services:
    # ─── Dozzle ───────────────────────────────────────────────
    dozzle:
        image: amir20/dozzle:latest
        container_name: dozzle
        restart: unless-stopped
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock:ro
            - ./dozzle/users.yml:/data/users.yml:ro
        environment:
            DOZZLE_AUTH_PROVIDER: simple
            DOZZLE_AUTH_TTL: 48h
            DOZZLE_REMOTE_AGENT: "5.181.0.112:7007|demo-uber|VPS,185.234.9.102:7007|mln-uber|VPS"
        networks:
            - monitoring_net

    # ─── Nginx ────────────────────────────────────────────────
    nginx:
        image: nginx:alpine
        container_name: monitoring_nginx
        restart: unless-stopped
        ports:
            - "80:80"
            - "443:443"
        volumes:
            - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
            - ./nginx/certs:/etc/nginx/certs:ro
            - nginx_logs:/var/log/nginx
        depends_on:
            - dozzle
            - wazuh.dashboard
        networks:
            - monitoring_net

    # ─── Wazuh Manager ────────────────────────────────────────
    wazuh.manager:
        image: wazuh/wazuh-manager:4.14.5
        hostname: wazuh.manager
        container_name: wazuh_manager
        restart: unless-stopped
        ulimits:
            memlock:
                soft: -1
                hard: -1
            nofile:
                soft: 655360
                hard: 655360
        ports:
            - "1514:1514" # Communication agents
            - "1515:1515" # Enrôlement agents
            - "514:514/udp" # Syslog entrant
        environment:
            - INDEXER_URL=https://wazuh.indexer:9200
            - INDEXER_USERNAME=admin
            - INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
            - FILEBEAT_SSL_VERIFICATION_MODE=full
            - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
            - SSL_CERTIFICATE=/etc/ssl/filebeat.pem
            - SSL_KEY=/etc/ssl/filebeat.key
            - API_USERNAME=wazuh-wui
            - API_PASSWORD=${WAZUH_API_PASSWORD}
        entrypoint: ["/bin/bash", "/wazuh-custom/init.sh"]
        volumes:
            - ./wazuh/config/wazuh_manager/:/wazuh-custom/:ro
            - wazuh_api_configuration:/var/ossec/api/configuration
            - wazuh_etc:/var/ossec/etc
            - wazuh_logs:/var/ossec/logs
            - wazuh_queue:/var/ossec/queue
            - wazuh_var_multigroups:/var/ossec/var/multigroups
            - wazuh_integrations:/var/ossec/integrations
            - wazuh_active_response:/var/ossec/active-response/bin
            - wazuh_agentless:/var/ossec/agentless
            - wazuh_wodles:/var/ossec/wodles
            - filebeat_etc:/etc/filebeat
            - filebeat_var:/var/lib/filebeat
            - ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
            - ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
            - ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
        networks:
            - monitoring_net

    # ─── Wazuh Indexer (OpenSearch) ───────────────────────────
    wazuh.indexer:
        image: wazuh/wazuh-indexer:4.14.5
        hostname: wazuh.indexer
        container_name: wazuh_indexer
        restart: unless-stopped
        ulimits:
            memlock:
                soft: -1
                hard: -1
            nofile:
                soft: 65536
                hard: 65536
        environment:
            - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
            - INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
        volumes:
            - wazuh_indexer_data:/var/lib/wazuh-indexer
            - ./wazuh/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
            - ./wazuh/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
            - ./wazuh/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
            - ./wazuh/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
            - ./wazuh/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
            - ./wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
            - ./wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
        networks:
            - monitoring_net

    # ─── Wazuh Dashboard ──────────────────────────────────────
    wazuh.dashboard:
        image: wazuh/wazuh-dashboard:4.14.5
        hostname: wazuh.dashboard
        container_name: wazuh_dashboard
        restart: unless-stopped
        environment:
            - INDEXER_USERNAME=admin
            - INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
            - WAZUH_API_URL=https://wazuh.manager
            - DASHBOARD_USERNAME=kibanaserver
            - DASHBOARD_PASSWORD=${WAZUH_DASHBOARD_PASSWORD}
            - API_USERNAME=wazuh-wui
            - API_PASSWORD=${WAZUH_API_PASSWORD}
        volumes:
            - ./wazuh/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
            - ./wazuh/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
            - ./wazuh/certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
            - ./wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
        depends_on:
            - wazuh.indexer
            - wazuh.manager
        networks:
            - monitoring_net
    rustfs_perm:
        image: alpine:latest
        container_name: rustfs_perm
        volumes:
            - /mnt/data:/data
        command: chown -R 1000:1000 /data
    rustfs:
        image: rustfs/rustfs:latest
        depends_on:
            rustfs_perm:
                condition: service_completed_successfully
        hostname: rustfs
        container_name: rustfs
        restart: unless-stopped
        volumes:
            - /mnt/data:/data
        environment:
            - RUSTFS_ACCESS_KEY=${RUSTFS_ACCESS_KEY:-rustfsadmin}
            - RUSTFS_SECRET_KEY=${RUSTFS_SECRET_KEY:-rustfsadmin}
            - RUSTFS_SERVER_DOMAINS=rustfs.uber-stup.club
            - RUSTFS_CONSOLE_ENABLE=true
            - RUSTFS_ADDRESS=:9000
            - RUSTFS_CONSOLE_ADDRESS=:9001
        networks:
            - monitoring_net

    # ─── Xavia OTA — PostgreSQL ───────────────────────────────
    xavia_db:
        image: postgres:16-alpine
        container_name: xavia_db
        restart: unless-stopped
        environment:
            - POSTGRES_USER=${XAVIA_POSTGRES_USER:-xavia}
            - POSTGRES_PASSWORD=${XAVIA_POSTGRES_PASSWORD}
            - POSTGRES_DB=${XAVIA_POSTGRES_DB:-releases_db}
        volumes:
            - xavia_db_data:/var/lib/postgresql/data
        networks:
            - monitoring_net

    # ─── Xavia OTA ────────────────────────────────────────────
    xavia:
        image: xaviaio/xavia-ota:latest
        container_name: xavia
        restart: unless-stopped
        environment:
            - HOST=https://ota.uber-stup.club
            - BLOB_STORAGE_TYPE=local
            - DB_TYPE=postgres
            - ADMIN_PASSWORD=${XAVIA_ADMIN_PASSWORD}
            - UPLOAD_KEY=${XAVIA_UPLOAD_KEY}
            - PRIVATE_KEY_BASE_64=${XAVIA_PRIVATE_KEY_BASE_64}
            - POSTGRES_USER=${XAVIA_POSTGRES_USER:-xavia}
            - POSTGRES_PASSWORD=${XAVIA_POSTGRES_PASSWORD}
            - POSTGRES_DB=${XAVIA_POSTGRES_DB:-releases_db}
            - POSTGRES_HOST=xavia_db
            - POSTGRES_PORT=5432
        volumes:
            - xavia_blobs:/app/blobs
        depends_on:
            - xavia_db
        networks:
            - monitoring_net
    # ─── Gitea ────────────────────────────────────────────────
    gitea:
        image: gitea/gitea:latest
        container_name: gitea
        restart: unless-stopped
        environment:
            - USER_UID=1000
            - USER_GID=1000
            - GITEA__database__DB_TYPE=sqlite3
            - GITEA__server__DOMAIN=${GITEA_DOMAIN:-gitea.uber-stup.club}
            - GITEA__server__ROOT_URL=https://${GITEA_DOMAIN:-gitea.uber-stup.club}
            - GITEA__server__HTTP_PORT=3000
            - GITEA__service__DISABLE_REGISTRATION=${GITEA_DISABLE_REGISTRATION:-true}
            - GITEA__service__REQUIRE_SIGNIN_VIEW=true
            - GITEA__security__SECRET_KEY=${GITEA_SECRET_KEY}
            - GITEA__security__INTERNAL_TOKEN=${GITEA_INTERNAL_TOKEN}
        volumes:
            - gitea_data:/data
        networks:
            - monitoring_net

networks:
    monitoring_net:
        driver: bridge

volumes:
    # Xavia
    xavia_db_data:
    xavia_blobs:
    # Wazuh
    wazuh_api_configuration:
    wazuh_etc:
    wazuh_logs:
    wazuh_queue:
    wazuh_var_multigroups:
    wazuh_integrations:
    wazuh_active_response:
    wazuh_agentless:
    wazuh_wodles:
    filebeat_etc:
    filebeat_var:
    wazuh_indexer_data:
    nginx_logs:
    # Gitea
    gitea_data: