version: "3.7"
services:
  
  deepfence-init-container:
    container_name: df-init-container
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_init:${DF_IMG_TAG:-3.7.3}
    privileged: true
    ulimits:
      core: 0
    network_mode: "host"
    pid: "host"
    restart: "no"
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-postgres:
    container_name: deepfence-postgres
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_postgres:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    restart: on-failure
    networks:
    - deepfence_net
    volumes:
    - deepfence_data:/data:rw
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-redis:
    container_name: deepfence-redis
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_redis:${DF_IMG_TAG:-3.7.3}
    environment:
      INITIALIZE_REDIS: "Y"
    ulimits:
      core: 0
    restart: on-failure
    networks:
    - deepfence_net
    depends_on:
    - deepfence-init-container
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-fetcher:
    container_name: deepfence-fetcher
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_fetcher:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    depends_on:
    - deepfence-postgres
    networks:
    - deepfence_net
    restart: on-failure
    volumes:
    - deepfence_data:/data:rw
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-topology:
    container_name: deepfence-topology
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_discovery:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    networks:
    - deepfence_net
    ports:
    - "127.0.0.1:8004:8004"
    restart: on-failure
    command: topology
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-discovery:
    container_name: deepfence-discovery
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_discovery:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    network_mode: "host"
    pid: "host"
    privileged: true
    restart: on-failure
    command: discovery localhost 8004
    volumes:
    - /var/run/docker.sock:/var/run/docker.sock
    - /sys/kernel/debug:/sys/kernel/debug:rw
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-logstash:
    container_name: deepfence-logstash
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_logstash:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    restart: on-failure
    networks:
    - deepfence_net
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-es:
    container_name: deepfence-es-master
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_elastic:${DF_IMG_TAG:-3.7.3}
    restart: on-failure
    networks:
    - deepfence_net
    volumes:
    - deepfence_data:/data:rw
    environment:
    - DF_PROG_NAME="es_master"
    - node.name=deepfence-es
    - discovery.seed_hosts=deepfence-es-slave1,deepfence-es-slave2
    - cluster.initial_master_nodes=deepfence-es
    ulimits:
      core: 0
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    cap_add:
    - IPC_LOCK
    ports:
    - "127.0.0.1:9200:9200"
    - "127.0.0.1:9300:9300"
    deploy:
      resources:
        limits:
          memory: 4g
        reservations:
          memory: 2g
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-es-slave1:
    container_name: deepfence-es-slave1
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_elastic:${DF_IMG_TAG:-3.7.3}
    restart: on-failure
    networks:
    - deepfence_net
    volumes:
    - deepfence_data:/data:rw
    environment:
    - DF_PROG_NAME="es_slave1"
    - node.name=deepfence-es-slave1
    - discovery.seed_hosts=deepfence-es,deepfence-es-slave2
    - cluster.initial_master_nodes=deepfence-es
    ulimits:
      core: 0
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    cap_add:
    - IPC_LOCK
    deploy:
      resources:
        limits:
          memory: 4g
        reservations:
          memory: 2g
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-es-slave2:
    container_name: deepfence-es-slave2
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_elastic:${DF_IMG_TAG:-3.7.3}
    restart: on-failure
    networks:
    - deepfence_net
    volumes:
    - deepfence_data:/data:rw
    environment:
    - DF_PROG_NAME="es_slave2"
    - node.name=deepfence-es-slave2
    - discovery.seed_hosts=deepfence-es,deepfence-es-slave1
    - cluster.initial_master_nodes=deepfence-es
    ulimits:
      core: 0
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    cap_add:
    - IPC_LOCK
    deploy:
      resources:
        limits:
          memory: 4g
        reservations:
          memory: 2g
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-router:
    container_name: deepfence-router
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_router:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    networks:
    - deepfence_net
    environment:
      OPERATING_MODE: "docker"
    restart: always
    ports:
    - "80:80"
    - "${MGMT_CONSOLE_PORT:-443}:443"
    volumes:
    - /etc/deepfence/certs:/etc/deepfence/certs/:ro
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-internal-router:
    container_name: deepfence-internal-router
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_router:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    networks:
    - deepfence_net
    environment:
      ENABLE_AUTH: "false"
      OPERATING_MODE: "docker"
    restart: always
    volumes:
    - /etc/deepfence/certs:/etc/deepfence/certs/:ro
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-api:
    container_name: deepfence-api
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_api:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    tmpfs:
    - /tmp
    ports:
    - "127.0.0.1:9997:9997"
    environment:
      ELASTICSEARCH_SCHEME: "http"
    networks:
    - deepfence_net
    depends_on:
    - deepfence-es
    - deepfence-es-slave1
    - deepfence-es-slave2
    - deepfence-redis
    - deepfence-postgres
    volumes:
    - /etc/docker/certs.d:/etc/docker/certs.d:ro
    entrypoint: /app/code/dockerify/api/entrypoint.sh
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-celery:
    container_name: deepfence-celery
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_api:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    entrypoint: /app/code/dockerify/celery/entrypoint.sh
    restart: on-failure
    networks:
    - deepfence_net
    depends_on:
    - deepfence-redis
    - deepfence-postgres
    volumes:
    - /etc/docker/certs.d:/etc/docker/certs.d:ro
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-backend:
    container_name: deepfence-backend
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_api:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    entrypoint: /app/code/dockerify/backend/entrypoint.sh
    restart: on-failure
    networks:
    - deepfence_net
    depends_on:
    - deepfence-init-container
    - deepfence-redis
    - deepfence-postgres
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-ui:
    container_name: deepfence-ui
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_ui:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    networks:
    - deepfence_net
    restart: on-failure
    depends_on:
    - deepfence-topology
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-diagnosis:
    container_name: deepfence-diagnosis
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_diagnosis:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    networks:
    - deepfence_net
    volumes:
    - /var/run/docker.sock:/var/run/docker.sock
    restart: always
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-vulnerability-mapper:
    container_name: deepfence-vulnerability-mapper
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_vulnerability_mapper:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    restart: always
    networks:
    - deepfence_net
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-secret-scanner:
    container_name: deepfence-secret-scanner
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_secret_scanner:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    restart: always
    networks:
    - deepfence_net
    entrypoint: /home/deepfence/usr/SecretScanner
    command: [ "-config-path","/home/deepfence/usr", "-http-port", "8011" ]
    logging:
      driver: "json-file"
      options:
        max-size: "1g"
  
  deepfence-package-scanner:
    container_name: deepfence-package-scanner
    image: ${IMAGE_REPOSITORY:-quay.io/deepfenceio}/deepfence_package_scanner:${DF_IMG_TAG:-3.7.3}
    ulimits:
      core: 0
    restart: always
    networks:
    - deepfence_net
    environment:
      MGMT_CONSOLE_URL: "deepfence-internal-router"
      MGMT_CONSOLE_PORT: "443"
      PACKAGE_SCAN_CONCURRENCY: "5"
    entrypoint: /usr/local/bin/package-scanner
    command: [ "-mode", "http-server", "-port", "8005" ]
    logging:
      driver: "json-file"
      options:
        max-size: "1g"

volumes:
  deepfence_data:
    driver: local

networks:
  deepfence_net:
    driver: bridge
