docker-compose.yml

# This file is part of Dependency-Track.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
# Copyright (c) OWASP Foundation. All Rights Reserved.
version: "3"

services:
  notification-publisher:
    image: ghcr.io/dependencytrack/hyades-notification-publisher:snapshot-native
    depends_on:
      postgres:
        condition: service_healthy
      redpanda:
        condition: service_healthy
      secret-init:
        condition: service_completed_successfully
    environment:
      KAFKA_BOOTSTRAP_SERVERS: "dt-redpanda:29092"
      QUARKUS_DATASOURCE_JDBC_URL: "jdbc:postgresql://dt-postgres:5432/dtrack"
      QUARKUS_DATASOURCE_USERNAME: "dtrack"
      QUARKUS_DATASOURCE_PASSWORD: "dtrack"
      SECRET_KEY_PATH: "/var/run/secrets/secret.key"
    ports:
      # Dynamic host port binding to allow for scaling of the service.
      # Scaling with Compose doesn't work when assigning static host ports.
      - "8090"
    profiles:
      - demo
    volumes:
      - "secret-data:/var/run/secrets:ro"
    restart: unless-stopped

  repo-meta-analyzer:
    image: ghcr.io/dependencytrack/hyades-repository-meta-analyzer:snapshot-native
    depends_on:
      postgres:
        condition: service_healthy
      redpanda:
        condition: service_healthy
      secret-init:
        condition: service_completed_successfully
    environment:
      KAFKA_BOOTSTRAP_SERVERS: "dt-redpanda:29092"
      KAFKA_STREAMS_NUM_STREAM_THREADS: "6" # Default number of input partitions is 6
      QUARKUS_DATASOURCE_JDBC_URL: "jdbc:postgresql://dt-postgres:5432/dtrack"
      QUARKUS_DATASOURCE_USERNAME: "dtrack"
      QUARKUS_DATASOURCE_PASSWORD: "dtrack"
      SECRET_KEY_PATH: "/var/run/secrets/secret.key"
    ports:
      # Dynamic host port binding to allow for scaling of the service.
      # Scaling with Compose doesn't work when assigning static host ports.
      - "8091"
    profiles:
      - demo
    volumes:
      - "secret-data:/var/run/secrets:ro"
    restart: unless-stopped

  vuln-analyzer:
    image: ghcr.io/dependencytrack/hyades-vulnerability-analyzer:snapshot-native
    depends_on:
      postgres:
        condition: service_healthy
      redpanda:
        condition: service_healthy
    environment:
      KAFKA_BOOTSTRAP_SERVERS: "dt-redpanda:29092"
      KAFKA_STREAMS_NUM_STREAM_THREADS: "12" # Default number of input partitions is 12
      QUARKUS_DATASOURCE_JDBC_URL: "jdbc:postgresql://dt-postgres:5432/dtrack"
      QUARKUS_DATASOURCE_USERNAME: "dtrack"
      QUARKUS_DATASOURCE_PASSWORD: "dtrack"
      SCANNER_INTERNAL_ENABLED: "true"
      # SCANNER_INTERNAL_TOPIC_PARTITIONS: "3"
      SCANNER_OSSINDEX_ENABLED: "true"
      # SCANNER_OSSINDEX_TOPIC_PARTITIONS: "3"
      # SCANNER_OSSINDEX_API_USERNAME: "email@example.com"
      # SCANNER_OSSINDEX_API_TOKEN: "your-token"
      # SCANNER_SNYK_ENABLED: "true"
      # SCANNER_SNYK_TOPIC_PARTITIONS: "3"
      # SCANNER_SNYK_API_ORG_ID: "your-org-id"
      # SCANNER_SNYK_API_TOKENS: "your-token-1,your-token-2"
    ports:
      # Dynamic host port binding to allow for scaling of the service.
      # Scaling with Compose doesn't work when assigning static host ports.
      - "8092"
    profiles:
      - demo
    restart: unless-stopped

  mirror-service:
    image: ghcr.io/dependencytrack/hyades-mirror-service:snapshot-native
    depends_on:
      postgres:
        condition: service_healthy
      redpanda:
        condition: service_healthy
    environment:
      KAFKA_BOOTSTRAP_SERVERS: "dt-redpanda:29092"
      KAFKA_STREAMS_NUM_STREAM_THREADS: "3"
    ports:
      # Dynamic host port binding to allow for scaling of the service.
      # Scaling with Compose doesn't work when assigning static host ports.
      - "8093"
    profiles:
      - demo
    restart: unless-stopped

  apiserver:
    image: ghcr.io/dependencytrack/hyades-apiserver:snapshot
    container_name: dt-apiserver
    depends_on:
      postgres:
        condition: service_healthy
      redpanda:
        condition: service_healthy
      secret-init:
        condition: service_completed_successfully
    environment:
      # Limit maximum heap size to 2GB.
      # Default would be 90% of available memory,
      # which can cause problems on some workstations.
      # For production deployments, the default should be used.
      EXTRA_JAVA_OPTIONS: "-Xmx2g"
      ALPINE_DATABASE_MODE: "external"
      ALPINE_DATABASE_URL: "jdbc:postgresql://dt-postgres:5432/dtrack"
      ALPINE_DATABASE_DRIVER: "org.postgresql.Driver"
      ALPINE_DATABASE_USERNAME: "dtrack"
      ALPINE_DATABASE_PASSWORD: "dtrack"
      ALPINE_METRICS_ENABLED: "true"
      ALPINE_SECRET_KEY_PATH: "/var/run/secrets/secret.key"
      KAFKA_BOOTSTRAP_SERVERS: "dt-redpanda:29092"
      KAFKA_NUM_STREAM_THREADS: "12" # Default number of input partitions is 12
      KAFKA_STREAMS_METRICS_RECORDING_LEVEL: "DEBUG"
      INTEGRITY_CHECK_ENABLED: "true"
    ports:
      - "127.0.0.1:8080:8080"
    volumes:
      - "apiserver-data:/data"
      - "secret-data:/var/run/secrets:ro"
    profiles:
      - demo
    restart: unless-stopped

  frontend:
    image: ghcr.io/dependencytrack/hyades-frontend:snapshot
    container_name: dt-frontend
    environment:
      API_BASE_URL: "http://localhost:8080"
    ports:
      - "127.0.0.1:8081:8080"
    profiles:
      - demo
    restart: unless-stopped

  postgres:
    image: postgres:16-alpine
    container_name: dt-postgres
    environment:
      POSTGRES_DB: "dtrack"
      POSTGRES_USER: "dtrack"
      POSTGRES_PASSWORD: "dtrack"
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready", "-d", "dtrack" ]
      interval: 5s
      timeout: 3s
      retries: 3
    ports:
      - "5432:5432"
    volumes:
      - "postgres-data:/var/lib/postgresql/data"
    restart: unless-stopped

  redpanda:
    image: docker.redpanda.com/vectorized/redpanda:v23.3.11
    container_name: dt-redpanda
    command:
      - redpanda
      - start
      - --smp
      - '1'
      - --reserve-memory
      - 0M
      - --memory
      - 512M
      - --overprovisioned
      - --node-id
      - '0'
      - --kafka-addr
      - PLAINTEXT://0.0.0.0:29092,OUTSIDE://0.0.0.0:9092,MINIKUBE://0.0.0.0:9093
      - --advertise-kafka-addr
      - PLAINTEXT://dt-redpanda:29092,OUTSIDE://localhost:9092,MINIKUBE://host.minikube.internal:9093
      - --pandaproxy-addr
      - PLAINTEXT://0.0.0.0:28082,OUTSIDE://0.0.0.0:8082
      - --advertise-pandaproxy-addr
      - PLAINTEXT://dt-redpanda:28082,OUTSIDE://localhost:8082
    healthcheck:
      test: [ "CMD-SHELL", "rpk", "cluster", "health", "--exit-when-healthy" ]
      interval: 5s
      timeout: 3s
      retries: 3
    ports:
      # Kafka API (for use from localhost)
      - "9092:9092"
      # Kafka API (for use from minikube)
      - "9093:9093"
    volumes:
      - "redpanda-data:/var/lib/redpanda/data"
    restart: unless-stopped

  redpanda-init:
    image: docker.redpanda.com/vectorized/redpanda:v23.3.11
    container_name: dt-redpanda-init
    depends_on:
      redpanda:
        condition: service_healthy
    entrypoint: "/bin/bash"
    command: "/tmp/create-topics.sh"
    user: "0" # Ensure user can read create-topics.sh
    environment:
      REDPANDA_BROKERS: "dt-redpanda:29092"
      # KAFKA_TOPIC_PREFIX: ""
      # NOTIFICATION_TOPICS_PARTITIONS: "3"
      # NOTIFICATION_TOPICS_RETENTION_MS: "43200000" # 12h
      # REPO_META_ANALYSIS_TOPICS_PARTITIONS: "3"
      # REPO_META_ANALYSIS_TOPICS_RETENTION_MS: "43200000" # 12h
      # VULN_ANALYSIS_TOPICS_PARTITIONS: "3"
      # VULN_ANALYSIS_TOPICS_RETENTION_MS: "43200000" # 12h
      # VULN_ANALYSIS_RESULT_TOPIC_PARTITIONS: "3"
      # VULN_ANALYSIS_RESULT_TOPIC_RETENTION_MS: "43200000" # 12h
      # VULN_MIRROR_TOPICS_PARTITIONS: "3"
      # VULN_MIRROR_TOPICS_RETENTION_MS: "43200000" # 12h
    volumes:
      - "./scripts/create-topics.sh:/tmp/create-topics.sh:ro"
    restart: on-failure

  redpanda-console:
    image: docker.redpanda.com/vectorized/console:v2.4.6
    container_name: dt-redpanda-console
    entrypoint: "/bin/sh"
    command: "-c 'echo \"$$CONSOLE_CONFIG_FILE\" > \"$$CONFIG_FILEPATH\"; /app/console'"
    depends_on:
      redpanda:
        condition: service_healthy
    environment:
      CONFIG_FILEPATH: "/tmp/config.yml"
      CONSOLE_CONFIG_FILE: |
        kafka:
          brokers: ["redpanda:29092"]
          protobuf:
            enabled: true
            mappings:
              - topicName: dtrack.notification.analyzer
                valueProtoType: org.dependencytrack.notification.v1.Notification
              - topicName: dtrack.notification.bom
                valueProtoType: org.dependencytrack.notification.v1.Notification
              - topicName: dtrack.notification.configuration
                valueProtoType: org.dependencytrack.notification.v1.Notification
              - topicName: dtrack.notification.datasource-mirroring
                valueProtoType: org.dependencytrack.notification.v1.Notification
              - topicName: dtrack.notification.file-system
                valueProtoType: org.dependencytrack.notification.v1.Notification
              - topicName: dtrack.notification.integration
                valueProtoType: org.dependencytrack.notification.v1.Notification
              - topicName: dtrack.notification.new-vulnerability
                valueProtoType: org.dependencytrack.notification.v1.Notification
              - topicName: dtrack.notification.new-vulnerable-dependency
                valueProtoType: org.dependencytrack.notification.v1.Notification
              - topicName: dtrack.notification.policy-violation
                valueProtoType: org.dependencytrack.notification.v1.Notification
              - topicName: dtrack.notification.project-audit-change
                valueProtoType: org.dependencytrack.notification.v1.Notification
              - topicName: dtrack.notification.project-created
                valueProtoType: org.dependencytrack.notification.v1.Notification
              - topicName: dtrack.notification.project-vuln-analysis-complete
                valueProtoType: org.dependencytrack.notification.v1.Notification
              - topicName: dtrack.notification.repository
                valueProtoType: org.dependencytrack.notification.v1.Notification
              - topicName: dtrack.notification.vex
                valueProtoType: org.dependencytrack.notification.v1.Notification
              - topicName: dtrack.repo-meta-analysis.component
                valueProtoType: org.dependencytrack.repometaanalysis.v1.AnalysisCommand
              - topicName: dtrack.repo-meta-analysis.result
                valueProtoType: org.dependencytrack.repometaanalysis.v1.AnalysisResult
              - topicName: dtrack.vuln-analysis.component
                keyProtoType: org.dependencytrack.vulnanalysis.v1.ScanKey
                valueProtoType: org.dependencytrack.vulnanalysis.v1.ScanCommand
              - topicName: dtrack.vuln-analysis.scanner.result
                keyProtoType: org.dependencytrack.vulnanalysis.v1.ScanKey
                valueProtoType: org.dependencytrack.vulnanalysis.v1.ScannerResult
              - topicName: dtrack.vuln-analysis.result
                keyProtoType: org.dependencytrack.vulnanalysis.v1.ScanKey
                valueProtoType: org.dependencytrack.vulnanalysis.v1.ScanResult
              - topicName: dtrack.vulnerability
                valueProtoType: org.cyclonedx.v1_4.Bom
              - topicName: dtrack.epss
                valueProtoType: org.dependencytrack.mirror.v1.EpssItem
            fileSystem:
              enabled: true
              paths: ["/etc/protos"]
              refreshInterval: 5m
    ports:
      - "127.0.0.1:28080:8080"
    volumes:
      - "./proto/src/main/proto:/etc/protos:ro"
    restart: unless-stopped

  secret-init:
    image: alpine:latest
    command: "/bin/sh -c 'if [ ! -f /tmp/secret/secret.key ]; then head -c 32 /dev/urandom > /tmp/secret/secret.key; fi'"
    profiles:
      - demo
    volumes:
      - "secret-data:/tmp/secret"
    restart: on-failure

  prometheus:
    image: prom/prometheus:v2.51.2
    container_name: dt-prometheus
    ports:
      - "127.0.0.1:9090:9090"
    volumes:
      - "./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro"
      - "prometheus-data:/prometheus"
    profiles:
      - monitoring
    restart: unless-stopped

  grafana:
    image: grafana/grafana-oss:10.4.2
    container_name: dt-grafana
    depends_on:
      - prometheus
    environment:
      GF_SECURITY_ADMIN_USER: "admin"
      GF_SECURITY_ADMIN_PASSWORD: "admin"
    ports:
      - "127.0.0.1:3000:3000"
    volumes:
      - "grafana-data:/var/lib/grafana"
      - "./monitoring/grafana/dashboards:/etc/dashboards:ro"
      - "./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro"
    profiles:
      - monitoring
    restart: unless-stopped

volumes:
  apiserver-data: { }
  secret-data: { }
  postgres-data: { }
  redpanda-data: { }
  grafana-data: { }
  prometheus-data: { }