UA-.NETStandard/samples/Redundancy/RedundantServer/Transparent/docker-compose.yml

# Transparent redundancy: two replicas present ONE logical OPC UA server behind a
# single virtual endpoint.
#
# Both replicas share one ApplicationUri and one ApplicationInstanceCertificate
# (seeded into a shared PKI volume by server-a, then reused by server-b), and
# mirror address-space + session state by CRDT gossip (HA_MODE=aa,
# REDUNDANCY_MODE=transparent). An nginx TCP load balancer publishes the single
# virtual endpoint; each replica advertises that same endpoint URL (HA_HOST=lb)
# while binding to all interfaces in its own container, so discovery and
# CreateSession echo the one endpoint the client actually uses.
#
# When a replica fails, the load balancer routes the next connection to the
# survivor; because the session is mirrored, a token-reuse reconnect resumes it
# transparently on the survivor (full ActivateSession re-check still applies).
#
# The build context is the repository root. Run from the repo root:
#   docker compose -f samples/Redundancy/RedundantServer/Transparent/docker-compose.yml up --build
#
# Single virtual OPC UA endpoint on the host: opc.tcp://localhost:62543/RedundantServer
#
# NOTE: this sample connects with SecurityMode None, so the per-replica cert race
# on first start is benign here. A SECURED transparent deployment must PRE-PROVISION
# the single shared ApplicationInstanceCertificate to every replica (for example a
# Kubernetes Secret / KMS), never let each replica self-generate one.

services:
  server-a:
    build:
      context: ../../../..
      dockerfile: samples/Redundancy/RedundantServer/Dockerfile
    image: opcua-redundant-server
    hostname: server-a
    environment:
      # Advertise the shared virtual endpoint (the load balancer host). The host
      # is a DNS name, so the listener binds to all interfaces in this container
      # while returning opc.tcp://lb:62543/... to clients.
      HA_HOST: lb
      HA_NODE_ID: replica-a
      HA_MODE: aa
      REDUNDANCY_MODE: transparent
      # Shared logical identity: every replica MUST use the same ApplicationUri
      # (CreateSession validates the client-supplied serverUri against it) and the
      # same certificate subject.
      HA_APPLICATION_URI: urn:OPCFoundation:RedundantServer:transparent
      HA_SUBJECT_NAME: "CN=RedundantServer, O=OPC Foundation, DC=lb"
      HA_PKI_ROOT: /shared/pki
      HA_GOSSIP_PORT: "4840"
      HA_GOSSIP_PEERS: server-b:4840
    command: ["--port", "62543"]
    volumes:
      - shared-pki:/shared/pki
    # server-a seeds the shared certificate; report healthy once the PKI store is
    # populated so server-b starts afterwards and reuses the same certificate.
    healthcheck:
      test: ["CMD-SHELL", "test -n \"$(ls -A /shared/pki 2>/dev/null)\""]
      interval: 3s
      timeout: 2s
      retries: 20

  server-b:
    build:
      context: ../../../..
      dockerfile: samples/Redundancy/RedundantServer/Dockerfile
    image: opcua-redundant-server
    hostname: server-b
    environment:
      HA_HOST: lb
      HA_NODE_ID: replica-b
      HA_MODE: aa
      REDUNDANCY_MODE: transparent
      HA_APPLICATION_URI: urn:OPCFoundation:RedundantServer:transparent
      HA_SUBJECT_NAME: "CN=RedundantServer, O=OPC Foundation, DC=lb"
      HA_PKI_ROOT: /shared/pki
      HA_GOSSIP_PORT: "4840"
      HA_GOSSIP_PEERS: server-a:4840
    command: ["--port", "62543"]
    volumes:
      - shared-pki:/shared/pki
    depends_on:
      server-a:
        condition: service_healthy

  lb:
    image: nginx:1.27-alpine
    hostname: lb
    depends_on:
      - server-a
      - server-b
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    ports:
      # The single virtual OPC UA endpoint exposed to clients on the host.
      - "62543:62543"

  client:
    build:
      context: ../../../..
      dockerfile: samples/Redundancy/RedundantClient/Dockerfile
    image: opcua-redundant-client
    depends_on:
      - lb
    command:
      - "--server"
      - "opc.tcp://lb:62543/RedundantServer"
      - "--autoaccept"
      - "--nosecurity"
      - "--duration"
      - "00:10:00"

volumes:
  shared-pki: