a reverse proxy or Grafana's TLS settings.
## Upgrading
Before upgrading, back up the Grafana database, plugins, and configuration. Grafana v13's unified-storage migration makes downgrade unsafe without restoring the pre-upgrade database. Validate plugins for React 19 compatibility; the image-renderer plugin has been removed.
## Common Use Cases
### Installing Plugins
src/grafana/README.zh.md
+5 -1
View File
@@ -12,7 +12,7 @@
| 变量名 | 描述 | 默认值 |
| ---------------------- | ------------------------------------------------ | ----------------------- |
| GRAFANA_VERSION | Grafana 镜像版本 | `12.3.3` |
| GRAFANA_VERSION | Grafana 镜像版本 | `13.1.1` |
| GRAFANA_PORT_OVERRIDE | 主机端口映射（映射到容器中的 Grafana 端口 3000） | `3000` |
| GRAFANA_ADMIN_USER | 管理员用户名 | `admin` |
| GRAFANA_ADMIN_PASSWORD | 管理员密码 | `admin` |
@@ -42,6 +42,10 @@
- 考虑在生产环境中禁用注册（`GRAFANA_ALLOW_SIGN_UP=false`）。
- 通过配置反向代理或 Grafana 的 TLS 设置在生产环境中使用 HTTPS。
## 升级
升级前，请备份 Grafana 数据库、插件和配置。Grafana v13 的 unified-storage migration 会导致直接降级不安全；如需回退，请恢复升级前的数据库。请验证插件与 React 19 的兼容性；image-renderer 插件已移除。
## 常见用例
### 安装插件
src/grafana/docker-compose.yaml
+1 -1
View File
@@ -9,7 +9,7 @@ x-defaults: &defaults
services:
grafana:
<<: *defaults
image: ${GLOBAL_REGISTRY:-}grafana/grafana:${GRAFANA_VERSION:-12.3.3}
image: ${GLOBAL_REGISTRY:-}grafana/grafana:${GRAFANA_VERSION:-13.1.1}
ports:
- '${GRAFANA_PORT_OVERRIDE:-3000}:3000'
volumes:
src/mongodb-standalone/.env.example
+1 -1
View File
@@ -1,5 +1,5 @@
# MongoDB Version
MONGO_VERSION=8.3.4
MONGO_VERSION=8.3.7
# MongoDB root credentials
MONGO_INITDB_ROOT_USERNAME=root
src/mongodb-standalone/README.md
+3 -1
View File
@@ -33,7 +33,7 @@ MongoDB is a document database designed for ease of application development and
| Variable | Description | Default |
| ---------------------------- | ---------------- | ---------- |
| `MONGO_VERSION` | MongoDB version | `8.3.4` |
| `MONGO_VERSION` | MongoDB version | `8.3.7` |
| `MONGO_INITDB_ROOT_USERNAME` | Root username | `root` |
| `MONGO_INITDB_ROOT_PASSWORD` | Root password | `password` |
| `MONGO_INITDB_DATABASE` | Initial database | `admin` |
@@ -43,6 +43,8 @@ MongoDB is a document database designed for ease of application development and
- `mongo_data`: A volume for storing MongoDB data.
Before upgrading across MongoDB releases, back up first, follow supported adjacent-release upgrade paths, and verify Feature Compatibility Version (FCV) at each step.
```bash
# Using mongo shell
mongo mongodb://root:password@localhost:27017/admin
src/mongodb-standalone/README.zh.md
+3 -1
View File
@@ -33,7 +33,7 @@ MongoDB 是一个为应用程序开发和扩展的简易性而设计的文档数
| 变量 | 描述 | 默认值 |
| ---------------------------- | ------------ | ---------- |
| `MONGO_VERSION` | MongoDB 版本 | `8.3.4` |
| `MONGO_VERSION` | MongoDB 版本 | `8.3.7` |
| `MONGO_INITDB_ROOT_USERNAME` | 根用户名 | `root` |
| `MONGO_INITDB_ROOT_PASSWORD` | 根密码 | `password` |
| `MONGO_INITDB_DATABASE` | 初始数据库 | `admin` |
@@ -43,6 +43,8 @@ MongoDB 是一个为应用程序开发和扩展的简易性而设计的文档数
- `mongo_data`: 用于存储 MongoDB 数据的卷。
跨 MongoDB 版本升级前，请先备份，遵循受支持的相邻版本升级路径，并在每一步验证功能兼容性版本（FCV）。
```bash
# 使用 mongo shell
mongo mongodb://root:password@localhost:27017/admin
src/mongodb-standalone/docker-compose.yaml
+1 -1
View File
@@ -9,7 +9,7 @@ x-defaults: &defaults
services:
mongo:
<<: *defaults
image: ${GLOBAL_REGISTRY:-}mongo:${MONGO_VERSION:-8.3.4}
image: ${GLOBAL_REGISTRY:-}mongo:${MONGO_VERSION:-8.3.7}
environment:
TZ: ${TZ:-UTC}
MONGO_INITDB_ROOT_USERNAME: ${MONGO_INITDB_ROOT_USERNAME:-root}
src/mysql/.env.example
+1 -1
View File
@@ -1,5 +1,5 @@
# MySQL Version
MYSQL_VERSION=9.7.1
MYSQL_VERSION=9.7.2
# Root password for MySQL
MYSQL_ROOT_PASSWORD=password
src/mysql/README.md
+1 -1
View File
@@ -10,7 +10,7 @@ This service deploys a MySQL database.
## Configuration
- `MYSQL_VERSION`: The version of the MySQL image, default is `9.7.1`.
- `MYSQL_VERSION`: The version of the MySQL image, default is `9.7.2`.
- `MYSQL_PORT_OVERRIDE`: The host port for MySQL, default is `3306`.
- `MYSQL_ROOT_PASSWORD`: The root password, default is `password`.
- `MYSQL_ROOT_HOST`: The root host, default is `%`.
src/mysql/README.zh.md
+1 -1
View File
@@ -10,7 +10,7 @@
## 配置
- `MYSQL_VERSION`: MySQL 镜像的版本，默认为 `9.7.1`。
- `MYSQL_VERSION`: MySQL 镜像的版本，默认为 `9.7.2`。
- `MYSQL_PORT_OVERRIDE`: MySQL 的主机端口，默认为 `3306`。
- `MYSQL_ROOT_PASSWORD`: root 密码，默认为 `password`。
- `MYSQL_ROOT_HOST`: root 主机，默认为 `%`。
src/mysql/docker-compose.yaml
+1 -1
View File
@@ -9,7 +9,7 @@ x-defaults: &defaults
services:
mysql:
<<: *defaults
image: ${GLOBAL_REGISTRY:-}mysql:${MYSQL_VERSION:-9.7.1}
image: ${GLOBAL_REGISTRY:-}mysql:${MYSQL_VERSION:-9.7.2}
ports:
- '${MYSQL_PORT_OVERRIDE:-3306}:3306'
volumes:
src/nginx/.env.example
+1 -1
View File
@@ -1,5 +1,5 @@
# Nginx version
NGINX_VERSION=1.29.4-alpine3.23
NGINX_VERSION=1.30.4-alpine3.24
# Timezone
TZ=UTC
src/nginx/README.md
+1 -1
View File
@@ -12,7 +12,7 @@ This service deploys Nginx, a high-performance web server and reverse proxy serv
| Variable Name | Description | Default Value |
| ------------------------- | ---------------------------------------------- | ------------------- |
| NGINX_VERSION | Nginx image version | `1.29.4-alpine3.23` |
| NGINX_VERSION | Nginx image version | `1.30.4-alpine3.24` |
| NGINX_HTTP_PORT_OVERRIDE | Host port mapping for HTTP (maps to port 80) | 80 |
| NGINX_HTTPS_PORT_OVERRIDE | Host port mapping for HTTPS (maps to port 443) | 443 |
| NGINX_HOST | Server hostname for configuration | `localhost` |
src/nginx/README.zh.md
+1 -1
View File
@@ -12,7 +12,7 @@
| 变量名 | 描述 | 默认值 |
| ------------------------- | ------------------------------------ | ------------------- |
| NGINX_VERSION | Nginx 镜像版本 | `1.29.4-alpine3.23` |
| NGINX_VERSION | Nginx 镜像版本 | `1.30.4-alpine3.24` |
| NGINX_HTTP_PORT_OVERRIDE | HTTP 主机端口映射（映射到端口 80） | 80 |
| NGINX_HTTPS_PORT_OVERRIDE | HTTPS 主机端口映射（映射到端口 443） | 443 |
| NGINX_HOST | 配置的服务器主机名 | `localhost` |
src/nginx/docker-compose.yaml
+1 -1
View File
@@ -9,7 +9,7 @@ x-defaults: &defaults
services:
nginx:
<<: *defaults
image: ${GLOBAL_REGISTRY:-}nginx:${NGINX_VERSION:-1.29.4-alpine3.23}
image: ${GLOBAL_REGISTRY:-}nginx:${NGINX_VERSION:-1.30.4-alpine3.24}
ports:
- '${NGINX_HTTP_PORT_OVERRIDE:-80}:80'
- '${NGINX_HTTPS_PORT_OVERRIDE:-443}:443'
src/opa/.env.example
+23
View File
@@ -0,0 +1,23 @@
# Optional global registry prefix, including a trailing slash when set
# GLOBAL_REGISTRY=
# Open Policy Agent image version
OPA_VERSION=1.18.2
# Container timezone
TZ=UTC
# Optional host port mapped to container port 8181
# OPA_PORT_OVERRIDE=8181
# Maximum CPU allocation
# OPA_CPU_LIMIT=0.5
# Reserved CPU allocation
# OPA_CPU_RESERVATION=0.1
# Maximum memory allocation
# OPA_MEMORY_LIMIT=256M
# Reserved memory allocation
# OPA_MEMORY_RESERVATION=128M
src/opa/README.md
+72
View File
@@ -0,0 +1,72 @@
# Open Policy Agent (OPA)
[English](./README.md) | [中文](./README.zh.md)
Open Policy Agent (OPA) is a general-purpose policy engine for making policy decisions from structured data. This Compose stack runs the official OPA image with a minimal authorization policy.
## Services
- `opa`: OPA policy server and HTTP API on container port 8181
## Quick Start
```bash
docker compose up -d
```
OPA is available at <http://127.0.0.1:8181> by default.
Evaluate the included policy for the allowed user `alice`:
```bash
curl --request POST http://127.0.0.1:8181/v1/data/app/authz/allow \
--header "Content-Type: application/json" \
--data '{"input":{"user":"alice"}}'
```
The response is `{"result":true}`.
## Configuration and Policy Files
- [policies/authz.rego](./policies/authz.rego) defines a default-deny authorization rule and permits users listed in policy data.
- [policies/data.json](./policies/data.json) contains the allowed users and initially permits `alice`.
Edit these local files and restart OPA to load policy changes:
```bash
docker compose restart opa
```
## Environment Variables
| Variable | Description | Default |
| --- | --- | --- |
| `GLOBAL_REGISTRY` | Optional global registry prefix | `""` |
| `OPA_VERSION` | OPA image version | `1.18.2` |
| `TZ` | Container timezone | `UTC` |
| `OPA_PORT_OVERRIDE` | Loopback host port mapped to container port 8181 | `8181` |
| `OPA_CPU_LIMIT` | CPU limit | `0.5` |
| `OPA_CPU_RESERVATION` | CPU reservation | `0.1` |
| `OPA_MEMORY_LIMIT` | Memory limit | `256M` |
| `OPA_MEMORY_RESERVATION` | Memory reservation | `128M` |
## Ports
- `127.0.0.1:8181`: OPA HTTP API, bound to host loopback by default
## Storage
The local `./policies` directory is mounted read-only at `/policies`. OPA requires no persistent or named volume in this stack.
## Security Notes
- The API is exposed only on host loopback by default and has no built-in authentication in this stack.
- The container runs as user `1000:1000` with a read-only root filesystem, all Linux capabilities dropped, and `no-new-privileges` enabled.
- `/tmp` is a bounded temporary filesystem with executable and set-user-ID files disabled.
- Review policy data and add an authenticated gateway before exposing OPA beyond the local host.
## References
- [Open Policy Agent documentation](https://www.openpolicyagent.org/docs/)
- [OPA Docker Hub repository](https://hub.docker.com/r/openpolicyagent/opa)
- [OPA REST API](https://www.openpolicyagent.org/docs/rest-api/)
src/opa/README.zh.md
+72
View File
@@ -0,0 +1,72 @@
# Open Policy Agent（OPA）
[English](./README.md) | [中文](./README.zh.md)
Open Policy Agent（OPA）是一个通用策略引擎，用于根据结构化数据作出策略决策。本 Docker Compose 栈使用官方 OPA 镜像，并提供一个最小授权策略。
## 服务
- `opa`：OPA 策略服务器与 HTTP API，使用容器端口 8181
## 快速开始
```bash
docker compose up -d
```
默认可通过 <http://127.0.0.1:8181> 访问 OPA。
为已允许的用户 `alice` 评估内置策略：
```bash
curl --request POST http://127.0.0.1:8181/v1/data/app/authz/allow \
--header "Content-Type: application/json" \
--data '{"input":{"user":"alice"}}'
```
响应为 `{"result":true}`。
## 配置与策略文件
- [policies/authz.rego](./policies/authz.rego) 定义默认拒绝的授权规则，并允许策略数据中列出的用户。
- [policies/data.json](./policies/data.json) 包含允许的用户，初始允许 `alice`。
编辑这些本地文件后，重启 OPA 以加载策略变更：
```bash
docker compose restart opa
```
## 环境变量
| 变量 | 说明 | 默认值 |
| --- | --- | --- |
| `GLOBAL_REGISTRY` | 可选的全局镜像仓库前缀 | `""` |
| `OPA_VERSION` | OPA 镜像版本 | `1.18.2` |
| `TZ` | 容器时区 | `UTC` |
| `OPA_PORT_OVERRIDE` | 映射到容器端口 8181 的宿主机回环端口 | `8181` |
| `OPA_CPU_LIMIT` | CPU 限制 | `0.5` |
| `OPA_CPU_RESERVATION` | CPU 预留 | `0.1` |
| `OPA_MEMORY_LIMIT` | 内存限制 | `256M` |
| `OPA_MEMORY_RESERVATION` | 内存预留 | `128M` |
## 端口
- `127.0.0.1:8181`：OPA HTTP API，默认仅绑定宿主机回环地址
## 存储
本地 `./policies` 目录以只读方式挂载到 `/policies`。此栈中的 OPA 不需要持久化卷或命名卷。
## 安全说明
- 默认仅在宿主机回环地址上公开 API，且此栈未提供内置身份验证。
- 容器以用户 `1000:1000` 运行，根文件系统只读，删除所有 Linux capabilities，并启用 `no-new-privileges`。
- `/tmp` 是容量受限的临时文件系统，禁止执行文件和设置用户 ID 的文件。
- 在本地主机以外公开 OPA 前，请审查策略数据并添加经过身份验证的网关。
## 参考资料
- [Open Policy Agent 文档](https://www.openpolicyagent.org/docs/)
- [OPA Docker Hub 仓库](https://hub.docker.com/r/openpolicyagent/opa)
- [OPA REST API](https://www.openpolicyagent.org/docs/rest-api/)
src/opa/docker-compose.yaml
+41
View File
@@ -0,0 +1,41 @@
x-defaults: &defaults
restart: unless-stopped
logging:
driver: json-file
options:
max-size: 100m
max-file: '3'
services:
opa:
<<: *defaults
image: ${GLOBAL_REGISTRY:-}openpolicyagent/opa:${OPA_VERSION:-1.18.2}
user: '1000:1000'
read_only: true
cap_drop:
- ALL
security_opt:
- no-new-privileges:true
ports:
- '127.0.0.1:${OPA_PORT_OVERRIDE:-8181}:8181'
volumes:
- ./policies:/policies:ro
tmpfs:
- /tmp:rw,noexec,nosuid,size=64m
environment:
- TZ=${TZ:-UTC}
command: [run, --server, '--addr=0.0.0.0:8181', /policies]
healthcheck:
test: [CMD, /opa, eval, --fail, 'http.send({"url":"http://127.0.0.1:8181/health","timeout":"1s"}).status_code == 200']
interval: 15s
timeout: 5s
retries: 3
start_period: 5s
deploy:
resources:
limits:
cpus: ${OPA_CPU_LIMIT:-0.5}
memory: ${OPA_MEMORY_LIMIT:-256M}
reservations:
cpus: ${OPA_CPU_RESERVATION:-0.1}
memory: ${OPA_MEMORY_RESERVATION:-128M}
src/opa/policies/authz.rego
+9
View File
@@ -0,0 +1,9 @@
package app.authz
import rego.v1
default allow := false
allow if {
input.user in data.allowed_users
}
src/opa/policies/data.json
+3
View File
@@ -0,0 +1,3 @@
{
"allowed_users": ["alice"]
}
src/postgres/.env.example
+1 -1
View File
@@ -1,5 +1,5 @@
# PostgreSQL Version
POSTGRES_VERSION=17.10
POSTGRES_VERSION=18.4
# Database user
POSTGRES_USER=postgres
src/postgres/README.md
+5 -1
View File
@@ -10,7 +10,7 @@ This service deploys a PostgreSQL database.
## Configuration
- `POSTGRES_VERSION`: The version of the PostgreSQL image, default is `17.10`.
- `POSTGRES_VERSION`: The version of the PostgreSQL image, default is `18.4`.
- `POSTGRES_USER`: The database username, default is `postgres`.
- `POSTGRES_PASSWORD`: The database password, default is `postgres`.
- `POSTGRES_DB`: The database name, default is `postgres`.
@@ -20,3 +20,7 @@ This service deploys a PostgreSQL database.
- `postgres_data`: A volume for storing PostgreSQL data.
- `init.sql`: Optional initialization script (mount to `/docker-entrypoint-initdb.d/init.sql`).
## Upgrade Warning
PostgreSQL 18 stores data under `/var/lib/postgresql`. Existing pre-18 data directories cannot be reused directly; back up and migrate with `pg_upgrade` or dump/restore before replacing an existing deployment.
src/postgres/README.zh.md
+5 -1
View File
@@ -10,7 +10,7 @@
## 配置
- `POSTGRES_VERSION`: PostgreSQL 镜像的版本，默认为 `17.10`。
- `POSTGRES_VERSION`: PostgreSQL 镜像的版本，默认为 `18.4`。
- `POSTGRES_USER`: 数据库用户名，默认为 `postgres`。
- `POSTGRES_PASSWORD`: 数据库密码，默认为 `postgres`。
- `POSTGRES_DB`: 数据库名称，默认为 `postgres`。
@@ -20,3 +20,7 @@
- `postgres_data`: 用于存储 PostgreSQL 数据的卷。
- `init.sql`: 可选的初始化脚本（挂载到 `/docker-entrypoint-initdb.d/init.sql`）。
## 升级警告
PostgreSQL 18 将数据存储在 `/var/lib/postgresql` 下。不能直接复用 PostgreSQL 18 之前的数据目录；替换现有部署前，请先备份，并使用 `pg_upgrade` 或转储与恢复方式迁移。
src/postgres/docker-compose.yaml
+2 -2
View File
@@ -9,14 +9,14 @@ x-defaults: &defaults
services:
postgres:
<<: *defaults
image: ${GLOBAL_REGISTRY:-}postgres:${POSTGRES_VERSION:-17.10}
image: ${GLOBAL_REGISTRY:-}postgres:${POSTGRES_VERSION:-18.4}
environment:
TZ: ${TZ:-UTC}
POSTGRES_USER: ${POSTGRES_USER:-postgres}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
POSTGRES_DB: ${POSTGRES_DB:-postgres}
volumes:
- postgres_data:/var/lib/postgresql/data
- postgres_data:/var/lib/postgresql
# Initialize the database with a custom SQL script
# - ./init.sql:/docker-entrypoint-initdb.d/init.sql
src/prometheus/.env.example
+1 -1
View File
@@ -1,7 +1,7 @@
# Prometheus Environment Variables
# Prometheus image version
PROMETHEUS_VERSION=v3.5.1
PROMETHEUS_VERSION=v3.13.1
# Host port mapping (maps to Prometheus port 9090 in container)
PROMETHEUS_PORT_OVERRIDE=9090
src/prometheus/README.md
+5 -1
View File
@@ -12,7 +12,7 @@ This service deploys Prometheus, an open-source system monitoring and alerting t
| Variable Name | Description | Default Value |
| ------------------------- | ------------------------------------------------------------- | ----------------------- |
| PROMETHEUS_VERSION | Prometheus image version | `v3.5.0` |
| PROMETHEUS_VERSION | Prometheus image version | `v3.13.1` |
| PROMETHEUS_PORT_OVERRIDE | Host port mapping (maps to Prometheus port 9090 in container) | `9090` |
| PROMETHEUS_RETENTION_TIME | How long to retain data | `15d` |
| PROMETHEUS_RETENTION_SIZE | Maximum storage size (empty = unlimited) | `""` |
@@ -90,6 +90,10 @@ Configure data retention using environment variables:
- Use authentication/authorization proxy for production deployments
- Monitor resource usage as Prometheus can consume significant storage and memory
## Upgrading
Before upgrading to Prometheus v3, back up the TSDB and review the migration guide. Rolling a v3 TSDB back requires Prometheus v2.55 or newer.
## Common Use Cases
### Monitoring Docker Containers
src/prometheus/README.zh.md
+5 -1
View File
@@ -12,7 +12,7 @@
| 变量名 | 描述 | 默认值 |
| ------------------------- | --------------------------------------------------- | ----------------------- |
| PROMETHEUS_VERSION | Prometheus 镜像版本 | `v3.5.0` |
| PROMETHEUS_VERSION | Prometheus 镜像版本 | `v3.13.1` |
| PROMETHEUS_PORT_OVERRIDE | 主机端口映射（映射到容器中的 Prometheus 端口 9090） | `9090` |
| PROMETHEUS_RETENTION_TIME | 数据保留时间 | `15d` |
| PROMETHEUS_RETENTION_SIZE | 最大存储大小（空值 = 无限制） | `""` |
@@ -90,6 +90,10 @@ volumes:
- 为生产部署使用身份验证/授权代理
- 监控资源使用情况，因为 Prometheus 可能消耗大量存储和内存
## 升级
升级到 Prometheus v3 前，请备份 TSDB 并查看 migration guide。将 v3 TSDB 回滚到旧版本需要使用 Prometheus v2.55 或更高版本。
## 常见用例
### 监控 Docker 容器
src/prometheus/docker-compose.yaml
+2 -2
View File
@@ -9,7 +9,7 @@ x-defaults: &defaults
services:
prometheus:
<<: *defaults
image: ${GLOBAL_REGISTRY:-}prom/prometheus:${PROMETHEUS_VERSION:-v3.5.1}
image: ${GLOBAL_REGISTRY:-}prom/prometheus:${PROMETHEUS_VERSION:-v3.13.1}
ports:
- '${PROMETHEUS_PORT_OVERRIDE:-9090}:9090'
volumes:
@@ -48,7 +48,7 @@ services:
- --no-verbose
- --tries=1
- --spider
- 'http://localhost:9090/-/healthy'
- 'http://localhost:9090/-/ready'
interval: 30s
timeout: 10s
src/rabbitmq/.env.example
+1 -1
View File
@@ -1,5 +1,5 @@
# RabbitMQ Version
RABBITMQ_VERSION=4.2.4-management-alpine
RABBITMQ_VERSION=4.3.4-management-alpine
# RabbitMQ credentials
RABBITMQ_DEFAULT_USER=admin
src/rabbitmq/README.md
+3 -1
View File
@@ -10,7 +10,7 @@ This service deploys RabbitMQ, a message broker for reliable messaging between a
## Configuration
- `RABBITMQ_VERSION`: The version of the RabbitMQ image, default is `4.2.4-management-alpine`.
- `RABBITMQ_VERSION`: The version of the RabbitMQ image, default is `4.3.4-management-alpine`.
- `RABBITMQ_PORT`: The host port for RabbitMQ, default is `5672`.
- `RABBITMQ_MANAGEMENT_PORT`: The host port for RabbitMQ Management UI, default is `15672`.
- `RABBITMQ_DEFAULT_USER`: The default username, default is `admin`.
