Began Framework start

docker/.gitignore

@@ -0,0 +1,2 @@
+.env
+gw-secret/GATEWAY_ADMIN_PASSWORD

docker/config/ignition/gateway.xml

@@ -0,0 +1,9 @@
+<?xml version="1.1" encoding="UTF-8"?>
+<!--
+  Ignition gateway configuration backup.
+  Mount this file read-only for initial config seeding only.
+  After first boot, Ignition manages its own config — do not overwrite a live gateway.xml.
+
+  To generate this file: Gateway > Config > Backup/Restore > Download Backup
+-->
+<ConfigurationUpdate />

docker/config/modbus/example-pumps.json

@@ -0,0 +1,19 @@
+{
+  "server": {
+    "host": "0.0.0.0",
+    "port": 5020
+  },
+  "registers": {
+    "holding": {
+      "0": 0,
+      "1": 0,
+      "2": 0,
+      "3": 0,
+      "4": 0
+    },
+    "coils": {
+      "0": false,
+      "1": false
+    }
+  }
+}

docker/config/postgres/init.sql

@@ -0,0 +1,10 @@
+-- PostgreSQL initialization script.
+-- Runs ONCE on first container start when the data volume is empty.
+-- Add schema, extensions, and seed data here.
+
+-- Enable useful extensions
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "pg_trgm";
+
+-- Ignition stores its own schema; this file is for project-specific tables.
+-- Add project tables below this line.

docker/config/traefik/dynamic/README.md

@@ -0,0 +1,10 @@
+# Traefik Dynamic Configuration
+
+Place `.yml` files here for dynamic routing rules, middleware, and TLS configuration.
+Traefik watches this directory and reloads automatically — no restart required.
+
+## Examples
+
+- `tls.yml` — TLS certificates and stores
+- `middlewares.yml` — reusable middleware (auth, rate limiting, headers)
+- `routers.yml` — additional route rules beyond Docker labels

docker/config/traefik/dynamic/ignition.yml

@@ -0,0 +1,13 @@
+http:
+  routers:
+    ignition:
+      entryPoints:
+        - web
+      rule: "Host(`ignition.localhost`)"
+      service: ignition
+
+  services:
+    ignition:
+      loadBalancer:
+        servers:
+          - url: "http://ignition:8088"

docker/config/traefik/traefik.yml

@@ -0,0 +1,19 @@
+api:
+  dashboard: true
+  insecure: true   # Dashboard on :8080 — restrict in production
+
+entryPoints:
+  web:
+    address: ":80"
+  websecure:
+    address: ":443"
+
+providers:
+  docker:
+    exposedByDefault: false
+  file:
+    directory: /etc/traefik/dynamic
+    watch: true
+
+log:
+  level: INFO

docker/docker-compose.override.yml

@@ -0,0 +1,16 @@
+# Project-specific service additions and overrides.
+# Add Modbus simulators and other project-specific containers here.
+# Do NOT modify docker-compose.yml directly for per-project changes.
+#
+# Example Modbus simulator:
+#
+# services:
+#   modbus-sim-pumps:
+#     image: oitc/modbus-server:latest
+#     ports:
+#       - "5020:5020"
+#     volumes:
+#       - ./config/modbus/pumps.json:/app/config.json
+#     restart: unless-stopped
+
+services: {}

docker/docker-compose.yml

@@ -0,0 +1,118 @@
+x-default-logging: &default-logging
+  logging:
+    driver: json-file
+    options:
+      max-size: "100m"
+      max-file: "5"
+
+x-ignition-opts: &ignition-opts
+  <<: *default-logging
+  build:
+    context: .
+    args:
+      IGNITION_VERSION: ${IGNITION_VERSION:-8.3.3}
+    dockerfile: ./gw-build/Dockerfile
+  image: framework-ignition:${IGNITION_VERSION:-8.3.3}
+  env_file: gw-init/gateway.env
+  secrets:
+    - gateway-admin-password
+
+name: framework
+
+services:
+  ignition:
+    <<: *ignition-opts
+    container_name: ignition
+    pull_policy: missing
+    depends_on:
+      traefik:
+        condition: service_healthy
+      postgres:
+        condition: service_healthy
+    command: >
+      -n ${GATEWAY_NAME:-framework} -m ${GATEWAY_MAX_MEMORY:-1024}
+    ports:
+      - "8088:8088"
+      - "8043:8043"
+      - "62541:62541"
+      - "1883:1883"
+    volumes:
+      - ignition-data:/usr/local/bin/ignition/data
+      - ./gw-config:/usr/local/bin/ignition/data/config:rw
+      - ./gw-commission/commissioning.json:/usr/local/bin/ignition/data/commissioning.json:ro
+      - ../ignition/project:/usr/local/bin/ignition/data/projects/framework:rw
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8088/StatusPing"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.ignition.entrypoints=web"
+      - "traefik.http.routers.ignition.rule=Host(`${GATEWAY_HOSTNAME:-ignition.localhost}`)"
+      - "traefik.http.services.ignition.loadbalancer.server.port=8088"
+    networks:
+      - proxy
+    restart: unless-stopped
+
+  postgres:
+    <<: *default-logging
+    image: postgres:16-alpine
+    container_name: postgres
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+      - ./config/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
+    environment:
+      POSTGRES_DB: ignition
+      POSTGRES_USER: ignition
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ignition"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - proxy
+    restart: unless-stopped
+
+  traefik:
+    <<: *default-logging
+    image: traefik:v3
+    container_name: traefik
+    ports:
+      - "80:80"
+      - "443:443"
+      - "8080:8080"
+    command:
+      - --configFile=/etc/traefik/traefik.yml
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./config/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
+      - ./config/traefik/dynamic:/etc/traefik/dynamic:ro
+    healthcheck:
+      test: ["CMD", "traefik", "healthcheck", "--ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 5s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.traefik.entrypoints=web"
+      - "traefik.http.routers.traefik.rule=Host(`traefik.localhost`)"
+      - "traefik.http.routers.traefik.service=api@internal"
+    networks:
+      - proxy
+    restart: unless-stopped
+
+networks:
+  proxy:
+    name: proxy
+
+secrets:
+  gateway-admin-password:
+    file: gw-secret/GATEWAY_ADMIN_PASSWORD
+
+volumes:
+  ignition-data:
+  postgres-data:

docker/gw-build/Dockerfile

@@ -0,0 +1,17 @@
+ARG IGNITION_VERSION=8.3.3
+FROM inductiveautomation/ignition:${IGNITION_VERSION}
+
+USER root
+
+RUN apt-get update && apt-get install -y \
+    iputils-ping \
+    htop \
+    nano \
+    net-tools \
+    traceroute \
+    && apt-get clean && rm -rf /var/lib/apt/lists/*
+
+# Uncomment to install third-party modules:
+# COPY modules/*.modl /usr/local/bin/ignition/user-lib/modules/
+
+EXPOSE 8088 8043 62541 1883

docker/gw-commission/commissioning.json

@@ -0,0 +1,5 @@
+{
+  "connections.useSsl": "false",
+  "eulaSetup.eula": "B3RM3rHPH6fHm8owWAEx/YnCk04FsYkXTDX8DOl4zQI=",
+  "isCommissioned": "COMMISSIONED"
+}

docker/gw-config/.gitignore

@@ -0,0 +1,13 @@
+# Ignition runtime-generated gateway config — do not commit
+local/
+resources/
+certificates/
+keystore/
+*.idb
+db/
+metricsdb/
+autobackup/
+jar-cache/
+*.log
+logs/
+.resources/

docker/gw-init/gateway.env

@@ -0,0 +1,8 @@
+ACCEPT_IGNITION_EULA=Y
+GATEWAY_ADMIN_USERNAME=admin
+GATEWAY_ADMIN_PASSWORD_FILE=/run/secrets/gateway-admin-password
+GATEWAY_PUBLIC_ADDRESS=${GATEWAY_HOSTNAME}
+IGNITION_EDITION=standard
+TZ=America/Chicago
+GATEWAY_MODULES_ENABLED=all
+DISABLE_QUICKSTART=true

docker/gw-secret/GATEWAY_ADMIN_PASSWORD.example

@@ -0,0 +1 @@
+changeme