docker-compose.production.yml

version: '3.5'

# will contain all elasticsearch data.
volumes:
  data:

secrets:
  elasticsearch.keystore:
    file: ./secrets/elasticsearch.keystore
  ca.crt:
    file: ./secrets/ca/ca.crt
  ca.key:
    file: ./secrets/ca/ca.key
  elasticsearch.key:
    file: ./secrets/elasticsearch/elasticsearch.key
  elasticsearch.cert:
    file: ./secrets/elasticsearch/elasticsearch.crt
  logstash.key:
    file: ./secrets/logstash/logstash.key
  logstash.pkcs8:
    file: ./secrets/logstash/logstash.pkcs8.key
  logstash.cert:
    file: ./secrets/logstash/logstash.crt
  kibana.key:
    file: ./secrets/kibana/kibana.key
  kibana.cert:
    file: ./secrets/kibana/kibana.crt
  filebeat.key:
    file: ./secrets/filebeat/filebeat.key
  filebeat.cert:
    file: ./secrets/filebeat/filebeat.crt

services:
  swag:
    image: linuxserver/swag
    container_name: swag
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=2000
      - PGID=2000
      - TZ=${TIMEZONE}
      - URL=${DOMAIN}
      - SUBDOMAINS=${SUBDOMAIN}
      - VALIDATION=http
      - EMAIL=${EMAIL}
      - STAGING=false
    volumes:
      - ./swag:/config
    ports:
      - 443:443
      - 80:80
    restart: unless-stopped
    networks:
      - elk
    depends_on: 
      - elasticsearch
      - kibana

  elasticsearch:
    container_name: elasticsearch
    hostname: elasticsearch
    build:
      context: elasticsearch/
      args:
        ELK_VERSION: ${ELK_VERSION}
    restart: unless-stopped
    environment:
      CONFIG_DIR: ${ELASTIC_DIR}/config
      ELASTIC_USERNAME: ${ELASTIC_USERNAME}
      ELASTIC_PASSWORD: ${ELASTIC_PASSWORD}
      ES_JAVA_OPTS: -Xmx${ELASTICSEARCH_HEAP} -Xms${ELASTICSEARCH_HEAP}
      bootstrap.memory_lock: "true"
      discovery.type: single-node
    volumes:
      - data:${ELASTIC_DIR}
      - ./elasticsearch/config/elasticsearch.yml:${ELASTIC_DIR}/config/elasticsearch.yml:ro
    secrets:
      - source: elasticsearch.keystore
        target: ${ELASTIC_DIR}/config/elasticsearch.keystore
      - source: ca.crt
        target: ${ELASTIC_DIR}/config/ca.crt
      - source: elasticsearch.cert
        target: ${ELASTIC_DIR}/config/elasticsearch.crt
      - source: elasticsearch.key
        target: ${ELASTIC_DIR}/config/elasticsearch.key
    expose:
      - 9200
      - 9300
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 200000
        hard: 200000
    networks:
      - elk

  kibana:
    container_name: kibana
    hostname: kibana
    build:
      context: kibana/
      args:
        ELK_VERSION: $ELK_VERSION
    restart: unless-stopped
    volumes:
      - ./kibana/config/kibana.yml:${KIBANA_DIR}/config/kibana.yml:ro
    environment:
      CONFIG_DIR: ${KIBANA_DIR}/config
      ELASTIC_USERNAME: ${ELASTIC_USERNAME}
      ELASTIC_PASSWORD: ${ELASTIC_PASSWORD}
      ENCRYPTION_KEY: ${XPACK_ENCRYPTION_KEY}
    secrets:
      - source: ca.crt
        target: ${KIBANA_DIR}/config/ca.crt
      - source: kibana.cert
        target: ${KIBANA_DIR}/config/kibana.crt
      - source: kibana.key
        target: ${KIBANA_DIR}/config/kibana.key
    ports:
      - "5601:5601"
    networks:
      - elk
    depends_on: 
      - elasticsearch

  logstash:
    container_name: logstash
    hostname: logstash
    build:
      context: logstash/
      args:
        ELK_VERSION: $ELK_VERSION
    restart: unless-stopped
    volumes:
      - ./logstash/config/logstash.yml:${LOGSTASH_DIR}/config/logstash.yml:ro
      - ./logstash/pipeline/logstash.conf:${LOGSTASH_DIR}/config/logstash.conf:ro
    environment:
      CONFIG_DIR: ${LOGSTASH_DIR}/config
      ELASTIC_USERNAME: ${ELASTIC_USERNAME}
      ELASTIC_PASSWORD: ${ELASTIC_PASSWORD}
      LS_JAVA_OPTS: "-Xmx${LOGSTASH_HEAP} -Xms${LOGSTASH_HEAP}"
    secrets:
      - source: ca.crt
        target: ${LOGSTASH_DIR}/config/ca.crt
      - source: logstash.cert
        target: ${LOGSTASH_DIR}/config/logstash.crt
      - source: logstash.key
        target: ${LOGSTASH_DIR}/config/logstash.key
      - source: logstash.pkcs8
        target: ${LOGSTASH_DIR}/config/logstash.pkcs8.key
    networks:
      - elk
    expose:
     - 12201/udp
     - 5044
     - 9600
     - 5000/tcp
     - 5000/udp
    depends_on: 
      - elasticsearch
  
  packetbeat:
    container_name: packetbeat
    hostname: packetbeat
    user: root
    build:
      context: packetbeat/
      args:
        ELK_VERSION: $ELK_VERSION
    restart: unless-stopped
    cap_add: 
      - NET_ADMIN
      - NET_RAW
    command: packetbeat -e -strict.perms=false
    volumes:
      - ./packetbeat/config/packetbeat.yml:${PACKETBEAT_DIR}/packetbeat.yml:ro
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      CONFIG_DIR: ${PACKETBEAT_DIR}/config
      ELASTIC_USERNAME: ${ELASTIC_USERNAME}
      ELASTIC_PASSWORD: ${ELASTIC_PASSWORD}
      LS_JAVA_OPTS: "-Xmx${PACKETBEAT_HEAP} -Xms${PACKETBEAT_HEAP}"
    secrets:
      - source: ca.crt
        target: ${PACKETBEAT_DIR}/config/ca.crt
    networks:
      - elk
    depends_on: 
      - logstash

  filebeat:
    container_name: filebeat
    hostname: filebeat
    build:
      context: filebeat/
      args:
        ELK_VERSION: $ELK_VERSION
    restart: unless-stopped
    command: filebeat -e -strict.perms=false
    volumes:
      - ./filebeat/config/filebeat.yml:${FILEBEAT_DIR}/filebeat.yml:ro
    environment:
      CONFIG_DIR: ${FILEBEAT_DIR}/config
      LS_JAVA_OPTS: "-Xmx${FILEBEAT_HEAP} -Xms${FILEBEAT_HEAP}"
    secrets:
      - source: ca.crt
        target: ${FILEBEAT_DIR}/config/ca.crt
      - source: filebeat.cert
        target: ${FILEBEAT_DIR}/config/filebeat.crt
      - source: filebeat.key
        target: ${FILEBEAT_DIR}/config/filebeat.key
    expose:
      - 9000
    networks:
      - elk
    depends_on: 
      - logstash

networks:
  elk:
    driver: bridge