sam/obmp-docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
obmp-docker/docker-compose.yml
sam cf4e5b07c6 Add Compose profiles, setup.sh bootstrap, and config templates for portable deployment 
Pins the Compose project name and splits services into core / test / auth
profiles so the BMP collector core can deploy standalone. Adds setup.sh
(idempotent bootstrap), .env.example, and repo-resident Authelia config
templates so a fresh host deploys without manual steps. Parameterizes
hardcoded host IP and domain; points the Grafana InfluxDB datasource at the
container name.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-18 19:21:04 -07:00

370 lines
12 KiB
YAML
Raw Blame History

---
name: obmp
volumes:
data-volume:
driver_opts:
type: none
device: ${OBMP_DATA_ROOT}/postgres/data
o: bind
ts-volume:
driver_opts:
type: none
device: ${OBMP_DATA_ROOT}/postgres/ts
o: bind
services:
zookeeper:
restart: unless-stopped
container_name: obmp-zookeeper
image: confluentinc/cp-zookeeper:7.1.1
volumes:
- ${OBMP_DATA_ROOT}/zk-data:/var/lib/zookeeper/data
- ${OBMP_DATA_ROOT}/zk-log:/var/lib/zookeeper/log
environment:
ZOOKEEPER_CLIENT_PORT: 2181
ZOOKEEPER_TICK_TIME: 2000
kafka:
restart: unless-stopped
container_name: obmp-kafka
image: confluentinc/cp-kafka:7.1.1
# Change the mount point to where you want to store Kafka data.
# Normally 80GB or more
volumes:
- ${OBMP_DATA_ROOT}/kafka-data:/var/lib/kafka/data
depends_on:
- zookeeper
ports:
- "9092:9092"
environment:
KAFKA_BROKER_ID: 1
KAFKA_ZOOKEEPER_CONNECT: obmp-zookeeper:2181
# Change/add listeners based on your FQDN that the host and other containers can access. You can use
# an IP address as well. By default, only within the compose/containers can Kafka be accesssed
# using port 29092. Outside access can be enabled, but you should use an FQDN listener.
KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://obmp-kafka:29092,PLAINTEXT_HOST://${HOST_IP:-10.40.40.202}:9092
KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT:PLAINTEXT,PLAINTEXT_HOST:PLAINTEXT
KAFKA_INTER_BROKER_LISTENER_NAME: PLAINTEXT
KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
KAFKA_NUM_PARTITIONS: 8
KAFKA_LOG_RETENTION_MINUTES: 720
KAFKA_LOG_ROLL_MS: 3600000
KAFKA_LOG_SEGMENT_BYTES: 1073741824
KAFKA_MESSAGE_MAX_BYTES: 100000000
KAFKA_LOG_CLEANER_THREADS: 2
# TODO: Move comment to documentation
# You can use SWAG and Let's Encrypt to front the Grafana HTTP port 3000 instance. Below is an example
# Create the SWAG direcgtory using "sudo mkdir -m 777 ${OBMP_DATA_ROOT}/swag"
# swag:
# image: linuxserver/letsencrypt:version-1.11.0
# container_name: obmp-swag
# cap_add:
# - NET_ADMIN
# environment:
# - PUID=1000
# - PGID=1000
# - TZ=UTC
# - URL=<domain of grafana host, this should be the domain only, not the hostname>
# - SUBDOMAINS=<hostname, without the domain>,
# - VALIDATION=http
# - EMAIL=<your email>
# - ONLY_SUBDOMAINS=true
# - STAGING=false
# volumes:
# - /var/openbmp/swag:/config
# ports:
# - 443:443
# - 80:80 #optional
# restart: unless-stopped
grafana:
restart: unless-stopped
container_name: obmp-grafana
image: grafana/grafana:9.1.7
ports:
- "3000:3000"
volumes:
- ${OBMP_DATA_ROOT}/grafana:/var/lib/grafana
- ${OBMP_DATA_ROOT}/grafana/provisioning:/etc/grafana/provisioning/
environment:
- GF_SECURITY_ADMIN_PASSWORD=openbmp
- GF_AUTH_ANONYMOUS_ENABLED=false
- GF_SERVER_ROOT_URL=https://${OBMP_DOMAIN:-bmp.apodacalab.com}/grafana/
- GF_SERVER_SERVE_FROM_SUB_PATH=true
- GF_AUTH_PROXY_ENABLED=true
- GF_AUTH_PROXY_HEADER_NAME=Remote-User
- GF_AUTH_PROXY_HEADER_PROPERTY=username
- GF_AUTH_PROXY_AUTO_SIGN_UP=true
- GF_USERS_HOME_PAGE=d/obmp-home/obmp-home
- GF_INSTALL_PLUGINS=agenty-flowcharting-panel,grafana-piechart-panel,grafana-worldmap-panel,grafana-simple-json-datasource,vonage-status-panel
# TODO: Move comment block to documentation
# The below is an example of how to enable OAuth
#- GF_AUTH_GENERIC_OAUTH_NAME=MyCompany SSO
#- GF_AUTH_GENERIC_OAUTH_ICON=signin
#- GF_AUTH_GENERIC_OAUTH_ENABLED=true
#- GF_AUTH_GENERIC_OAUTH_CLIENT_ID=<the client ID>
#- GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=<client secret>
#- GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true
#- GF_AUTH_GENERIC_OAUTH_AUTH_URL=<auth url, such as https://domain/as/authorization.oauth2>
#- GF_AUTH_GENERIC_OAUTH_TOKEN_URL=<token url, such as https://domain/as/token.oauth2
#- GF_AUTH_GENERIC_OAUTH_API_URL=<userinfo url, such as https://domain/idp/userinfo.openid
#- GF_AUTH_GENERIC_OAUTH_SCOPES=email openid profile
#- GF_AUTH_GENERIC_OAUTH_SEND_CLIENT_CREDENTIALS_VIA_POST=true
#- GF_SERVER_ENFORCE_DOMAIN=true
#- GF_SERVER_PROTOCOL=http
#- GF_SERVER_HTTP_PORT=3000
#- GF_SERVER_DOMAIN=<fqdn of grafana server>
#- GF_SERVER_ROOT_URL=%(protocol)s://%(domain)s:%(http_port)s/
psql:
restart: unless-stopped
container_name: obmp-psql
image: openbmp/postgres:2.2.1
privileged: true
shm_size: 1536m
sysctls:
- net.ipv4.tcp_keepalive_intvl=30
- net.ipv4.tcp_keepalive_probes=5
- net.ipv4.tcp_keepalive_time=180
ports:
- "5432:5432"
volumes:
- data-volume:/var/lib/postgresql/data
- ts-volume:/var/lib/postgresql/ts
# alter_job max_runtime in _timescaledb_config.bgw_job ( https://docs.timescale.com/latest/api#alter_job )
command: >
-c max_wal_size=10GB
environment:
- POSTGRES_PASSWORD=openbmp
- POSTGRES_USER=openbmp
- POSTGRES_DB=openbmp
collector:
restart: unless-stopped
container_name: obmp-collector
image: openbmp/collector:2.2.3
sysctls:
- net.ipv4.tcp_keepalive_intvl=30
- net.ipv4.tcp_keepalive_probes=5
- net.ipv4.tcp_keepalive_time=180
ports:
- "5000:5000"
volumes:
- ${OBMP_DATA_ROOT}/config:/config
environment:
- KAFKA_FQDN=obmp-kafka:29092
psql-app:
restart: unless-stopped
container_name: obmp-psql-app
image: openbmp/psql-app:2.2.2
sysctls:
- net.ipv4.tcp_keepalive_intvl=30
- net.ipv4.tcp_keepalive_probes=5
- net.ipv4.tcp_keepalive_time=180
ports:
- "9005:9005"
volumes:
- ${OBMP_DATA_ROOT}/config:/config
environment:
- MEM=3 # Set memory to at least 2GB but ideally 4GB
- KAFKA_FQDN=obmp-kafka:29092
- RPKI_URL=https://rpki.cloudflare.com/rpki.json # define the URL to retrieve json endoed RPKI data
- RPKI_PASS=None
- RPKI_USER=None
- ENABLE_RPKI=1 # 1 enables, 0 disables RPKI sync
- ENABLE_IRR=1 # 1 enables, 0 disables IRR sync
- ENABLE_DBIP=1 # 1 enables, 0 disables DBIP import
- POSTGRES_REPORT_WINDOW='8 minute' # default POSTGRESS window to select when building
# summary tables. For deployments that absorb large
# bursts increase the value, ex 60 minute
- POSTGRES_PASSWORD=openbmp
- POSTGRES_USER=openbmp
- POSTGRES_DB=openbmp
- POSTGRES_HOST=obmp-psql
- POSTGRES_PORT=5432
- POSTGRES_DROP_peer_event_log='1 year'
- POSTGRES_DROP_stat_reports='4 weeks'
- POSTGRES_DROP_ip_rib_log='4 weeks'
- POSTGRES_DROP_alerts='4 weeks'
- POSTGRES_DROP_ls_nodes_log='4 months'
- POSTGRES_DROP_ls_links_log='4 months'
- POSTGRES_DROP_ls_prefixes_log='4 months'
- POSTGRES_DROP_stats_chg_byprefix='4 weeks'
- POSTGRES_DROP_stats_chg_byasn='4 weeks'
- POSTGRES_DROP_stats_chg_bypeer='4 weeks'
- POSTGRES_DROP_stats_ip_origins='4 weeks'
- POSTGRES_DROP_stats_peer_rib='4 weeks'
- POSTGRES_DROP_stats_peer_update_counts='4 weeks'
exabgp:
restart: unless-stopped
container_name: obmp-exabgp
profiles: ["test"]
build:
context: ./exabgp
dockerfile: Dockerfile
# Host networking so ExaBGP can reach CML routers directly on port 179
network_mode: host
environment:
# IP on the host that CML routers reach (BGP peering source)
- EXABGP_LOCAL_IP=${HOST_IP:-10.40.40.202}
# ExaBGP presents as AS 65100 (eBGP peer to the lab route reflectors)
- EXABGP_LOCAL_AS=${EXABGP_LOCAL_AS:-65100}
# Peer list — ";"-separated entries of "ip:peer_as:description".
# Default covers both labs: AS 65020 (ESXi) and AS 65021 (Proxmox).
- EXABGP_PEERS=${EXABGP_PEERS:-10.100.0.100:65020:CML-R9K-CORE-01;10.100.0.200:65020:CML-R9K-CORE-02;10.100.1.100:65021:PROX-R9K-CORE-01;10.100.1.200:65021:PROX-R9K-CORE-02}
# Flask API port (also on host network)
- EXABGP_API_PORT=${EXABGP_API_PORT:-5050}
volumes:
# Mount scenarios dir so you can edit/add scenarios without rebuilding
- ./exabgp/scenarios:/exabgp/scenarios
# No ports: block needed — network_mode: host exposes directly
exabgp-ui:
restart: unless-stopped
container_name: obmp-exabgp-ui
profiles: ["test"]
build:
context: ./exabgp-ui
dockerfile: Dockerfile
# Host networking so NGINX can proxy /api to ExaBGP Flask on localhost:5050
network_mode: host
# Serves on port 5001 (host network, defined in nginx.conf)
# --- Phase 4: gNMI Streaming Telemetry ---
influxdb:
restart: unless-stopped
container_name: obmp-influxdb
profiles: ["test"]
image: influxdb:2.7
ports:
- "8086:8086"
volumes:
- ${OBMP_DATA_ROOT}/influxdb:/var/lib/influxdb2
environment:
- DOCKER_INFLUXDB_INIT_MODE=setup
- DOCKER_INFLUXDB_INIT_USERNAME=openbmp
- DOCKER_INFLUXDB_INIT_PASSWORD=openbmp123
- DOCKER_INFLUXDB_INIT_ORG=openbmp
- DOCKER_INFLUXDB_INIT_BUCKET=telemetry
- DOCKER_INFLUXDB_INIT_ADMIN_TOKEN=openbmp-telemetry-token
- DOCKER_INFLUXDB_INIT_RETENTION=30d
telegraf:
restart: unless-stopped
container_name: obmp-telegraf
profiles: ["test"]
build:
context: ./telegraf
dockerfile: Dockerfile
network_mode: host
depends_on:
- influxdb
environment:
- INFLUXDB_TOKEN=openbmp-telemetry-token
# --- Phase 4: Traffic Generator ---
traffic-gen:
restart: unless-stopped
container_name: obmp-traffic-gen
profiles: ["test"]
build:
context: ./traffic-gen
dockerfile: Dockerfile
network_mode: host
cap_add:
- NET_RAW
- NET_ADMIN
environment:
- TRAFFIC_GEN_PORT=5051
- TRAFFIC_GEN_MODE=sender
- RESPONDER_URL=http://172.30.0.10:5053
traffic-gen-ui:
restart: unless-stopped
container_name: obmp-traffic-gen-ui
profiles: ["test"]
build:
context: ./traffic-gen-ui
dockerfile: Dockerfile
network_mode: host
# Serves on port 5002 (host network, defined in nginx.conf)
traffic-gen-responder:
restart: unless-stopped
container_name: obmp-traffic-gen-responder
profiles: ["test"]
build:
context: ./traffic-gen
dockerfile: Dockerfile
cap_add:
- NET_RAW
- NET_ADMIN
environment:
- TRAFFIC_GEN_PORT=5053
- TRAFFIC_GEN_MODE=responder
- TRAFFIC_GEN_RESPONDER_MODE=echo
- TRAFFIC_GEN_INTERFACE=eth0
networks:
traffic-test-net:
ipv4_address: 172.30.0.10
ports:
- "5053:5053"
whois:
restart: unless-stopped
container_name: obmp-whois
image: openbmp/whois:2.2.0
sysctls:
- net.ipv4.tcp_keepalive_intvl=30
- net.ipv4.tcp_keepalive_probes=5
- net.ipv4.tcp_keepalive_time=180
ports:
- "4300:43"
# volumes:
# - ${OBMP_DATA_ROOT}/config:/config
environment:
- POSTGRES_PASSWORD=openbmp
- POSTGRES_USER=openbmp
- POSTGRES_DB=openbmp
- POSTGRES_HOST=obmp-psql
- POSTGRES_PORT=5432
authelia:
restart: unless-stopped
container_name: obmp-authelia
profiles: ["auth"]
image: authelia/authelia:4.38
ports:
- "9091:9091"
volumes:
- ${OBMP_DATA_ROOT}/authelia:/config
environment:
- TZ=UTC
portal:
restart: unless-stopped
container_name: obmp-portal
profiles: ["auth"]
image: nginx:alpine
ports:
- "8080:80"
volumes:
- ./portal:/usr/share/nginx/html:ro
networks:
traffic-test-net:
driver: bridge
ipam:
config:
- subnet: 172.30.0.0/24
Reference in New Issue View Git Blame Copy Permalink