Draft: Added compose files for testing 2.0

.gitignore

@@ -1,5 +1,6 @@
 docker-compose/.env
 docker-compose/.volumes
+docker-compose2.0/.volumes
 .idea
 terraform/**/terraform.tfstate
 terraform/**/terraform.tfstate.backup

docker-compose2.0/docker-compose.2.0-ha.yaml

@@ -0,0 +1,87 @@
+services:
+  core:
+    image: ghcr.io/defguard/defguard:dev
+    environment:
+      DEFGUARD_COOKIE_INSECURE: "true"
+      DEFGUARD_SECRET_KEY: aa5a506b11d719dd7170f57f5d9947faf8eb0bc2be1325e42aa0237c3dcfd26456e73dff9eef3b12c7bcf8711b45e3e703d8e21ee1c08520f5e12e3f5772da94
+      DEFGUARD_AUTH_SECRET: defguard-auth-secret
+      DEFGUARD_GATEWAY_SECRET: defguard-gateway-secret
+      DEFGUARD_YUBIBRIDGE_SECRET: defguard-yubibridge-secret
+      DEFGUARD_DB_HOST: db
+      DEFGUARD_DB_PORT: 5432
+      DEFGUARD_DB_USER: defguard
+      DEFGUARD_DB_PASSWORD: defguard
+      DEFGUARD_DB_NAME: defguard
+      DEFGUARD_URL: http://localhost:8000
+      RUST_BACKTRACE: 1
+    depends_on:
+      - db
+    ports:
+      - "8000:8000"
+
+  edge1:
+    image: ghcr.io/defguard/defguard-proxy:dev
+    volumes:
+      - ./.volumes/certs2.0-ha/edge1:/etc/defguard/certs
+    depends_on:
+      - core
+
+  edge2:
+    image: ghcr.io/defguard/defguard-proxy:dev
+    volumes:
+      - ./.volumes/certs2.0-ha/edge2:/etc/defguard/certs
+    depends_on:
+      - core
+
+  edge-lb:
+    image: nginx:1.25-alpine
+    depends_on:
+      - edge1
+      - edge2
+    ports:
+      - "8080:8080"
+    volumes:
+      - ./nginx/edge.conf:/etc/nginx/conf.d/default.conf:ro
+
+  gateway1:
+    image: ghcr.io/defguard/gateway:dev
+    depends_on:
+      - core
+    cap_add:
+      - NET_ADMIN
+    volumes:
+      - ./.volumes/certs2.0-ha/gateway1:/etc/defguard/certs
+    environment:
+      DEFGUARD_STATS_PERIOD: 10
+
+  gateway2:
+    image: ghcr.io/defguard/gateway:dev
+    depends_on:
+      - core
+    cap_add:
+      - NET_ADMIN
+    volumes:
+      - ./.volumes/certs2.0-ha/gateway2:/etc/defguard/certs
+    environment:
+      DEFGUARD_STATS_PERIOD: 10
+
+  gateway-lb:
+    image: nginx:1.25-alpine
+    depends_on:
+      - gateway1
+      - gateway2
+    ports:
+      - "50051:50051/udp"
+    volumes:
+      - ./nginx/gateway.conf:/etc/nginx/nginx.conf:ro
+
+  db:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_DB: defguard
+      POSTGRES_USER: defguard
+      POSTGRES_PASSWORD: defguard
+    volumes:
+      - ./.volumes/db2.0-ha:/var/lib/postgresql/data
+    ports:
+      - "5432:5432"

docker-compose2.0/docker-compose.2.0.yaml

@@ -0,0 +1,56 @@
+services:
+  core:
+    image: ghcr.io/defguard/defguard:dev
+    build:
+      context: .
+      dockerfile: Dockerfile
+    environment:
+      DEFGUARD_COOKIE_INSECURE: "true"
+      DEFGUARD_SECRET_KEY: aa5a506b11d719dd7170f57f5d9947faf8eb0bc2be1325e42aa0237c3dcfd26456e73dff9eef3b12c7bcf8711b45e3e703d8e21ee1c08520f5e12e3f5772da94
+      DEFGUARD_AUTH_SECRET: defguard-auth-secret
+      DEFGUARD_GATEWAY_SECRET: defguard-gateway-secret
+      DEFGUARD_YUBIBRIDGE_SECRET: defguard-yubibridge-secret
+      DEFGUARD_DB_HOST: db
+      DEFGUARD_DB_PORT: 5432
+      DEFGUARD_DB_USER: defguard
+      DEFGUARD_DB_PASSWORD: defguard
+      DEFGUARD_DB_NAME: defguard
+      DEFGUARD_URL: http://localhost:8000
+      RUST_BACKTRACE: 1
+    ports:
+      # rest api
+      - "8000:8000"
+      # grpc
+      - "50055:50055"
+    depends_on:
+      - db
+
+  edge:
+    image: ghcr.io/defguard/defguard-proxy:dev
+    volumes:
+      - ./.volumes/certs2.0/proxy:/etc/defguard/certs
+    ports:
+      - "8080:8080"
+
+  gateway:
+    image: ghcr.io/defguard/gateway:dev
+    ports:
+      # WireGuard endpoint
+      - "50051:50051/udp"
+    depends_on:
+      - core
+    cap_add:
+      - NET_ADMIN
+    volumes:
+      - ./.volumes/certs2.0/gateway:/etc/defguard/certs
+
+  db:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_DB: defguard
+      POSTGRES_USER: defguard
+      POSTGRES_PASSWORD: defguard
+    volumes:
+      - ./.volumes/db2.0:/var/lib/postgresql/data
+    ports:
+      - "5432:5432"

docker-compose2.0/nginx/edge.conf

@@ -0,0 +1,38 @@
+upstream defguard_edge {
+  # For HTTP, round-robin is the default
+  server edge1:8080 max_fails=2 fail_timeout=10s;
+  server edge2:8080 max_fails=2 fail_timeout=10s;
+
+  # Optional: keepalive connections to backends
+  keepalive 64;
+}
+
+server {
+  listen 8080;
+
+  # Preserve original client information
+  proxy_set_header Host              $host;
+  proxy_set_header X-Real-IP         $remote_addr;
+  proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+  proxy_set_header X-Forwarded-Proto $scheme;
+
+  # WebSockets support (if used)
+  proxy_http_version 1.1;
+  proxy_set_header Upgrade           $http_upgrade;
+  proxy_set_header Connection        $connection_upgrade;
+
+  location / {
+    proxy_pass http://defguard_edge;
+
+    # Reasonable timeouts for long requests / SSE
+    proxy_connect_timeout 5s;
+    proxy_send_timeout 60s;
+    proxy_read_timeout 60s;
+  }
+}
+
+# Map used by WebSocket upgrade header handling
+map $http_upgrade $connection_upgrade {
+  default upgrade;
+  ''      close;
+}

docker-compose2.0/nginx/gateway.conf

@@ -0,0 +1,30 @@
+worker_processes auto;
+
+events { }
+
+stream {
+  # Upstream group containing all Defguard Gateway instances
+  upstream defguard_gateways {
+    # Sticky sessions: the same client IP will always be routed
+    # to the same backend gateway (important for WireGuard/UDP)
+    hash $remote_addr consistent;
+
+    # Backend gateways (Docker service names)
+    server gateway1:50051 max_fails=2 fail_timeout=10s;
+    server gateway2:50051 max_fails=2 fail_timeout=10s;
+  }
+
+  server {
+    # Public UDP listener for WireGuard clients
+    listen 50051 udp;
+
+    # Forward traffic to the upstream gateways
+    proxy_pass defguard_gateways;
+
+    # Increase timeout for long-lived UDP sessions
+    proxy_timeout 10m;
+
+    # Number of expected responses per request (usually 1 for WireGuard)
+    proxy_responses 1;
+  }
+}