docker-compose.yml

services:

  traefik:
    image: docker.io/traefik:3.3
    command:
      # https://doc.traefik.io/traefik/user-guides/docker-compose/acme-http/
      # - "--log.level=DEBUG"
      - "--api.insecure=true"
      - '--api.dashboard=true'
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entryPoints.web.address=:${PORT_HTTP}"
      - "--entryPoints.websecure.address=:${PORT_HTTPS}"
      - "--certificatesresolvers.myresolver.acme.httpchallenge=true"
      - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory" # Comment out to use real HTTP Challenges.
      - "--certificatesresolvers.myresolver.acme.email=postmaster@e-hacking.de"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
    cap_add:
      - CAP_NET_BIND_SERVICE
    ports:
      - "${PORT_HTTP}:${PORT_HTTP}"
      - "${PORT_HTTPS}:${PORT_HTTPS}"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/user/${UID}/podman/podman.sock:/var/run/docker.sock:Z"
    environment:
      - DOCKER_HOST=unix:///var/run/user/${UID}/podman/podman.sock
    restart: always
    labels:
      - 'traefik.http.routers.dashboard.rule=((Host(`${HOST1}`) || Host(`${HOST2}`)) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`)))'
      - 'traefik.http.routers.dashboard.priority=99999'
      - 'traefik.http.routers.dashboard.service=api@internal'
      - 'traefik.http.routers.dashboard.tls.certresolver=myresolver'
      - 'com.centurylinklabs.watchtower.enable=true'

  app:
    image: ghcr.io/ehacking-websec/ehacking/ehacking:${DOCKER_TAG}
    pull_policy: always
    cap_add:
      - CAP_NET_BIND_SERVICE
    depends_on:
      - traefik
      - couchdb
      - axis2-flag
      - axis2-fake
    env_file:
      - .env
    environment:
      - ATTACKER_URL=https://${ATTACKER_HOST}:${PORT_HTTPS}
      - SP_URL=https://${SP_HOST}:${PORT_HTTPS}
      - SPA_URL=https://${SPA_HOST}:${PORT_HTTPS}
      - IDP_URL=https://${IDP_HOST}:${PORT_HTTPS}
      - RS_URL=https://${RS_HOST}:${PORT_HTTPS}
      - FLAG_SOAP_AUTH_WSS=${FLAG_SOAP_AUTH_WSS:-FLAG{soap_auth_wss_dummy}}
      - FLAG_SOAP_AUTH_ADMIN1=${FLAG_SOAP_AUTH_ADMIN1:-FLAG{soap_auth_admin1_dummy}}
      - FLAG_SOAP_AUTH_ADMIN2=${FLAG_SOAP_AUTH_ADMIN2:-FLAG{soap_auth_admin2_dummy}}
      - FLAG_JSON_PASSWORD=${FLAG_JSON_PASSWORD:-FLAG{json_password_challenge_dummy}}
      - FLAG_JSON_SIGNATURE_VERIFIER1=${FLAG_JSON_SIGNATURE_VERIFIER1:-FLAG{json_signature_verifier_1_dummy}}
      - FLAG_JSON_SIGNATURE_VERIFIER2=${FLAG_JSON_SIGNATURE_VERIFIER2:-FLAG{json_signature_verifier_2_dummy}}
      - FLAG_JSON_SIGNATURE_VERIFIER3=${FLAG_JSON_SIGNATURE_VERIFIER3:-FLAG{json_signature_verifier_3_dummy}}
      - FLAG_JSON_SIGNATURE_VERIFIER4=${FLAG_JSON_SIGNATURE_VERIFIER4:-FLAG{json_signature_verifier_4_dummy}}
      - FLAG_JSON_SIGNATURE_VERIFIER5=${FLAG_JSON_SIGNATURE_VERIFIER5:-FLAG{json_signature_verifier_5_dummy}}
      - FLAG_JSON_SIGNATURE_VERIFIER6=${FLAG_JSON_SIGNATURE_VERIFIER6:-FLAG{json_signature_verifier_6_dummy}}
      - FLAG_JSON_SIGNATURE_VERIFIER7=${FLAG_JSON_SIGNATURE_VERIFIER7:-FLAG{json_signature_verifier_7_dummy}}
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.all-in-one.entrypoints=websecure'
      - 'traefik.http.routers.all-in-one.rule=(Host(`${HOST1}`) || Host(`${HOST2}`) || Host(`${IDP_HOST}`) || Host(`${REST_HOST}`) || Host(`${RS_HOST}`) || Host(`${SOAP_HOST}`) || Host(`${SP_HOST}`) || Host(`${SPA_HOST}`))'
      - 'traefik.http.routers.all-in-one.priority=1'
      - 'traefik.http.services.all-in-one.loadbalancer.server.port=80'
      - 'traefik.http.routers.all-in-one.tls.certresolver=myresolver'
      - 'com.centurylinklabs.watchtower.enable=true'
    restart: always

  axis2-flag:
    image: ghcr.io/ehacking-websec/ehacking/axis2-flag:${DOCKER_TAG}
    environment:
      - FLAG_WSADDRESSING_SPOOFING_TO=${FLAG_WSADDRESSING_SPOOFING_TO:-FLAG{soap_wsaddressing_secret_dummy}}
    expose:
      - "8080"

  axis2-fake:
    image: ghcr.io/ehacking-websec/ehacking/axis2-flag:${DOCKER_TAG}
    depends_on:
      - traefik
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.axis2-fake.entrypoints=websecure'
      - 'traefik.http.routers.axis2-fake.rule=(Host(`${SOAP_HOST}`) && PathPrefix(`/axis2/services/`))'
      - 'traefik.http.routers.axis2-fake.priority=10000'
      - "traefik.http.routers.axis2-fake.tls.certresolver=myresolver"
      - 'traefik.http.services.axis2-fake.loadbalancer.server.port=8080'

  couchdb:
    image: docker.io/couchdb:latest
    environment:
      COUCHDB_USER: "root"
      COUCHDB_PASSWORD: "super_secure"
    restart: always
    labels:
      - "traefik.enable=true"
      - "com.centurylinklabs.watchtower.enable=true"

  rookies:
    image: ghcr.io/ehacking-websec/rookies:latest
    pull_policy: always
    depends_on:
      - traefik
    env_file:
      - .env
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.rookies.entrypoints=websecure"
      - "traefik.http.routers.rookies.rule=Host(`${ROOKIES_HOST}`)"
      - "traefik.http.services.rookies.loadbalancer.server.port=3000"
      - "traefik.http.routers.rookies.tls.certresolver=myresolver"
      - "com.centurylinklabs.watchtower.enable=true"
    restart: always

  watchtower:
    image: docker.io/containrrr/watchtower
    volumes:
      - "/var/run/user/${UID}/podman/podman.sock:/var/run/docker.sock:Z"
    environment:
      - TZ=Europe/Berlin
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_LABEL_ENABLE=true
      - WATCHTOWER_INCLUDE_RESTARTING=true
      # - WATCHTOWER_RUN_ONCE=true
      # Field name   | Mandatory? | Allowed values  | Allowed special characters
      # ----------   | ---------- | --------------  | --------------------------
      # Seconds      | Yes        | 0-59            | * / , -
      # Minutes      | Yes        | 0-59            | * / , -
      # Hours        | Yes        | 0-23            | * / , -
      # Day of month | Yes        | 1-31            | * / , - ?
      # Month        | Yes        | 1-12 or JAN-DEC | * / , -
      # Day of week  | Yes        | 0-6 or SUN-SAT  | * / , - ?
      - WATCHTOWER_SCHEDULE=0 0 7 * * * # every day on 7am
      - DOCKER_HOST=unix:///var/run/user/${UID}/podman/podman.sock
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    restart: always