mirror of
https://github.com/XRPLF/rippled.git
synced 2026-08-19 21:30:56 +00:00
520626143d
The setting was flagged in review as unauthenticated admin access. It is deliberate, and it matches the sibling stack in docker-compose.yml, which carries the same two variables and the same published port with its intent in comments. This copy had none, so the reasoning lived only in a review thread and was rediscovered as a finding each time the file was looked at. Viewer would break the harness rather than harden it: the validation suite drives the Grafana API against this instance to confirm each dashboard provisions and loads, and the dashboards and datasources come from the read-only mounts on the same service.
118 lines
4.2 KiB
YAML
118 lines
4.2 KiB
YAML
# Docker Compose workload harness for telemetry validation.
|
|
#
|
|
# Runs the OTel telemetry backend only. There are no validator services here:
|
|
# - OTel Collector (traces + native OTLP metrics)
|
|
# - Tempo (trace backend + search API)
|
|
# - Prometheus (metrics)
|
|
# - Loki (log aggregation for log-trace correlation)
|
|
# - Grafana (dashboards + trace/log exploration)
|
|
#
|
|
# The validator cluster runs as host processes, not containers.
|
|
# run-full-validation.sh starts NUM_NODES (default 5) xrpld instances on
|
|
# 127.0.0.1, each with a cfg it generates inline, peered to each other via
|
|
# [ips_fixed]. They reach the collector through the published ports below and
|
|
# write their logs into the bind-mounted workdir for the filelog receiver.
|
|
#
|
|
# Usage:
|
|
# # Start the telemetry backend on its own:
|
|
# docker compose -f docker/telemetry/docker-compose.workload.yaml up -d
|
|
#
|
|
# # Or let the orchestrator start this stack and the node cluster together:
|
|
# docker/telemetry/workload/run-full-validation.sh
|
|
#
|
|
# Prerequisites (for the orchestrator, not for this stack):
|
|
# - xrpld binary built with -DXRPL_ENABLE_TELEMETRY=ON
|
|
# - Validator keys generated via generate-validator-keys.sh
|
|
#
|
|
# Image tags are pinned to the same versions as docker-compose.yml, which
|
|
# mounts these same collector, Tempo and Prometheus config files. Floating
|
|
# tags would let an upstream release change the harness result.
|
|
#
|
|
# Note: No Docker healthchecks are defined here. The orchestrator script
|
|
# (run-full-validation.sh) polls each service endpoint directly from the
|
|
# host, which avoids issues with missing curl/wget in container images.
|
|
|
|
services:
|
|
# ---------------------------------------------------------------------------
|
|
# Telemetry Backend Stack
|
|
# ---------------------------------------------------------------------------
|
|
|
|
otel-collector:
|
|
image: otel/opentelemetry-collector-contrib:0.158.0
|
|
command: ["--config=/etc/otel-collector-config.yaml"]
|
|
ports:
|
|
- "4317:4317" # OTLP gRPC
|
|
- "4318:4318" # OTLP HTTP (traces + beast::insight metrics)
|
|
- "8889:8889" # Prometheus metrics endpoint
|
|
- "13133:13133" # Health check
|
|
volumes:
|
|
- ./otel-collector-config.yaml:/etc/otel-collector-config.yaml:ro
|
|
# Mount the validation workdir so the filelog receiver can tail node
|
|
# logs. run-full-validation.sh sets XRPLD_LOG_DIR to its workdir; the
|
|
# default matches that workdir so a bare `docker compose up` also works.
|
|
- ${XRPLD_LOG_DIR:-/tmp/xrpld-validation}:/var/log/xrpld:ro
|
|
depends_on:
|
|
- tempo
|
|
networks:
|
|
- workload-net
|
|
|
|
tempo:
|
|
image: grafana/tempo:2.9.4
|
|
command: ["-config.file=/etc/tempo.yaml"]
|
|
ports:
|
|
- "3200:3200" # Tempo HTTP API
|
|
volumes:
|
|
- ./tempo.yaml:/etc/tempo.yaml:ro
|
|
- tempo-data:/var/tempo
|
|
networks:
|
|
- workload-net
|
|
|
|
prometheus:
|
|
image: prom/prometheus:v3.13.2
|
|
ports:
|
|
- "9090:9090"
|
|
volumes:
|
|
- ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
|
|
depends_on:
|
|
- otel-collector
|
|
networks:
|
|
- workload-net
|
|
|
|
loki:
|
|
image: grafana/loki:3.7.6
|
|
ports:
|
|
- "3100:3100" # Loki HTTP API
|
|
command: ["-config.file=/etc/loki/local-config.yaml"]
|
|
networks:
|
|
- workload-net
|
|
|
|
grafana:
|
|
image: grafana/grafana:13.1.2
|
|
# Anonymous Admin is deliberate, and matches the sibling stack in
|
|
# docker-compose.yml. This stack is an ephemeral local/CI backend that
|
|
# run-full-validation.sh brings up and tears down around a single run; it
|
|
# holds no durable data and is never exposed beyond the host. Admin rather
|
|
# than Viewer because the harness drives the Grafana API against it, and
|
|
# the dashboards and datasources are provisioned from the mounts below.
|
|
environment:
|
|
- GF_AUTH_ANONYMOUS_ENABLED=true # No login required for local dev
|
|
- GF_AUTH_ANONYMOUS_ORG_ROLE=Admin # Full access without auth
|
|
ports:
|
|
- "3000:3000" # Grafana web UI
|
|
volumes:
|
|
- ./grafana/provisioning:/etc/grafana/provisioning:ro
|
|
- ./grafana/dashboards:/var/lib/grafana/dashboards:ro
|
|
depends_on:
|
|
- tempo
|
|
- prometheus
|
|
- loki
|
|
networks:
|
|
- workload-net
|
|
|
|
volumes:
|
|
tempo-data:
|
|
|
|
networks:
|
|
workload-net:
|
|
driver: bridge
|