masque-vpn/docker-compose.yml at main · cloudbridge-research/masque-vpn · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
version: '3.8'

services:
  # MASQUE VPN Server
  vpn-server:
    build:
      context: .
      dockerfile: vpn_server/Dockerfile
    container_name: masque-vpn-server
    restart: unless-stopped
    ports:
      - "4433:4433/udp"  # MASQUE/QUIC
      - "8080:8080/tcp"  # Admin Web UI
      - "9090:9090/tcp"  # Metrics
    volumes:
      - ./vpn_server/cert:/app/cert:ro
      - ./vpn_server/config.server.toml:/app/config.server.toml:ro
      - vpn_server_data:/app/data
      - vpn_server_logs:/app/logs
    environment:
      - ENVIRONMENT=production
      - TZ=UTC
    networks:
      - vpn-network
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Admin Web UI (if separate from server)
  admin-webui:
    build:
      context: ./admin_webui
      dockerfile: Dockerfile
    container_name: masque-admin-webui
    restart: unless-stopped
    ports:
      - "3000:80"
    environment:
      - VPN_SERVER_URL=http://vpn-server:8080
    depends_on:
      - vpn-server
    networks:
      - vpn-network

  # Prometheus for metrics collection
  prometheus:
    image: prom/prometheus:latest
    container_name: masque-prometheus
    restart: unless-stopped
    ports:
      - "9091:9090"
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--storage.tsdb.retention.time=200h'
      - '--web.enable-lifecycle'
    networks:
      - vpn-network

  # Grafana for metrics visualization
  grafana:
    image: grafana/grafana:latest
    container_name: masque-grafana
    restart: unless-stopped
    ports:
      - "3001:3000"
    volumes:
      - grafana_data:/var/lib/grafana
      - ./grafana/provisioning:/etc/grafana/provisioning:ro
      - ./grafana/dashboards:/var/lib/grafana/dashboards:ro
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin
      - GF_USERS_ALLOW_SIGN_UP=false
    depends_on:
      - prometheus
    networks:
      - vpn-network

  # Example VPN Client (for testing)
  vpn-client-test:
    build:
      context: .
      dockerfile: vpn_client/Dockerfile
    container_name: masque-vpn-client-test
    restart: "no"
    volumes:
      - ./vpn_client/cert:/app/cert:ro
      - ./vpn_client/config.client.toml:/app/config.client.toml:ro
      - vpn_client_logs:/app/logs
    environment:
      - ENVIRONMENT=production
      - TZ=UTC
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    privileged: true
    depends_on:
      - vpn-server
    networks:
      - vpn-network
    profiles:
      - testing

networks:
  vpn-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16

volumes:
  vpn_server_data:
  vpn_server_logs:
  vpn_client_logs:
  prometheus_data:
  grafana_data: