chapi-demo-stack/docker-compose.yml at main · credential-handler/chapi-demo-stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
# Copyright (c) 2026 Digital Bazaar, Inc. All rights reserved.
#
# One-command, phone-reachable CHAPI demo stack.
#
# Runs the chapi-demo-{wallet,issuer,verifier} sites in containers and
# exposes each through a Cloudflare quick tunnel (random, ephemeral
# *.trycloudflare.com URLs — no account needed, no interstitial pages).
# The credential mediator (authn.io) is NOT containerized: it runs on the
# host (e.g. `node authn.localhost.js` with webpack watch for live
# development) and is reached via host.docker.internal, with its own
# quick tunnel so phones can load it.
#
# The cloudflared image is distroless (no shell), so each tunnel's
# assigned URL is read from cloudflared's metrics endpoint
# (http://<tunnel>:2000/quicktunnel) rather than from its logs.
#
# Usage: docker compose up -d && ./urls.sh
# (./urls.sh re-prints the URLs of a running stack any time)
#
# See README.md for details and caveats.

x-demo: &demo
  image: node:24-alpine
  volumes:
    - ./demo-entrypoint.sh:/entrypoint.sh:ro
  entrypoint: ["sh", "/entrypoint.sh"]
  depends_on:
    - mediator-tunnel
  restart: unless-stopped

x-demo-env: &demo-env
  # pin until credential-handler-polyfill#51 (iOS WebKit break in
  # 3.2.1+/4.x) is fixed upstream
  POLYFILL_PIN: "3.0.2"
  MEDIATOR_METRICS: http://mediator-tunnel:2000

services:
  # --- tunnel to the mediator already running on the host ---
  mediator-tunnel:
    image: cloudflare/cloudflared:latest
    command: ["tunnel", "--loglevel", "warn", "--metrics", "0.0.0.0:2000",
      "--url", "https://host.docker.internal:33443", "--no-tls-verify"]
    extra_hosts:
      - host.docker.internal:host-gateway
    restart: unless-stopped

  # --- demo sites (cloned + patched + served at container start) ---
  wallet:
    <<: *demo
    environment:
      <<: *demo-env
      NAME: wallet
      REPO: https://github.com/credential-handler/chapi-demo-wallet.git
      PORT: "8081"

  issuer:
    <<: *demo
    environment:
      <<: *demo-env
      NAME: issuer
      REPO: https://github.com/credential-handler/chapi-demo-issuer.git
      PORT: "8082"

  verifier:
    <<: *demo
    environment:
      <<: *demo-env
      NAME: verifier
      REPO: https://github.com/credential-handler/chapi-demo-verifier.git
      PORT: "8083"

  # --- tunnels to the demo sites ---
  wallet-tunnel:
    image: cloudflare/cloudflared:latest
    command: ["tunnel", "--loglevel", "warn", "--metrics", "0.0.0.0:2000",
      "--url", "http://wallet:8081"]
    depends_on:
      - wallet
    restart: unless-stopped

  issuer-tunnel:
    image: cloudflare/cloudflared:latest
    command: ["tunnel", "--loglevel", "warn", "--metrics", "0.0.0.0:2000",
      "--url", "http://issuer:8082"]
    depends_on:
      - issuer
    restart: unless-stopped

  verifier-tunnel:
    image: cloudflare/cloudflared:latest
    command: ["tunnel", "--loglevel", "warn", "--metrics", "0.0.0.0:2000",
      "--url", "http://verifier:8083"]
    depends_on:
      - verifier
    restart: unless-stopped

  # --- prints the phone-ready URLs once everything is up ---
  urls:
    image: alpine:3
    volumes:
      - ./print-urls.sh:/print-urls.sh:ro
    command: ["sh", "/print-urls.sh"]
    depends_on:
      - mediator-tunnel
      - wallet-tunnel
      - issuer-tunnel
      - verifier-tunnel
    restart: "no"