docker-compose.yml

version: '3.8'

services:
  # Control Plane API
  control-plane:
    build: ./control-plane
    container_name: sentinel-control-plane
    ports:
      - "8000:8000"
    environment:
      - KAFKA_BOOTSTRAP_SERVERS=kafka:9092
      - NEO4J_URI=bolt://neo4j:7687
      - NEO4J_USER=neo4j
      - NEO4J_PASSWORD=sentinelprime
      - REDIS_HOST=redis
      - REDIS_PORT=6379
    depends_on:
      - kafka
      - neo4j
      - redis
    volumes:
      - ./control-plane:/app
    networks:
      - sentinel-network
    restart: unless-stopped

  # Kafka (using Redpanda for lightweight deployment)
  kafka:
    image: redpandadata/redpanda:latest
    container_name: sentinel-kafka
    command:
      - redpanda
      - start
      - --smp 1
      - --memory 1G
      - --reserve-memory 0M
      - --overprovisioned
      - --node-id 0
      - --kafka-addr PLAINTEXT://0.0.0.0:9092
      - --advertise-kafka-addr PLAINTEXT://kafka:9092
    ports:
      - "9092:9092"
      - "9644:9644"
    networks:
      - sentinel-network
    restart: unless-stopped

  # Neo4j Graph Database
  neo4j:
    image: neo4j:5.16.0
    container_name: sentinel-neo4j
    ports:
      - "7474:7474"  # HTTP
      - "7687:7687"  # Bolt
    environment:
      - NEO4J_AUTH=neo4j/sentinelprime
      - NEO4J_dbms_memory_heap_max__size=512M
      - NEO4J_dbms_memory_pagecache_size=256M
    volumes:
      - neo4j-data:/data
    networks:
      - sentinel-network
    restart: unless-stopped

  # Redis (for caching and session management)
  redis:
    image: redis:7-alpine
    container_name: sentinel-redis
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    networks:
      - sentinel-network
    restart: unless-stopped

  # Elasticsearch (for log storage and search)
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.0
    container_name: sentinel-elasticsearch
    environment:
      - discovery.type=single-node
      - "ES_JAVA_OPTS=-Xms256m -Xmx256m"
      - xpack.security.enabled=false
      - bootstrap.memory_lock=true
    ulimits:
      memlock:
        soft: -1
        hard: -1
    ports:
      - "9200:9200"
    volumes:
      - elasticsearch-data:/usr/share/elasticsearch/data
    networks:
      - sentinel-network
    restart: unless-stopped

  # Kibana (for visualization)
  kibana:
    image: docker.elastic.co/kibana/kibana:8.11.0
    container_name: sentinel-kibana
    ports:
      - "5601:5601"
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    depends_on:
      - elasticsearch
    networks:
      - sentinel-network
    restart: unless-stopped

  # Prometheus (for metrics)
  prometheus:
    image: prom/prometheus:latest
    container_name: sentinel-prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus-data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
    networks:
      - sentinel-network
    restart: unless-stopped

  # Grafana (for dashboards)
  grafana:
    image: grafana/grafana:latest
    container_name: sentinel-grafana
    ports:
      - "3001:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=sentinelprime
      - GF_USERS_ALLOW_SIGN_UP=false
    volumes:
      - grafana-data:/var/lib/grafana
      - ./monitoring/grafana/dashboards:/etc/grafana/provisioning/dashboards
      - ./monitoring/grafana/datasources:/etc/grafana/provisioning/datasources
    depends_on:
      - prometheus
    networks:
      - sentinel-network
    restart: unless-stopped

  # Wazuh Manager (EDR)
  # Note: Uncomment for full deployment
  # wazuh:
  #   image: wazuh/wazuh:latest
  #   container_name: sentinel-wazuh
  #   ports:
  #     - "1514:1514"  # Agent connections
  #     - "1515:1515"  # Agent enrollment
  #     - "55000:55000"  # API
  #   volumes:
  #     - wazuh-data:/var/ossec/data
  #     - ./edr/wazuh/config.yaml:/var/ossec/etc/ossec.conf
  #   networks:
  #     - sentinel-network
  #   restart: unless-stopped

  # Zeek (NDR)
  # Note: Requires host network mode for packet capture
  # zeek:
  #   image: zeekurity/zeek:latest
  #   container_name: sentinel-zeek
  #   network_mode: host
  #   volumes:
  #     - ./ndr/zeek:/usr/local/zeek/share/zeek/site
  #     - zeek-logs:/usr/local/zeek/logs
  #   cap_add:
  #     - NET_ADMIN
  #     - NET_RAW
  #   restart: unless-stopped

networks:
  sentinel-network:
    driver: bridge

volumes:
  neo4j-data:
  redis-data:
  elasticsearch-data:
  prometheus-data:
  grafana-data:
  wazuh-data:
  zeek-logs: