docker-compose.yaml

version: '3.8'
services:

# not sure if we will need this
# syslog:
# sudo docker run -it -p 5514:514 -v $(pwd)/syslog-ng/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf -v $(pwd)/network.log:/var/log/network.log balabit/syslog-ng:latest -edv

  elasticsearch:
    build:
      context: elasticsearch/
    volumes:
      - ./elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      ES_JAVA_OPTS: "-Xmx1G -Xms1G"
    networks:
      - flesk
    hostname: "elasticsearch"

  logstash:
    build:
      context: logstash/
    volumes:
      - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml:ro
      - ./logstash/pipeline:/usr/share/logstash/pipeline:ro
      - ./logstash/patterns:/opt/logstash/patterns
      - ./logstash/geoipdbs:/etc/logstash/geoipdbs
      - ./logstash/dictionaries:/etc/logstash/dictionaries
      #- ./etc:/var/log/suricata
      - ./logstash/templates:/opt/logstash/templates
    ports:
      - "514:514/udp"
      #- "535:535/udp"
    environment:
      LS_JAVA_OPTS: "-Xmx2G -Xms2G"
    networks:
      - flesk
    depends_on:
      - elasticsearch
    hostname: "logstash"

  kibana:
    build:
      context: kibana/
    volumes:
      - ./kibana/config/:/usr/share/kibana/config:ro
    ports:
      - "5601:5601/tcp"
    networks:
      - flesk
    depends_on:
      - elasticsearch
    hostname: "kibana"
    
#  suricata:
#    build:
#      context: suricata/
#    volumes:
#      - ./suricata/config/suricata.yaml:/etc/suricata/suricata.yaml
#      - ./etc:/var/log/suricata
#    cap_add:
#      - sys_nice
#      - net_admin
#    networks:
#      - flesk
#    depends_on:
#      - logstash
#    hostname: "suricata"
  

#  filebeat:
#    build:
#      context: filebeat/
#    volumes:
#      - ./filebeat/config/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
#      - ./etc:/var/log/suricata:rw
#    ports:
#      - "535:535/udp"
#    hostname: "filebeat"
#    networks:
#      - flesk
#    depends_on:
#      - kibana
#      - logstash
#    #command: ["./wait-for-it.sh", "db:5432", "--", "python", "app.py"]
#    #entrypoint: bash -c 'export PATH=$PATH:/usr/share/filebeat && /usr/local/bin/docker-entrypoint -e'
#    #Because docker compose has terrible support and does not recognize service readiness
#    restart: on-failure:10


  snort3:
    build:
      context: snort3/
    hostname: snort3
    ports:
      - "6969:6969"
    volumes:
      - ./snort3/snort3-community-rules:/usr/local/etc/snort/snort3-community-rules:rw
    networks: 
      - flesk
    #depends_on:
      #- logstash
      #- elasticsearch
    entrypoint: ["/bin/bash"]
    # put the nodes on the host network so that source ips are retained

volumes:
  suricata-logs:

networks:

  flesk:
    driver: bridge