Add example with tls enabled dependencies (#82)

* Add example with tls enabled dependencies

* bash oops

* Move cert material to named volume

.gitignore

@@ -1 +1,2 @@
-.idea
+.idea
+.pki

docker-compose-tls.yml

@@ -0,0 +1,116 @@
+version: "3.5"
+services:
+  elasticsearch:
+    container_name: temporal-elasticsearch
+    environment:
+      - cluster.routing.allocation.disk.threshold_enabled=true
+      - cluster.routing.allocation.disk.watermark.low=512mb
+      - cluster.routing.allocation.disk.watermark.high=256mb
+      - cluster.routing.allocation.disk.watermark.flood_stage=128mb
+      - discovery.type=single-node
+      - ES_JAVA_OPTS=-Xms100m -Xmx100m
+      - ELASTIC_PASSWORD=elastic
+      - xpack.security.enabled=true
+      - xpack.security.http.ssl.enabled=true
+      - xpack.security.http.ssl.key=certs/elasticsearch-key.pem
+      - xpack.security.http.ssl.certificate=certs/elasticsearch.pem
+      - xpack.security.http.ssl.certificate_authorities=certs/ca.pem
+      - xpack.security.transport.ssl.enabled=true
+      - xpack.security.transport.ssl.key=certs/elasticsearch-key.pem
+      - xpack.security.transport.ssl.certificate=certs/elasticsearch.pem
+      - xpack.security.transport.ssl.certificate_authorities=certs/ca.pem
+    image: elasticsearch:${ELASTICSEARCH_VERSION}
+    networks:
+      - temporal-network
+    expose:
+      - 9200
+    volumes:
+      - temporal_tls_pki:/usr/share/elasticsearch/config/certs
+  postgresql:
+    container_name: temporal-postgresql
+    command: 
+      - "-c"
+      - "ssl=on" 
+      - "-c"
+      - "ssl_cert_file=/pki/postgresql.pem"
+      - "-c"
+      - "ssl_key_file=/pki/postgresql-key.pem"
+      - "-c"
+      - "ssl_ca_file=/pki/ca.pem"
+    environment:
+      POSTGRES_PASSWORD: temporal
+      POSTGRES_USER: temporal
+    image: postgres:${POSTGRESQL_VERSION}
+    networks:
+      - temporal-network
+    expose:
+      - 5432
+    volumes:
+      - temporal_tls_pki:/pki
+  temporal:
+    container_name: temporal
+    build:
+      context: .
+      dockerfile: tls/Dockerfile.auto-setup-tls
+      args:
+        - BASEIMAGE=auto-setup:${TEMPORAL_VERSION}
+    image: auto-setup-tls:${TEMPORAL_VERSION}
+    depends_on:
+      - postgresql
+      - elasticsearch
+    environment:
+      - DB=postgresql
+      - DB_PORT=5432
+      - POSTGRES_USER=temporal
+      - POSTGRES_PWD=temporal
+      - POSTGRES_SEEDS=postgresql
+      - SQL_TLS=true
+      - DYNAMIC_CONFIG_FILE_PATH=config/dynamicconfig/development_sql_es.yaml
+      - ENABLE_ES=true
+      - ES_SEEDS=elasticsearch
+      - ES_VERSION=v7
+      - ES_SCHEME=https
+      - ES_USER=elastic
+      - ES_PWD=elastic
+    networks:
+      - temporal-network
+    ports:
+      - 7233:7233
+    volumes:
+      - ./dynamicconfig:/etc/temporal/config/dynamicconfig
+  temporal-admin-tools:
+    container_name: temporal-admin-tools
+    depends_on:
+      - temporal
+    environment:
+      - TEMPORAL_CLI_ADDRESS=temporal:7233
+    build:
+      context: .
+      dockerfile: tls/Dockerfile.admin-tools-tls
+      args:
+        - BASEIMAGE=admin-tools:${TEMPORAL_VERSION}
+    image: temporalio/admin-tools-tls:${TEMPORAL_VERSION}
+    networks:
+      - temporal-network
+    stdin_open: true
+    tty: true
+  temporal-ui:
+    container_name: temporal-ui
+    depends_on:
+      - temporal
+    environment:
+      - TEMPORAL_ADDRESS=temporal:7233
+      - TEMPORAL_CORS_ORIGINS=http://localhost:3000
+    image: temporalio/ui:${TEMPORAL_UI_VERSION}
+    networks:
+      - temporal-network
+    ports:
+      - 8080:8080
+networks:
+  temporal-network:
+    driver: bridge
+    name: temporal-network
+
+volumes:
+  temporal_tls_pki:
+   external: true

tls/Dockerfile.admin-tools-tls

@@ -0,0 +1,6 @@
+ARG BASEIMAGE
+FROM temporalio/${BASEIMAGE}
+
+COPY ./.pki/ca.pem /usr/local/share/ca-certificates/ca.crt
+
+RUN update-ca-certificates

tls/Dockerfile.auto-setup-tls

@@ -0,0 +1,9 @@
+ARG BASEIMAGE
+FROM temporalio/${BASEIMAGE}
+
+USER root
+COPY ./.pki/ca.pem /usr/local/share/ca-certificates/ca.crt
+
+RUN update-ca-certificates
+
+USER temporal

tls/Dockerfile.tls

@@ -0,0 +1,24 @@
+# syntax=docker/dockerfile:1.3-labs 
+
+FROM golang
+
+RUN go install github.com/cloudflare/cfssl/cmd/cfssl@latest
+RUN go install github.com/cloudflare/cfssl/cmd/cfssljson@latest
+
+VOLUME ["/pki"]
+WORKDIR /pki
+
+VOLUME ["/pki-out"]
+
+RUN <<EOF
+    echo '{"CN":"CA","key":{"algo":"rsa","size":2048}}' | cfssl gencert -initca - | cfssljson -bare ca -
+    echo '{"signing":{"default":{"expiry":"43800h","usages":["signing","key encipherment","server auth"]}}}' > ca-config.json
+    echo '{"CN":"postgresql","hosts":[""],"key":{"algo":"rsa","size":2048}}' | cfssl gencert -config=ca-config.json -ca=ca.pem -ca-key=ca-key.pem -hostname="127.0.0.1,localhost,postgresql" - | cfssljson -bare postgresql
+    echo '{"CN":"elasticsearch","hosts":[""],"key":{"algo":"rsa","size":2048}}' | cfssl gencert -config=ca-config.json -ca=ca.pem -ca-key=ca-key.pem -hostname="127.0.0.1,localhost,elasticsearch" - | cfssljson -bare elasticsearch
+
+    chgrp 999 postgresql-key.pem
+    chmod 640 postgresql-key.pem
+    chmod 640 elasticsearch-key.pem
+EOF
+
+ENTRYPOINT cp /pki/ca.pem /pki-out/ca.pem

tls/README.md

@@ -0,0 +1,15 @@
+# Temporal with tls enabled dependencies
+
+## Setup
+
+run from a shell
+
+`./tls/make-certs.sh`
+
+## Startup
+
+run from a shell
+
+`COMPOSE_PROJECT_NAME=tls_test docker-compose -f docker-compose-tls.yml build --no-cache`
+
+`COMPOSE_PROJECT_NAME=tls_test docker-compose -f docker-compose-tls.yml up`

tls/make-certs.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -xe
+
+docker build -t temporal_tls:test -f ${PWD}/tls/Dockerfile.tls .
+mkdir .pki
+docker run --rm -v temporal_tls_pki:/pki -v ${PWD}/.pki:/pki-out temporal_tls:test