siem-backend/compose.yml

services:
  mariadb:
    image: mariadb:11.8
    container_name: siem-mariadb
    restart: unless-stopped
    env_file:
      - .env
    environment:
      MARIADB_DATABASE: ${MARIADB_DATABASE}
      MARIADB_USER: ${MARIADB_USER}
      MARIADB_PASSWORD: ${MARIADB_PASSWORD}
      MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD}
      TZ: ${TZ}
    command:
      - --character-set-server=utf8mb4
      - --collation-server=utf8mb4_unicode_ci
      - --innodb-buffer-pool-size=512M
      - --max-connections=300
    volumes:
      - mariadb_data:/var/lib/mysql
      - ./deploy/mariadb/init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD-SHELL", "mariadb-admin ping -h 127.0.0.1 -u root -p$$MARIADB_ROOT_PASSWORD --silent"]
      interval: 20s
      timeout: 5s
      retries: 10
      start_period: 30s

  siem-backend:
    image: git.send.nrw/sendnrw/siem-backend:latest
    container_name: siem-backend
    restart: unless-stopped
    env_file:
      - .env
    environment:
      LISTEN_ADDR: ${LISTEN_ADDR}
      DB_DSN: ${DB_DSN}
      DB_MAX_OPEN_CONNS: ${DB_MAX_OPEN_CONNS}
      DB_MAX_IDLE_CONNS: ${DB_MAX_IDLE_CONNS}
      DB_CONN_MAX_LIFETIME: ${DB_CONN_MAX_LIFETIME}
      DB_CONN_MAX_IDLE_TIME: ${DB_CONN_MAX_IDLE_TIME}
      MAX_BODY_BYTES: ${MAX_BODY_BYTES}
      HTTP_READ_TIMEOUT: ${HTTP_READ_TIMEOUT}
      HTTP_WRITE_TIMEOUT: ${HTTP_WRITE_TIMEOUT}
      HTTP_IDLE_TIMEOUT: ${HTTP_IDLE_TIMEOUT}
      DETECTION_INTERVAL: ${DETECTION_INTERVAL}
      OFFLINE_AFTER: ${OFFLINE_AFTER}
      FAILED_LOGON_WINDOW: ${FAILED_LOGON_WINDOW}
      FAILED_LOGON_THRESHOLD: ${FAILED_LOGON_THRESHOLD}
      REBOOT_WINDOW: ${REBOOT_WINDOW}
      REBOOT_THRESHOLD: ${REBOOT_THRESHOLD}
      PASSWORD_SPRAY_WINDOW: ${PASSWORD_SPRAY_WINDOW}
      PASSWORD_SPRAY_MIN_USERS: ${PASSWORD_SPRAY_MIN_USERS}
      PASSWORD_SPRAY_MIN_ATTEMPTS: ${PASSWORD_SPRAY_MIN_ATTEMPTS}
      SUCCESS_AFTER_FAILURE_WINDOW: ${SUCCESS_AFTER_FAILURE_WINDOW}
      NEW_SOURCE_IP_LOOKBACK: ${NEW_SOURCE_IP_LOOKBACK}
      NEW_SOURCE_IP_WINDOW: ${NEW_SOURCE_IP_WINDOW}
      DETECTIONS_LIMIT: ${DETECTIONS_LIMIT}
      TZ: ${TZ}
    depends_on:
      mariadb:
        condition: service_healthy
    ports:
      - "8090:8080"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8080/healthz >/dev/null 2>&1 || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

  prometheus:
    image: prom/prometheus:latest
    container_name: siem-prometheus
    restart: unless-stopped
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.path=/prometheus
      - --storage.tsdb.retention.time=30d
      - --web.enable-lifecycle
    depends_on:
      siem-backend:
        condition: service_healthy
    volumes:
      - ./deploy/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./deploy/prometheus/rules:/etc/prometheus/rules:ro
      - prometheus_data:/prometheus
    ports:
      - "9090:9090"

  grafana:
    image: grafana/grafana:latest
    container_name: siem-grafana
    restart: unless-stopped
    env_file:
      - .env
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD}
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_SERVER_ROOT_URL: http://localhost:3000
      TZ: ${TZ}
    depends_on:
      - prometheus
    volumes:
      - grafana_data:/var/lib/grafana
      - ./deploy/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./deploy/grafana/dashboards:/var/lib/grafana/dashboards:ro
    ports:
      - "3000:3000"

volumes:
  mariadb_data:
  prometheus_data:
  grafana_data: