Public Access
initial-commit
This commit is contained in:
Guillaume GRABÉ
@@ -0,0 +1,233 @@
|
||||
version: '3.8'
|
||||
|
||||
# Demo stack secrets — override via .env file or environment variables.
|
||||
# These are NOT production credentials. Generate your own before deploying.
|
||||
x-dd-secrets: &dd-secrets
|
||||
DD_SECRET_KEY: ${DD_SECRET_KEY:-CHANGE_ME_generate_a_random_secret_key}
|
||||
DD_CREDENTIAL_AES_256_KEY: ${DD_CREDENTIAL_AES_256_KEY:-CHANGE_ME_generate_a_base64_aes_key}
|
||||
|
||||
services:
|
||||
# PostgreSQL for Charybdis
|
||||
postgres-charybdis:
|
||||
image: postgres:15-alpine
|
||||
container_name: charybdis-postgres
|
||||
environment:
|
||||
POSTGRES_DB: charybdis
|
||||
POSTGRES_USER: charybdis
|
||||
POSTGRES_PASSWORD: ${CHARYBDIS_DB_PASSWORD:-charybdis}
|
||||
ports:
|
||||
- "5432:5432"
|
||||
volumes:
|
||||
- charybdis-postgres-data:/var/lib/postgresql/data
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U charybdis"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
networks:
|
||||
- charybdis-network
|
||||
|
||||
# PostgreSQL for DefectDojo
|
||||
postgres-defectdojo:
|
||||
image: postgres:15-alpine
|
||||
container_name: defectdojo-postgres
|
||||
environment:
|
||||
POSTGRES_DB: defectdojo
|
||||
POSTGRES_USER: defectdojo
|
||||
POSTGRES_PASSWORD: ${DD_DB_PASSWORD:-defectdojo}
|
||||
volumes:
|
||||
- defectdojo-postgres-data:/var/lib/postgresql/data
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U defectdojo"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
networks:
|
||||
- charybdis-network
|
||||
|
||||
# Redis for DefectDojo
|
||||
redis-defectdojo:
|
||||
image: redis:7-alpine
|
||||
container_name: defectdojo-redis
|
||||
networks:
|
||||
- charybdis-network
|
||||
|
||||
# DefectDojo
|
||||
defectdojo-uwsgi:
|
||||
image: defectdojo/defectdojo-django:2.38.1
|
||||
platform: linux/amd64 # Force x86_64 emulation for ARM64 (Mac Silicon)
|
||||
container_name: defectdojo-uwsgi
|
||||
depends_on:
|
||||
postgres-defectdojo:
|
||||
condition: service_healthy
|
||||
redis-defectdojo:
|
||||
condition: service_started
|
||||
environment:
|
||||
DD_DEBUG: 'True'
|
||||
DD_ALLOWED_HOSTS: '*'
|
||||
DD_DATABASE_URL: postgresql://defectdojo:${DD_DB_PASSWORD:-defectdojo}@postgres-defectdojo:5432/defectdojo
|
||||
DD_CELERY_BROKER_URL: redis://redis-defectdojo:6379/0
|
||||
<<: *dd-secrets
|
||||
DD_INITIALIZE: 'true'
|
||||
DD_ADMIN_USER: ${DD_ADMIN_USER:-admin}
|
||||
DD_ADMIN_PASSWORD: ${DD_ADMIN_PASSWORD:-admin}
|
||||
DD_ADMIN_MAIL: 'admin@example.com'
|
||||
ports:
|
||||
- "8080:8081" # DefectDojo HTTP endpoint is on 8081 inside container
|
||||
volumes:
|
||||
- defectdojo-media:/app/media
|
||||
networks:
|
||||
- charybdis-network
|
||||
# Healthcheck disabled - DefectDojo takes time to initialize
|
||||
# Access will be available after ~2 minutes
|
||||
# healthcheck:
|
||||
# test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8080/').read()"]
|
||||
# interval: 30s
|
||||
# timeout: 10s
|
||||
# retries: 5
|
||||
# start_period: 120s
|
||||
|
||||
# DefectDojo Celery Worker
|
||||
defectdojo-celery:
|
||||
image: defectdojo/defectdojo-django:2.38.1
|
||||
platform: linux/amd64 # Force x86_64 emulation for ARM64 (Mac Silicon)
|
||||
container_name: defectdojo-celery
|
||||
depends_on:
|
||||
- defectdojo-uwsgi
|
||||
- redis-defectdojo
|
||||
environment:
|
||||
DD_DATABASE_URL: postgresql://defectdojo:${DD_DB_PASSWORD:-defectdojo}@postgres-defectdojo:5432/defectdojo
|
||||
DD_CELERY_BROKER_URL: redis://redis-defectdojo:6379/0
|
||||
<<: *dd-secrets
|
||||
entrypoint: ['/entrypoint-celery-worker.sh']
|
||||
networks:
|
||||
- charybdis-network
|
||||
|
||||
# DefectDojo Celery Beat
|
||||
defectdojo-beat:
|
||||
image: defectdojo/defectdojo-django:2.38.1
|
||||
platform: linux/amd64 # Force x86_64 emulation for ARM64 (Mac Silicon)
|
||||
container_name: defectdojo-beat
|
||||
depends_on:
|
||||
- defectdojo-celery
|
||||
environment:
|
||||
DD_DATABASE_URL: postgresql://defectdojo:${DD_DB_PASSWORD:-defectdojo}@postgres-defectdojo:5432/defectdojo
|
||||
DD_CELERY_BROKER_URL: redis://redis-defectdojo:6379/0
|
||||
<<: *dd-secrets
|
||||
entrypoint: ['/entrypoint-celery-beat.sh']
|
||||
networks:
|
||||
- charybdis-network
|
||||
|
||||
# Keycloak (Identity Provider)
|
||||
keycloak:
|
||||
image: quay.io/keycloak/keycloak:24.0
|
||||
container_name: charybdis-keycloak
|
||||
command: start-dev --import-realm
|
||||
environment:
|
||||
KEYCLOAK_ADMIN: admin
|
||||
KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
|
||||
ports:
|
||||
- "8082:8080"
|
||||
volumes:
|
||||
- ./scripts/keycloak/charybdis-realm.json:/opt/keycloak/data/import/charybdis-realm.json:ro
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/8080 && echo -e 'GET /health/ready HTTP/1.1\r\nHost: localhost\r\n\r\n' >&3 && cat <&3 | grep -q '200'"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 15
|
||||
start_period: 30s
|
||||
networks:
|
||||
- charybdis-network
|
||||
|
||||
# Charybdis
|
||||
charybdis:
|
||||
build:
|
||||
context: ..
|
||||
dockerfile: Dockerfile
|
||||
container_name: charybdis
|
||||
depends_on:
|
||||
postgres-charybdis:
|
||||
condition: service_healthy
|
||||
keycloak:
|
||||
condition: service_healthy
|
||||
defectdojo-uwsgi:
|
||||
condition: service_started # Changed from service_healthy since healthcheck is disabled
|
||||
environment:
|
||||
DATABASE_URL: postgresql://charybdis:${CHARYBDIS_DB_PASSWORD:-charybdis}@postgres-charybdis:5432/charybdis
|
||||
RUST_LOG: info
|
||||
DEFECTDOJO_API_URL: http://defectdojo-uwsgi:8081
|
||||
DEFECTDOJO_API_TOKEN: ${DEFECTDOJO_API_TOKEN:-changeme}
|
||||
ports:
|
||||
- "50051:50051" # gRPC
|
||||
- "8081:8080" # YAML adapter
|
||||
volumes:
|
||||
- ./config.toml:/app/config.toml:ro
|
||||
networks:
|
||||
- charybdis-network
|
||||
restart: unless-stopped
|
||||
|
||||
# Backstage (commented out - requires custom build)
|
||||
# To enable Backstage:
|
||||
# 1. Follow https://backstage.io/docs/getting-started/create-an-app
|
||||
# 2. Build Docker image: cd backstage-app && yarn install && yarn build
|
||||
# 3. Uncomment this section and postgres-backstage below
|
||||
|
||||
# backstage:
|
||||
# build:
|
||||
# context: ./backstage-app
|
||||
# dockerfile: Dockerfile
|
||||
# container_name: backstage
|
||||
# depends_on:
|
||||
# - charybdis
|
||||
# - postgres-backstage
|
||||
# environment:
|
||||
# POSTGRES_HOST: postgres-backstage
|
||||
# POSTGRES_PORT: 5432
|
||||
# POSTGRES_USER: backstage
|
||||
# POSTGRES_PASSWORD: backstage
|
||||
# CHARYBDIS_URL: http://charybdis:8080
|
||||
# ports:
|
||||
# - "3000:3000"
|
||||
# - "7007:7007"
|
||||
# volumes:
|
||||
# - ./backstage/app-config.yaml:/app/app-config.yaml:ro
|
||||
# networks:
|
||||
# - charybdis-network
|
||||
# restart: unless-stopped
|
||||
|
||||
# postgres-backstage:
|
||||
# image: postgres:15-alpine
|
||||
# container_name: backstage-postgres
|
||||
# environment:
|
||||
# POSTGRES_DB: backstage
|
||||
# POSTGRES_USER: backstage
|
||||
# POSTGRES_PASSWORD: backstage
|
||||
# volumes:
|
||||
# - backstage-postgres-data:/var/lib/postgresql/data
|
||||
# healthcheck:
|
||||
# test: ["CMD-SHELL", "pg_isready -U backstage"]
|
||||
# interval: 10s
|
||||
# timeout: 5s
|
||||
# retries: 5
|
||||
# networks:
|
||||
# - charybdis-network
|
||||
|
||||
# Helper: grpcurl for testing
|
||||
grpcurl:
|
||||
image: fullstorydev/grpcurl:latest
|
||||
container_name: charybdis-grpcurl
|
||||
network_mode: service:charybdis
|
||||
entrypoint: ["/bin/sh"]
|
||||
command: ["-c", "sleep infinity"]
|
||||
profiles:
|
||||
- tools
|
||||
|
||||
volumes:
|
||||
charybdis-postgres-data:
|
||||
defectdojo-postgres-data:
|
||||
defectdojo-media:
|
||||
# backstage-postgres-data: # Uncomment if enabling Backstage
|
||||
|
||||
networks:
|
||||
charybdis-network:
|
||||
driver: bridge
|
||||
Reference in New Issue
Block a user