docker-compose.yml

version: "3.8"

volumes:
  postgresdata:
    name: postgresdata
    driver: local
  prometheusdata:
    name: prometheusdata
    driver: local
  grafanadata:
    name: grafanadata
    driver: local
  certs:
    name: certs
    driver: local
  esdata:
    name: esdata
    driver: local
  kibanadata:
    name: kibanadata
    driver: local
  logstashdata:
    name: logstashdata
    driver: local

networks:
  default:
    name: transcendence
    external: false
    driver: bridge
  elastic:
    name: elastic
    driver: bridge
  monitoring:
    name: monitoring
    driver: bridge

services:
  db:
    depends_on:
      logstash:
        condition: service_healthy
    image: postgres:latest
    container_name: db
    env_file:
      - ./config/secrets/database.env
    volumes:
      - postgresdata:/var/lib/postgresql/data
      - ./config/postgresql/postgresql.conf:/etc/postgresql/postgresql.conf
    command: [ "postgres", "-c", "config_file=/etc/postgresql/postgresql.conf" ]
    logging:
      driver: syslog
      options:
        syslog-address: tcp://localhost:5043
    shm_size: 128mb
    networks:
      - default
      - elastic
      - monitoring
    restart: unless-stopped
  nginx:
    depends_on:
      logstash:
        condition: service_healthy
      backend:
        condition: service_started
    image: nginx:latest
    container_name: nginx
    ports:
      - "443:443"
    volumes:
      - ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./config/nginx/default:/etc/nginx/conf.d/default.conf:ro
      - ./config/nginx/certs:/etc/nginx/certs:ro
      - ./frontend:/var/www/html:ro
      - ./core/media:/var/www/media:ro
    networks:
      - default
      - elastic
      - monitoring
    restart: unless-stopped
  backend:
    build:
      context: ./config/backend
    depends_on:
      logstash:
        condition: service_healthy
      db:
        condition: service_started
    env_file:
      - ./config/secrets/backend.env
    image: backend:latest
    container_name: backend
    ports:
      - "8000:8000"
    networks:
      - default
      - elastic
      - monitoring
    volumes:
      - ./core:/main/core
    restart: unless-stopped
  nginx-exporter:
    depends_on:
      - nginx
    image: nginx/nginx-prometheus-exporter:latest
    container_name: nginx-exporter
    command: "--nginx.scrape-uri=https://nginx/stub_status"
    networks:
      - monitoring
    restart: unless-stopped
  node_exporter:
    image: prom/node-exporter:latest
    container_name: node-exporter
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - '--path.procfs=/host/proc'
      - '--path.rootfs=/rootfs'
      - '--path.sysfs=/host/sys'
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
    networks:
      - monitoring
    restart: unless-stopped
  postgres_exporter:
    depends_on:
      - db
    image: wrouesnel/postgres_exporter
    container_name: postgres-exporter
    networks:
      - monitoring
    env_file:
      - ./config/secrets/database.env
    restart: unless-stopped
  alertmanager:
    image: prom/alertmanager:latest
    container_name: alertmanager
    ports:
      - "9093:9093"
    volumes:
      - ./config/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml
    networks:
      - monitoring
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--storage.tsdb.retention.time=30d"
      - "--storage.tsdb.retention.size=1GB"
    ports:
      - "9090:9090"
    volumes:
      - prometheusdata:/prometheus
      - ./config/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
      - ./config/prometheus/alert.rules:/etc/prometheus/alert.rules
    depends_on:
      - backend
      - nginx-exporter
      - postgres_exporter
      - alertmanager
    networks:
      - monitoring
    restart: unless-stopped
  grafana:
    image: grafana/grafana:11.1.8
    container_name: grafana
    ports:
      - "3000:3000"
    volumes:
      - grafanadata:/var/lib/grafana
      - ./config/grafana/config/grafana.ini:/etc/grafana/grafana.ini:ro
      - ./config/grafana/config/ssl:/etc/grafana/ssl:ro
      - ./config/grafana/provisioning:/etc/grafana/provisioning:ro
      - ./config/grafana/dashboards:/var/lib/grafana/dashboards:ro
    depends_on:
      - prometheus
    networks:
      - monitoring
    restart: unless-stopped
  setup:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.15.0
    container_name: elksetup
    volumes:
      - certs:/usr/share/elasticsearch/config/certs
      - ./config/elasticsearch/elasticsearch_init.sh:/usr/share/elasticsearch/elasticsearch_init.sh
    networks:
      - elastic
    env_file:
      - .env
    command: [ "bash", "elasticsearch_init.sh" ]
    user: "0"
    healthcheck:
      test: [ "CMD-SHELL", "[ -f config/certs/elasticsearch/elasticsearch.crt ]" ]
      interval: 1s
      timeout: 5s
      retries: 120
  elasticsearch:
    depends_on:
      setup:
        condition: service_healthy
    image: docker.elastic.co/elasticsearch/elasticsearch:8.15.0
    container_name: elasticsearch
    labels:
      co.elastic.logs/module: elasticsearch
    volumes:
      - certs:/usr/share/elasticsearch/config/certs
      - esdata:/usr/share/elasticsearch/data
    networks:
      - elastic
    environment:
      - node.name=elasticsearch
      - cluster.name=${CLUSTER_NAME}
      - discovery.type=single-node
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - bootstrap.memory_lock=true
      - xpack.monitoring.collection.enabled=true
      - xpack.security.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=certs/elasticsearch/elasticsearch.key
      - xpack.security.http.ssl.certificate=certs/elasticsearch/elasticsearch.crt
      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.key=certs/elasticsearch/elasticsearch.key
      - xpack.security.transport.ssl.certificate=certs/elasticsearch/elasticsearch.crt
      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.verification_mode=certificate
      - xpack.license.self_generated.type=${LICENSE}
    mem_limit: ${ES_MEM_LIMIT}
    ulimits:
      memlock:
        soft: -1
        hard: -1
    healthcheck:
      test: [ "CMD-SHELL", "curl -s --cacert config/certs/ca/ca.crt https://localhost:9200 | grep -q 'missing authentication credentials'" ]
      interval: 10s
      timeout: 10s
      retries: 120
  kibana:
    depends_on:
      elasticsearch:
        condition: service_healthy
    image: docker.elastic.co/kibana/kibana:8.15.0
    container_name: kibana
    labels:
      co.elastic.logs/module: kibana
    volumes:
      - certs:/usr/share/kibana/config/certs
      - ./config/kibana/kibana.yml:/usr/share/kibana/config/kibana.yml
      - kibanadata:/usr/share/kibana/data
    networks:
      - elastic
    ports:
      - "5601:5601"
    environment:
      - SERVERNAME=kibana
      - ELASTICSEARCH_HOSTS=https://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=${KIBANA_USER}
      - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
      - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/ca/ca.crt
      - XPACK_SECURITY_ENCRYPTIONKEY=${ENCRYPTION_KEY}
      - XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY=${ENCRYPTION_KEY}
      - XPACK_REPORTING_ENCRYPTIONKEY=${ENCRYPTION_KEY}
    mem_limit: ${KB_MEM_LIMIT}
    healthcheck:
      test: [ "CMD-SHELL", "curl --cacert config/certs/kibana/kibana.crt -s -I https://localhost:5601 | grep -q 'HTTP/1.1 302 Found'" ]
      interval: 10s
      timeout: 10s
      retries: 120
  logstash:
    depends_on:
      elasticsearch:
        condition: service_healthy
      kibana:
        condition: service_healthy
    image: docker.elastic.co/logstash/logstash:8.15.0
    container_name: logstash
    labels:
      co.elastic.logs/module: logstash
    user: root
    volumes:
      - logstashdata:/usr/share/logstash/data
      - certs:/usr/share/logstash/certs
      - ./config/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf:ro
    networks:
      - elastic
    ports:
      - "5043:5043"
    environment:
      - xpack.enabled=true
      - xpack.monitoring.enabled=true
      - ELASTIC_USER=${ELASTIC_USER}
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - ELASTIC_HOSTS=https://elasticsearch:9200
    healthcheck:
      test: [ "CMD-SHELL", "bash -c 'echo > /dev/tcp/localhost/5044' || exit 1" ]
      interval: 10s
      retries: 5
      start_period: 30s
      timeout: 10s