reverse-proxy/compose.yml at main · AFGES/reverse-proxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
name: pangolin
services:
  pangolin:
    image: docker.io/fosrl/pangolin:ee-postgresql-1.16
    container_name: pangolin
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    env_file:
      - env/pangolin.env
      - env/postgres.env
    deploy:
      resources:
        limits:
          memory: 1g
        reservations:
          memory: 256m
    volumes:
      - ./config:/app/config:z
      - traefik_logs:/app/config/logs:z
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
      interval: "10s"
      timeout: "10s"
      retries: 15

  gerbil:
    image: docker.io/fosrl/gerbil:1.3.0
    container_name: gerbil
    restart: unless-stopped
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --reachableAt=http://gerbil:3004
      - --generateAndSaveKeyTo=/var/config/key
      - --remoteConfig=http://pangolin:3001/api/v1/
    volumes:
      - ./config/:/var/config:z
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    ports:
      - 51820:51820/udp
      - 21820:21820/udp
      - 443:443
      - 80:80

  traefik:
    image: docker.io/traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    network_mode: service:gerbil # Ports appear on the gerbil service
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    env_file:
      - env/traefik.env
    volumes:
      - ./config/traefik:/etc/traefik:z,ro # Volume to store the Traefik configuration
      - traefik_letsencrypt:/letsencrypt:Z # Volume to store the Let's Encrypt certificates
      - traefik_logs:/var/log/traefik:z # Volume to store Traefik logs

  postgres:
    image: docker.io/library/postgres:18
    container_name: postgres
    restart: unless-stopped
    env_file:
      - env/postgres.env
    volumes:
      - postgres_data:/var/lib/postgresql:Z
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  crowdsec:
    image: docker.io/crowdsecurity/crowdsec:latest
    container_name: crowdsec
    restart: unless-stopped
    environment:
      COLLECTIONS: "crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules"
    volumes:
      - ./config/crowdsec:/etc/crowdsec:z
      - crowdsec_db:/var/lib/crowdsec/data:z
      - traefik_logs:/var/log/traefik:z,ro
    ports:
      - 8080:8080 # Local API port for bouncer communication

volumes:
  traefik_letsencrypt:
  traefik_logs:
  postgres_data:
  crowdsec_db:

networks:
  default:
    driver: bridge
    name: pangolin