name: greenfield-siem services: postgres: image: postgres:18.4-alpine environment: POSTGRES_DB: siem POSTGRES_USER: siem POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} volumes: - postgres_data:/var/lib/postgresql - ./deploy/postgres/init.sql:/docker-entrypoint-initdb.d/001-init.sql:ro healthcheck: test: ["CMD-SHELL", "pg_isready -U siem -d siem"] interval: 5s timeout: 3s retries: 30 restart: unless-stopped ports: - "127.0.0.1:${POSTGRES_PORT:-5432}:5432" clickhouse: image: clickhouse/clickhouse-server:26.6.2.81 environment: CLICKHOUSE_DB: siem CLICKHOUSE_USER: siem CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD} CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1" volumes: - clickhouse_data:/var/lib/clickhouse - clickhouse_logs:/var/log/clickhouse-server - ./deploy/clickhouse/init.sql:/docker-entrypoint-initdb.d/001-init.sql:ro - ./deploy/clickhouse/prometheus.xml:/etc/clickhouse-server/config.d/prometheus.xml:ro ulimits: nofile: soft: 262144 hard: 262144 healthcheck: test: ["CMD-SHELL", "clickhouse-client --user siem --password $$CLICKHOUSE_PASSWORD --query 'SELECT 1' >/dev/null"] interval: 5s timeout: 5s retries: 30 restart: unless-stopped ports: - "127.0.0.1:${CLICKHOUSE_HTTP_PORT:-8123}:8123" redpanda: image: docker.redpanda.com/redpandadata/redpanda:v26.1.13 command: - redpanda - start - --kafka-addr - internal://0.0.0.0:9092,external://0.0.0.0:19092 - --advertise-kafka-addr - internal://redpanda:9092,external://localhost:19092 - --pandaproxy-addr - internal://0.0.0.0:8082,external://0.0.0.0:18082 - --advertise-pandaproxy-addr - internal://redpanda:8082,external://localhost:18082 - --schema-registry-addr - internal://0.0.0.0:8081,external://0.0.0.0:18081 - --rpc-addr - redpanda:33145 - --advertise-rpc-addr - redpanda:33145 - --mode - dev-container - --smp - "2" - --default-log-level=info volumes: - redpanda_data:/var/lib/redpanda/data healthcheck: test: ["CMD-SHELL", "RPK_BROKERS=localhost:9092 rpk cluster health | grep -q 'Healthy:.*true'"] interval: 5s timeout: 5s retries: 40 restart: unless-stopped ports: - "127.0.0.1:${REDPANDA_KAFKA_PORT:-19092}:19092" - "127.0.0.1:${REDPANDA_ADMIN_PORT:-19644}:9644" redpanda-init: image: docker.redpanda.com/redpandadata/redpanda:v26.1.13 depends_on: redpanda: condition: service_healthy entrypoint: ["/bin/sh", "-ec"] environment: RPK_BROKERS: redpanda:9092 command: >- rpk topic create --if-not-exists -p ${KAFKA_PARTITIONS:-6} -r 1 -c retention.ms=${KAFKA_RETENTION_MS:-86400000} siem-events restart: "no" redpanda-console: image: docker.redpanda.com/redpandadata/console:v3.8.0 depends_on: redpanda: condition: service_healthy entrypoint: /bin/sh command: -c 'echo "$$CONSOLE_CONFIG_FILE" > /tmp/config.yml; /app/console' environment: CONFIG_FILEPATH: /tmp/config.yml CONSOLE_CONFIG_FILE: | kafka: brokers: ["redpanda:9092"] schemaRegistry: enabled: true urls: ["http://redpanda:8081"] redpanda: adminApi: enabled: true urls: ["http://redpanda:9644"] restart: unless-stopped ports: - "127.0.0.1:${REDPANDA_CONSOLE_PORT:-8081}:8080" garage: image: dxflrs/garage:v2.3.0 command: ["/garage", "server", "--single-node", "--default-bucket"] environment: GARAGE_DEFAULT_ACCESS_KEY: ${GARAGE_ACCESS_KEY} GARAGE_DEFAULT_SECRET_KEY: ${GARAGE_SECRET_KEY} GARAGE_DEFAULT_BUCKET: ${GARAGE_BUCKET:-siem-raw} volumes: - garage_meta:/var/lib/garage/meta - garage_data:/var/lib/garage/data - ./deploy/garage/garage.toml:/etc/garage.toml:ro restart: unless-stopped ports: - "127.0.0.1:${GARAGE_S3_PORT:-3900}:3900" - "127.0.0.1:${GARAGE_ADMIN_PORT:-3903}:3903" ingress: image: greenfield-siem-app:local build: . command: ["ingress"] environment: &app-env SERVICE_ADDR: :8080 POSTGRES_URL: postgres://siem:${POSTGRES_PASSWORD}@postgres:5432/siem?sslmode=disable CLICKHOUSE_URL: http://clickhouse:8123 CLICKHOUSE_USER: siem CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD} KAFKA_BROKERS: redpanda:9092 KAFKA_TOPIC: siem-events TENANT_ID: ${TENANT_ID:-default} UI_USERNAME: ${UI_USERNAME:-admin} UI_PASSWORD: ${UI_PASSWORD} ENROLLMENT_KEY: ${ENROLLMENT_KEY} RAW_ARCHIVE_ENABLED: ${RAW_ARCHIVE_ENABLED:-true} RAW_SPOOL_DIR: /var/spool/siem-raw RAW_RETENTION: ${RAW_RETENTION:-720h} depends_on: postgres: condition: service_healthy redpanda-init: condition: service_completed_successfully restart: unless-stopped ports: - "${INGRESS_BIND:-0.0.0.0}:${INGRESS_PORT:-8090}:8080" processor: image: greenfield-siem-app:local command: ["processor"] user: "0:0" environment: <<: *app-env KAFKA_GROUP: siem-processor-v1 volumes: - raw_spool:/var/spool/siem-raw depends_on: clickhouse: condition: service_healthy redpanda-init: condition: service_completed_successfully restart: unless-stopped detector: image: greenfield-siem-app:local command: ["detector"] environment: <<: *app-env DETECTOR_INTERVAL: ${DETECTOR_INTERVAL:-30s} DETECTOR_LOOKBACK: ${DETECTOR_LOOKBACK:-20m} depends_on: clickhouse: condition: service_healthy postgres: condition: service_healthy processor: condition: service_started restart: unless-stopped api: image: greenfield-siem-app:local command: ["api"] environment: <<: *app-env UI_QUERY_LIMIT: ${UI_QUERY_LIMIT:-500} depends_on: clickhouse: condition: service_healthy postgres: condition: service_healthy restart: unless-stopped ports: - "${UI_BIND:-0.0.0.0}:${UI_PORT:-8080}:8080" archive-uploader: image: rclone/rclone:1.74.4 entrypoint: ["/bin/sh", "-ec"] command: | while true; do rclone move /spool garage:${GARAGE_BUCKET:-siem-raw} --exclude '*.tmp' --create-empty-src-dirs --transfers 8 --checkers 8 --retries 5 || true rclone delete garage:${GARAGE_BUCKET:-siem-raw} --min-age ${RAW_RETENTION:-720h} --retries 5 || true sleep 30 done environment: RCLONE_CONFIG_GARAGE_TYPE: s3 RCLONE_CONFIG_GARAGE_PROVIDER: Other RCLONE_CONFIG_GARAGE_ACCESS_KEY_ID: ${GARAGE_ACCESS_KEY} RCLONE_CONFIG_GARAGE_SECRET_ACCESS_KEY: ${GARAGE_SECRET_KEY} RCLONE_CONFIG_GARAGE_ENDPOINT: http://garage:3900 RCLONE_CONFIG_GARAGE_REGION: garage RCLONE_CONFIG_GARAGE_FORCE_PATH_STYLE: "true" volumes: - raw_spool:/spool depends_on: - garage - processor restart: unless-stopped prometheus: image: prom/prometheus:v3.13.1 command: ["--config.file=/etc/prometheus/prometheus.yml", "--storage.tsdb.retention.time=30d"] volumes: - ./deploy/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro - prometheus_data:/prometheus depends_on: - ingress - redpanda restart: unless-stopped ports: - "127.0.0.1:${PROMETHEUS_PORT:-9090}:9090" volumes: postgres_data: clickhouse_data: clickhouse_logs: redpanda_data: garage_meta: garage_data: raw_spool: prometheus_data: