docker-compose.failover.yml - master - Al/TESamples

docker-compose.failover.yml
106 строк5 KB
Initial Commit
11 май 2026, 17:40
11 май 2026, 17:400a04577
# =============================================================
# Failover + Chaos overlay (Phase 5, M4)
#
# Использование:
#   docker compose -f docker-compose.yml -f docker-compose.failover.yml up -d
#   make up-failover
#
# Что добавляет:
#  - Toxiproxy (порт 18080 — proxy для realm-primary, :8474 — control API).
#  - На Keycloak:
#      KC_HOSTNAME=http://keycloak:8080 — стабильный iss независимо от Host header,
#      KC_HOSTNAME_BACKCHANNEL_DYNAMIC=true — admin/openid-config продолжают работать
#      по любому хосту (полезно для tests с хоста).
#  - На BFF (Java + Python) добавляются переменные:
#      KC_PRIMARY_BASE_URL   = http://toxiproxy:18080  (через прокси, можно «убить»)
#      KC_SECONDARY_BASE_URL = http://keycloak:8080    (напрямую — fallback)
#      PRIMARY_REALM         = realm-primary
#      SECONDARY_REALM       = realm-secondary
#  - На chain-сервисы:
#      KC_TRUSTED_ISSUERS = comma-list iss URI обоих realms.
#
# Combinable c observability overlay:
#   docker compose -f docker-compose.yml \
#                  -f docker-compose.observability.yml \
#                  -f docker-compose.failover.yml up -d
# =============================================================

services:
  # ---------- Стабильный iss + дин. backchannel ----------
  # В failover-режиме перетираем KC_HOSTNAME — для chaos-сценариев нужен
  # стабильный internal iss, иначе токены, выпущенные до chaos-injection,
  # будут невалидны после.
  keycloak:
    environment:
      KC_HOSTNAME: "http://keycloak:8080"
      # _BACKCHANNEL_DYNAMIC: admin/openid-config поддерживает любой Host header,
      # удобно для тестов с хоста + контейнеров одновременно.
      KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"

  # ---------- Toxiproxy ----------
  # L4-прокси с программируемой инжекцией сбоев (latency/disconnect/bandwidth).
  # Конфиг toxiproxy.json: один proxy "keycloak-primary" :18080 → keycloak:8080.
  # Chaos-скрипты (chaos/scenarios/*.sh) дёргают control API :8474, добавляя
  # toxics (`disconnect`, `latency_ms=5000` и т. п.) к proxy.
  toxiproxy:
    image: ghcr.io/shopify/toxiproxy:2.11.0
    restart: unless-stopped
    command: ["-host", "0.0.0.0", "-config", "/config/toxiproxy.json"]
    volumes:
      - ./chaos/toxiproxy/toxiproxy.json:/config/toxiproxy.json:ro
    ports:
      - "${TOXIPROXY_API_PORT:-18474}:8474"   # control API (с хоста — для chaos-скриптов)
      - "${TOXIPROXY_PROXY_PORT:-28080}:18080" # сам прокси-порт (downstream = keycloak)
    depends_on:
      keycloak:
        condition: service_started

  # ---------- Конфигурация BFF под failover ----------
  bff-agent:
    environment:
      KC_PRIMARY_BASE_URL: "http://toxiproxy:18080"
      KC_SECONDARY_BASE_URL: "http://keycloak:8080"
      PRIMARY_REALM: "realm-primary"
      SECONDARY_REALM: "realm-secondary"
      BFF_CLIENT_SECRET_PRIMARY: "bff-agent-dev-secret"
      BFF_CLIENT_SECRET_SECONDARY: "bff-agent-secondary-dev-secret"
      AGENT_CLIENT_SECRET_PRIMARY: "agent-runtime-dev-secret"
      AGENT_CLIENT_SECRET_SECONDARY: "agent-runtime-secondary-dev-secret"
    depends_on:
      toxiproxy:
        condition: service_started

  bff-agent-py:
    environment:
      KC_PRIMARY_BASE_URL: "http://toxiproxy:18080"
      KC_SECONDARY_BASE_URL: "http://keycloak:8080"
      PRIMARY_REALM: "realm-primary"
      SECONDARY_REALM: "realm-secondary"
      BFF_CLIENT_SECRET_PRIMARY: "bff-agent-dev-secret"
      BFF_CLIENT_SECRET_SECONDARY: "bff-agent-secondary-dev-secret"
      AGENT_CLIENT_SECRET_PRIMARY: "agent-runtime-dev-secret"
      AGENT_CLIENT_SECRET_SECONDARY: "agent-runtime-secondary-dev-secret"
    depends_on:
      toxiproxy:
        condition: service_started

  # ---------- Chain-сервисы доверяют обоим issuer (multi-issuer, FR-06.7) ----------
  service-a:
    environment:
      KC_TRUSTED_ISSUERS: "http://keycloak:8080/realms/realm-primary,http://keycloak:8080/realms/realm-secondary"
  service-b:
    environment:
      KC_TRUSTED_ISSUERS: "http://keycloak:8080/realms/realm-primary,http://keycloak:8080/realms/realm-secondary"
  service-c:
    environment:
      KC_TRUSTED_ISSUERS: "http://keycloak:8080/realms/realm-primary,http://keycloak:8080/realms/realm-secondary"

  service-a-py:
    environment:
      KC_TRUSTED_ISSUERS: "http://keycloak:8080/realms/realm-primary,http://keycloak:8080/realms/realm-secondary"
  service-b-py:
    environment:
      KC_TRUSTED_ISSUERS: "http://keycloak:8080/realms/realm-primary,http://keycloak:8080/realms/realm-secondary"
  service-c-py:
    environment:
      KC_TRUSTED_ISSUERS: "http://keycloak:8080/realms/realm-primary,http://keycloak:8080/realms/realm-secondary"