agent/docker-compose.yml at main · cyberdiagram/agent · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
# Security Audit Agent - Docker Compose Configuration
# Run with: docker-compose up -d

version: '3.8'

services:
  # ==========================================================================
  # Main Agent Service
  # ==========================================================================
  agent:
    build:
      context: .
      dockerfile: Dockerfile
    image: security-audit-agent:latest
    container_name: security-audit-agent
    restart: unless-stopped

    # Environment variables
    env_file:
      - .env
    environment:
      - NODE_ENV=production
      - DATABASE_PATH=/app/data/audit.db
      - POC_DATABASE_PATH=/app/data/poc-database.db
      - KNOWLEDGE_DATABASE_PATH=/app/data/knowledge.db
      - LOG_PATH=/app/logs
      - MONITOR_URL=http://monitor:3000

    # Volumes for persistent data
    volumes:
      - agent-data:/app/data
      - agent-logs:/app/logs
      - agent-reports:/app/reports
      - ./writeup:/app/writeup:ro

    # Network configuration
    networks:
      - agent-network

    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 4G
        reservations:
          cpus: '1'
          memory: 2G

    # Dependencies
    depends_on:
      - monitor

    # Security options
    security_opt:
      - no-new-privileges:true

    # Healthcheck disabled for agent (runs scans, not a server)
    # Override command for specific scans
    # command: ["node", "dist/index.js", "TARGET_IP", "comprehensive"]

  # ==========================================================================
  # Monitoring Server
  # ==========================================================================
  monitor:
    build:
      context: .
      dockerfile: Dockerfile
    image: security-audit-agent:latest
    container_name: security-audit-monitor
    restart: unless-stopped

    # Override command to run monitoring server
    command: ["node", "dist/monitoring/server.js"]

    env_file:
      - .env
    environment:
      - NODE_ENV=production
      - DATABASE_PATH=/app/data/audit.db
      - MONITOR_PORT=3000

    # Expose monitoring port
    ports:
      - "3000:3000"

    # Share data volume with agent
    volumes:
      - agent-data:/app/data:ro
      - agent-logs:/app/logs:ro

    networks:
      - agent-network

    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 512M

    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  # ==========================================================================
  # Dashboard (React Frontend)
  # ==========================================================================
  dashboard:
    build:
      context: ./dashboard
      dockerfile: Dockerfile
    image: security-audit-dashboard:latest
    container_name: security-audit-dashboard
    restart: unless-stopped

    environment:
      - VITE_API_URL=http://monitor:3000

    ports:
      - "5173:80"

    networks:
      - agent-network

    depends_on:
      - monitor

    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M

# =============================================================================
# Volumes
# =============================================================================
volumes:
  agent-data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${PWD}/data

  agent-logs:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${PWD}/logs

  agent-reports:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${PWD}/reports

# =============================================================================
# Networks
# =============================================================================
networks:
  agent-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/16