Add S3 OCSP status publishing and standalone Rust Axum responder

docker-compose.yml

@@ -105,8 +105,44 @@ services:
       OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
       OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
       OTEL_EXCLUDED_PATHS: ${OTEL_EXCLUDED_PATHS:-/api/health}
+      # OCSP status publisher (optional). The bucket must be writable by
+      # KCA; the responder later reads the same prefix with read-only access.
+      KCA_OCSP_S3_BUCKET: ${KCA_OCSP_S3_BUCKET:-}
+      KCA_OCSP_S3_PREFIX: ${KCA_OCSP_S3_PREFIX:-ocsp}
+      KCA_OCSP_S3_REGION: ${KCA_OCSP_S3_REGION:-}
+      KCA_OCSP_S3_ENDPOINT: ${KCA_OCSP_S3_ENDPOINT:-}
+      KCA_OCSP_S3_FORCE_PATH_STYLE: ${KCA_OCSP_S3_FORCE_PATH_STYLE:-false}
+      KCA_OCSP_PUBLISH_INTERVAL_SECONDS: ${KCA_OCSP_PUBLISH_INTERVAL_SECONDS:-1}
+      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
+      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
+      AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN:-}
+      AWS_REGION: ${AWS_REGION:-}
     ports:
       - "127.0.0.1:${APP_PORT:-8080}:8080"
 
+  # Optional standalone OCSP responder. It deliberately has no database,
+  # Redis or KCA master-key environment. Enable with:
+  #   docker compose --profile ocsp up --build
+  ocsp:
+    profiles: ["ocsp"]
+    build:
+      context: .
+      dockerfile: ocsp-responder/Dockerfile
+    environment:
+      OCSP_CONFIG: /etc/ocsp/responder.yaml
+      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
+      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
+      AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN:-}
+      AWS_REGION: ${AWS_REGION:-}
+    volumes:
+      - ${OCSP_CONFIG_FILE:-./ocsp-responder/responder.example.yaml}:/etc/ocsp/responder.yaml:ro
+      - ${OCSP_CA_DIR:-./ocsp-responder/ca}:/etc/ocsp/ca:ro
+      - ${OCSP_SIGNER_DIR:-./ocsp-responder/signers}:/etc/ocsp/signers:ro
+    ports:
+      - "127.0.0.1:${OCSP_PORT:-2560}:2560"
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+
 volumes:
   pgdata: