Publish OCSP snapshots through Redis

docker-compose.yml

@@ -105,25 +105,17 @@ services:
       OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
       OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
       OTEL_EXCLUDED_PATHS: ${OTEL_EXCLUDED_PATHS:-/api/health}
-      # OCSP status publisher (optional). The bucket must be writable by
-      # KCA; the responder later reads the same prefix with read-only access.
-      KCA_OCSP_S3_BUCKET: ${KCA_OCSP_S3_BUCKET:-}
-      KCA_OCSP_S3_PREFIX: ${KCA_OCSP_S3_PREFIX:-ocsp}
-      KCA_OCSP_S3_REGION: ${KCA_OCSP_S3_REGION:-}
-      KCA_OCSP_S3_ENDPOINT: ${KCA_OCSP_S3_ENDPOINT:-}
-      KCA_OCSP_S3_FORCE_PATH_STYLE: ${KCA_OCSP_S3_FORCE_PATH_STYLE:-false}
+      # OCSP snapshots use the same Redis instance as sessions, under ocsp:*.
+      KCA_OCSP_REDIS_PREFIX: ${KCA_OCSP_REDIS_PREFIX:-ocsp}
       KCA_OCSP_PUBLISH_INTERVAL_SECONDS: ${KCA_OCSP_PUBLISH_INTERVAL_SECONDS:-1}
       KCA_OCSP_HEARTBEAT_INTERVAL_SECONDS: ${KCA_OCSP_HEARTBEAT_INTERVAL_SECONDS:-30}
-      KCA_OCSP_OBJECT_EXPIRY_SECONDS: ${KCA_OCSP_OBJECT_EXPIRY_SECONDS:-60}
-      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
-      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
-      AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN:-}
-      AWS_REGION: ${AWS_REGION:-}
+      KCA_OCSP_REDIS_EXPIRY_SECONDS: ${KCA_OCSP_REDIS_EXPIRY_SECONDS:-60}
     ports:
       - "127.0.0.1:${APP_PORT:-8080}:8080"
 
-  # Optional standalone OCSP responder. It deliberately has no database,
-  # Redis or KCA master-key environment. Enable with:
+  # Optional standalone OCSP responder. It has no database or KCA master-key
+  # environment, but reads OCSP keys from the same Redis instance as sessions.
+  # Enable with:
   #   docker compose --profile ocsp up --build
   ocsp:
     profiles: ["ocsp"]
@@ -131,12 +123,12 @@ services:
     build:
       context: .
       dockerfile: ocsp-responder/Dockerfile
+    depends_on:
+      redis:
+        condition: service_healthy
     environment:
       OCSP_CONFIG: /etc/ocsp/responder.yaml
-      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
-      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
-      AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN:-}
-      AWS_REGION: ${AWS_REGION:-}
+      OCSP_REDIS_URL: ${OCSP_REDIS_URL:-redis://redis:6379/0}
     volumes:
       - ${OCSP_CONFIG_FILE:-./ocsp-responder/responder.example.yaml}:/etc/ocsp/responder.yaml:ro
       - ${OCSP_CA_DIR:-./ocsp-responder/ca}:/etc/ocsp/ca:ro