mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity
Files
8020101cc8f737d3b30902e089d7a264caa839a8
stack/docker-compose.yml
Jason Woltje 429cf85f87 fix(#363): rebuild gosu from source with Go 1.26 to fix CRITICAL CVEs 
The gosu 1.19 binary bundled in the postgres base image was compiled
with Go 1.24.6, which contains CVE-2025-68121 (CRITICAL) and 5 HIGH
severity Go stdlib vulnerabilities. Since upstream gosu has not released
a version built with patched Go (1.24.13+ / 1.25.7+), this adds a
multi-stage Docker build that recompiles gosu from source using Go 1.26.

Changes:
- Pin postgres base image to 17.7-alpine3.22 for reproducibility
- Add golang:1.26-alpine3.22 builder stage to compile gosu v1.19
- Replace bundled gosu binary with freshly built version
- Pin all postgres:17-alpine references across compose files and CI

CVEs fixed:
- CVE-2025-68121 (CRITICAL): Go crypto/tls vulnerability
- CVE-2025-58183 (HIGH): Go archive/tar unbounded allocation
- CVE-2025-61726 (HIGH): Go net/url memory exhaustion
- CVE-2025-61728 (HIGH): Go archive/zip CPU exhaustion
- CVE-2025-61729 (HIGH): Go crypto/x509 DoS
- CVE-2025-61730 (HIGH): Go TLS 1.3 handshake vulnerability

Fixes #363

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-12 12:38:33 -06:00

569 lines
18 KiB
YAML
Raw Blame History

services:
# ======================
# PostgreSQL Database
# ======================
postgres:
image: git.mosaicstack.dev/mosaic/stack-postgres:${IMAGE_TAG:-dev}
container_name: mosaic-postgres
restart: unless-stopped
environment:
POSTGRES_USER: ${POSTGRES_USER:-mosaic}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-mosaic_dev_password}
POSTGRES_DB: ${POSTGRES_DB:-mosaic}
# Performance tuning
POSTGRES_SHARED_BUFFERS: ${POSTGRES_SHARED_BUFFERS:-256MB}
POSTGRES_EFFECTIVE_CACHE_SIZE: ${POSTGRES_EFFECTIVE_CACHE_SIZE:-1GB}
POSTGRES_MAX_CONNECTIONS: ${POSTGRES_MAX_CONNECTIONS:-100}
ports:
- "${POSTGRES_PORT:-5432}:5432"
volumes:
- postgres_data:/var/lib/postgresql/data
- ./docker/postgres/init-scripts:/docker-entrypoint-initdb.d:ro
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-mosaic} -d ${POSTGRES_DB:-mosaic}"]
interval: 10s
timeout: 5s
retries: 5
start_period: 30s
networks:
- mosaic-internal
profiles:
- database
- full
labels:
- "com.mosaic.service=database"
- "com.mosaic.description=PostgreSQL 17 with pgvector"
# ======================
# Valkey Cache
# ======================
valkey:
image: valkey/valkey:8-alpine
container_name: mosaic-valkey
restart: unless-stopped
command:
- valkey-server
- --maxmemory ${VALKEY_MAXMEMORY:-256mb}
- --maxmemory-policy allkeys-lru
- --appendonly yes
ports:
- "${VALKEY_PORT:-6379}:6379"
volumes:
- valkey_data:/data
healthcheck:
test: ["CMD", "valkey-cli", "ping"]
interval: 10s
timeout: 5s
retries: 5
start_period: 10s
networks:
- mosaic-internal
profiles:
- cache
- full
labels:
- "com.mosaic.service=cache"
- "com.mosaic.description=Valkey Redis-compatible cache"
# ======================
# Authentik PostgreSQL
# ======================
# authentik-postgres:
# image: postgres:17.7-alpine3.22
# container_name: mosaic-authentik-postgres
# restart: unless-stopped
# environment:
# POSTGRES_USER: ${AUTHENTIK_POSTGRES_USER:-authentik}
# POSTGRES_PASSWORD: ${AUTHENTIK_POSTGRES_PASSWORD:-authentik_password}
# POSTGRES_DB: ${AUTHENTIK_POSTGRES_DB:-authentik}
# volumes:
# - authentik_postgres_data:/var/lib/postgresql/data
# healthcheck:
# test: ["CMD-SHELL", "pg_isready -U ${AUTHENTIK_POSTGRES_USER:-authentik}"]
# interval: 10s
# timeout: 5s
# retries: 5
# start_period: 20s
# networks:
# - mosaic-internal
# profiles:
# - authentik
# - full
# labels:
# - "com.mosaic.service=auth-database"
# - "com.mosaic.description=Authentik PostgreSQL database"
# ======================
# Authentik Redis
# ======================
# authentik-redis:
# image: valkey/valkey:8-alpine
# container_name: mosaic-authentik-redis
# restart: unless-stopped
# command: valkey-server --save 60 1 --loglevel warning
# volumes:
# - authentik_redis_data:/data
# healthcheck:
# test: ["CMD", "valkey-cli", "ping"]
# interval: 10s
# timeout: 5s
# retries: 5
# start_period: 10s
# networks:
# - mosaic-internal
# profiles:
# - authentik
# - full
# labels:
# - "com.mosaic.service=auth-cache"
# - "com.mosaic.description=Authentik Redis cache"
# ======================
# Authentik Server
# ======================
# authentik-server:
# image: ghcr.io/goauthentik/server:2025.10.2
# container_name: mosaic-authentik-server
# restart: unless-stopped
# command: server
# environment:
# AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:-change-this-to-a-random-secret}
# AUTHENTIK_ERROR_REPORTING__ENABLED: ${AUTHENTIK_ERROR_REPORTING:-false}
# AUTHENTIK_POSTGRESQL__HOST: authentik-postgres
# AUTHENTIK_POSTGRESQL__PORT: 5432
# AUTHENTIK_POSTGRESQL__NAME: ${AUTHENTIK_POSTGRES_DB:-authentik}
# AUTHENTIK_POSTGRESQL__USER: ${AUTHENTIK_POSTGRES_USER:-authentik}
# AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_POSTGRES_PASSWORD:-authentik_password}
# AUTHENTIK_REDIS__HOST: authentik-redis
# AUTHENTIK_REDIS__PORT: 6379
# AUTHENTIK_BOOTSTRAP_PASSWORD: ${AUTHENTIK_BOOTSTRAP_PASSWORD:-admin}
# AUTHENTIK_BOOTSTRAP_EMAIL: ${AUTHENTIK_BOOTSTRAP_EMAIL:-admin@localhost}
# AUTHENTIK_COOKIE_DOMAIN: ${AUTHENTIK_COOKIE_DOMAIN:-.localhost}
# ports:
# - "${AUTHENTIK_PORT_HTTP:-9000}:9000"
# - "${AUTHENTIK_PORT_HTTPS:-9443}:9443"
# volumes:
# - authentik_media:/media
# - authentik_templates:/templates
# depends_on:
# authentik-postgres:
# condition: service_healthy
# authentik-redis:
# condition: service_healthy
# healthcheck:
# test:
# [
# "CMD",
# "wget",
# "--no-verbose",
# "--tries=1",
# "--spider",
# "http://localhost:9000/-/health/live/",
# ]
# interval: 30s
# timeout: 10s
# retries: 3
# start_period: 90s
# networks:
# - mosaic-internal
# - mosaic-public
# profiles:
# - authentik
# - full
# labels:
# - "com.mosaic.service=auth-server"
# - "com.mosaic.description=Authentik OIDC server"
# # Traefik labels (activated when TRAEFIK_MODE=bundled or upstream)
# - "traefik.enable=${TRAEFIK_ENABLE:-false}"
# - "traefik.http.routers.mosaic-auth.rule=Host(`${MOSAIC_AUTH_DOMAIN:-auth.mosaic.local}`)"
# - "traefik.http.routers.mosaic-auth.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
# - "traefik.http.routers.mosaic-auth.tls=${TRAEFIK_TLS_ENABLED:-true}"
# - "traefik.http.services.mosaic-auth.loadbalancer.server.port=9000"
# - "traefik.docker.network=${TRAEFIK_DOCKER_NETWORK:-mosaic-public}"
# # Let's Encrypt (if enabled)
# - "traefik.http.routers.mosaic-auth.tls.certresolver=${TRAEFIK_CERTRESOLVER:-}"
# ======================
# Authentik Worker
# ======================
# authentik-worker:
# image: ghcr.io/goauthentik/server:2025.10.2
# container_name: mosaic-authentik-worker
# restart: unless-stopped
# command: worker
# environment:
# AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:-change-this-to-a-random-secret}
# AUTHENTIK_ERROR_REPORTING__ENABLED: ${AUTHENTIK_ERROR_REPORTING:-false}
# AUTHENTIK_POSTGRESQL__HOST: authentik-postgres
# AUTHENTIK_POSTGRESQL__PORT: 5432
# AUTHENTIK_POSTGRESQL__NAME: ${AUTHENTIK_POSTGRES_DB:-authentik}
# AUTHENTIK_POSTGRESQL__USER: ${AUTHENTIK_POSTGRES_USER:-authentik}
# AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_POSTGRES_PASSWORD:-authentik_password}
# AUTHENTIK_REDIS__HOST: authentik-redis
# AUTHENTIK_REDIS__PORT: 6379
# volumes:
# - authentik_media:/media
# - authentik_certs:/certs
# - authentik_templates:/templates
# depends_on:
# authentik-postgres:
# condition: service_healthy
# authentik-redis:
# condition: service_healthy
# networks:
# - mosaic-internal
# profiles:
# - authentik
# - full
# labels:
# - "com.mosaic.service=auth-worker"
# - "com.mosaic.description=Authentik background worker"
# ======================
# Ollama (Optional AI Service)
# ======================
# ollama:
# image: ollama/ollama:latest
# container_name: mosaic-ollama
# restart: unless-stopped
# ports:
# - "${OLLAMA_PORT:-11434}:11434"
# volumes:
# - ollama_data:/root/.ollama
# healthcheck:
# test: ["CMD", "curl", "-f", "http://localhost:11434/api/tags"]
# interval: 30s
# timeout: 10s
# retries: 3
# start_period: 60s
# networks:
# - mosaic-internal
# profiles:
# - ollama
# - full
# labels:
# - "com.mosaic.service=ai"
# - "com.mosaic.description=Ollama LLM service"
# # Uncomment if you have GPU support
# # deploy:
# # resources:
# # reservations:
# # devices:
# # - driver: nvidia
# # count: 1
# # capabilities: [gpu]
# ======================
# OpenBao Secrets Management (Optional)
# ======================
openbao:
image: git.mosaicstack.dev/mosaic/stack-openbao:${IMAGE_TAG:-dev}
container_name: mosaic-openbao
restart: unless-stopped
user: root
ports:
- "127.0.0.1:${OPENBAO_PORT:-8200}:8200"
volumes:
- openbao_data:/openbao/data
- openbao_init:/openbao/init
environment:
VAULT_ADDR: http://0.0.0.0:8200
SKIP_SETCAP: "true"
command: ["bao", "server", "-config=/openbao/config/config.hcl"]
cap_add:
- IPC_LOCK
healthcheck:
test: ["CMD-SHELL", "nc -z 127.0.0.1 8200 || exit 1"]
interval: 10s
timeout: 5s
retries: 5
start_period: 10s
networks:
- mosaic-internal
profiles:
- openbao
- full
labels:
- "com.mosaic.service=secrets"
- "com.mosaic.description=OpenBao secrets management"
openbao-init:
image: git.mosaicstack.dev/mosaic/stack-openbao:${IMAGE_TAG:-dev}
container_name: mosaic-openbao-init
restart: unless-stopped
user: root
volumes:
- openbao_init:/openbao/init
environment:
VAULT_ADDR: http://openbao:8200
command: ["/openbao/init.sh"]
depends_on:
openbao:
condition: service_healthy
networks:
- mosaic-internal
profiles:
- openbao
- full
labels:
- "com.mosaic.service=secrets-init"
- "com.mosaic.description=OpenBao auto-initialization sidecar"
# ======================
# Traefik Reverse Proxy (Optional - Bundled Mode)
# ======================
# Enable with: COMPOSE_PROFILES=traefik-bundled or --profile traefik-bundled
# Set TRAEFIK_MODE=bundled in .env
# traefik:
# image: traefik:v3.2
# container_name: mosaic-traefik
# restart: unless-stopped
# command:
# - "--configFile=/etc/traefik/traefik.yml"
# ports:
# - "${TRAEFIK_HTTP_PORT:-80}:80"
# - "${TRAEFIK_HTTPS_PORT:-443}:443"
# - "${TRAEFIK_DASHBOARD_PORT:-8080}:8080"
# volumes:
# - /var/run/docker.sock:/var/run/docker.sock:ro
# - ./docker/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
# - ./docker/traefik/dynamic:/etc/traefik/dynamic:ro
# - traefik_letsencrypt:/letsencrypt
# environment:
# - TRAEFIK_ACME_EMAIL=${TRAEFIK_ACME_EMAIL:-}
# networks:
# - mosaic-public
# profiles:
# - traefik-bundled
# - full
# labels:
# - "com.mosaic.service=reverse-proxy"
# - "com.mosaic.description=Traefik reverse proxy and load balancer"
# healthcheck:
# test: ["CMD", "traefik", "healthcheck", "--ping"]
# interval: 30s
# timeout: 10s
# retries: 3
# start_period: 20s
# ======================
# Mosaic API
# ======================
api:
image: git.mosaicstack.dev/mosaic/stack-api:${IMAGE_TAG:-dev}
container_name: mosaic-api
restart: unless-stopped
environment:
NODE_ENV: production
# API Configuration - PORT is what NestJS reads
PORT: ${API_PORT:-3001}
API_HOST: ${API_HOST:-0.0.0.0}
# Database
DATABASE_URL: postgresql://${POSTGRES_USER:-mosaic}:${POSTGRES_PASSWORD:-mosaic_dev_password}@postgres:5432/${POSTGRES_DB:-mosaic}
# Cache
VALKEY_URL: redis://valkey:6379
# Authentication
OIDC_ISSUER: ${OIDC_ISSUER}
OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI:-http://localhost:3001/auth/callback}
# JWT
JWT_SECRET: ${JWT_SECRET:-change-this-to-a-random-secret}
JWT_EXPIRATION: ${JWT_EXPIRATION:-24h}
# Ollama (optional)
OLLAMA_ENDPOINT: ${OLLAMA_ENDPOINT:-http://ollama:11434}
# OpenBao (optional)
OPENBAO_ADDR: ${OPENBAO_ADDR:-http://openbao:8200}
volumes:
- openbao_init:/openbao/init:ro
ports:
- "${API_PORT:-3001}:${API_PORT:-3001}"
depends_on:
postgres:
condition: service_healthy
valkey:
condition: service_healthy
healthcheck:
test:
[
"CMD-SHELL",
'node -e "require(''http'').get(''http://localhost:${API_PORT:-3001}/health'', (r) => {process.exit(r.statusCode === 200 ? 0 : 1)})"',
]
interval: 30s
timeout: 10s
retries: 3
start_period: 40s
networks:
- mosaic-internal
- mosaic-public
labels:
- "com.mosaic.service=api"
- "com.mosaic.description=Mosaic NestJS API"
# Traefik labels (activated when TRAEFIK_MODE=bundled or upstream)
- "traefik.enable=${TRAEFIK_ENABLE:-false}"
- "traefik.http.routers.mosaic-api.rule=Host(`${MOSAIC_API_DOMAIN:-api.mosaic.local}`)"
- "traefik.http.routers.mosaic-api.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
- "traefik.http.routers.mosaic-api.tls=${TRAEFIK_TLS_ENABLED:-true}"
- "traefik.http.services.mosaic-api.loadbalancer.server.port=${API_PORT:-3001}"
- "traefik.docker.network=${TRAEFIK_DOCKER_NETWORK:-mosaic-public}"
# Let's Encrypt (if enabled)
- "traefik.http.routers.mosaic-api.tls.certresolver=${TRAEFIK_CERTRESOLVER:-}"
# ======================
# Mosaic Orchestrator
# ======================
orchestrator:
image: git.mosaicstack.dev/mosaic/stack-orchestrator:${IMAGE_TAG:-dev}
container_name: mosaic-orchestrator
restart: unless-stopped
# Run as non-root user (node:node, UID 1000)
user: "1000:1000"
environment:
NODE_ENV: production
# Orchestrator Configuration
ORCHESTRATOR_PORT: 3001
# Valkey
VALKEY_URL: redis://valkey:6379
# Claude API
CLAUDE_API_KEY: ${CLAUDE_API_KEY}
# Docker
DOCKER_SOCKET: /var/run/docker.sock
# Git
GIT_USER_NAME: "Mosaic Orchestrator"
GIT_USER_EMAIL: "orchestrator@mosaicstack.dev"
# Security
KILLSWITCH_ENABLED: true
SANDBOX_ENABLED: true
ports:
- "3002:3001"
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- orchestrator_workspace:/workspace
depends_on:
valkey:
condition: service_healthy
api:
condition: service_healthy
healthcheck:
test:
["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:3001/health || exit 1"]
interval: 30s
timeout: 10s
retries: 3
start_period: 40s
networks:
- mosaic-internal
# Security hardening
security_opt:
- no-new-privileges:true
cap_drop:
- ALL
cap_add:
- NET_BIND_SERVICE
read_only: false # Cannot be read-only due to workspace writes
tmpfs:
- /tmp:noexec,nosuid,size=100m
labels:
- "com.mosaic.service=orchestrator"
- "com.mosaic.description=Mosaic Agent Orchestrator"
- "com.mosaic.security=hardened"
- "com.mosaic.security.non-root=true"
- "com.mosaic.security.capabilities=minimal"
# ======================
# Mosaic Web
# ======================
web:
image: git.mosaicstack.dev/mosaic/stack-web:${IMAGE_TAG:-dev}
container_name: mosaic-web
restart: unless-stopped
environment:
NODE_ENV: production
PORT: ${WEB_PORT:-3000}
NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3001}
ports:
- "${WEB_PORT:-3000}:${WEB_PORT:-3000}"
depends_on:
api:
condition: service_healthy
healthcheck:
test:
[
"CMD-SHELL",
'node -e "require(''http'').get(''http://localhost:${WEB_PORT:-3000}'', (r) => {process.exit(r.statusCode === 200 ? 0 : 1)})"',
]
interval: 30s
timeout: 10s
retries: 3
start_period: 40s
networks:
- mosaic-public
labels:
- "com.mosaic.service=web"
- "com.mosaic.description=Mosaic Next.js Web App"
# Traefik labels (activated when TRAEFIK_MODE=bundled or upstream)
- "traefik.enable=${TRAEFIK_ENABLE:-false}"
- "traefik.http.routers.mosaic-web.rule=Host(`${MOSAIC_WEB_DOMAIN:-mosaic.local}`)"
- "traefik.http.routers.mosaic-web.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
- "traefik.http.routers.mosaic-web.tls=${TRAEFIK_TLS_ENABLED:-true}"
- "traefik.http.services.mosaic-web.loadbalancer.server.port=${WEB_PORT:-3000}"
- "traefik.docker.network=${TRAEFIK_DOCKER_NETWORK:-mosaic-public}"
# Let's Encrypt (if enabled)
- "traefik.http.routers.mosaic-web.tls.certresolver=${TRAEFIK_CERTRESOLVER:-}"
# ======================
# Volumes
# ======================
volumes:
postgres_data:
name: mosaic-postgres-data
driver: local
valkey_data:
name: mosaic-valkey-data
driver: local
# authentik_postgres_data:
# name: mosaic-authentik-postgres-data
# driver: local
# authentik_redis_data:
# name: mosaic-authentik-redis-data
# driver: local
# authentik_media:
# name: mosaic-authentik-media
# driver: local
# authentik_certs:
# name: mosaic-authentik-certs
# driver: local
# authentik_templates:
# name: mosaic-authentik-templates
# driver: local
# ollama_data:
# name: mosaic-ollama-data
# driver: local
openbao_data:
name: mosaic-openbao-data
driver: local
openbao_init:
name: mosaic-openbao-init
driver: local
# traefik_letsencrypt:
# name: mosaic-traefik-letsencrypt
# driver: local
orchestrator_workspace:
name: mosaic-orchestrator-workspace
driver: local
# ======================
# Networks
# ======================
networks:
# Internal network for database/cache isolation
# Note: NOT marked as 'internal: true' because API needs external access
# for Authentik OIDC and external Ollama services
mosaic-internal:
name: mosaic-internal
driver: bridge
# Public network for services that need external access
mosaic-public:
name: mosaic-public
driver: bridge
Reference in New Issue View Git Blame Copy Permalink