cortex/docker-compose.yml at master · cloudpassage/cortex · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
version: '3.4'
x-halocelery_version:
  &default_halocelery_version docker.io/halotools/halocelery:v0.8
x-donbot_version:
  &default_donbot_version docker.io/halotools/don-bot:v0.19
x-celery_env_vars:
  &default_celery_env_vars
  CELERY_BACKEND_URL: redis://redis
  CELERY_BROKER_URL: amqp://guest:guest@rabbitmq:5672//
  CONTAINER_MEM_LIMIT: 256m
x-proxy_env_vars:
  &default_proxy_env_vars
  HTTPS_PROXY: ${HTTPS_PROXY_URL}
x-api_env_vars:
  &default_api_env_vars
  HALO_API_HOSTNAME: api.cloudpassage.com

services:
#####################################
# Rabbitmq service
#####################################
  rabbitmq:
    container_name: rabbitmq
    hostname: rabbitmq
    image: docker.io/rabbitmq:3-management
    deploy:
      resources:
        limits:
          memory: 256M
    restart: always
    environment:
      << : *default_proxy_env_vars
    depends_on:
      - redis
    networks:
      - cortex
#####################################
# Flower service
#####################################
  flower:
    container_name: flower
    image: *default_halocelery_version
    deploy:
      resources:
        limits:
          memory: 256M
    command: celery flower -A halocelery --address=0.0.0.0 --port=5555 -l INFO
    environment:
      << : *default_celery_env_vars
      << : *default_proxy_env_vars
    restart: always
    read_only: true
    depends_on:
      - rabbitmq
    links:
      - "rabbitmq:5672"
      - "redis:6379"
    networks:
      - cortex
#####################################
# Celeryworker service
#####################################
  celeryworker:
    container_name: celeryworker
    image: *default_halocelery_version
    deploy:
      resources:
        limits:
          memory: 256M
    command: unbuffer celery worker -A halocelery -l INFO
    user: root
    restart: always
    environment:
      << : *default_celery_env_vars
      << : *default_proxy_env_vars
      << : *default_api_env_vars
      HALO_API_KEY: ${HALO_API_KEY}
      HALO_API_SECRET_KEY: ${HALO_API_SECRET_KEY}
      HALO_API_KEY_RW: ${HALO_API_KEY_RW}
      HALO_API_SECRET_KEY_RW: ${HALO_API_SECRET_KEY_RW}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
      SLACK_API_TOKEN: ${SLACK_API_TOKEN}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      - rabbitmq
    links:
      - "rabbitmq:5672"
      - "redis:6379"
    networks:
      - cortex
#####################################
# Redis service
#####################################
  redis:
    container_name: redis
    image: docker.io/redis:3-alpine
    deploy:
      resources:
        limits:
          memory: 256M
    environment:
      << : *default_proxy_env_vars
    restart: always
    networks:
      - cortex
#####################################
# Scheduler service
#####################################
  scheduler:
    container_name: scheduler
    image: *default_halocelery_version
    deploy:
      resources:
        limits:
          memory: 256M
    command: unbuffer celery beat -A halocelery -l INFO --pidfile=
    restart: always
    depends_on:
      - celeryworker
    links:
      - "rabbitmq:5672"
      - "redis:6379"
    environment:
      << : *default_celery_env_vars
      << : *default_proxy_env_vars
      FLOWER_HOST: http://flower:5555
      HALOCELERY_CONFIG_DIR: /etc/config/
    volumes:
      - "./config/enabled/:/etc/config/"
    networks:
      - cortex
#####################################
# Donbot service
#####################################
  donbot:
    container_name: don-bot
    image: *default_donbot_version
    deploy:
      resources:
        limits:
          memory: 256M
    restart: always
    read_only: true
    depends_on:
      - celeryworker
    links:
      - "rabbitmq:5672"
      - "redis:6379"
      - "flower:5555"
    env_file:
      - cortex_conf.env
    environment:
      << : *default_celery_env_vars
      << : *default_proxy_env_vars
      << : *default_api_env_vars
      # NOSLACK: "true"
      FLOWER_HOST: http://flower:5555
      HALO_API_KEY: ${HALO_API_KEY}
      HALO_API_SECRET_KEY: ${HALO_API_SECRET_KEY}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
      SLACK_API_TOKEN: ${SLACK_API_TOKEN}
      SLACK_CHANNEL: ${SLACK_CHANNEL}
      AWS_ROLE_NAME: ${AWS_ROLE_NAME}
      AWS_ACCOUNT_NUMBERS: ${AWS_ACCOUNT_NUMBERS}
      MONITOR_EVENTS: "yes"
      #####################################
      # Donbot's containerized task image versions
      #####################################
      EC2_HALO_DELTA_VERSION: v0.2
      FIREWALL_GRAPH_VERSION: v0.2
    networks:
      - cortex

networks:
  cortex:
    driver: bridge