257 lines
7.6 KiB
YAML
257 lines
7.6 KiB
YAML
name: greenfield-siem
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:18.4-alpine
|
|
environment:
|
|
POSTGRES_DB: siem
|
|
POSTGRES_USER: siem
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql
|
|
- ./deploy/postgres/init.sql:/docker-entrypoint-initdb.d/001-init.sql:ro
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U siem -d siem"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 30
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
|
|
|
|
clickhouse:
|
|
image: clickhouse/clickhouse-server:26.6.2.81
|
|
environment:
|
|
CLICKHOUSE_DB: siem
|
|
CLICKHOUSE_USER: siem
|
|
CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD}
|
|
CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"
|
|
volumes:
|
|
- clickhouse_data:/var/lib/clickhouse
|
|
- clickhouse_logs:/var/log/clickhouse-server
|
|
- ./deploy/clickhouse/init.sql:/docker-entrypoint-initdb.d/001-init.sql:ro
|
|
- ./deploy/clickhouse/prometheus.xml:/etc/clickhouse-server/config.d/prometheus.xml:ro
|
|
ulimits:
|
|
nofile:
|
|
soft: 262144
|
|
hard: 262144
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "clickhouse-client --user siem --password $$CLICKHOUSE_PASSWORD --query 'SELECT 1' >/dev/null"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 30
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:${CLICKHOUSE_HTTP_PORT:-8123}:8123"
|
|
|
|
redpanda:
|
|
image: docker.redpanda.com/redpandadata/redpanda:v26.1.13
|
|
command:
|
|
- redpanda
|
|
- start
|
|
- --kafka-addr
|
|
- internal://0.0.0.0:9092,external://0.0.0.0:19092
|
|
- --advertise-kafka-addr
|
|
- internal://redpanda:9092,external://localhost:19092
|
|
- --pandaproxy-addr
|
|
- internal://0.0.0.0:8082,external://0.0.0.0:18082
|
|
- --advertise-pandaproxy-addr
|
|
- internal://redpanda:8082,external://localhost:18082
|
|
- --schema-registry-addr
|
|
- internal://0.0.0.0:8081,external://0.0.0.0:18081
|
|
- --rpc-addr
|
|
- redpanda:33145
|
|
- --advertise-rpc-addr
|
|
- redpanda:33145
|
|
- --mode
|
|
- dev-container
|
|
- --smp
|
|
- "2"
|
|
- --default-log-level=info
|
|
volumes:
|
|
- redpanda_data:/var/lib/redpanda/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "RPK_BROKERS=localhost:9092 rpk cluster health | grep -q 'Healthy:.*true'"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 40
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:${REDPANDA_KAFKA_PORT:-19092}:19092"
|
|
- "127.0.0.1:${REDPANDA_ADMIN_PORT:-19644}:9644"
|
|
|
|
redpanda-init:
|
|
image: docker.redpanda.com/redpandadata/redpanda:v26.1.13
|
|
depends_on:
|
|
redpanda:
|
|
condition: service_healthy
|
|
entrypoint: ["/bin/sh", "-ec"]
|
|
environment:
|
|
RPK_BROKERS: redpanda:9092
|
|
command: >-
|
|
rpk topic create --if-not-exists -p ${KAFKA_PARTITIONS:-6} -r 1
|
|
-c retention.ms=${KAFKA_RETENTION_MS:-86400000}
|
|
siem-events
|
|
restart: "no"
|
|
|
|
redpanda-console:
|
|
image: docker.redpanda.com/redpandadata/console:v3.8.0
|
|
depends_on:
|
|
redpanda:
|
|
condition: service_healthy
|
|
entrypoint: /bin/sh
|
|
command: -c 'echo "$$CONSOLE_CONFIG_FILE" > /tmp/config.yml; /app/console'
|
|
environment:
|
|
CONFIG_FILEPATH: /tmp/config.yml
|
|
CONSOLE_CONFIG_FILE: |
|
|
kafka:
|
|
brokers: ["redpanda:9092"]
|
|
schemaRegistry:
|
|
enabled: true
|
|
urls: ["http://redpanda:8081"]
|
|
redpanda:
|
|
adminApi:
|
|
enabled: true
|
|
urls: ["http://redpanda:9644"]
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:${REDPANDA_CONSOLE_PORT:-8081}:8080"
|
|
|
|
garage:
|
|
image: dxflrs/garage:v2.3.0
|
|
command: ["/garage", "server", "--single-node", "--default-bucket"]
|
|
environment:
|
|
GARAGE_DEFAULT_ACCESS_KEY: ${GARAGE_ACCESS_KEY}
|
|
GARAGE_DEFAULT_SECRET_KEY: ${GARAGE_SECRET_KEY}
|
|
GARAGE_DEFAULT_BUCKET: ${GARAGE_BUCKET:-siem-raw}
|
|
volumes:
|
|
- garage_meta:/var/lib/garage/meta
|
|
- garage_data:/var/lib/garage/data
|
|
- ./deploy/garage/garage.toml:/etc/garage.toml:ro
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:${GARAGE_S3_PORT:-3900}:3900"
|
|
- "127.0.0.1:${GARAGE_ADMIN_PORT:-3903}:3903"
|
|
|
|
ingress:
|
|
image: greenfield-siem-app:local
|
|
build: .
|
|
command: ["ingress"]
|
|
environment: &app-env
|
|
SERVICE_ADDR: :8080
|
|
POSTGRES_URL: postgres://siem:${POSTGRES_PASSWORD}@postgres:5432/siem?sslmode=disable
|
|
CLICKHOUSE_URL: http://clickhouse:8123
|
|
CLICKHOUSE_USER: siem
|
|
CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD}
|
|
KAFKA_BROKERS: redpanda:9092
|
|
KAFKA_TOPIC: siem-events
|
|
TENANT_ID: ${TENANT_ID:-default}
|
|
UI_USERNAME: ${UI_USERNAME:-admin}
|
|
UI_PASSWORD: ${UI_PASSWORD}
|
|
ENROLLMENT_KEY: ${ENROLLMENT_KEY}
|
|
RAW_ARCHIVE_ENABLED: ${RAW_ARCHIVE_ENABLED:-true}
|
|
RAW_SPOOL_DIR: /var/spool/siem-raw
|
|
RAW_RETENTION: ${RAW_RETENTION:-720h}
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redpanda-init:
|
|
condition: service_completed_successfully
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${INGRESS_BIND:-0.0.0.0}:${INGRESS_PORT:-8090}:8080"
|
|
|
|
processor:
|
|
image: greenfield-siem-app:local
|
|
command: ["processor"]
|
|
user: "0:0"
|
|
environment:
|
|
<<: *app-env
|
|
KAFKA_GROUP: siem-processor-v1
|
|
volumes:
|
|
- raw_spool:/var/spool/siem-raw
|
|
depends_on:
|
|
clickhouse:
|
|
condition: service_healthy
|
|
redpanda-init:
|
|
condition: service_completed_successfully
|
|
restart: unless-stopped
|
|
|
|
detector:
|
|
image: greenfield-siem-app:local
|
|
command: ["detector"]
|
|
environment:
|
|
<<: *app-env
|
|
DETECTOR_INTERVAL: ${DETECTOR_INTERVAL:-30s}
|
|
DETECTOR_LOOKBACK: ${DETECTOR_LOOKBACK:-20m}
|
|
depends_on:
|
|
clickhouse:
|
|
condition: service_healthy
|
|
postgres:
|
|
condition: service_healthy
|
|
processor:
|
|
condition: service_started
|
|
restart: unless-stopped
|
|
|
|
api:
|
|
image: greenfield-siem-app:local
|
|
command: ["api"]
|
|
environment:
|
|
<<: *app-env
|
|
UI_QUERY_LIMIT: ${UI_QUERY_LIMIT:-500}
|
|
depends_on:
|
|
clickhouse:
|
|
condition: service_healthy
|
|
postgres:
|
|
condition: service_healthy
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${UI_BIND:-0.0.0.0}:${UI_PORT:-8080}:8080"
|
|
|
|
archive-uploader:
|
|
image: rclone/rclone:1.74.4
|
|
entrypoint: ["/bin/sh", "-ec"]
|
|
command: |
|
|
while true; do
|
|
rclone move /spool garage:${GARAGE_BUCKET:-siem-raw} --exclude '*.tmp' --create-empty-src-dirs --transfers 8 --checkers 8 --retries 5 || true
|
|
rclone delete garage:${GARAGE_BUCKET:-siem-raw} --min-age ${RAW_RETENTION:-720h} --retries 5 || true
|
|
sleep 30
|
|
done
|
|
environment:
|
|
RCLONE_CONFIG_GARAGE_TYPE: s3
|
|
RCLONE_CONFIG_GARAGE_PROVIDER: Other
|
|
RCLONE_CONFIG_GARAGE_ACCESS_KEY_ID: ${GARAGE_ACCESS_KEY}
|
|
RCLONE_CONFIG_GARAGE_SECRET_ACCESS_KEY: ${GARAGE_SECRET_KEY}
|
|
RCLONE_CONFIG_GARAGE_ENDPOINT: http://garage:3900
|
|
RCLONE_CONFIG_GARAGE_REGION: garage
|
|
RCLONE_CONFIG_GARAGE_FORCE_PATH_STYLE: "true"
|
|
volumes:
|
|
- raw_spool:/spool
|
|
depends_on:
|
|
- garage
|
|
- processor
|
|
restart: unless-stopped
|
|
|
|
prometheus:
|
|
image: prom/prometheus:v3.13.1
|
|
command: ["--config.file=/etc/prometheus/prometheus.yml", "--storage.tsdb.retention.time=30d"]
|
|
volumes:
|
|
- ./deploy/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
|
|
- prometheus_data:/prometheus
|
|
depends_on:
|
|
- ingress
|
|
- redpanda
|
|
restart: unless-stopped
|
|
ports:
|
|
- "127.0.0.1:${PROMETHEUS_PORT:-9090}:9090"
|
|
|
|
volumes:
|
|
postgres_data:
|
|
clickhouse_data:
|
|
clickhouse_logs:
|
|
redpanda_data:
|
|
garage_meta:
|
|
garage_data:
|
|
raw_spool:
|
|
prometheus_data:
|