docker-compose.yml

services:
  sentinel-kit-app-frontend:
    container_name: sentinel-kit-app-frontend
    hostname: ${SENTINELKIT_FRONTEND_HOSTNAME}
    build:
      context: .
      dockerfile: config/docker-config/Dockerfile.frontend
    working_dir: /app
    environment:
      - APP_ENV=${APP_ENV}
      - VITE_ALLOWED_HOSTS=${SENTINELKIT_FRONTEND_HOSTNAME},${SENTINELKIT_BACKEND_HOSTNAME},${SENTINELKIT_KIBANA_HOSTNAME},${SENTINELKIT_GRAFANA_HOSTNAME}
      - VITE_API_BASE_URL=https://${SENTINELKIT_BACKEND_HOSTNAME}/api
      - VITE_BACKEND_URL=https://${SENTINELKIT_BACKEND_HOSTNAME}
      - VITE_KIBANA_URL=https://${SENTINELKIT_KIBANA_HOSTNAME}
      - VITE_GRAFANA_URL=https://${SENTINELKIT_GRAFANA_HOSTNAME}
    volumes:
      - ./sentinel-kit_server_frontend:/app
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    stdin_open: true
    tty: true
    restart: on-failure
    networks:
      - sentinel-kit-network
    depends_on:
      sentinel-kit-app-backend:
        condition: service_healthy

  sentinel-kit-app-backend:
    container_name: sentinel-kit-app-backend
    hostname: ${SENTINELKIT_BACKEND_HOSTNAME}
    build:
      context: .
      dockerfile: config/docker-config/Dockerfile.backend
    restart: on-failure
    working_dir: /var/www/html
    entrypoint: /usr/local/bin/backend-entrypoint.sh
    environment:
      - APP_ENV=${APP_ENV}
      - JWT_PASSPHRASE=${BACKEND_JWT_PASSPHRASE}
      - DATABASE_URL=mysql://${MYSQL_USER}:${MYSQL_PASSWORD}@sentinel-kit-db-mysql:3306/${MYSQL_DATABASE}?serverVersion=9.4.0&charset=utf8
      - DEFAULT_URI=https://${SENTINELKIT_BACKEND_HOSTNAME}
      - DATAMONITOR_SERVER_TOKEN=${SENTINELKIT_DATAMONITOR_SERVER_TOKEN}
      - CORS_ALLOW_ORIGIN=https://${SENTINELKIT_FRONTEND_HOSTNAME}
      - FLUENTBIT_SERVER_URL=http://sentinel-kit-server-fluentbit:24224
      - ELASTICSEARCH_HOST=sentinel-kit-db-elasticsearch-es01:9200
      - ELASTICSEARCH_USERNAME=elastic
      - ELASTICSEARCH_SSL=true
      - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD}
    volumes:
      - ./config/docker-config/backend-entrypoint.sh:/usr/local/bin/backend-entrypoint.sh:ro
      - ./sentinel-kit_server_backend:/var/www/html:delegated
      - ./sentinel-kit_server_backend/public:/var/www/html/public:delegated
      - ./data/rulesets/sigma_ruleset:/detection-rules/sigma
      - ./config/elastalert_ruleset:/detection-rules/elastalert
      - sentinel-kit_certificates_jwt:/var/www/html/config/jwt
      - sentinel-kit_server_backend_vendor_cache:/var/www/html/vendor
      - sentinel-kit_server_backend_var_cache:/var/www/html/var
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s
    stdin_open: true
    tty: true
    networks:
      - sentinel-kit-network
    depends_on:
      sentinel-kit-db-mysql:
        condition: service_healthy
      sentinel-kit-db-elasticsearch-es01:
        condition: service_healthy

  sentinel-kit-server-rules-scanner:
    container_name: sentinel-kit-server-rules-scanner
    hostname: sentinel-kit-server-rules-scanner
    build:
      context: .
      dockerfile: config/docker-config/Dockerfile.scanner
    restart: on-failure
    user: "0"
    depends_on:
      sentinel-kit-db-mysql:
        condition: service_healthy
      sentinel-kit-db-elasticsearch-es01:
        condition: service_healthy
    environment:
      - ES_PASSWORD=${ELASTICSEARCH_PASSWORD}
      - MYSQL_USER=${MYSQL_USER}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
      - MYSQL_DATABASE=${MYSQL_DATABASE}
      - ELASTALERT_MODE=daemon
    volumes:
      - ./data/rulesets/sigma_ruleset:/app/sigma_ruleset:ro
      - ./config/elastalert/defaults.yml:/app/defaults.yml:ro
      - ./config/elastalert/elastalert_config.yml:/app/elastalert_config.yml:ro
      - ./config/elastalert_ruleset:/app/elastalert_ruleset
      - sentinel-kit_certificates_elasticsearch:/app/certs:ro
    healthcheck:
      test: ["CMD", "sh", "-c", "pgrep -f 'python|elastalert' > /dev/null || exit 1"]
      interval: 60s
      timeout: 10s
      retries: 3
      start_period: 120s
    stdin_open: true
    tty: true
    networks:
      - sentinel-kit-network

  sentinel-kit-server-fluentbit:
    container_name: sentinel-kit-server-fluentbit
    hostname: sentinel-kit-server-fluentbit
    build:
      context: .
      dockerfile: config/docker-config/Dockerfile.fluentbit
    restart: on-failure
    depends_on:
      sentinel-kit-db-elasticsearch-es01:
        condition: service_healthy
    user: "0"
    environment:
      - ELASTIC_PASSWORD=${ELASTICSEARCH_PASSWORD}
    stdin_open: true
    tty: true
    volumes:
      - ./config/fluentbit_server:/fluent-bit/etc
      - ./data/log_ingest_data:/fluent-bit/logs
      - ./data/fluentbit_db:/fluent-bit/database
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:2020/api/v1/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    networks:
      - sentinel-kit-network

  sentinel-kit-server-sftp:
    container_name: sentinel-kit-server-sftp
    hostname: sentinel-kit-server-sftp
    image: atmoz/sftp
    restart: on-failure
    command: ${SFTP_USER}:${SFTP_PASSWORD}:1001
    ports:
      - "2222:22"
    volumes:
      - ./data/ftp_data:/home/${SFTP_USER}/uploads
    networks:
      - sentinel-kit-network
    working_dir: /home/${SFTP_USER}/uploads
    profiles: ["sftp"]

  sentinel-kit-db-mysql:
    container_name: sentinel-kit-db-mysql
    hostname: sentinel-kit-db-mysql
    image: mysql:9.4.0
    restart: on-failure
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      MYSQL_USER: ${MYSQL_USER}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
      MYSQL_EXPORTER_PASSWORD: ${MYSQL_EXPORTER_PASSWORD}
    volumes:
      - sentinel-kit_db_mysql_data:/var/lib/mysql
      - ./config/mysql/init_mysqld_exporter.sh:/docker-entrypoint-initdb.d/init_mysqld_exporter.sh:ro
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${MYSQL_ROOT_PASSWORD}"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 80s
    networks:
      - sentinel-kit-network


  sentinel-kit-utils-phpmyadmin:
    container_name: sentinel-kit-utils-phpmyadmin
    hostname: ${SENTINELKIT_PMA_HOSTNAME}
    image: phpmyadmin/phpmyadmin
    restart: on-failure
    environment:
      PMA_HOST: sentinel-kit-db-mysql
      PMA_PORT: 3306
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:80"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    networks:
      - sentinel-kit-network
    depends_on:
      - sentinel-kit-db-mysql
    profiles: ["phpmyadmin"]

  sentinel-kit-server-caddy:
    image: caddy:2.10.2-alpine
    container_name: sentinel-kit-server-caddy
    restart: on-failure
    environment:
      - SENTINELKIT_FRONTEND_HOSTNAME=${SENTINELKIT_FRONTEND_HOSTNAME}
      - SENTINELKIT_BACKEND_HOSTNAME=${SENTINELKIT_BACKEND_HOSTNAME}
      - SENTINELKIT_PMA_HOSTNAME=${SENTINELKIT_PMA_HOSTNAME}
      - SENTINELKIT_KIBANA_HOSTNAME=${SENTINELKIT_KIBANA_HOSTNAME}
      - SENTINELKIT_GRAFANA_HOSTNAME=${SENTINELKIT_GRAFANA_HOSTNAME}
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./config/caddy_server/Caddyfile:/etc/caddy/Caddyfile
      - ./data/caddy_logs:/var/log/caddy
      - ./config/caddy_server/certificates:/data/caddy/pki/authorities/local
      - sentinel-kit_server_caddy_data:/data
      - sentinel-kit_server_caddy_config:/config
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:2020/metrics"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    networks:
      - sentinel-kit-network

  sentinel-kit-conf-elasticsearch-setup:
    image: docker.elastic.co/elasticsearch/elasticsearch:${ELASTICSTACK_VERSION}
    container_name: sentinel-kit-conf-elasticsearch-setup
    restart: on-failure
    volumes:
      -  sentinel-kit_certificates_elasticsearch:/usr/share/elasticsearch/config/certs
      - ./config/elasticsearch/es-setup.sh:/usr/share/elasticsearch/es-setup.sh:ro
    user: "0"
    command: 'sh -c "/usr/share/elasticsearch/es-setup.sh"'
    environment:
      - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD}
      - ELASTICSEARCH_CLUSTER_MODE=${ELASTICSEARCH_CLUSTER_MODE}
    healthcheck:
      test: ["CMD-SHELL", "[ -f /usr/share/elasticsearch/config/certs/es01/es01.crt ]"]
      interval: 1s
      timeout: 5s
      retries: 120
    networks:
      - sentinel-kit-network

  sentinel-kit-db-elasticsearch-es01:
    depends_on:
      - sentinel-kit-conf-elasticsearch-setup
    image: docker.elastic.co/elasticsearch/elasticsearch:${ELASTICSTACK_VERSION}
    container_name: sentinel-kit-db-elasticsearch-es01
    restart: on-failure
    volumes:
      - sentinel-kit_certificates_elasticsearch:/usr/share/elasticsearch/config/certs
      - sentinel-kit_db_elasticsearch_es01_data:/usr/share/elasticsearch/data
    environment:
      - node.name=sentinel-kit-db-elasticsearch-es01
      - cluster.name=${ELASTICSEARCH_CLUSTER_NAME}
      - cluster.initial_master_nodes=sentinel-kit-db-elasticsearch-es01
      - ELASTIC_PASSWORD=${ELASTICSEARCH_PASSWORD}
      - bootstrap.memory_lock=true
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=certs/sentinel-kit-db-elasticsearch-es01/sentinel-kit-db-elasticsearch-es01.key
      - xpack.security.http.ssl.certificate=certs/sentinel-kit-db-elasticsearch-es01/sentinel-kit-db-elasticsearch-es01.crt
      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.key=certs/sentinel-kit-db-elasticsearch-es01/sentinel-kit-db-elasticsearch-es01.key
      - xpack.security.transport.ssl.certificate=certs/sentinel-kit-db-elasticsearch-es01/sentinel-kit-db-elasticsearch-es01.crt
      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.license.self_generated.type=${ELASTICSEARCH_LICENSE}
      - xpack.ml.use_auto_machine_memory_percent=true
    mem_limit: ${ELASTICSEARCH_MEMORY_LIMIT}
    ulimits:
      memlock:
        soft: -1
        hard: -1
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
        ]
      interval: 10s
      timeout: 10s
      retries: 120
    networks:
      - sentinel-kit-network

  sentinel-kit-db-elasticsearch-es02:
    depends_on:
      - sentinel-kit-db-elasticsearch-es01
      - sentinel-kit-conf-elasticsearch-setup
    image: docker.elastic.co/elasticsearch/elasticsearch:${ELASTICSTACK_VERSION}
    container_name: sentinel-kit-db-elasticsearch-es02
    restart: on-failure
    volumes:
      -  sentinel-kit_certificates_elasticsearch:/usr/share/elasticsearch/config/certs
      - sentinel-kit_db_elasticsearch_es02_data:/usr/share/elasticsearch/data
    environment:
      - node.name=sentinel-kit-db-elasticsearch-es02
      - cluster.name=${ELASTICSEARCH_CLUSTER_NAME}
      - cluster.initial_master_nodes=sentinel-kit-db-elasticsearch-es01
      - discovery.seed_hosts=sentinel-kit-db-elasticsearch-es01
      - ELASTIC_PASSWORD=${ELASTICSEARCH_PASSWORD}
      - bootstrap.memory_lock=true
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=certs/sentinel-kit-db-elasticsearch-es02/sentinel-kit-db-elasticsearch-es02.key
      - xpack.security.http.ssl.certificate=certs/sentinel-kit-db-elasticsearch-es02/sentinel-kit-db-elasticsearch-es02.crt
      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.key=certs/sentinel-kit-db-elasticsearch-es02/sentinel-kit-db-elasticsearch-es02.key
      - xpack.security.transport.ssl.certificate=certs/sentinel-kit-db-elasticsearch-es02/sentinel-kit-db-elasticsearch-es02.crt
      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.license.self_generated.type=${ELASTICSEARCH_LICENSE}
      - xpack.ml.use_auto_machine_memory_percent=true
    mem_limit: ${ELASTICSEARCH_MEMORY_LIMIT}
    ulimits:
      memlock:
        soft: -1
        hard: -1
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'",
        ]
      interval: 10s
      timeout: 10s
      retries: 120
    networks:
      - sentinel-kit-network
    profiles: ["es-secondary-node"]

  sentinel-kit-utils-kibana:
    container_name: sentinel-kit-utils-kibana
    hostname: ${SENTINELKIT_KIBANA_HOSTNAME}
    restart: on-failure
    depends_on:
      sentinel-kit-db-elasticsearch-es01:
        condition: service_healthy
    image: docker.elastic.co/kibana/kibana:${ELASTICSTACK_VERSION}
    volumes:
      -  sentinel-kit_certificates_elasticsearch:/usr/share/kibana/config/certs/elasticsearch:ro
      - ./data/kibana:/usr/share/kibana/data
    environment:
      - SERVERNAME=sentinel-kit-utils-kibana
      - KIBANA_FLEET_PACKAGE_UPDATE_ENABLED=false
      - ELASTICSEARCH_HOSTS=https://sentinel-kit-db-elasticsearch-es01:9200
      - ELASTICSEARCH_USERNAME=kibana_system
      - ELASTICSEARCH_PASSWORD=s3nt1n3lkit_k1b4n4_syst3m_p4sswd
      - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/elasticsearch/ca/ca.crt
    mem_limit: ${ELASTICSEARCH_MEMORY_LIMIT}
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -s -I http://localhost:5601 | grep -q 'HTTP/1.1 302 Found'",
        ]
      interval: 10s
      timeout: 10s
      retries: 120
    networks:
      - sentinel-kit-network
    profiles: ["kibana"]

  sentinel-kit-utils-prometheus:
    container_name: sentinel-kit-utils-prometheus
    image: prom/prometheus:latest
    restart: on-failure
    volumes:
      - ./config/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:9090/-/healthy"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    networks:
      - sentinel-kit-network
    profiles: ["internal-monitoring"]

  sentinel-kit-utils-grafana:
    container_name: sentinel-kit-utils-grafana
    hostname: ${SENTINELKIT_GRAFANA_HOSTNAME}
    image: grafana/grafana:latest
    restart: on-failure
    user: "0"
    volumes:
      -  sentinel-kit_certificates_elasticsearch:/etc/grafana/certs/elasticsearch:ro
      - ./data/grafana:/var/lib/grafana
      - ./config/grafana/datasources:/etc/grafana/provisioning/datasources
      - ./config/grafana/dashboards:/etc/grafana/provisioning/dashboards
      - ./config/grafana/grafana.ini:/etc/grafana/grafana.ini
    environment:
      - SENTINELKIT_GRAFANA_HOSTNAME=${SENTINELKIT_GRAFANA_HOSTNAME}
      - GF_SECURITY_ADMIN_USER=${GF_SECURITY_ADMIN_USER}
      - GF_SECURITY_ADMIN_PASSWORD=${GF_SECURITY_ADMIN_PASSWORD}
      - GF_SERVER_HTTP_PORT=3000
      - GF_SECURITY_ALLOW_EMBEDDING=true
      - ES_PASSWORD=${ELASTICSEARCH_PASSWORD}
      - MYSQL_DATABASE=${MYSQL_DATABASE}
      - MYSQL_USER=${MYSQL_USER}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    networks:
      - sentinel-kit-network
    entrypoint: 
      - /bin/sh
      - -c
      - |
        cp /etc/grafana/certs/elasticsearch/ca/ca.crt /usr/local/share/ca-certificates/elasticsearch-ca.crt
        update-ca-certificates
        /run.sh
    profiles: ["internal-monitoring"]

  sentinel-kit-utils-elastic-exporter:
    hostname: sentinel-kit-utils-elastic-exporter
    container_name: sentinel-kit-utils-elastic-exporter
    image: prometheuscommunity/elasticsearch-exporter:latest
    restart: on-failure
    command:
      - '--es.uri=https://elastic:${ELASTICSEARCH_PASSWORD}@sentinel-kit-db-elasticsearch-es01:9200'
      - '--es.all'
      - '--es.timeout=10s'
      - '--es.ssl-skip-verify'
    volumes:
      - sentinel-kit_certificates_elasticsearch:/usr/share/exporter/ca:ro
    networks:
      - sentinel-kit-network
    depends_on:
      sentinel-kit-db-elasticsearch-es01:
        condition: service_healthy
    profiles: ["internal-monitoring"]

  sentinel-kit-utils-mysql-exporter:
    hostname: sentinel-kit-utils-mysql-exporter
    container_name: sentinel-kit-utils-mysql-exporter
    image: prom/mysqld-exporter:latest
    restart: on-failure
    environment:
      - MYSQLD_EXPORTER_PASSWORD=${MYSQL_EXPORTER_PASSWORD}
    volumes:
      - ./config/mysql/my.cnf:/etc/mysql/my.cnf:ro
    command:
      [ "--config.my-cnf=/etc/mysql/my.cnf" ]
    networks:
      - sentinel-kit-network
    depends_on:
      - sentinel-kit-db-mysql
    profiles: ["internal-monitoring"]

networks:
  sentinel-kit-network:
    driver: bridge

volumes:
  sentinel-kit_server_caddy_data:
  sentinel-kit_server_caddy_config:
  sentinel-kit_db_elasticsearch_es01_data:
  sentinel-kit_db_elasticsearch_es02_data:
  sentinel-kit_db_mysql_data:
  sentinel-kit_server_backend_vendor_cache:
  sentinel-kit_server_backend_var_cache:
  sentinel-kit_server_backend_public:
  sentinel-kit_certificates_elasticsearch:
  sentinel-kit_certificates_jwt: