services:
  crowdsec:
    image: ${CROWDSEC_IMAGE}
    container_name: crowdsec
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    environment:
      COLLECTIONS: ${CROWDSEC_COLLECTIONS}
      BOUNCER_KEY_TRAEFIK: ${CROWDSEC_BOUNCER_API_KEY}
      LEVEL: ${CROWDSEC_LOG_LEVEL}
      TZ: ${TZ:-America/Mexico_City}
      POSTGRES_HOST: crowdsec-postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DB: ${CROWDSEC_POSTGRES_DB}
      POSTGRES_USER: ${CROWDSEC_POSTGRES_USER}
      POSTGRES_PASSWORD: ${CROWDSEC_POSTGRES_PASSWORD}
    volumes:
      - ${CROWDSEC_CONFIG_PATH}:/etc/crowdsec:Z
      - crowdsec_lib:/var/lib/crowdsec
      - ${TRAEFIK_LOG_PATH}:/var/log/traefik:ro
      - /var/log:/var/log/host:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    expose:
      - "8080"
      - "7422"
    ports:
      - "127.0.0.1:8080:8080"
    networks:
      - crowdsec_internal
      - proxy
    healthcheck:
      test: ["CMD", "cscli", "lapi", "status"]
      interval: 30s
      timeout: 5s
      retries: 3

  crowdsec-postgres:
    image: ${CROWDSEC_POSTGRES_IMAGE}
    container_name: crowdsec-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${CROWDSEC_POSTGRES_USER}
      POSTGRES_PASSWORD: ${CROWDSEC_POSTGRES_PASSWORD}
      POSTGRES_DB: ${CROWDSEC_POSTGRES_DB}
    volumes:
      - ${CROWDSEC_POSTGRES_PATH}:/var/lib/postgresql/data:Z
    networks:
      - crowdsec_internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${CROWDSEC_POSTGRES_USER} -d ${CROWDSEC_POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5

  crowdsec-prometheus:
    image: prom/prometheus@sha256:e4254400b85610324913f0dc4acf92603d9984e7519414c5a12811aa6146acc3
    container_name: crowdsec-prometheus
    restart: unless-stopped
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--storage.tsdb.retention.time=7d"
      - "--web.enable-lifecycle"
    volumes:
      - ${CROWDSEC_PROMETHEUS_CONFIG}/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ${CROWDSEC_PROMETHEUS_PATH}:/prometheus:Z
    networks:
      - crowdsec_internal
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:9090/-/healthy"]
      interval: 30s
      timeout: 5s
      retries: 3

  crowdsec-grafana:
    image: ${GRAFANA_IMAGE}
    container_name: crowdsec-grafana
    restart: unless-stopped
    environment:
      GF_SERVER_ROOT_URL: https://${CROWDSEC_GRAFANA_DOMAIN}
      GF_AUTH_PROXY_ENABLED: "true"
      GF_AUTH_PROXY_HEADER_NAME: X-Authentik-Username
      GF_AUTH_PROXY_HEADER_EMAIL: X-Authentik-Email
      GF_AUTH_PROXY_HEADER_GROUPS: X-Authentik-Groups
      GF_AUTH_PROXY_AUTO_SIGN_UP: "true"
      GF_AUTH_PROXY_ENABLE_LOGIN_TOKEN: "false"
      GF_AUTH_DISABLE_LOGIN_FORM: "true"
      GF_AUTH_SIGNOUT_REDIRECT: https://${AUTHENTIK_DOMAIN:-auth.sherlockhomeless.net}/application/o/${CROWDSEC_GRAFANA_SLUG:-grafana}/end-session/
    volumes:
      - ${CROWDSEC_GRAFANA_PATH}:/var/lib/grafana:Z
      - ${CROWDSEC_GRAFANA_PROVISIONING}:/etc/grafana/provisioning:ro
      - ${CROWDSEC_GRAFANA_DASHBOARDS}:/var/lib/grafana/dashboards:ro
    networks:
      - crowdsec_internal
      - proxy
    labels:
      traefik.enable: "true"
      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
      traefik.http.routers.crowdsec-grafana.rule: "Host(`${CROWDSEC_GRAFANA_DOMAIN}`)"
      traefik.http.routers.crowdsec-grafana.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
      traefik.http.routers.crowdsec-grafana.tls: "true"
      traefik.http.routers.crowdsec-grafana.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
      traefik.http.routers.crowdsec-grafana.service: "crowdsec-grafana"
      traefik.http.routers.crowdsec-grafana.middlewares: "crowdsec-bouncer@file,${TRAEFIK_AUTH_MIDDLEWARE}"
      traefik.http.services.crowdsec-grafana.loadbalancer.server.port: "3000"
      homepage.group: "Observabilidad"
      homepage.name: "Grafana"
      homepage.href: "https://${CROWDSEC_GRAFANA_DOMAIN}"
      homepage.description: "Dashboards CrowdSec y monitorizacion"
      homepage.icon: "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/grafana.svg"
      homepage.siteMonitor: "https://${CROWDSEC_GRAFANA_DOMAIN}"

networks:
  crowdsec_internal:
    driver: bridge
  proxy:
    external: true

volumes:
  crowdsec_lib: