compose.yaml

# Copyright(C) 2021, Stamus Networks
# Written by Raphaël Brogat <rbrogat@stamus-networks.com>
#
# This file comes with ABSOLUTELY NO WARRANTY!
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

networks:
    network:

configs:
    opensearch-config:
        file: docker/configs/opensearch/opensearch.yml
    opensearch-dashboard-config:
        file: docker/configs/opensearch_dashboards/opensearch_dashboards.yml
    fluentd-config:
        file: docker/configs/fluentd/fluent.conf
    fluentd-template:
        file: docker/configs/fluentd/template.json

volumes:
    elastic-data: #for ES data persistency
    suricata-rules: #for suricata rules transfer between scirius and suricata and for persistency
    scirius-data: #for scirius data persistency
    scirius-static: #statics files to be served by nginx
    suricata-run: #path where the suricata socket resides
    suricata-logs:
    suricata-logrotate:
        driver_opts:
            type: none
            o: bind
            device: ./docker/containers-data/suricata/logrotate
    logstash-sincedb: #where logstash stores it's state so it doesn't re-ingest
    arkime-logs:
    arkime-pcap:
    arkime-config:
    db-data:
    fluentd-pos:

services:
    elasticsearch:
        image: opensearchproject/opensearch:1
        restart: ${RESTART_MODE:-unless-stopped}
        healthcheck:
            test: ['CMD-SHELL', 'curl --silent --fail localhost:9200/_cluster/health || exit 1']
            interval: 10s
            timeout: 5s
            retries: 3
            start_period: 30s
        environment:
            - plugins.security.disabled=true
            - discovery.type=single-node
        volumes:
            - ${ELASTIC_DATAPATH:-elastic-data}:/usr/share/opensearch/data
        ports:
            - 9200:9200
        mem_limit: ${ELASTIC_MEMORY:-3G}
        ulimits:
            memlock:
                soft: -1
                hard: -1
        networks:
            network:

    kibana:
        # image: opensearchproject/opensearch-dashboards:1
        build:
            context: docker/opensearch-dashboards
            dockerfile: Dockerfile
        restart: ${RESTART_MODE:-unless-stopped}
        configs:
            - source: opensearch-dashboard-config
              target: /usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
        healthcheck:
            test: ['CMD-SHELL', 'curl --silent --fail localhost:5601 || exit 1']
            interval: 30s
            timeout: 5s
            retries: 3
            start_period: 30s
        depends_on:
            elasticsearch:
                condition: service_healthy
        ports:
            - 5601:5601
        networks:
            network:

    fluentd:
        build:
            context: docker/fluentd
            dockerfile: Dockerfile
        command: fluentd -c /fluentd/etc/fluent.conf
        configs:
            - source: fluentd-config
              target: /fluentd/etc/fluent.conf
            - source: fluentd-template
              target: /fluentd/etc/template.json
        volumes:
            - fluentd-pos:/fluentd/log/td-agent/
            - ./docker/containers-data/suricata/logs:/var/log/suricata:ro
        networks:
            network:

    suricata:
        image: jasonish/suricata:master-amd64
        entrypoint: /etc/suricata/new_entrypoint.sh
        restart: ${RESTART_MODE:-unless-stopped}
        environment:
            - SURICATA_OPTIONS=${INTERFACES} -vvv --set sensor-name=suricata
        cap_add:
            - NET_ADMIN
            - SYS_NICE
        network_mode: host
        volumes:
            - ./docker/containers-data/suricata/logs:/var/log/suricata
            - suricata-rules:/etc/suricata/rules
            - suricata-run:/var/run/suricata/
            - ./docker/containers-data/suricata/etc:/etc/suricata
            - ./docker/containers-data/suricata/logrotate:/etc/logrotate.d/

    scirius:
        build:
            context: '.'
            dockerfile: Dockerfile
        restart: ${RESTART_MODE:-unless-stopped}
        healthcheck:
            interval: 10s
            timeout: 1s
            retries: 5
            start_period: 5m
        environment:
            - SECRET_KEY=${SCIRIUS_SECRET_KEY:-$(openssl rand -hex 32)}
            - DEBUG=${SCIRIUS_DEBUG:-False}
            - SCIRIUS_IN_SELKS=True
            - USE_ELASTICSEARCH=True
            - ELASTICSEARCH_ADDRESS=elasticsearch:9200 #Default
            - USE_KIBANA=True
            - KIBANA_URL=http://kibana:5601 #Default
            - KIBANA_PROXY=True #Get kibana proxied by Scirius
            - ALLOWED_HOSTS=* #allow connexions from anywhere
            - KIBANA7_DASHBOARDS_PATH=/opt/selks/kibana7-dashboards #where to find kibana dashboards
            - SURICATA_UNIX_SOCKET=/var/run/suricata/suricata-command.socket #socket to control suricata
            - USE_EVEBOX=True #gives access to evebox in the top menu
            - EVEBOX_ADDRESS=evebox:5636 #Default
            - USE_SURICATA_STATS=True #display more informations on the suricata page
            - USE_MOLOCH=True
            - MOLOCH_URL=http://arkime:8005
            - DATABASE_TYPE=pg
            - DATABASE_NAME=selks
            - DATABASE_USERNAME=selks
            - DATABASE_PASSWORD=selks
            - DATABASE_HOST=db
            - DATABASE_PORT=5432
        volumes:
            - scirius-static:/static/
            - scirius-data:/data/
            - ./docker/containers-data/scirius/logs/:/logs/
            - suricata-rules:/rules
            - suricata-run:/var/run/suricata
            - ./docker/containers-data/suricata/logs:/var/log/suricata:ro
        networks:
            network:
        depends_on:
            db:
                condition: service_healthy
            elasticsearch:
                condition: service_healthy
            kibana:
                condition: service_healthy

    evebox:
        image: jasonish/evebox:master
        command: ['-e', 'http://elasticsearch:9200']
        restart: ${RESTART_MODE:-unless-stopped}
        environment:
            - EVEBOX_HTTP_TLS_ENABLED=false
            - EVEBOX_AUTHENTICATION_REQUIRED=false
        networks:
            network:

    nginx:
        image: nginx
        command: ['${NGINX_EXEC:-nginx}', '-g', 'daemon off;']
        restart: ${RESTART_MODE:-unless-stopped}
        healthcheck:
            test: ['CMD', 'service', 'nginx', 'status']
            interval: 10s
            timeout: 2s
            retries: 5
        depends_on:
            scirius: #we need to wait for scirius to populate the static files
                condition: service_healthy
        volumes:
            - scirius-static:/static/:ro
            - ./docker/containers-data/nginx/conf.d/:/etc/nginx/conf.d/:ro
            - ./docker/containers-data/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
            - ./docker/containers-data/nginx/ssl:/etc/nginx/ssl:ro
        ports:
            - 443:443
        networks:
            network:

    cron:
        # This containers handles crontabs for the other containers, following the 1 task per container principle.
        # It is based on  `docker:latest` image, wich is an alpine image with docker binary
        image: docker:latest
        healthcheck:
            test: ['CMD', 'ps', '|', 'grep', 'crond']
            interval: 1m
            timeout: 1m
            retries: 3
        command:
            [
                sh,
                -c,
                "echo '*	*	 *	*	 *	run-parts /etc/periodic/1min' >> /etc/crontabs/root && crond -f -l 8",
            ]
        restart: ${RESTART_MODE:-unless-stopped}
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock # This bind-mout allows using the hosts docker deamon instead of created one inside the container

            # Those volumes will contain the cron jobs
            - ./docker/containers-data/cron-jobs/1min:/etc/periodic/1min/:ro
            - ./docker/containers-data/cron-jobs/15min:/etc/periodic/15min/:ro
            - ./docker/containers-data/cron-jobs/daily:/etc/periodic/daily/:ro
            - ./docker/containers-data/cron-jobs/hourly:/etc/periodic/hourly/:ro
            - ./docker/containers-data/cron-jobs/monthly:/etc/periodic/monthly/:ro
            - ./docker/containers-data/cron-jobs/weekly:/etc/periodic/weekly/:ro

    arkime:
        build:
            context: docker/Arkime
            dockerfile: Dockerfile.arkime
        restart: ${RESTART_MODE:-no}
        depends_on:
            elasticsearch:
                condition: service_healthy
        healthcheck:
            test: ['CMD', 'curl', '-f', 'http://scirius:8000/arkime']
            interval: 15s
            timeout: 5s
            retries: 3
        volumes:
            - ./docker/containers-data/suricata/logs:/suricata-logs:ro
            - ./docker/containers-data/arkime/logs:/opt/arkime/logs
            - arkime-pcap:/opt/arkime/raw
        ports:
            - 8005:8005
        networks:
            network:

    db:
        image: postgres
        restart: always
        shm_size: 128mb
        environment:
            POSTGRES_USER: selks
            POSTGRES_PASSWORD: selks
        volumes:
            - db-data:/var/lib/postgresql/data
        healthcheck:
            test: ['CMD-SHELL', 'pg_isready -U selks']
            interval: 5s
            timeout: 1s
            retries: 5
        networks:
            network:

    celery-worker:
        build:
            context: '.'
            dockerfile: Dockerfile
        restart: always
        working_dir: /opt/scirius
        entrypoint: celery
        command: -A suricata worker --loglevel=info
        environment:
            - SECRET_KEY=c8c0d898133cd973ea6a7b7a14c377bbb12dddc574c3ccaa
            - DATABASE_TYPE=postgres
            - DATABASE_NAME=selks
            - DATABASE_USERNAME=selks
            - DATABASE_PASSWORD=example
            - DATABASE_HOST=db
            - DATABASE_PORT=5432
        volumes:
            - ./docker/containers-data/scirius/logs/:/logs/
        healthcheck:
            test:
                [
                    'CMD-SHELL',
                    'celery --broker=amqp://guest:guest@rabbitmq:5672// -A suricata inspect ping',
                ]
            interval: 30s
            timeout: 10s
            retries: 3
        depends_on:
            rabbitmq:
                condition: service_healthy

    celery-flower:
        build:
            context: '.'
            dockerfile: Dockerfile
        restart: always
        command: celery --broker=amqp://guest:guest@rabbitmq:5672// flower -A suricata
        environment:
            - SECRET_KEY=c8c0d898133cd973ea6a7b7a14c377bbb12dddc574c3ccaa
        depends_on:
            scirius:
                condition: service_healthy
            rabbitmq:
                condition: service_healthy
            celery-worker:
                condition: service_healthy
        ports:
            - 5555:5555

    rabbitmq:
        image: rabbitmq:3-management-alpine
        healthcheck:
            test: rabbitmq-diagnostics -q ping
            interval: 30s
            timeout: 30s
            retries: 3
        ports:
            - 5672:5672
            - 15672:15672