38 lines
1.1 KiB
YAML
38 lines
1.1 KiB
YAML
# CP2A1 — Trusted Gate Evaluator (External Gate Enforcement Foundation)
|
|
# STRICTLY NON-PRODUCTIVE / NO AUTONOMY.
|
|
#
|
|
# Netzwerk: eigenes internal-Netz (keine Egress, keine Internet-Erreichbarkeit).
|
|
# RQ wird per `docker network connect` an dieses Netz angebunden (RQ <-> Evaluator).
|
|
# State-Mount: RO (read-only) auf /opt/control-plane/state.
|
|
# Härtung: --cap-drop ALL, --no-new-privileges, --read-only, kein Docker-Socket.
|
|
services:
|
|
gate-evaluator:
|
|
build: .
|
|
image: gate-evaluator:cp2a1
|
|
container_name: gate-evaluator
|
|
restart: unless-stopped
|
|
read_only: true
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
tmpfs:
|
|
- /tmp
|
|
volumes:
|
|
# RO-State-Mount: autoritativer CP1-State (root-owned, 0700/600)
|
|
- /opt/control-plane/state:/opt/control-plane/state:ro
|
|
# Audit-Volume (append-only, gegen RQ-Manipulation geschuetzt)
|
|
- gate-audit:/audit
|
|
networks:
|
|
- gate-internal
|
|
environment:
|
|
- GATE_EVALUATOR_PORT=8080
|
|
# Kein Docker-Socket, keine Credentials, keine Egress (internal-Netz)
|
|
|
|
networks:
|
|
gate-internal:
|
|
driver: bridge
|
|
internal: true
|
|
|
|
volumes:
|
|
gate-audit:
|