siem-backend/compose.yml

services:
  mariadb:
    image: mariadb:11.8
    container_name: siem-mariadb
    restart: unless-stopped
    ports:
      - 3307:3306
    env_file:
      - .env
    environment:
      MARIADB_DATABASE: ${MARIADB_DATABASE}
      MARIADB_USER: ${MARIADB_USER}
      MARIADB_PASSWORD: ${MARIADB_PASSWORD}
      MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD}
      TZ: ${TZ}
    command:
      - --character-set-server=utf8mb4
      - --collation-server=utf8mb4_unicode_ci
      - --innodb-buffer-pool-size=512M
      - --max-connections=300
    volumes:
      - mariadb_data:/var/lib/mysql
      - ./deploy/mariadb/init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test:
        - CMD-SHELL
        - mariadb-admin ping -h 127.0.0.1 -u root -p$$MARIADB_ROOT_PASSWORD
          --silent
      interval: 20s
      timeout: 5s
      retries: 10
      start_period: 30s
    networks:
      - dockge_default
  siem-backend:
    image: git.send.nrw/sendnrw/siem-backend:latest
    container_name: siem-backend
    restart: unless-stopped
    env_file:
      - .env
    environment:
      LISTEN_ADDR: ${LISTEN_ADDR}
      DB_DSN: ${DB_DSN}
      DB_MAX_OPEN_CONNS: ${DB_MAX_OPEN_CONNS}
      DB_MAX_IDLE_CONNS: ${DB_MAX_IDLE_CONNS}
      DB_CONN_MAX_LIFETIME: ${DB_CONN_MAX_LIFETIME}
      DB_CONN_MAX_IDLE_TIME: ${DB_CONN_MAX_IDLE_TIME}
      MAX_BODY_BYTES: ${MAX_BODY_BYTES}
      HTTP_READ_TIMEOUT: ${HTTP_READ_TIMEOUT}
      HTTP_WRITE_TIMEOUT: ${HTTP_WRITE_TIMEOUT}
      HTTP_IDLE_TIMEOUT: ${HTTP_IDLE_TIMEOUT}
      DETECTION_INTERVAL: ${DETECTION_INTERVAL}
      OFFLINE_AFTER: ${OFFLINE_AFTER}
      FAILED_LOGON_WINDOW: ${FAILED_LOGON_WINDOW}
      FAILED_LOGON_THRESHOLD: ${FAILED_LOGON_THRESHOLD}
      REBOOT_WINDOW: ${REBOOT_WINDOW}
      REBOOT_THRESHOLD: ${REBOOT_THRESHOLD}
      PASSWORD_SPRAY_WINDOW: ${PASSWORD_SPRAY_WINDOW}
      PASSWORD_SPRAY_MIN_USERS: ${PASSWORD_SPRAY_MIN_USERS}
      PASSWORD_SPRAY_MIN_ATTEMPTS: ${PASSWORD_SPRAY_MIN_ATTEMPTS}
      SUCCESS_AFTER_FAILURE_WINDOW: ${SUCCESS_AFTER_FAILURE_WINDOW}
      NEW_SOURCE_IP_LOOKBACK: ${NEW_SOURCE_IP_LOOKBACK}
      NEW_SOURCE_IP_WINDOW: ${NEW_SOURCE_IP_WINDOW}
      DETECTIONS_LIMIT: ${DETECTIONS_LIMIT}
      NEW_EVENT_ID_MODE: ${NEW_EVENT_ID_MODE}
      NEW_EVENT_ID_LEARNING_PERIOD: ${NEW_EVENT_ID_LEARNING_PERIOD}
      NEW_EVENT_ID_CONFIRM_WINDOW: ${NEW_EVENT_ID_CONFIRM_WINDOW}
      NEW_EVENT_ID_MIN_COUNT: ${NEW_EVENT_ID_MIN_COUNT}
      NEW_EVENT_ID_IGNORE_CHANNELS: ${NEW_EVENT_ID_IGNORE_CHANNELS}
      NEW_EVENT_ID_ALERT_CHANNELS: ${NEW_EVENT_ID_ALERT_CHANNELS}
      NEW_EVENT_ID_HIGH_RISK_IDS: ${NEW_EVENT_ID_HIGH_RISK_IDS}
      STORE_EVENT_ROWS: ${STORE_EVENT_ROWS}
      STORE_RAW_XML: ${STORE_RAW_XML}
      METADATA_CONTEXT_EVENT_IDS: ${METADATA_CONTEXT_EVENT_IDS}
      METADATA_BUCKET: ${METADATA_BUCKET}
      EVENT_RETENTION: ${EVENT_RETENTION}
      RAW_RETENTION: ${RAW_RETENTION}
      METADATA_RETENTION: ${METADATA_RETENTION}
      PARTITION_MAINTENANCE_ENABLED: ${PARTITION_MAINTENANCE_ENABLED}
      PARTITION_MAINTENANCE_INTERVAL: ${PARTITION_MAINTENANCE_INTERVAL}
      PARTITION_INTERVAL: ${PARTITION_INTERVAL}
      PARTITION_AHEAD: ${PARTITION_AHEAD}
      PARTITION_BEHIND: ${PARTITION_BEHIND}
      PARTITION_RETENTION: ${PARTITION_RETENTION}
      TZ: ${TZ}
    depends_on:
      mariadb:
        condition: service_healthy
    ports:
      - 8090:8080
    healthcheck:
      test:
        - CMD-SHELL
        - wget -qO- http://127.0.0.1:8080/healthz >/dev/null 2>&1 || exit 1
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s
    networks:
      - dockge_default
  stress-agent:
    profiles: ["stress"]
    build:
      context: .
      dockerfile: Dockerfile.stress
    container_name: siem-stress-agent
    restart: "no"
    environment:
      SIEM_STRESS_URL: ${SIEM_STRESS_URL}
      SIEM_STRESS_HOST: ${SIEM_STRESS_HOST}
      SIEM_STRESS_API_KEY: ${SIEM_STRESS_API_KEY}
      SIEM_STRESS_ENROLLMENT_KEY: ${ENROLLMENT_KEY}
      SIEM_STRESS_SCENARIO: ${SIEM_STRESS_SCENARIO}
      SIEM_STRESS_RATE: ${SIEM_STRESS_RATE}
      SIEM_STRESS_BATCH: ${SIEM_STRESS_BATCH}
      SIEM_STRESS_WORKERS: ${SIEM_STRESS_WORKERS}
      SIEM_STRESS_DURATION: ${SIEM_STRESS_DURATION}
      SIEM_STRESS_MAX_EVENTS: ${SIEM_STRESS_MAX_EVENTS}
      SIEM_STRESS_TIMEOUT: ${SIEM_STRESS_TIMEOUT}
      SIEM_STRESS_CONFIRM: ${SIEM_STRESS_CONFIRM}
    depends_on:
      siem-backend:
        condition: service_healthy
    networks:
      - dockge_default

  prometheus:
    image: prom/prometheus:latest
    container_name: siem-prometheus
    restart: unless-stopped
    env_file:
      - .env
    environment:
      TZ: ${TZ}
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=30d
      - --web.enable-lifecycle
    depends_on:
      siem-backend:
        condition: service_healthy
    volumes:
      - ./deploy/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./deploy/prometheus/rules:/etc/prometheus/rules:ro
      - prometheus_data:/prometheus
    ports:
      - 9090:9090
    networks:
      - dockge_default
  grafana:
    image: grafana/grafana:latest
    container_name: siem-grafana
    restart: unless-stopped
    env_file:
      - .env
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD}
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_SERVER_ROOT_URL: http://localhost:3000
      TZ: ${TZ}
    depends_on:
      - prometheus
    volumes:
      - grafana_data:/var/lib/grafana
      - ./deploy/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./deploy/grafana/dashboards:/var/lib/grafana/dashboards:ro
    ports:
      - 3090:3000
    networks:
      - dockge_default
volumes:
  mariadb_data: null
  prometheus_data: null
  grafana_data: null
networks:
  dockge_default:
    external: true