Create docker-compose.yaml

deployment/nginx-proxy-manager/docker-compose.yaml

@@ -0,0 +1,137 @@
+# Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# You may obtain a copy of the License at
+
+#     http://www.apache.org/licenses/LICENSE-2.0
+
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+##
+## Docker compose file for open-appsec integrated with NGINX Proxy Manager
+##
+
+version: '3.9'
+
+services:
+  appsec-agent:
+    image: ghcr.io/openappsec/agent:${APPSEC_VERSION}
+    container_name: appsec-agent
+    ipc: shareable
+    restart: unless-stopped
+    environment:
+      - SHARED_STORAGE_HOST=appsec-shared-storage
+      - LEARNING_HOST=appsec-smartsync
+      - TUNING_HOST=appsec-tuning-svc
+      - https_proxy=${APPSEC_HTTPS_PROXY}
+      - user_email=${APPSEC_USER_EMAIL}
+      - AGENT_TOKEN=${APPSEC_AGENT_TOKEN}
+      - autoPolicyLoad=${APPSEC_AUTO_POLICY_LOAD}
+      - nginxproxymanager=true
+    volumes:
+      - ${APPSEC_CONFIG}:/etc/cp/conf
+      - ${APPSEC_DATA}:/etc/cp/data
+      - ${APPSEC_LOGS}:/var/log/nano_agent
+      - ${APPSEC_LOCALCONFIG}:/ext/appsec
+    command: /cp-nano-agent
+
+  appsec-nginx-proxy-manager:
+    container_name: appsec-nginx-proxy-manager
+    image: ghcr.io/openappsec/nginx-proxy-manager-attachment:${APPSEC_VERSION}
+    ipc: service:appsec-agent
+    restart: unless-stopped
+    ports:
+      - '80:80' # Public HTTP Port
+      - '443:443' # Public HTTPS Port
+      - '81:81' # Admin Web Port
+    volumes:
+      - ${NPM_DATA}:/data
+      - ${NPM_LETSENCRYPT}:/etc/letsencrypt
+      - ${APPSEC_LOGS}:/ext/appsec-logs
+      - ${APPSEC_LOCALCONFIG}:/ext/appsec
+
+  appsec-smartsync:
+    profiles:
+      - standalone
+    image: ghcr.io/openappsec/smartsync:${APPSEC_VERSION}
+    container_name: appsec-smartsync
+    environment:
+      - SHARED_STORAGE_HOST=appsec-shared-storage
+    restart: unless-stopped
+    depends_on:
+      - appsec-shared-storage
+
+  appsec-shared-storage:
+    profiles:
+      - standalone
+    image: ghcr.io/openappsec/smartsync-shared-files:${APPSEC_VERSION}
+    container_name: appsec-shared-storage
+    ipc: service:appsec-agent
+    restart: unless-stopped
+## if you do not want to run this container as "root" user you can comment it out and instead run the below command after the deployment
+## docker exec -u root appsec-shared-storage chown -R appuser:appuser /db
+    user: root
+    volumes:
+      - ${APPSEC_SMART_SYNC_STORAGE}:/db:z
+## instead of using local storage for local learning (see line above)
+## you can also configure central nfs storage by configuring nfs volume (uncomment the relevant section at end of this file)
+## use a shared nfs storage which is recommended in redundant deployments (uncomment line below, comment out the line above) 
+#     - learning_nfs:/db:z
+
+  appsec-tuning-svc:
+    profiles:
+      - standalone
+    image: ghcr.io/openappsec/smartsync-tuning:${APPSEC_VERSION}
+    container_name: appsec-tuning-svc
+    environment:
+      - SHARED_STORAGE_HOST=appsec-shared-storage
+      - QUERY_DB_PASSWORD=${APPSEC_DB_PASSWORD}
+      - QUERY_DB_HOST=${APPSEC_DB_HOST}
+      - QUERY_DB_USER=${APPSEC_DB_USER}
+## only relevant when deploying own DB 
+#     - SSLMODE:
+    restart: unless-stopped
+    volumes:
+      - ${APPSEC_CONFIG}:/etc/cp/conf
+    depends_on:
+      - appsec-shared-storage
+      - appsec-db
+      
+  appsec-db:
+    profiles:
+      - standalone
+    image: postgres
+    container_name: appsec-db
+    restart: unless-stopped
+    environment:
+      - POSTGRES_PASSWORD=${APPSEC_DB_PASSWORD}
+      - POSTGRES_USER=${APPSEC_DB_USER} 
+    volumes:
+      - ${APPSEC_POSTGRES_STORAGE}:/var/lib/postgresql/data
+
+## example juice-shop backend container (vulnerable webserver, USE ONLY FOR TESTING AND IN LAB ENV)
+##
+## uncomment this block for testing purposes only, make sure to also create a new proxy host in the NGINX Proxy Manager WebUI 
+## which accepts traffic on http port 80 and proxies traffic to juiceshop-backend on port 3000.
+## note that juiceshop container listens on HTTP port 3000 by default
+#
+# juiceshop-backend:
+#   image: bkimminich/juice-shop:latest
+#   container_name: juiceshop-backend
+
+
+## advanced configuration: learning_nfs volume for nfs storage in shared_storage container
+##
+## when configuring nfs storage in shared_storage container configuration above, make sure to also specify learning_nfs volume (see example below for using AWS EFS storage)
+##
+#volumes:
+# learning_nfs:
+#   driver: local
+#   driver_opts:
+#     type: nfs
+#     o: addr=fs-abcdef.efs.eu-west-1.amazonaws.com,rw,nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport
+#     device: ":/"