cloudsql-compose.yml

# Copyright 2026 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

services:
  # S3Proxy - S3-compatible object storage emulator
  # GCS emulator (fake-gcs-server) does not support exporting an HMAC access key and secret
  s3proxy:
    image: andrewgaul/s3proxy:4.1.1@sha256:87662b2a5afcdfa5f478a1c61650bae4c87bbd15f6ff2823236bcfd66ef7fe04
    ports:
      - "9002:80"   # S3 API
    environment:
      - S3PROXY_AUTHORIZATION=none
      - JCLOUDS_FILESYSTEM_BASEDIR=/data
    healthcheck:
      # s3proxy image does not have curl: use /dev/tcp bashism to achieve same
      test:
        - CMD
        - bash
        - -c
        - exec 3<>"/dev/tcp/127.0.0.1/80" && printf "GET /healthz HTTP/1.0\r\n\r\n" >&3 && head -n 1 <&3 | grep -q " 200 "
      interval: 3s
      timeout: 3s
      retries: 10
    volumes:
      - s3_data:/data/tiles

  mysql:
    image: mysql:26.7@sha256:45abdd9b4144660b5c93a5b7d0ebb21e024f0ba9851ecb4ab43bf83c6bf83592
    ports:
      - "3306:3306"
    environment:
      - MYSQL_ROOT_PASSWORD=rootpassword
      - MYSQL_DATABASE=sequencer
      - MYSQL_USER=rekor
      - MYSQL_PASSWORD=rekorpassword
    command:
      - --max_connections=1000
    healthcheck:
      test: "mysqladmin -h 127.0.0.1 --user=$$MYSQL_USER --password=$$MYSQL_ROOT_PASSWORD -s ping"
      interval: 5s
      timeout: 5s
      retries: 10
    volumes:
      - mysql_data:/var/lib/mysql

  rekor:
    build:
      context: .
      target: local-deploy
      args:
        STORAGE_BACKEND: gcpcloudsql
    environment:
      - GCS_HMAC_ACCESS_KEY_ID=minioadmin
      - GCS_HMAC_SECRET=minioadmin
      - GCS_ENDPOINT_URL=http://s3proxy:80
      - GCS_REGION=us-east-1
    command:
      - "rekor-server"
      - "serve"
      - "--http-address=0.0.0.0"
      - "--grpc-address=0.0.0.0"
      - "--hostname=rekor-local"
      - "--gcp-bucket=tiles"
      - "--gcp-cloudsql-dsn=rekor:rekorpassword@tcp(mysql:3306)/sequencer?parseTime=true"
      - "--signer-filepath=/pki/ed25519-priv-key.pem"
      - "--checkpoint-interval=2s"
      - "--log-level=debug"
      - "--request-response-logging=true"
      - "--persistent-antispam"
      - "--witness-policy-path=/witness/policy.yaml"
    ports:
      - "3005:3000" # http port
      - "3006:3001" # grpc port
      - "2115:2112" # metrics port
    healthcheck:
      test:
        - CMD-SHELL
        - curl http://localhost:3000/healthz | grep '{"status":"SERVING"}'
      timeout: 30s
      retries: 10
      interval: 3s
    volumes:
      - ./tests/testdata/pki:/pki
      - ./tests/testdata/witness:/witness
    depends_on:
      s3proxy:
        condition: service_healthy
      mysql:
        condition: service_healthy
      witness:
        condition: service_healthy

  witness:
    build:
      context: https://github.com/transparency-dev/witness.git#main
      dockerfile: cmd/omniwitness/Dockerfile
    volumes:
      - witness_data:/witness_data:rw
      - ./tests/testdata/witness:/witness_config
    command:
      - "--listen=:8100"
      - "--db_file=/witness_data/witness.sqlite"
      - "--private_key_path=/witness_config/private.key"
      - "--additional_logs=/witness_config/config.yaml"
      - "--logtostderr"
      - "--v=2"
      - "--rate_limit=100"
    restart: always
    healthcheck:
      test:
      - CMD-SHELL
      - wget --spider --tries=1 http://localhost:8081/metrics || exit 1
      timeout: 30s
      retries: 10
      interval: 3s
    ports:
      - "8100:8100"

volumes:
  s3_data: {}
  mysql_data: {}
  witness_data: {}