Something went wrong. Try again.
A container registry that uses the AT Protocol for manifest storage and S3 for blob storage. atcr.io
docker container atproto go
Something went wrong. Try again.
at-container-registry docker-compose.yml
7.4 kB · 199 lines
YAML
at main
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200services: atcr-appview: build: context: . dockerfile: Dockerfile.dev args: GO_TAGS: testmode image: atcr-appview-dev:latest container_name: atcr-appview # Option B: share the hold's network namespace so "localhost:8080" reaches the # hold from inside appview. This lets the hold use did:web:localhost%3A8080, # which is the only port-bearing did:web atproto accepts as a service-token # `aud` (real PDSes reject did:web:<ip>%3A<port> since atproto only allows # ports on localhost). Ports for appview are published on the atcr-hold # service below, since it owns the namespace. network_mode: "service:atcr-hold" depends_on: - atcr-hold env_file: - ../atcr-secrets.env # Optional: Load from .env.appview file (create from .env.appview.example) # env_file: # - .env.appview # Base config: config-appview.example.yaml (passed via Air entrypoint) # Env vars below override config file values for local dev environment: # ATCR_SERVER_CLIENT_NAME: "Seamark" # ATCR_SERVER_CLIENT_SHORT_NAME: "Seamark" # First entry is the default blob-storage hold. Comma-separate for multiple: # ATCR_SERVER_MANAGED_HOLDS: "did:web:a,did:web:b" (Viper splits on commas). ATCR_SERVER_MANAGED_HOLDS: did:web:localhost%3A8080 # Labeler URL (HTTP for dev — ParseLabelerURL accepts it directly so we don't # have to round-trip through did:web → https:// resolution). ATCR_LABELER_DID: did:web:172.28.0.4%3A5002 ATCR_LOG_LEVEL: debug LOG_SHIPPER_BACKEND: victoria LOG_SHIPPER_URL: http://172.28.0.10:9428 # Limit local Docker logs - real logs go to Victoria Logs # Local logs just for live tailing (docker logs -f) logging: driver: json-file options: max-size: "10m" max-file: "1" volumes: # Mount source code for Air hot reload - .:/app:z # Cache go modules between rebuilds - go-mod-cache:/go/pkg/mod # UI database (includes OAuth sessions, devices, and Jetstream cache) - atcr-ui:/var/lib/atcr restart: unless-stopped # No `networks:`/`dns:`/`ports:` here — appview inherits atcr-hold's network # namespace (see network_mode above). It is reachable on atcr-network at the # hold's IP (172.28.0.3) and shares the hold's loopback. # The AppView is stateless - all storage is external: # - Manifests/Tags -> ATProto PDS (via middleware) # - Blobs/Layers -> Hold service (via ProxyBlobStore) # - OAuth tokens -> SQLite database (atcr-ui volume)
atcr-hold: env_file: - ../atcr-secrets.env # Load S3/Storj credentials from external file # Base config: config-hold.example.yaml (passed via Air entrypoint) # Env vars below override config file values for local dev environment: # appview shares this container's netns (network_mode: service:atcr-hold), # so it is reachable at 127.0.0.1:5000 from here. Must match appview's # auto-detected dev DID (addr :5000 -> http://127.0.0.1:5000). HOLD_SERVER_APPVIEW_DID: did:web:127.0.0.1%3A5000 HOLD_SCANNER_SECRET: dev-secret # localhost (not the 172.28 IP) so the hold's own DID is # did:web:localhost%3A8080 — the aud appview presents, and the only # port-bearing did:web a real PDS accepts. HOLD_SERVER_PUBLIC_URL: http://localhost:8080 HOLD_REGISTRATION_OWNER_DID: did:plc:pddp4xt5lgnv2qsegbzzs4xg HOLD_REGISTRATION_ALLOW_ALL_CREW: true HOLD_LOG_LEVEL: debug # Subscribe to the dev labeler so takedowns purge records on this hold and # GC honors the reversibility window. Same value the appview uses for # ATCR_LABELER_DID — accepts a did:web identifier or a raw URL. HOLD_LABELER_DID: did:web:172.28.0.4%3A5002 # Short grace window for dev so the takedown→GC path is exercisable without # waiting weeks. Production default is 720h (30 days). HOLD_LABELER_GRACE_WINDOW: 1h LOG_SHIPPER_BACKEND: victoria LOG_SHIPPER_URL: http://172.28.0.10:9428 # S3 storage config comes from env_file (AWS_*, S3_*) # Limit local Docker logs - real logs go to Victoria Logs # Local logs just for live tailing (docker logs -f) logging: driver: json-file options: max-size: "10m" max-file: "1" build: context: . dockerfile: Dockerfile.dev args: AIR_CONFIG: .air.hold.toml GO_TAGS: testmode image: atcr-hold-dev:latest container_name: atcr-hold ports: - "8080:8080" # appview shares this namespace, so its port is published here. - "5000:5000" volumes: # Mount source code for Air hot reload - .:/app:z # Cache go modules between rebuilds - go-mod-cache:/go/pkg/mod # PDS data (carstore SQLite + signing keys) - atcr-hold:/var/lib/atcr-hold restart: unless-stopped dns: - 8.8.8.8 - 1.1.1.1 networks: atcr-network: ipv4_address: 172.28.0.3
atcr-labeler: # Base config: config-labeler.example.yaml (passed via Air entrypoint). # Env vars below override config file values for local dev. # # Why did:web for dev: did:plc would submit a real PLC operation to plc.directory # for every fresh dev environment, polluting production with throwaway DIDs that # point at 172.28.0.x. did:web is purely self-served via /.well-known/did.json so # nothing leaks. Switch to plc + a real public_url for production. environment: LABELER_LABELER_DID_METHOD: web LABELER_LABELER_PUBLIC_URL: http://172.28.0.4:5002 LABELER_LABELER_OWNER_DID: did:plc:pddp4xt5lgnv2qsegbzzs4xg LABELER_LABELER_DATA_DIR: /var/lib/atcr-labeler LABELER_LOG_LEVEL: debug LOG_SHIPPER_BACKEND: victoria LOG_SHIPPER_URL: http://172.28.0.10:9428 logging: driver: json-file options: max-size: "10m" max-file: "1" build: context: . dockerfile: Dockerfile.dev args: AIR_CONFIG: .air.labeler.toml GO_TAGS: testmode image: atcr-labeler-dev:latest container_name: atcr-labeler ports: - "5002:5002" volumes: # Mount source code for Air hot reload - .:/app:z - go-mod-cache:/go/pkg/mod # Persist signing key + did.txt + label database across container restarts so # dev signatures stay verifiable. Wipe with `docker compose down -v` to reset. - atcr-labeler:/var/lib/atcr-labeler restart: unless-stopped dns: - 8.8.8.8 - 1.1.1.1 networks: atcr-network: ipv4_address: 172.28.0.4
# Victoria Logs for centralized log storage # Uncomment to enable, then set LOG_SHIPPER_* env vars above victorialogs: image: victoriametrics/victoria-logs:latest container_name: victorialogs ports: - "9428:9428" volumes: - victorialogs-data:/victoria-logs-data command: - "-storageDataPath=/victoria-logs-data" - "-retentionPeriod=7d" restart: unless-stopped networks: atcr-network: ipv4_address: 172.28.0.10
networks: atcr-network: driver: bridge ipam: config: - subnet: 172.28.0.0/24
volumes: atcr-hold: atcr-labeler: atcr-auth: atcr-ui: go-mod-cache: victorialogs-data: