docker-compose.yml

version: '3.9'
services:
  velociraptor:
    container_name: velociraptor
    #image: wlambert/velociraptor
    build:
      context: ./velociraptor
      dockerfile: Dockerfile
    volumes:
      - ./velociraptor_data:/velociraptor/:rw
      - ./velociraptor/custom:/custom:ro
      - ./velociraptor/entrypoint:/entrypoint:ro
      - velo_api:/api/
    environment:
      - VELO_USER=${VELO_USER}
      - VELO_PASSWORD=${VELO_PASSWORD}
      - VELO_ROLE=${VELO_ROLE}
      - VELO_SERVER_URL=${VELO_SERVER_URL}
      - VELO_FRONTEND_HOSTNAME=${VELO_FRONTEND_HOSTNAME}
    ports:
      - "8000:8000"
      - "8001:8001"
      - "8889:8889"
    restart: unless-stopped
    networks:
      - default
      - iris_frontend
  prometheus:
    profiles: ["prometheus"]
    image: prom/prometheus:latest
    container_name: prometheus
    ports:
      - 9090:9090
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --web.external-url=http://0.0.0.0/velocistack/prometheus
      - --web.route-prefix=/
    volumes:
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
    depends_on:
      - cadvisor
  cadvisor:
    image: google/cadvisor:latest
    container_name: cadvisor
    ports:
      - 8080:8080
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:rw
      - /sys:/sys:ro
      - /var/lib/docker:/var/lib/docker:ro
  pushgateway:
    image: prom/pushgateway
    container_name: pushgateway
    ports:
      - 9091:9091
  node-exporter:
    image: prom/node-exporter:latest
    container_name: node-exporter
    restart: unless-stopped
    expose:
      - 9100
    depends_on:
      - velociraptor
  grafana:
    profiles: ["grafana"]
    image: grafana/grafana
    container_name: grafana
    ports:
      - 3000:3000
    environment:
      - GF_SERVER_ROOT_URL=http://0.0.0.0/velocistack/grafana
      - GF_AUTH_ANONYMOUS_ENABLED=true  
      #- GF_SECURITY_ADMIN_PASSWORD=password
    volumes:
      - ./grafana/provisioning:/etc/grafana/provisioning:ro
    depends_on:
      - prometheus
      - cadvisor
  
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_VERSION}
    profiles: 
      - elastic
    container_name: elasticsearch
    environment:
      - xpack.security.enabled=false
      - discovery.type=single-node
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    cap_add:
      - IPC_LOCK
    ports:
      - 9200:9200
      - 9300:9300

  kibana:
    container_name: kibana
    image: docker.elastic.co/kibana/kibana:${ELASTIC_VERSION}
    profiles: 
      - elastic
    environment:
      - xpack.security.enabled=false
      - xpack.spaces.enabled=false
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - SERVER_NAME=https://${KIBANA_SERVER_NAME}/kibana
      - SERVER_BASEPATH=/velocistack/kibana
      - SERVER_DEFAULTROUTE=/app/discover
      - SERVER_DEFAULTINDEX=artifact*
      - SERVER_SHOWINSECURECLUSTERWARNING=false
      - TELEMETRY_ENABLED=false
    ports:
      - 5601:5601
    depends_on:
      - elasticsearch
  
  setup_kibana:
    image: centos:7
    profiles:
      - elastic
    container_name: setup_kibana
    volumes:
      - ./kibana/scripts/setup-kibana.sh:/setup-kibana.sh:ro
        #command: /bin/bash
    command: ['/bin/bash', '-c', 'cat /setup-kibana.sh | tr -d "\r" | bash']
    depends_on:
      - kibana
  
  zinc:
    container_name: zinc
    profiles: ["zinc"]
    #image: public.ecr.aws/h9e2j3o7/zinc:latest
    build:
      context: ./zinc
      dockerfile: Dockerfile
    volumes:
      - ./zinc/data:/data:rw
    environment:
      - DATA_PATH=/data
      - ZINC_FIRST_ADMIN_USER=${FIRST_ADMIN_USER}
      - ZINC_FIRST_ADMIN_PASSWORD=${FIRST_ADMIN_PASSWORD}
    ports:
      - "4080:4080"
    restart: unless-stopped

  omgwtfssl:
    container_name: omgwtfssl
    image: paulczar/omgwtfssl
    restart: "no"
    volumes:
      - nginx_certs:/certs
    environment:
      - SSL_SUBJECT=$HOSTNAME
      - CA_SUBJECT=my@example.com
      - SSL_KEY=/certs/nginx.key
      - SSL_CSR=/certs/nginx.csr
      - SSL_CERT=/certs/nginx.crt

  nginx:
    container_name: nginx
    image: nginx:latest
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - nginx_certs:/etc/nginx/ssl:ro
    ports:
      - '0.0.0.0:443:443'
      - '0.0.0.0:80:80'
    depends_on:
      - omgwtfssl
      - app
    networks:
      - default
      - iris_frontend
  
  rabbitmq:
    profiles: ["iris", "intelowl"]
    image: rabbitmq:3-management-alpine
    container_name: rabbitmq
    ports:
        - "0.0.0.0:5672:5672"
        - "0.0.0.0:15672:15672"
    networks:
      - iris_backend
      - default

  db:
    container_name: iris-db
    profiles: ["iris"]
    image: iriswebapp_db:v2.4.7
    build:
      context: iris/docker/db
    restart: always
    ports:
      - "127.0.0.1:5432:5432"
    environment:
      - POSTGRES_PASSWORD
      - POSTGRES_USER
      - POSTGRES_DB
      - POSTGRES_ADMIN_USER
      - POSTGRES_ADMIN_PASSWORD
    networks:
      - iris_backend
    volumes:
      - db_data:/var/lib/postgresql/data

  app:
    container_name: iris-web
    profiles: ["iris"]
    build:
      context: .
      dockerfile: iris/docker/webApp/Dockerfile
    image: iriswebapp_app:v2.4.7
    command: /bin/bash -c "until pg_isready --username=$POSTGRES_ADMIN_USER --host=db; do sleep 1; done && nohup ./iris-entrypoint.sh iriswebapp"
    volumes:
      - iris-downloads:/home/iris/downloads
      - user_templates:/home/iris/user_templates
      - server_data:/home/iris/server_data
      - velo_api:/velociraptor:ro
    restart: always
    depends_on:
      - "rabbitmq"
      - "db"
      - "velociraptor"
    ports:
      - "127.0.0.1:8100:8000"
    environment:
      - APP_PORT
      - POSTGRES_PASSWORD
      - POSTGRES_USER
      - POSTGRES_DB
      - POSTGRES_ADMIN_USER
      - POSTGRES_ADMIN_PASSWORD
      - POSTGRES_SERVER
      - POSTGRES_PORT
      - DOCKERIZED
      - IRIS_SECRET_KEY
      - IRIS_SECURITY_PASSWORD_SALT
      - IRIS_ADM_PASSWORD
    networks:
      - iris_backend
      - iris_frontend

  worker:
    container_name: iris-worker
    profiles: ["iris"]
    build:
      context: .
      dockerfile: iris/docker/webApp/Dockerfile
    image: iriswebapp_app:v2.4.7
    command: ['./wait-for-iriswebapp.sh', 'app:8000', './iris-entrypoint.sh', 'iris-worker']
    volumes:
      - iris-downloads:/home/iris/downloads
      - user_templates:/home/iris/user_templates
      - server_data:/home/iris/server_data
      - velo_api:/velociraptor:ro
    depends_on:
      - "rabbitmq"
      - "db"
      - "app"
      - "velociraptor"
    environment:
      - APP_PORT
      - POSTGRES_PASSWORD
      - POSTGRES_USER
      - POSTGRES_DB
      - POSTGRES_ADMIN_USER
      - POSTGRES_ADMIN_PASSWORD
      - POSTGRES_SERVER
      - POSTGRES_PORT
      - DOCKERIZED
      - IRIS_WORKER
    networks:
      - iris_frontend
      - iris_backend

  postgres:
    profiles: ["intelowl"]
    image: library/postgres:12-alpine
    container_name: intelowl_postgres
    volumes:
      - postgres_data:/var/lib/postgresql/data/
    env_file:
      - ./intelowl/docker/env_file_postgres

  uwsgi:
    profiles: ["intelowl"]
    image: intelowlproject/intelowl:${INTELOWL_TAG_VERSION}
    container_name: uwsgi
    volumes:
      #- ./intelowl/docker/entrypoints/uwsgi.sh:/intelowl/docker/entrypoints/uwsgi.sh:ro
      - ./intelowl/configuration/intel_owl.ini:/etc/uwsgi/sites/intel_owl.ini # uwsgi configuration file
      - ./intelowl/configuration:/opt/deploy/intel_owl/configuration
      - generic_logs:/var/log/intel_owl
      - static_content:/opt/deploy/intel_owl/static
      - shared_files:/opt/deploy/files_required
    entrypoint:
      - ./docker/entrypoints/uwsgi.sh
    expose:
      - "8001"
    env_file:
      - ./intelowl/docker/env_file_app
    depends_on:
      - postgres
  celery_beat:
    profiles: ["intelowl"]
    image: intelowlproject/intelowl:${INTELOWL_TAG_VERSION}
    container_name: intelowl_celery_beat
    restart: unless-stopped
    volumes:
      - ./intelowl/docker/entrypoints/celery_beat.sh:/intelowl/docker/entrypoints/celery_beat.sh:ro 
      - ./intelowl/configuration:/opt/deploy/intel_owl/configuration
      - generic_logs:/var/log/intel_owl
      - shared_files:/opt/deploy/files_required
    entrypoint:
      - /intelowl/docker/entrypoints/celery_beat.sh
    env_file:
      - ./intelowl/docker/env_file_app
    depends_on:
      - rabbitmq
      - postgres
      - uwsgi

  celery_worker_default:
    profiles: ["intelowl"]
    image: intelowlproject/intelowl:${INTELOWL_TAG_VERSION}
    container_name: intelowl_celery_worker_default
    restart: unless-stopped
    stop_grace_period: 3m
    volumes:
      - ./intelowl/docker/entrypoints/celery_default.sh:/intelowl/docker/entrypoints/celery_default.sh:ro
      - ./intelowl/configuration:/opt/deploy/intel_owl/configuration
      - generic_logs:/var/log/intel_owl
      - shared_files:/opt/deploy/files_required
    entrypoint:
      - /intelowl/docker/entrypoints/celery_default.sh
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    env_file:
      - ./intelowl/docker/env_file_app
    depends_on:
      - rabbitmq
      - postgres
  intelowl_nginx:
    profiles: ["intelowl"]
    image: intelowlproject/intelowl_nginx:${INTELOWL_TAG_VERSION}
    container_name: intelowl_nginx
    restart: unless-stopped
    hostname: nginx
    volumes:
      - ./intelowl/configuration/nginx/errors.conf:/etc/nginx/errors.conf
      - ./intelowl/configuration/nginx/https.conf:/etc/nginx/conf.d/default.conf
      - ./intelowl/configuration/nginx/locations.conf:/etc/nginx/locations.conf
      - nginx_certs:/etc/nginx/ssl:ro
      - nginx_logs:/var/log/nginx
      - static_content:/var/www/static
    ports:
      - "8443:443"
        #- "443:443"
    depends_on:
      - uwsgi
volumes:
  elasticsearch-data:
    driver: local
  iris-downloads:
  user_templates:
  server_data:
  db_data:
  postgres_data:
  generic_logs:
  static_content:
  shared_files:
  nginx_logs:
  nginx_certs:
  velo_api:
networks:
  iris_backend:
    name: iris_backend
    driver: bridge
  iris_frontend:
    name: iris_frontend
    driver: bridge