mindex/docker-compose.test.yml at master · silencespeakstruth/mindex · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
# Integration-test stack (does NOT extend docker-compose.yml): Qdrant + a deterministic
# mock embedder (no GPU) + mindex + a pytest runner that drives the HTTPS API. This is
# mindex's primary containerized use. Run:
#
#   docker compose -f docker-compose.test.yml up --build \
#       --exit-code-from test-runner --abort-on-container-exit
#
# Migrations are additive (CREATE ... IF NOT EXISTS), so a re-run against the persisted
# test_mindex_db volume needs no reset. Each test uses a fresh project GUID.
# EXCEPTION: a volume created before the v2 schema baseline (retrieval v3) is an
# old-lineage database and mindex now REFUSES it at startup — run `down -v` once
# after pulling that change.
services:

  qdrant:
    image: qdrant/qdrant:v1.14.1
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'exec 3<>/dev/tcp/localhost/6333'"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 5s

  mock-embedder:
    build:
      context: tests/mock_embedder
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:11211/docs')"]
      interval: 3s
      timeout: 3s
      retries: 10

  mock-ollama:
    build:
      context: tests/mock_ollama
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:11434/docs')"]
      interval: 3s
      timeout: 3s
      retries: 10

  mindex:
    build: .
    volumes:
      - test_mindex_db:/data
      - test_mindex_certs:/certs
      - hf_cache:/root/.cache/huggingface
      # Request-shape limits are TOML-only (no CLI flag); the limit tests in
      # test_validation.py rely on the shrunken values in this file.
      - ./tests/integration/mindex-test-config.toml:/config/mindex-test-config.toml:ro
    environment:
      RUST_LOG: info
    command:
      - --config=/config/mindex-test-config.toml
      - --bind=0.0.0.0:11111
      - --db-path=/data/mindex.db
      - --cert-path=/certs/cert.pem
      - --key-path=/certs/key.pem
      - --qdrant-server=http://qdrant:6334
      - --model-server=http://mock-embedder:11211
      # The concurrency tests fire several simultaneous /index requests; each takes a
      # pool connection for its first (project-row) transaction before the per-file
      # claim, so the pool must comfortably exceed test concurrency. The default (4)
      # is a deployment tuning knob, not a correctness boundary — with too few
      # connections the pool returns PoolEmpty (→ 500) rather than queueing.
      - --db-pool-size=16
    depends_on:
      qdrant:
        condition: service_healthy
      mock-embedder:
        condition: service_healthy
      mock-ollama:
        condition: service_healthy

  # ── The authorized half of the stack ────────────────────────────────────────
  # A second mindex with [auth].enabled, because the suite above asserts the
  # unauthorized behaviour and that coverage is the point: an auth-off deployment
  # must stay byte-for-byte what it was. Its own database and collections, so the
  # two cannot disturb each other's fixtures.

  # The credentials are minted by this container *before* it becomes the server,
  # rather than by an init service, because `--abort-on-container-exit` aborts the
  # whole run when any container exits — and a one-shot bootstrap exits by design,
  # which tore the stack down before a single test ran.
  #
  # Minting first is also what the ordering has to be: `mint-token` creates the key
  # file itself (0600, O_EXCL) when absent, and a server that generated its own
  # would sign with a secret no token here was minted under. It doubles as a check
  # that the cold-volume bootstrap works, since the volume starts empty.
  #
  # The root token is wildcard + every action — exactly what must never be pasted
  # anywhere. Here it is only the *minter*; what the tests exercise are the narrow
  # tokens derived from it through POST /auth/tokens.
  mindex-auth:
    build: .
    volumes:
      - test_auth_db:/data
      - test_auth_certs:/certs
      - test_auth_keys:/keys
      - test_auth_tokens:/tokens
      - hf_cache:/root/.cache/huggingface
      - ./tests/integration/mindex-auth-config.toml:/config/mindex-auth-config.toml:ro
    environment:
      RUST_LOG: info
      MINDEX_CONFIG: /config/mindex-auth-config.toml
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        set -e
        mindex mint-token --sub 'root@test' --project '*' \
          --can search,research,index,delete,admin,mint --days 30 > /tokens/root.jwt
        # A token under a *second* key id, so a test can establish that a `kid`
        # other than the active one is a first-class credential — which is what
        # makes deleting one key a way to withdraw one holder. Minted here rather
        # than over the network because `--key-id --new-key` is deliberately
        # local-only: creating signing material is not a thing a token may do.
        #
        # The `||` is not defensive noise. The key volume persists between runs and
        # `--new-key` refuses an id that already exists — deliberately, since
        # replacing one would invalidate every token signed under it — so the second
        # run of this stack takes the other branch. That is the same path an
        # operator re-minting for an existing holder takes.
        mindex mint-token --sub 'revocable@test' --project '*' --can search \
          --days 30 --key-id doomed --new-key > /tokens/revocable.jwt \
        || mindex mint-token --sub 'revocable@test' --project '*' --can search \
          --days 30 --key-id doomed > /tokens/revocable.jwt
        # Only now the server, and only via the image's own entrypoint — it is what
        # generates the self-signed certificate.
        exec /entrypoint.sh \
          --config=/config/mindex-auth-config.toml \
          --bind=0.0.0.0:11111 \
          --db-path=/data/mindex.db \
          --cert-path=/certs/cert.pem \
          --key-path=/certs/key.pem \
          --qdrant-server=http://qdrant:6334 \
          --model-server=http://mock-embedder:11211 \
          --db-pool-size=16
    depends_on:
      qdrant:
        condition: service_healthy
      mock-embedder:
        condition: service_healthy
      mock-ollama:
        condition: service_healthy

  test-runner:
    build:
      context: tests/integration
    environment:
      MINDEX_URL: https://mindex:11111
      MINDEX_AUTH_URL: https://mindex-auth:11111
      MINDEX_ROOT_TOKEN_FILE: /tokens/root.jwt
      MINDEX_REVOCABLE_TOKEN_FILE: /tokens/revocable.jwt
      MOCK_EMBEDDER_URL: http://mock-embedder:11211
      MOCK_OLLAMA_URL: http://mock-ollama:11434
    volumes:
      - test_auth_tokens:/tokens:ro
    depends_on:
      - mindex
      - mindex-auth

volumes:
  test_mindex_db:
  test_mindex_certs:
  test_auth_db:
  test_auth_certs:
  test_auth_keys:
  test_auth_tokens:
  hf_cache: