docker-compose.yml.sample

services:

  #########################################################
  ##############  Incoming Traffic Endpoints ##############
  #########################################################
  # Endpoint of the system control panel
  hosting-control-caddy:
    container_name: hosting-control-caddy
    image: caddy:2.11-alpine
    user: 1000:1000
    runtime: sysbox-runc
    read_only: true
    environment:
      - HOSTING_DOMAIN=hosting.knf.vu.lt
      - TLS_LETSENCRYPT_EMAIL=internal # Self-Signed

      - DBGATE_AUTH_HEADER=${DBGATE_AUTH_HEADER}
    volumes:
      - ./control-modules/control-caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - ./_DATA/control-caddy/caddy_data:/data
      - ./_DATA/control-caddy/caddy_config:/config
      - ./_DATA/control-caddy/caddy_logs:/var/log/caddy
      - ./_DATA/control-caddy/certs:/config/certs:ro
    ports:
      - 80:80
      - 443:443
      - 8443:8443
    networks:
      external: {}
      isolated-control-panel: {}
      filtered-users:
        ipv4_address: 172.19.2.2
    restart: unless-stopped


  # Users servers hosted apps WEB traffic endpoint
  hosting-users-caddy:
    container_name: hosting-users-caddy
    image: caddy:2.11-alpine
    user: 1000:1000
    runtime: sysbox-runc
    read_only: true
    volumes:
      - ./_DATA/users-caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - ./_DATA/users-caddy/caddy_data:/data
      - ./_DATA/users-caddy/caddy_config:/config
      - ./_DATA/users-caddy/caddy_logs:/var/log/caddy
      - ./_DATA/users-caddy/certs:/config/certs:ro
    ports:
      - 10080:80
      - 10443:443
    networks:
      external: {}
      filtered-users:
        ipv4_address: 172.19.2.3
    restart: unless-stopped


  # SSH Router for Users
  hosting-users-ssh-router:
    container_name: hosting-users-ssh-router
    image: vuknf/hosting-users-ssh-router:latest
    user: 1000:1000
    runtime: sysbox-runc
    read_only: true
    environment:
      - BACKEND_SSH_API_URL=http://hosting-control-backend:8000/api/sshrouter
      - BACKEND_SSH_API_KEY=${BACKEND_SSH_API_KEY}
    ports:
      - "10022:2222"
    networks:
      external: {}
      isolated-control-panel: {}
      filtered-users:
        ipv4_address: 172.19.2.5
    restart: unless-stopped
  #########################################################
  #########################################################
  #########################################################




  #########################################################
  ############  System Control Panel Services #############
  #########################################################
  # Control Panel Frontend
  hosting-control-frontend:
    container_name: hosting-control-frontend
    image: vuknf/hosting-control-frontend:latest
    user: 1000:1000
    runtime: sysbox-runc
    read_only: true
    environment:
      - BACKEND_API_URL=http://hosting-control-backend:8000
    volumes:
      - /etc/localtime:/etc/localtime:ro
    networks:
      - isolated-control-panel
    restart: unless-stopped


  # Control Panel Backend
  hosting-control-backend:
    container_name: hosting-control-backend
    image: vuknf/hosting-control-backend:latest
    user: 1000:1000
    runtime: sysbox-runc
    read_only: true
    environment:
      - TMPDIR=/tmp/backend
      - DB_PATH=/data/database.db

      - DOCKER_CONTROLLER_HOST=hosting-control-docker
      - DOCKER_CONTROLLER_PORT=8000

      - BACKEND_SSH_API_KEY=${BACKEND_SSH_API_KEY}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./_DATA/control-backend:/data
    extra_hosts:
      - "auth.docker.io:172.19.0.30"
      - "registry-1.docker.io:172.19.0.30"
    networks:
      - isolated-control-panel
      - isolated-control-docker
    restart: unless-stopped
  

  # Exit container for Docker Hub API access (L4 SNI proxy)
  hosting-control-backend-exit:
    container_name: hosting-control-backend-exit
    image: vuknf/caddy-l4:2.11
    user: 1000:1000
    runtime: sysbox-runc
    read_only: true
    volumes:
      - ./control-modules/control-backend-exit/Caddyfile:/etc/caddy/Caddyfile:ro
    networks:
      isolated-control-panel:
        ipv4_address: 172.19.0.30
      external: {}
    restart: unless-stopped


  # System Docker Controller
  hosting-control-docker:
    container_name: hosting-control-docker
    image: vuknf/hosting-control-docker:latest
    user: root
    runtime: sysbox-runc
    read_only: true
    environment:
      - ROOT_DIR=${ROOT_DIR}
      - USERS_VM_DIR=SERVERS
      - APP_DEBUG=false
    volumes:
      - /etc/localtime:/etc/localtime:ro

      # Users Caddy
      - ./_DATA/users-caddy:/users-caddy

      # Control Docker
      - /var/run/docker.sock:/var/run/docker.sock

      # Users virtual servers persistent directories
      - ${ROOT_DIR}/SERVERS:${ROOT_DIR}/SERVERS
    networks:
      - isolated-control-docker
    restart: unless-stopped


  # Container Monitoring (Cadvisor)
  hosting-control-cadvisor:
    container_name: hosting-control-cadvisor
    image: gcr.io/cadvisor/cadvisor:v0.52.1
    privileged: true
    devices:
      - /dev/kmsg
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    networks:
      - isolated-control-docker
    restart: unless-stopped


  hosting-control-dockersocket:
    container_name: hosting-control-dockersocket
    image: caddy:2.11-alpine
    user: 1000:1000
    runtime: sysbox-runc
    read_only: true
    volumes:
      - ./control-modules/control-dockersocket/Caddyfile:/etc/caddy/Caddyfile:ro
    networks:
      isolated-control-docker: {}
      filtered-users:
        ipv4_address: 172.19.2.11
    restart: unless-stopped 
  
  
  # Database Browser
  hosting-control-dbgate:
    container_name: hosting-control-dbgate
    image: dbgate/dbgate:7.1.4
    environment:
      WEB_ROOT: /dbgate

      BASIC_AUTH: 1
      LOGIN: dbgate
      PASSWORD: ${DBGATE_PASSWORD}

      CONNECTIONS: con1
      LABEL_con1: App Hosting Platform - SQLite
      FILE_con1: /root/db.sqlite3
      ENGINE_con1: sqlite@dbgate-plugin-sqlite
    read_only: false
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./_DATA/control-backend/database.db:/root/db.sqlite3
    networks:
      - isolated-control-panel
    restart: unless-stopped
  #########################################################
  #########################################################
  #########################################################




  #########################################################
  ####################  Documentation #####################
  #########################################################
  hosting-control-docs-web:
    container_name: hosting-control-docs-web
    image: linuxserver/bookstack:25.11.1
    environment:
      - PUID=1000
      - PGID=1000
      - APP_KEY=${BOOKSTACK_APP_KEY}
      - APP_URL=https://hosting.knf.vu.lt/docs
      - DB_HOST=hosting-control-docs-mariadb
      - DB_PORT=3306
      - DB_USERNAME=bookstack
      - DB_PASSWORD=bookstack
      - DB_DATABASE=bookstackapp
      - APP_DEFAULT_DARK_MODE=true
      - APP_PROXIES=*
      - APP_TIMEZONE=Europe/Vilnius
      - SESSION_LIFETIME=40320
      - DRAWIO=https://hosting.knf.vu.lt/draw/?embed=1&proto=json&spin=1&configure=1
    read_only: false
    volumes:
      - ./_DATA/control-docs/app_data:/config
    depends_on:
      - hosting-control-docs-mariadb
    networks:
      - isolated-control-panel
    restart: unless-stopped



  hosting-control-docs-mariadb:
    container_name: hosting-control-docs-mariadb
    image: linuxserver/mariadb:10.11.10
    environment:
      - PUID=1000
      - PGID=1000
      - MYSQL_ROOT_PASSWORD=bookstack
      - TZ=Europe/Vilnius
      - MYSQL_DATABASE=bookstackapp
      - MYSQL_USER=bookstack
      - MYSQL_PASSWORD=bookstack
    read_only: false
    volumes:
      - ./_DATA/control-docs/db_data:/config
    networks:
      - isolated-control-panel
    restart: unless-stopped



  hosting-control-docs-drawio:
    container_name: hosting-control-docs-drawio
    image: jgraph/drawio:29.0.3
    user: 1000:1000
    runtime: sysbox-runc
    read_only: false
    networks:
      - isolated-control-panel
    restart: unless-stopped



  hosting-control-swagger:
    container_name: hosting-control-swagger
    image: swaggerapi/swagger-ui:v5.29.5
    user: 1000:1000
    runtime: sysbox-runc
    read_only: false
    volumes:
      - ./control-modules/control-swagger/swagger.yaml:/swagger.yaml:ro
    environment:
      - SWAGGER_JSON=/swagger.yaml
      - BASE_URL=/swagger
    networks:
      - isolated-control-panel
    restart: unless-stopped
  #########################################################
  #########################################################
  #########################################################





  #########################################################
  ############## Outgoing Traffic Management ##############
  #########################################################
  # Outgoing users traffic firewall
  hosting-users-firewall:
    container_name: hosting-users-firewall
    image: vuknf/hosting-users-firewall:latest
    user: root
    runtime: sysbox-runc
    command: >-
      sh -c "
      sysctl -w net.ipv4.ip_forward=1 &&
      iptables -F &&
      iptables -t nat -F &&
      iptables -t nat -X &&

      echo '[*] Set default policies' &&
      iptables -P FORWARD DROP &&

      echo '[*] Restrict access to local networks' &&
      iptables -A FORWARD -s 172.19.2.0/24 -d 172.16.0.0/12 -j DROP &&
      iptables -A FORWARD -s 172.19.2.0/24 -d 192.168.0.0/16 -j DROP &&
      iptables -A FORWARD -s 172.19.2.0/24 -d 10.0.0.0/8 -j DROP &&

      echo '[*] Allow VM traffic to internet' &&
      iptables -A FORWARD -s 172.19.2.0/24 -j ACCEPT &&

      echo '[*] Allow returning traffic' &&
      iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT &&

      echo '[*] NAT outgoing traffic' &&
      iptables -t nat -A POSTROUTING -s 172.19.2.0/24 -o eth1 -j MASQUERADE &&
      iptables -t nat -A POSTROUTING -s 172.19.2.0/24 -o eth0 -j MASQUERADE &&

      echo '[*] Starting DNS forwarder' &&
      dnsmasq --no-daemon --no-resolv --server=8.8.8.8 --server=1.1.1.1 --log-queries &

      echo '[*] Router configuration complete' &&
      tail -f /dev/null"
    networks:
      external: {}
      filtered-users:
        ipv4_address: 172.19.2.1
    restart: unless-stopped


  # Docker Hub cache proxy for users
  hosting-users-dockerhub-cache:
    container_name: hosting-users-dockerhub-cache
    image: registry:3.0.0
    user: 1000:1000
    runtime: sysbox-runc
    read_only: true
    environment:
      REGISTRY_PROXY_REMOTEURL: https://registry-1.docker.io
    volumes:
      - ./_DATA/users-dockerhub-cache:/var/lib/registry
    networks:
      external: {}
      filtered-users:
        ipv4_address: 172.19.2.4
    restart: unless-stopped
  #########################################################
  #########################################################
  #########################################################





networks:
  external:
    name: external
    external: true
  isolated-control-panel:
    name: isolated-control-panel
    driver: bridge
    internal: true
    ipam:
      config:
        - subnet: 172.19.0.0/24
          gateway: 172.19.0.1
  isolated-control-docker:
    name: isolated-control-docker
    driver: bridge
    internal: true
    ipam:
      config:
        - subnet: 172.19.1.0/24
          gateway: 172.19.1.1
  filtered-users:
    name: filtered-users
    driver: bridge
    internal: false
    driver_opts:
      com.docker.network.bridge.enable_ip_masquerade: 'false'
    ipam:
      config:
        - subnet: 172.19.2.0/24
          ip_range: 172.19.2.128/25
          gateway: 172.19.2.254