docker-compose.yml

services:
  # ── Reverse proxy (core redirector) ─────────────────────────────────
  proxy:
    build: .
    container_name: infraguard-proxy
    restart: unless-stopped
    env_file: .env
    ports:
      - "443:443"
      - "80:80"
    volumes:
      - ./config:/app/config:ro
      - ./examples:/app/examples:ro
      - ./rules:/app/rules:ro
      - ./pages:/app/pages:ro
      - ./data:/app/data
      - certs:/app/certs:ro
      - geoip:/app/geoip:ro
    command: ["run", "-c", "/app/config/config.yaml", "--port", "443"]
    healthcheck:
      test: ["CMD", "python3", "-c", "import urllib.request,ssl,os; p=os.environ.get('INFRAGUARD_HEALTH_PATH','health'); urllib.request.urlopen(f'https://127.0.0.1:443/{p}', context=ssl._create_unverified_context())"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 15s
    networks:
      - infraguard

  # ── Web dashboard ───────────────────────────────────────────────────
  dashboard:
    build: .
    container_name: infraguard-dashboard
    restart: unless-stopped
    env_file: .env
    ports:
      - "8080:8080"
    volumes:
      - ./config:/app/config:ro
      - ./examples:/app/examples:ro
      - ./data:/app/data
      - certs:/app/certs:ro
      - geoip:/app/geoip:ro
    command: ["dashboard", "-c", "/app/config/config.yaml", "--tls"]
    depends_on:
      proxy:
        condition: service_healthy
    networks:
      - infraguard

  # ── Let's Encrypt (optional) ────────────────────────────────────────
  # Automatically obtains and renews TLS certificates via certbot.
  # Enable by setting INFRAGUARD_LETSENCRYPT=true in .env.
  #
  # Requirements:
  #   - Port 80 must be reachable from the internet
  #   - INFRAGUARD_DOMAIN must resolve to this host
  #   - INFRAGUARD_DOMAIN_EMAIL must be a valid email
  #
  # Certs are written to the shared "certs" volume at:
  #   /etc/letsencrypt/live/${INFRAGUARD_DOMAIN}/fullchain.pem
  #   /etc/letsencrypt/live/${INFRAGUARD_DOMAIN}/privkey.pem
  #
  # After first run, restart the proxy to pick up the new certs.
  # docker compose --profile letsencrypt up certbot
  certbot:
    image: certbot/certbot:latest
    container_name: infraguard-certbot
    profiles: ["letsencrypt"]
    env_file: .env
    volumes:
      - certs:/etc/letsencrypt
      - certbot-www:/var/www/certbot
    entrypoint: /bin/sh
    command:
      - -c
      - |
        if [ "$${INFRAGUARD_LETSENCRYPT}" = "true" ]; then
          certbot certonly --standalone \
            --non-interactive --agree-tos \
            --email $${INFRAGUARD_DOMAIN_EMAIL} \
            -d $${INFRAGUARD_DOMAIN} \
            --preferred-challenges http \
          && echo "Certificate obtained for $${INFRAGUARD_DOMAIN}"
        else
          echo "Let's Encrypt disabled (INFRAGUARD_LETSENCRYPT != true)"
        fi
    ports:
      - "80:80"
    networks:
      - infraguard

  # Renewal runs on a schedule (every 12 hours)
  certbot-renew:
    image: certbot/certbot:latest
    container_name: infraguard-certbot-renew
    profiles: ["letsencrypt"]
    env_file: .env
    volumes:
      - certs:/etc/letsencrypt
      - certbot-www:/var/www/certbot
    entrypoint: /bin/sh
    command: -c 'trap exit TERM; while :; do certbot renew --quiet; sleep 43200; done'
    depends_on:
      certbot:
        condition: service_completed_successfully
    networks:
      - infraguard

  # ── GeoIP database downloader ────────────────────────────────────────
  # Downloads GeoLite2 databases from GitHub on first run.
  # Run with: docker compose up geoip-update
  # Databases are stored in the "geoip" volume at /geoip/*.mmdb
  geoip-update:
    image: alpine/curl:latest
    container_name: infraguard-geoip-update
    profiles: ["geoip"]
    volumes:
      - geoip:/geoip
    entrypoint: /bin/sh
    command:
      - -c
      - |
        echo "Downloading GeoLite2 databases..."
        curl -sSL -o /geoip/GeoLite2-City.mmdb https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-City.mmdb && echo "  City DB downloaded"
        curl -sSL -o /geoip/GeoLite2-ASN.mmdb https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-ASN.mmdb && echo "  ASN DB downloaded"
        curl -sSL -o /geoip/GeoLite2-Country.mmdb https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-Country.mmdb && echo "  Country DB downloaded"
        ls -lh /geoip/*.mmdb
        echo "Done."

  # ── Additional redirector node (scale with --scale proxy-node=N) ────
  # Uncomment to run extra redirector instances behind a load balancer.
  #
  # proxy-node:
  #   build: .
  #   restart: unless-stopped
  #   env_file: .env
  #   ports:
  #     - "443"
  #   volumes:
  #     - ./config:/app/config:ro
  #     - ./examples:/app/examples:ro
  #     - ./data:/app/data
  #     - certs:/app/certs:ro
  #   command: ["run", "-c", "/app/config/config.yaml"]
  #   networks:
  #     - infraguard
  #   deploy:
  #     replicas: 2

  # ── Command Post (multi-instance aggregator) ─────────────────────────
  # Aggregates stats, requests, and live events from multiple InfraGuard
  # instances into a single dashboard.
  # Enable with: docker compose --profile command-post up -d command-post
  # Access at: http://localhost:9090
  command-post:
    build: .
    container_name: infraguard-command-post
    profiles: ["command-post"]
    restart: unless-stopped
    env_file: .env
    ports:
      - "9090:9090"
    volumes:
      - ./config:/app/config:ro
      - certs:/app/certs:ro
    command: ["command-post", "-c", "/app/config/command-post.yaml", "--port", "9090"]
    networks:
      - infraguard

  # ── PwnDrop payload delivery (optional) ──────────────────────────────
  # Self-hosted file hosting for serving payloads via content routes.
  # Enable with: docker compose --profile pwndrop up -d pwndrop
  # Access PwnDrop UI at https://localhost:8443
  # InfraGuard reaches it internally at http://pwndrop:80
  pwndrop:
    build:
      context: ./vendor/pwndrop
      dockerfile: Dockerfile
    container_name: infraguard-pwndrop
    profiles: ["pwndrop"]
    restart: unless-stopped
    env_file: .env
    ports:
      - "8443:443"
    volumes:
      - pwndrop-data:/pwndrop/data
      - certs:/pwndrop/certs:ro
      - ./config/pwndrop.ini:/pwndrop/pwndrop.ini
    networks:
      - infraguard

volumes:
  certs:
  certbot-www:
  geoip:
  pwndrop-data:

networks:
  infraguard:
    driver: bridge