docker-compose.yml

services:
  workspace-builder:
    container_name: workspace-builder
    build: ./workspace
    environment:
      - DOJO_WORKSPACE=${DOJO_WORKSPACE}
      - NIX_GARBAGE_COLLECT=${NIX_GARBAGE_COLLECT:-false}
    volumes:
      - /data/workspace/nix:/nix

  workspacefs:
    container_name: workspacefs
    privileged: true
    build: ./workspacefs
    volumes:
      - /data/workspacefs:/run/workspace:shared
      - /data/workspace/nix:/nix
    depends_on:
      workspace-builder:
        condition: service_completed_successfully

  dojofs:
    container_name: dojofs
    privileged: true
    pid: host
    build: ./dojofs
    volumes:
      - /run/dojofs:/run/dojofs:shared
      - /var/run/docker.sock:/var/run/docker.sock:ro

  homefs:
    container_name: homefs
    privileged: true
    build: ./homefs
    environment:
      - STORAGE_ROOT=/run/homefs
      - STORAGE_HOST=192.168.42.1
    volumes:
      - /run/homefs:/run/homefs:shared
      - /var/run/docker/plugins:/var/run/docker/plugins
    ports:
      - "4201:4201"

  ctfd:
    container_name: ctfd
    profiles:
      - main
    hostname: ctfd
    build: /opt/CTFd
    platform: linux/amd64
    user: root
    restart: always
    entrypoint: ""
    command:
      - /bin/sh
      - -c
      - |
        if [ "$DOJO_ENV" != "development" ]; then
          ./docker-entrypoint.sh;
        else
          FLASK_DEBUG=True WERKZEUG_DEBUG_PIN=off flask run --host 0.0.0.0 --port 8000;
        fi
    ulimits:
        nofile:
            soft: 32768
            hard: 1048576
    environment:
      - UPLOAD_FOLDER=/var/uploads
      - DATABASE_URL=mysql+pymysql://${DB_USER}:${DB_PASS}@${DB_HOST}/${DB_NAME}
      - REDIS_URL=redis://cache:6379
      - WORKERS=8
      - LOG_FOLDER=/var/log/CTFd
      - ACCESS_LOG=-
      - ERROR_LOG=-
      - REVERSE_PROXY=true
      - SERVER_SENT_EVENTS=false
      - SECRET_KEY=${SECRET_KEY}
      - DOJO_HOST=${DOJO_HOST}
      - HOST_DATA_PATH=/data
      - MAIL_SERVER=${MAIL_SERVER}
      - MAIL_PORT=${MAIL_PORT}
      - MAIL_USERNAME=${MAIL_USERNAME}
      - MAIL_PASSWORD=${MAIL_PASSWORD}
      - MAIL_ADDRESS=${MAIL_ADDRESS}
      - DOCKER_USERNAME=${DOCKER_USERNAME}
      - DOCKER_TOKEN=${DOCKER_TOKEN}
      - DISCORD_CLIENT_ID=${DISCORD_CLIENT_ID}
      - DISCORD_CLIENT_SECRET=${DISCORD_CLIENT_SECRET}
      - DISCORD_BOT_TOKEN=${DISCORD_BOT_TOKEN}
      - DISCORD_GUILD_ID=${DISCORD_GUILD_ID}
      - INTERNET_FOR_ALL=${INTERNET_FOR_ALL}
      - VIRTUAL_HOST=${VIRTUAL_HOST}
      - VIRTUAL_PORT=8000
      - LETSENCRYPT_HOST=${LETSENCRYPT_HOST}
      - MAC_HOSTNAME=${MAC_HOSTNAME}
      - MAC_USERNAME=${MAC_USERNAME}
      - MAC_KEY_FILE=${MAC_KEY_FILE}
      - MAC_GUEST_CONTROL_FILE=${MAC_GUEST_CONTROL_FILE}
    volumes:
      - /data/CTFd/logs:/var/log/CTFd
      - /data/CTFd/uploads:/var/uploads
      - /data/mac:/var/data/mac
      - /data/homes:/var/homes:shared
      - /data/dojos:/var/dojos
      - /data/workspace_nodes.json:/var/workspace_nodes.json:ro
      - /data/ssh_host_keys/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
      - ./user_firewall.allowed:/var/user_firewall.allowed:ro
      - /etc/docker/seccomp.json:/etc/docker/seccomp.json:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /opt/pwn.college/dojo_plugin:/opt/CTFd/CTFd/plugins/dojo_plugin:ro
      - /opt/pwn.college/dojo_theme:/opt/CTFd/CTFd/themes/dojo_theme:ro
    healthcheck:
      test:
        - "CMD"
        - "python"
        - "-c"
        - |
          import requests
          response = requests.get('http://localhost:8000')
          response.raise_for_status()
      interval: 10s
      timeout: 10s
      retries: 3
    depends_on:
      workspace-builder:
        condition: service_completed_successfully
      workspacefs:
        condition: service_started
      dojofs:
        condition: service_started
      homefs:
        condition: service_started
      db:
        condition: service_healthy
        restart: true
      cache:
        condition: service_started

  db:
    container_name: db
    profiles:
      - main
    build: ./db
    restart: always
    environment:
      - MYSQL_ROOT_PASSWORD=${DB_PASS}
      - MYSQL_USER=${DB_USER}
      - MYSQL_PASSWORD=${DB_PASS}
      - MYSQL_DATABASE=${DB_NAME}
      - DB_EXTERNAL=${DB_EXTERNAL}
    volumes:
      - /data/mysql:/var/lib/mysql
    command: [/start.sh]
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-p${DB_PASS}", "-u${DB_USER}", "-h${DB_HOST}"]
      interval: 10s
      timeout: 10s
      retries: 3

  cache:
    container_name: cache
    profiles:
      - main
    image: redis:4
    restart: always
    volumes:
      - /data/redis:/data

  sshd:
    container_name: sshd
    profiles:
      - main
    build: ./sshd
    volumes:
      - /data/workspace_nodes.json:/var/workspace_nodes.json:ro
      - /data/ssh_host_keys:/etc/ssh:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /data/mac:/var/data/mac:ro
    environment:
      - DB_HOST=${DB_HOST}
      - DB_NAME=${DB_NAME}
      - DB_USER=${DB_USER}
      - DB_PASS=${DB_PASS}
      - REDIS_URL=redis://cache:6379
      - MAC_HOSTNAME=${MAC_HOSTNAME}
      - MAC_USERNAME=${MAC_USERNAME}
      - MAC_KEY_FILE=${MAC_KEY_FILE}
      - MAC_GUEST_CONTROL_FILE=${MAC_GUEST_CONTROL_FILE}
    ports:
      - "22:22"

  nginx-proxy:
    container_name: nginx-proxy
    profiles:
      - main
    image: nginxproxy/nginx-proxy:1.5
    restart: always
    ports:
      - "80:80"
      - "443:443"
    environment:
      - DEFAULT_HOST=${DOJO_HOST}
      - TRUST_DOWNSTREAM_PROXY=false
      - LOG_JSON=true
    volumes:
      - conf:/etc/nginx/conf.d
      - html:/usr/share/nginx/html
      - certs:/etc/nginx/certs:ro
      - ./nginx-proxy/etc/nginx/vhost.d:/etc/nginx/vhost.d
      - /var/run/docker.sock:/tmp/docker.sock:ro
    networks:
      default:
      workspace_net:
        aliases:
          - nginx
        ipv4_address: 10.0.0.3

  acme-companion:
    container_name: nginx-proxy-acme
    profiles:
      - main
    image: nginxproxy/acme-companion:2.3
    restart: always
    volumes_from:
      - nginx-proxy
    volumes:
      - certs:/etc/nginx/certs:rw
      - acme:/etc/acme.sh
      - /var/run/docker.sock:/var/run/docker.sock:ro

  node-exporter:
    container_name: node-exporter
    image: prom/node-exporter
    command:
      - "--path.rootfs=/host"
    network_mode: host
    pid: host
    volumes:
      - /:/host:ro,rslave

  cadvisor:
    container_name: cadvisor
    image: gcr.io/cadvisor/cadvisor
    privileged: true
    ports:
      - "8080:8080"
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /data/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro

  prometheus:
    container_name: prometheus
    profiles:
      - main
    image: prom/prometheus
    volumes:
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_targets:/etc/prometheus/targets:ro
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:9090/-/healthy"]
      interval: 10s
      timeout: 10s
      retries: 3
    depends_on:
      prometheus-generate-targets:
        condition: service_completed_successfully

  prometheus-generate-targets:
    image: python:3.12-slim
    profiles:
      - main
    command:
      - /usr/local/bin/python
      - -c
      - |
        import json
        main_node_ip = "192.168.42.1"
        workspace_nodes = json.load(open("/var/workspace_nodes.json"))
        workspace_node_ips = [f"192.168.42.{int(node_id) + 1}" for node_id in workspace_nodes]
        cadvisor_targets = [{
            "labels": {"job": "cadvisor"},
            "targets": [f"{ip}:8080" for ip in [main_node_ip] + workspace_node_ips]
        }]
        node_exporter_targets = [{
            "labels": {"job": "node_exporter"},
            "targets": [f"{ip}:9100" for ip in [main_node_ip] + workspace_node_ips]
        }]
        with open("/etc/prometheus/targets/cadvisor.json", "w") as f:
            json.dump(cadvisor_targets, f, indent=2)
        with open("/etc/prometheus/targets/node_exporter.json", "w") as f:
            json.dump(node_exporter_targets, f, indent=2)
    volumes:
      - /data/workspace_nodes.json:/var/workspace_nodes.json:ro
      - prometheus_targets:/etc/prometheus/targets

  grafana:
    container_name: grafana
    profiles:
      - main
    image: grafana/grafana
    ports:
      - "3000:3000"
    environment:
      GF_SECURITY_DISABLE_INITIAL_ADMIN_CREATION: "true"
      GF_AUTH_ANONYMOUS_ENABLED: "true"
      GF_AUTH_ANONYMOUS_ORG_ROLE: "Admin"
      GF_AUTH_DISABLE_SIGNOUT_MENU: "true"
      GF_AUTH_DISABLE_LOGIN_FORM: "true"
    volumes:
      - ./grafana/datasource.yml:/etc/grafana/provisioning/datasources/datasource.yml:ro
    depends_on:
      prometheus:
        condition: service_healthy

  watchdog:
    container_name: watchdog
    profiles:
      - main
    build: ./watchdog
    volumes:
      - /data/workspace_nodes.json:/var/workspace_nodes.json:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro

  create-workspace-net:
    image: busybox:uclibc
    command: /bin/true
    networks:
      - workspace_net

volumes:
  conf:
  html:
  certs:
  acme:
  prometheus_targets:

networks:
  default:
    driver: bridge
  workspace_net:
    name: workspace_net
    driver: bridge
    ipam:
      config:
        - subnet: 10.0.0.0/8
    driver_opts:
      com.docker.network.bridge.name: "workspace_net"
      com.docker.network.bridge.enable_icc: "false"