docker-compose.yml

services:
  caddy:
    image: caddy:2.8.4-alpine
    container_name: caddy
    restart: unless-stopped
    networks:
      - core
    ports:
      - 80:80
    environment:
      - BASE_DOMAIN=${BASE_DOMAIN}
      - ADDRESS=${ADDRESS}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile

  api:
    image: ghcr.io/tracecathq/tracecat:${TRACECAT__IMAGE_TAG:-0.8.5}
    container_name: api
    restart: unless-stopped
    networks:
      - core
      - core-db
    environment:
      LOG_LEVEL: ${LOG_LEVEL}
      TRACECAT__API_URL: ${TRACECAT__API_URL}
      TRACECAT__API_ROOT_PATH: ${TRACECAT__API_ROOT_PATH}
      TRACECAT__APP_ENV: ${TRACECAT__APP_ENV}
      TRACECAT__DB_ENCRYPTION_KEY: ${TRACECAT__DB_ENCRYPTION_KEY} # Sensitive
      TRACECAT__DB_SSLMODE: ${TRACECAT__DB_SSLMODE}
      TRACECAT__DB_URI: ${TRACECAT__DB_URI} # Sensitive
      TRACECAT__PUBLIC_RUNNER_URL: ${TRACECAT__PUBLIC_RUNNER_URL}
      TRACECAT__PUBLIC_APP_URL: ${TRACECAT__PUBLIC_APP_URL}
      TRACECAT__SERVICE_KEY: ${TRACECAT__SERVICE_KEY} # Sensitive
      TRACECAT__SIGNING_SECRET: ${TRACECAT__SIGNING_SECRET} # Sensitive
      TRACECAT__ALLOW_ORIGINS: ${TRACECAT__ALLOW_ORIGINS}
      TRACECAT__AUTH_TYPES: ${TRACECAT__AUTH_TYPES}
      OAUTH_CLIENT_ID: ${OAUTH_CLIENT_ID}
      OAUTH_CLIENT_SECRET: ${OAUTH_CLIENT_SECRET}
      USER_AUTH_SECRET: ${USER_AUTH_SECRET}
      RUN_MIGRATIONS: true
      # Temporal
      TEMPORAL__CLUSTER_URL: ${TEMPORAL__CLUSTER_URL}
      TEMPORAL__CLUSTER_QUEUE: ${TEMPORAL__CLUSTER_QUEUE}

  worker:
    image: ghcr.io/tracecathq/tracecat:${TRACECAT__IMAGE_TAG:-0.8.5}
    restart: unless-stopped
    networks:
      - core
      - core-db
    environment:
      LOG_LEVEL: ${LOG_LEVEL}
      TRACECAT__API_URL: ${TRACECAT__API_URL}
      TRACECAT__API_ROOT_PATH: ${TRACECAT__API_ROOT_PATH}
      TRACECAT__APP_ENV: ${TRACECAT__APP_ENV}
      TRACECAT__DB_ENCRYPTION_KEY: ${TRACECAT__DB_ENCRYPTION_KEY} # Sensitive
      TRACECAT__DB_SSLMODE: ${TRACECAT__DB_SSLMODE}
      TRACECAT__DB_URI: ${TRACECAT__DB_URI} # Sensitive
      TRACECAT__PUBLIC_RUNNER_URL: ${TRACECAT__PUBLIC_RUNNER_URL}
      TRACECAT__SERVICE_KEY: ${TRACECAT__SERVICE_KEY} # Sensitive
      TRACECAT__SIGNING_SECRET: ${TRACECAT__SIGNING_SECRET} # Sensitive
      # Temporal
      TEMPORAL__CLUSTER_URL: ${TEMPORAL__CLUSTER_URL}
      TEMPORAL__CLUSTER_QUEUE: ${TEMPORAL__CLUSTER_QUEUE}
      # SMTP
      SMTP_HOST: ${SMTP_HOST}
      SMTP_PORT: ${SMTP_PORT}
      SMTP_STARTTLS_ENABLED: ${SMTP_STARTTLS_ENABLED}
      SMTP_SSL_ENABLED: ${SMTP_SSL_ENABLED}
      SMTP_IGNORE_CERT_ERRORS: ${SMTP_IGNORE_CERT_ERRORS}
      SMTP_AUTH_ENABLED: ${SMTP_AUTH_ENABLED}
      SMTP_USER: ${SMTP_USER}
      SMTP_PASS: ${SMTP_PASS}
      # LDAP
      LDAP_HOST: ${LDAP_HOST}
      LDAP_PORT: ${LDAP_PORT}
      LDAP_SSL: ${LDAP_SSL}
      LDAP_TYPE: ${LDAP_TYPE}

    command: ["python", "tracecat/dsl/worker.py"]

  ui:
    image: ghcr.io/tracecathq/tracecat-ui:${TRACECAT__IMAGE_TAG:-0.8.5}
    container_name: ui
    restart: unless-stopped
    networks:
      - core
    environment:
      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
      NEXT_PUBLIC_APP_ENV: ${NEXT_PUBLIC_APP_ENV}
      NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL}
      NEXT_PUBLIC_AUTH_TYPES: ${TRACECAT__AUTH_TYPES}
      NEXT_SERVER_API_URL: ${NEXT_SERVER_API_URL}
      NODE_ENV: ${NODE_ENV}
    depends_on:
      - api

  postgres_db:
    image: postgres:16
    container_name: postgres_db
    restart: always
    networks:
      - core-db
    shm_size: 128mb
    environment:
      POSTGRES_USER: ${TRACECAT__POSTGRES_USER}
      POSTGRES_PASSWORD: ${TRACECAT__POSTGRES_PASSWORD}
    volumes:
      - core-db:/var/lib/postgresql/data

  temporal_postgres_db:
    image: postgres:13
    container_name: temporal_postgres_db
    restart: always
    networks:
      - temporal-db
    environment:
      POSTGRES_USER: ${TEMPORAL__POSTGRES_USER}
      POSTGRES_PASSWORD: ${TEMPORAL__POSTGRES_PASSWORD}  # Sensitive
    volumes:
      - temporal-db:/var/lib/postgresql/data

  temporal:
    image: temporalio/auto-setup:${TEMPORAL__VERSION}
    container_name: temporal
    restart: always
    networks:
      - core
      - temporal-db
    environment:
      - DB=postgres12
      - DB_PORT=5432
      - POSTGRES_USER=${TEMPORAL__POSTGRES_USER}
      - POSTGRES_PWD=${TEMPORAL__POSTGRES_PASSWORD}  # Sensitive
      - POSTGRES_SEEDS=temporal_postgres_db
      - LOG_LEVEL=warn
    depends_on:
      - temporal_postgres_db

  # Tracecat uses Elasticsearch for event normalization
  # Disable this if you don't intend to use Tracecat's ECS normalization action
  # or have your own Elasticsearch instance
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.15.0
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
    container_name: elasticsearch
    restart: unless-stopped
    networks:
      - core
    volumes:
      - elasticsearch-data:/usr/share/elasticsearch/data

volumes:
  core-db:
  temporal-db:
  elasticsearch-data:

networks:
  core:
  core-db:
    internal: true
  temporal-db:
    internal: true