@@ -19,3 +19,5 @@ This service deploys RabbitMQ, a message broker for reliable messaging between a
## Volumes
- `rabbitmq_data`: A volume for storing RabbitMQ data.
Before upgrading from RabbitMQ 4.2 to 4.3, back up data, enable all stable feature flags, and follow the supported 4.2→4.3 upgrade path.
src/rabbitmq/README.zh.md
+3 -1
View File
@@ -10,7 +10,7 @@
## 配置
- `RABBITMQ_VERSION`: RabbitMQ 镜像的版本，默认为 `4.2.4-management-alpine`。
- `RABBITMQ_VERSION`: RabbitMQ 镜像的版本，默认为 `4.3.4-management-alpine`。
- `RABBITMQ_PORT`: RabbitMQ 的主机端口，默认为 `5672`。
- `RABBITMQ_MANAGEMENT_PORT`: RabbitMQ 管理界面的主机端口，默认为 `15672`。
- `RABBITMQ_DEFAULT_USER`: 默认用户名，默认为 `admin`。
@@ -19,3 +19,5 @@
## 卷
- `rabbitmq_data`: 用于存储 RabbitMQ 数据的卷。
从 RabbitMQ 4.2 升级到 4.3 前，请先备份数据、启用所有稳定的功能标志，并遵循受支持的 4.2→4.3 升级路径。
src/rabbitmq/docker-compose.yaml
+1 -1
View File
@@ -9,7 +9,7 @@ x-defaults: &defaults
services:
rabbitmq:
<<: *defaults
image: ${GLOBAL_REGISTRY:-}rabbitmq:${RABBITMQ_VERSION:-4.2.4-management-alpine}
image: ${GLOBAL_REGISTRY:-}rabbitmq:${RABBITMQ_VERSION:-4.3.4-management-alpine}
volumes:
- rabbitmq_data:/var/lib/rabbitmq
ports:
src/redis/.env.example
+1 -1
View File
@@ -2,7 +2,7 @@
GLOBAL_REGISTRY=
# Redis version
REDIS_VERSION=8.8.0-alpine3.23
REDIS_VERSION=8.8.1-alpine3.23
# Password for Redis authentication (leave empty for no password)
REDIS_PASSWORD=
src/redis/README.md
+1 -1
View File
@@ -19,7 +19,7 @@ docker compose up -d
| Variable Name | Description | Default Value |
| -------------------------- | -------------------------------------------------------- | ------------------ |
| `GLOBAL_REGISTRY` | Global registry prefix for all images | `""` |
| `REDIS_VERSION` | Redis image version | `8.8.0-alpine3.23` |
| `REDIS_VERSION` | Redis image version | `8.8.1-alpine3.23` |
| `REDIS_PASSWORD` | Password for Redis authentication (empty = no auth) | `""` |
| `REDIS_PORT_OVERRIDE` | Host port mapping (maps to Redis port 6379 in container) | `6379` |
| `TZ` | Timezone | `UTC` |
src/redis/README.zh.md
+1 -1
View File
@@ -19,7 +19,7 @@ docker compose up -d
| 变量名 | 说明 | 默认值 |
| -------------------------- | -------------------------------------------- | ------------------ |
| `GLOBAL_REGISTRY` | 全局镜像仓库前缀 | `""` |
| `REDIS_VERSION` | Redis 镜像版本 | `8.8.0-alpine3.23` |
| `REDIS_VERSION` | Redis 镜像版本 | `8.8.1-alpine3.23` |
| `REDIS_PASSWORD` | Redis 认证密码（留空表示不启用认证） | `""` |
| `REDIS_PORT_OVERRIDE` | 主机端口映射（映射到容器内 Redis 端口 6379） | `6379` |
| `TZ` | 时区 | `UTC` |
src/redis/docker-compose.yaml
+1 -1
View File
@@ -9,7 +9,7 @@ x-defaults: &defaults
services:
redis:
<<: *defaults
image: ${GLOBAL_REGISTRY:-}redis:${REDIS_VERSION:-8.8.0-alpine3.23}
image: ${GLOBAL_REGISTRY:-}redis:${REDIS_VERSION:-8.8.1-alpine3.23}
ports:
- '${REDIS_PORT_OVERRIDE:-6379}:6379'
volumes: