mirror of
https://github.com/openappsec/openappsec.git
synced 2025-06-28 16:41:02 +03:00
118 lines
4.5 KiB
YAML
118 lines
4.5 KiB
YAML
version: "2"
|
|
services:
|
|
appsec-agent:
|
|
image: ghcr.io/openappsec/agent:${APPSEC_VERSION}
|
|
container_name: appsec-agent
|
|
environment:
|
|
- SHARED_STORAGE_HOST=appsec-shared-storage
|
|
- LEARNING_HOST=appsec-smartsync
|
|
- TUNING_HOST=appsec-tuning-svc
|
|
- https_proxy=${APPSEC_HTTPS_PROXY}
|
|
- user_email=${USER_EMAIL}
|
|
# - AGENT_TOKEN=${APPSEC_AGENT_TOKEN}
|
|
- autoPolicyLoad=${APPSEC_AUTO_POLICY_LOAD}
|
|
- registered_server="NGINX"
|
|
ipc: shareable
|
|
volumes:
|
|
- ${APPSEC_CONFIG}:/etc/cp/conf
|
|
- ${APPSEC_DATA}:/etc/cp/data
|
|
- ${APPSEC_LOGS}:/var/log/nano_agent
|
|
- ${APPSEC_LOCALCONFIG}:/ext/appsec
|
|
command: /cp-nano-agent
|
|
appsec-nginx:
|
|
image: ghcr.io/openappsec/nginx-attachment:${APPSEC_VERSION}
|
|
container_name: appsec-nginx
|
|
ipc: service:appsec-agent
|
|
## when mounting own external nginx config uncomment the two lines below, place the config in {NGINX_CONF_DIR}
|
|
# volumes:
|
|
# - ${NGINX_CONF_DIR}:/etc/nginx/conf.d
|
|
|
|
## advanced configuration - volume mount for nginx.conf file:
|
|
## to change global instructions it's possible to also mount your own nginx.conf file by uncommenting the two lines below
|
|
## make sure to include the line starting with "load_module" which loads the appsec attachment
|
|
## and is included in /etc/nginx/conf.d/nginx.conf file as part of the nginx-attachment container
|
|
## make sure to only have one "volumes:" key
|
|
# volumes:
|
|
# - ${NGINX_CONF_FILE}:/etc/nginx/nginx.conf
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
appsec-smartsync:
|
|
profiles:
|
|
- standalone
|
|
image: ghcr.io/openappsec/smartsync:${APPSEC_VERSION}
|
|
container_name: appsec-smartsync
|
|
environment:
|
|
- SHARED_STORAGE_HOST=appsec-shared-storage
|
|
depends_on:
|
|
- appsec-shared-storage
|
|
appsec-shared-storage:
|
|
profiles:
|
|
- standalone
|
|
image: ghcr.io/openappsec/smartsync-shared-files:${APPSEC_VERSION}
|
|
container_name: appsec-shared-storage
|
|
ipc: service:appsec-agent
|
|
## if you do not want to run this container as "root" user you can comment it out and instead run the below command after the deployment
|
|
## docker exec -u root appsec-shared-storage chown -R appuser:appuser /db
|
|
user: root
|
|
volumes:
|
|
- ${SMART_SYNC_STORAGE}:/db:z
|
|
## instead of using local storage for local learning (see line above)
|
|
## you can also configure central nfs storage by configuring nfs volume (uncomment the relevant section at end of this file)
|
|
## use a shared nfs storage which is recommended in redundant deployments (uncomment line below, comment out the line above)
|
|
# - learning_nfs:/db:z
|
|
appsec-tuning-svc:
|
|
profiles:
|
|
- standalone
|
|
image: ghcr.io/openappsec/smartsync-tuning:${APPSEC_VERSION}
|
|
container_name: appsec-tuning-svc
|
|
environment:
|
|
- SHARED_STORAGE_HOST=appsec-shared-storage
|
|
- QUERY_DB_PASSWORD=${DB_PASSWORD}
|
|
- QUERY_DB_HOST=${DB_HOST}
|
|
- QUERY_DB_USER=${DB_USER}
|
|
## only relevant when deploying own DB
|
|
# - SSLMODE:
|
|
volumes:
|
|
- ${APPSEC_CONFIG}:/etc/cp/conf
|
|
depends_on:
|
|
- appsec-shared-storage
|
|
- appsec-db
|
|
appsec-db:
|
|
profiles:
|
|
- standalone
|
|
image: postgres
|
|
container_name: appsec-db
|
|
restart: always
|
|
environment:
|
|
- POSTGRES_PASSWORD=${DB_PASSWORD}
|
|
- POSTGRES_USER=${DB_USER}
|
|
volumes:
|
|
- ${POSTGRES_STORAGE}:/var/lib/postgresql/data
|
|
|
|
## example juice-shop backend container (vulnerable webserver, USE ONLY FOR TESTING AND IN LAB ENV)
|
|
##
|
|
## uncomment this block for testing purposes only, make sure to also adjust the nginx.conf file
|
|
## to include a proxy_pass directive forwarding external traffic on e.g. port 80 to the juiceshop-backend container
|
|
## you can use the example file available here:
|
|
## https://raw.githubusercontent.com/openappsec/openappsec/refs/heads/main/examples/juiceshop/default.conf
|
|
## in the appsec-nginx service definition
|
|
## note that juiceshop container listens on HTTP port 3000 by default
|
|
#
|
|
# juiceshop-backend:
|
|
# image: bkimminich/juice-shop:latest
|
|
# container_name: juiceshop-backend
|
|
|
|
|
|
## advanced configuration: learning_nfs volume for nfs storage in shared_storage container
|
|
##
|
|
## when configuring nfs storage in shared_storage container configuration above, make sure to also specify learning_nfs volume (see example below for using AWS EFS storage)
|
|
#
|
|
# volumes:
|
|
# learning_nfs:
|
|
# driver: local
|
|
# driver_opts:
|
|
# type: nfs
|
|
# o: addr=fs-abcdef.efs.eu-west-1.amazonaws.com,rw,nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport
|
|
# device: ":/"
|