docker-compose.yaml

version: '3.4'
services:
    origin-server:
      build:
        context: ./containers/test-origin
        # context: ./containers/origin-server
        dockerfile: Dockerfile
      network_mode: "service:nginx"  # nginx connects to this at localhost:8080
      #ports:
        #- "8080:8080"

    nginx:
      build:
        context: ./containers/nginx
        dockerfile: Dockerfile
      ports:
        - "80:80"
        - "443:443"

    banjax:
      build:
        context: ./containers/banjax
        dockerfile: Dockerfile
      network_mode: "service:nginx"  # nginx connects to this at localhost:8081
      cap_add:
        - NET_ADMIN
      volumes:
        - ./containers/banjax/banjax-config.yaml:/etc/banjax/banjax-config.yaml
        - ./containers/banjax/ca.crt:/etc/banjax/caroot.pem
        - ./containers/banjax/instance.key:/etc/banjax/key.pem
        - ./containers/banjax/instance.crt:/etc/banjax/certificate.pem
#        - ./localhost.pem:/etc/banjax/certificate.pem

    zookeeper:
      image: wurstmeister/zookeeper
      ports:
        - "2181:2181"
        # - "2182:2182"
        # - "8080:8080"

    kafka-server:
      build:
        context: ./containers/kafka
        dockerfile: Dockerfile
      ports:
        - "9092:9092"
        # - "9093:9093"
      environment:
        KAFKA_ADVERTISED_HOST_NAME: 127.0.0.1                   # XXX WHEN YOU'RE RUNNING auth-server ON THE HOST
        KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://127.0.0.1:9092  # XXX WHEN YOU'RE RUNNING auth-server ON THE HOST
        # KAFKA_ADVERTISED_HOST_NAME: kafka                   # XXX WHEN YOU'RE RUNNING auth-server FROM DOCKER-COMPOSE
        # KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9092  # XXX WHEN YOU'RE RUNNING auth-server FROM DOCKER-COMPOSE
        KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
        KAFKA_BROKER_ID: 1
      depends_on:
        - zookeeper

    # XXX `docker-compose up --build purge-plugin-builder` needlessly builds `auth-server` even though it doesn't depend on it. dunno why.
    purge-plugin-builder:
      build:
        context: ./containers/nginx
        dockerfile: Dockerfile
        target: purge-plugin-build-target

    bind-server:
      build:
        context: ./containers/bind
        dockerfile: Dockerfile
      ports:
        - "53:53/udp"

    certbot:
      build:
        context: ./containers/certbot
        dockerfile: Dockerfile
      network_mode: "service:bind-server"  # bind9 connects to this at localhost:5053

    elasticsearch:
      build:
        context: ./containers/elasticsearch
        dockerfile: Dockerfile
      environment:
        # - node.name=es01
        # - cluster.name=es-docker-cluster
        # - discovery.seed_hosts=es02,es03
        # - cluster.initial_master_nodes=es01,es02,es03
        - xpack.security.enabled=true
        - xpack.security.transport.ssl.enabled=true
        - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/instance.key
        - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/instance.crt
        - discovery.type=single-node
        - bootstrap.memory_lock=true
        - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      ulimits:
        memlock:
          soft: -1
          hard: -1
      # volumes:
      #   - data01:/usr/share/elasticsearch/data
      ports:
        - 9200:9200
      networks:
        - elastic

    kibana:
      build:
        context: ./containers/kibana
        dockerfile: Dockerfile
      ports:
        - 5601:5601
      environment:
        ELASTICSEARCH_URL: http://elasticsearch:9200
        ELASTICSEARCH_HOSTS: http://elasticsearch:9200
        server.ssl.enabled: "true"
        elasticsearch.ssl.certificateAuthorities: /etc/kibana/ca.crt
        ELASTICSEARCH_USERNAME: elastic
        ELASTICSEARCH_PASSWORD: ${ELASTICSEARCH_PASSWORD:-password}
      networks:
        - elastic
      volumes:
        - /var/run/:/var/run/  # if you just mount the socket and the docker daemon restarts, filebeat won't re-find it

    filebeat:
      build:
        context: ./containers/filebeat
        dockerfile: Dockerfile
      user: root
      environment:
        ELASTICSEARCH_URL: http://elasticsearch:9200
        ELASTICSEARCH_HOST: http://elasticsearch:9200
        ELASTICSEARCH_PASSWORD: ${ELASTICSEARCH_PASSWORD:-password}
        KIBANA_HOST: http://kibana:5601
        DEFLECT_EDGE_NAME: edge_name,
        DEFLECT_DNET: dnet,
      networks:
        - elastic
      volumes:
        - /var/run/:/var/run/  # if you just mount the socket and the docker daemon restarts, filebeat won't re-find it
        - /var/lib/docker/containers/:/var/lib/docker/containers/:ro

#    legacy-logstash:
#      build:
#        context: ./containers/legacy-logstash
#        dockerfile: Dockerfile
#      ports:
#        - 5044:5044
#      environment:
#        ELASTICSEARCH_URL: http://elasticsearch:9200
#        ELASTICSEARCH_HOST: http://elasticsearch:9200

    pebble:
      image: letsencrypt/pebble:latest
      command: pebble -config /test/config/pebble-config.json -strict -dnsserver bind-server:53
      environment:
        # TODO(@cpu): Delete this explicit GODEBUG env var once Pebble is built
        # with Go 1.13.x which defaults TLS 1.3 to on
        GODEBUG: "tls13=1"
      ports:
        - 14000:14000  # HTTPS ACME API
        - 15000:15000  # HTTPS Management API
      # network_mode: "service:bind-server"  # 

networks:
  elastic:
    driver: bridge