Skip to content

README.md

Latest commit

 

History

History
61 lines (44 loc) · 2.76 KB

README.md

File metadata and controls

61 lines (44 loc) · 2.76 KB
Raw

RabbitMQ Server Image

A thin, professional wrapper around the official rabbitmq:*-management image (Docker Hub) — tracking the floating 4-management tag (latest RabbitMQ 4.x; major pinned to avoid a 5.x jump).

It keeps the upstream image intact and layers on three concerns that the old BAUER GROUP broker did by hand:

Concern Old solution This image
TLS certificate openssl in entrypoint, self-signed only Layered: self-signed / managed LE / BYO
Tuning config sed patching a committed 90-custom.conf envsubst-rendered 90-tuning.conf from env
Plugins manual rabbitmq-plugins enable notes in .env baked default set + runtime env toggles

Default plugins

Baked into etc/rabbitmq/enabled_plugins:

rabbitmq_management, rabbitmq_prometheus, rabbitmq_shovel, rabbitmq_shovel_management, rabbitmq_federation, rabbitmq_federation_management.

AMQP 0-9-1 and AMQP 1.0 are core protocols in RabbitMQ 4.x (no plugin needed).

Optional protocols are shipped but off; enable per deployment via env: RABBITMQ_ENABLE_MQTT, RABBITMQ_ENABLE_WEB_MQTT, RABBITMQ_ENABLE_STOMP, RABBITMQ_ENABLE_WEB_STOMP (=true). The entrypoint runs rabbitmq-plugins enable --offline before the node starts.

Configuration layering

RabbitMQ reads every /etc/rabbitmq/conf.d/*.conf alphabetically (later wins):

  1. 10-defaults.conf — generated by the upstream entrypoint from RABBITMQ_DEFAULT_USER / RABBITMQ_DEFAULT_PASS / RABBITMQ_DEFAULT_VHOST. (Setting a default user means the insecure guest account is never created; the init container also actively deletes it as defense-in-depth.)
  2. 20-base.conf — our static structural settings (listeners, TLS paths, management, prometheus, TCP options).
  3. 90-tuning.conf — rendered at boot by docker-entrypoint-custom.sh from 90-tuning.conf.template + environment (sizing knobs).

TLS modes (RABBITMQ_TLS_MODE)

Mode Behaviour
selfsigned (default) Generates a 4096-bit, 10-year self-signed cert with the BAUER GROUP subject on first boot. Zero-config; clients must trust it.
managed Uses cert.pem/key.pem written into the certs volume by a traefik-certs-dumper sidecar (real Let's Encrypt). Falls back to self-signed if absent (optionally waits RABBITMQ_TLS_MANAGED_WAIT seconds).
byo Uses operator-mounted cert.pem/key.pem; fails fast if missing.

In every mode the entrypoint guarantees ca.pem exists and chmod 600s the key.

Build

docker build \
  --build-arg RABBITMQ_VERSION=4-management \
  -t ghcr.io/bauer-group/cs-rabbitmq/rabbitmq:local .

See the repository root README.md and docs/ for full deployment guidance.