services:
  crowdsec:
    image: ghcr.io/crowdsecurity/crowdsec:latest
    hostname: crowdsec
    environment:
      GID: "1000"
      CUSTOM_HOSTNAME: "crowdsec"
      COLLECTIONS: "crowdsecurity/traefik crowdsecurity/http-cve crowdsecurity/base-http-scenarios crowdsecurity/sshd crowdsecurity/linux crowdsecurity/appsec-generic-rules crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs"
      DOCKER_HOST: unix:///var/run/docker.sock
      PGDSN: ${CROWDSEC_PGDSN}
      BOUNCER_KEY_TRAEFIK: ${BOUNCER_KEY_TRAEFIK}
    volumes:
      - /volume1/docker/crowdsec/var/lib/crowdsec/data:/var/lib/crowdsec/data
      - /volume1/docker/crowdsec/etc/crowdsec:/etc/crowdsec/
      - /volume1/docker/traefik/logs:/var/log/traefik:ro
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - traefik_backend
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.crowdsec.rule=Host(`security.${DOMAIN}`)
        - traefik.http.routers.crowdsec.tls=true
        - traefik.http.routers.crowdsec.tls.certresolver=letsencrypt
        - traefik.http.routers.crowdsec.entrypoints=websecure
        - traefik.http.services.crowdsec.loadbalancer.server.port=8080
        - traefik.swarm.network=traefik_backend
        - traefik.http.routers.crowdsec.middlewares=crowdsec@file
      resources:
        limits:
          cpus: '4'
          memory: 512M

  crowdsec-web-ui:
    image: ghcr.io/theduffman85/crowdsec-web-ui:latest
    environment:
      CROWDSEC_API_URL: http://crowdsec:8080
      CROWDSEC_API_KEY: ${CROWDSEC_API_KEY}
      CROWDSEC_URL: http://crowdsec:8080
      CROWDSEC_USER: crowdsec-web-ui
      CROWDSEC_PASSWORD: ${CROWDSEC_PASSWORD}
      CROWDSEC_SIMULATIONS_ENABLED: "false"
      CROWDSEC_LOOKBACK_PERIOD: "7d"
      CROWDSEC_REFRESH_INTERVAL: "30s"
      CROWDSEC_ALWAYS_SHOW_MACHINE: "false"
    volumes:
      - /volume1/docker/crowdsec-web-ui:/data
    networks:
      - traefik_backend
    ports:
      - 5173:5173
    deploy:
      labels:
        - traefik.enable=true
        - traefik.http.routers.crowdsec-ui.rule=Host(`secure.${DOMAIN}`)
        - traefik.http.routers.crowdsec-ui.tls=true
        - traefik.http.routers.crowdsec-ui.tls.certresolver=letsencrypt
        - traefik.http.routers.crowdsec-ui.entrypoints=websecure
        - traefik.http.services.crowdsec-ui.loadbalancer.server.scheme=http
        - traefik.http.services.crowdsec-ui.loadbalancer.server.port=3000
        - traefik.http.routers.crowdsec-ui.middlewares=forwardAuth-authentik@file
        - traefik.swarm.network=traefik_backend

networks:
  postgresql_db-backend:
    external: true
  traefik_backend:
    external: true