docker-compose.yml

# driver_analyzer production stack
# NOTE: AutoPiff services build from ../AutoPiff.
#       When adding new AutoPiff stages, also add them to ../AutoPiff/docker-compose.yml.

version: '3'

services:
  # --- MWDB Core Components ---
  mwdb-postgres:
    restart: unless-stopped
    image: postgres:14-alpine
    environment:
      - POSTGRES_DB=mwdb
      - POSTGRES_USER=mwdb
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-mwdb-password}
    volumes:
      - mwdb-postgres-data:/var/lib/postgresql/data

  mwdb-redis:
    restart: unless-stopped
    image: redis:6-alpine

  mwdb-core:
    restart: unless-stopped
    image: certpl/mwdb:latest
    ports:
      - "8080:8080"
    environment:
      - MWDB_POSTGRES_URI=postgresql://mwdb:${POSTGRES_PASSWORD:-mwdb-password}@mwdb-postgres:5432/mwdb
      - MWDB_REDIS_URI=redis://mwdb-redis:6379/0
      - MWDB_SECRET_KEY=${MWDB_SECRET_KEY:-dev-secret-key-change-me}
      - MWDB_ENABLE_KARTON=1
      - MWDB_ADMIN_LOGIN=${MWDB_ADMIN_LOGIN:-admin}
      - MWDB_ADMIN_PASSWORD=${MWDB_ADMIN_PASSWORD:-admin}
    depends_on:
      - mwdb-postgres
      - mwdb-redis
      - karton-redis
      - karton-system
      - minio
    volumes:
      - mwdb-uploads-data:/app/uploads
      - ./karton.ini:/etc/karton/karton.ini:ro

  mwdb-web:
    restart: unless-stopped
    image: certpl/mwdb-web:v2.16.1
    ports:
      - "8082:80"
    environment:
      - PROXY_BACKEND_URL=http://mwdb-core:8080
    # volumes:
    #   - ./mwdb-ui:/usr/share/nginx/html
    depends_on:
      - mwdb-core

  karton-driver-dashboard:
    build: services/dashboard
    container_name: driver_analyzer_dashboard
    restart: on-failure
    ports:
      - "8088:5000"
    environment:
      - MWDB_API_URL=http://mwdb-core:8080/api/
      - MWDB_API_KEY=${MWDB_API_KEY}
    # networks:
    #   - karton-network
    depends_on:
      - mwdb-core

  # --- Karton Core Components ---
  karton-redis:
    restart: unless-stopped
    image: redis:6-alpine

  karton-rabbitmq:
    restart: unless-stopped
    image: rabbitmq:3.8-management-alpine
    ports:
      - "5672:5672"
      - "15672:15672"
    environment:
      - RABBITMQ_DEFAULT_USER=${RABBITMQ_USER:-karton}
      - RABBITMQ_DEFAULT_PASS=${RABBITMQ_PASSWORD:-karton-password}

  karton-system:
    restart: unless-stopped
    image: certpl/karton-system:latest
    environment:
      - KARTON_RABBITMQ_HOST=karton-rabbitmq
      - KARTON_RABBITMQ_USER=${RABBITMQ_USER:-karton}
      - KARTON_RABBITMQ_PASSWORD=${RABBITMQ_PASSWORD:-karton-password}
      - KARTON_S3_ACCESS_KEY=${MINIO_ROOT_USER:-minio}
      - KARTON_S3_SECRET_KEY=${MINIO_ROOT_PASSWORD:-minio-password}
      - KARTON_S3_ADDRESS=http://minio:9000
      - KARTON_S3_BUCKET=karton
      - KARTON_REDIS_HOST=karton-redis
    depends_on:
      - karton-redis
      - karton-rabbitmq
      - minio

  minio:
    restart: unless-stopped
    image: minio/minio:RELEASE.2023-09-30T07-02-29Z
    command: server /data
    ports:
      - "9000:9000"
    environment:
      - MINIO_ROOT_USER=${MINIO_ROOT_USER:-minio}
      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD:-minio-password}
    volumes:
      - minio-data:/data

  karton-dashboard:
    restart: unless-stopped
    image: certpl/karton-dashboard:latest
    ports:
      - "8081:5000"
    environment:
      - KARTON_RABBITMQ_HOST=karton-rabbitmq
      - KARTON_RABBITMQ_USER=${RABBITMQ_USER:-karton}
      - KARTON_RABBITMQ_PASSWORD=${RABBITMQ_PASSWORD:-karton-password}
      - KARTON_S3_ACCESS_KEY=${MINIO_ROOT_USER:-minio}
      - KARTON_S3_SECRET_KEY=${MINIO_ROOT_PASSWORD:-minio-password}
      - PYTHONUNBUFFERED=1
      - KARTON_S3_ADDRESS=http://minio:9000
      - KARTON_S3_BUCKET=karton
      - KARTON_REDIS_HOST=karton-redis
    depends_on:
      - karton-system
      - minio
      - karton-redis

  # --- Integrations ---
  mwdb-reporter:
    restart: unless-stopped
    image: certpl/karton-mwdb-reporter:latest
    environment: &custom_karton_env
      KARTON_RABBITMQ_HOST: karton-rabbitmq
      KARTON_RABBITMQ_USER: ${RABBITMQ_USER:-karton}
      KARTON_RABBITMQ_PASSWORD: ${RABBITMQ_PASSWORD:-karton-password}
      KARTON_S3_ACCESS_KEY: ${MINIO_ROOT_USER:-minio}
      KARTON_S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minio-password}
      PYTHONUNBUFFERED: "1"
      KARTON_S3_ADDRESS: http://minio:9000
      KARTON_S3_BUCKET: karton
      KARTON_S3_SECURE: "0"
      KARTON_REDIS_HOST: karton-redis
      # mwdb-reporter expects [mwdb] section via KARTON_MWDB_...
      KARTON_MWDB_API_URL: http://mwdb-core:8080/api/
      # KARTON_MWDB_API_KEY should be set in environment or .env file
      KARTON_MWDB_API_KEY: ${MWDB_API_KEY:-CHANGE_ME_TO_YOUR_MWDB_API_KEY}
      # My custom services expect plain env vars
      MWDB_API_URL: http://mwdb-core:8080/api/
      MWDB_API_KEY: ${MWDB_API_KEY:-CHANGE_ME_TO_YOUR_MWDB_API_KEY}
    depends_on:
      - karton-system
      - minio
      - mwdb-core
      - karton-redis

  karton-classifier:
    restart: unless-stopped
    image: certpl/karton-classifier:latest
    environment: *custom_karton_env
    depends_on:
      - karton-system
      - minio
      - karton-redis

  # --- Custom Driver Services ---
  karton-driver-classifier:
    restart: unless-stopped
    build: ./services/classifier
    environment: *custom_karton_env

    depends_on:
      - karton-system
      - minio
      - karton-redis

  karton-driver-signature:
    restart: unless-stopped
    build: ./services/signature
    environment: *custom_karton_env
    depends_on:
      - karton-system
      - minio
      - karton-redis

  karton-driver-ioctlance:
    restart: unless-stopped
    build: ./services/ioctlance
    environment: *custom_karton_env
    deploy:
      replicas: 10
    depends_on:
      - karton-system
      - minio
      - karton-redis

  karton-driver-reporter:
    restart: unless-stopped
    build: ./services/reporter
    environment:
      <<: *custom_karton_env
      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
    depends_on:
      - karton-system
      - minio
      - mwdb-core
      - karton-redis

  karton-telegram-bot:
    restart: unless-stopped
    build: ./services/telegram
    environment:
      <<: *custom_karton_env
      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN}
      TELEGRAM_CHAT_ID: ${TELEGRAM_CHAT_ID:-}
    depends_on:
      - karton-redis
      - mwdb-core

  karton-driver-patch-differ:
    restart: unless-stopped
    # Now builds from AutoPiff instead of local duplicate
    build:
      context: ../AutoPiff
      dockerfile: services/karton-patch-differ/Dockerfile
    environment: *custom_karton_env
    volumes:
      - ../AutoPiff/rules:/app/rules:ro
    depends_on:
      - karton-system
      - minio
      - karton-redis
      - mwdb-core

  # --- AutoPiff Stage 5: Reachability Tagging ---
  karton-driver-reachability:
    restart: unless-stopped
    build:
      context: ../AutoPiff
      dockerfile: services/karton-reachability/Dockerfile
    environment: *custom_karton_env
    depends_on:
      - karton-system
      - minio
      - karton-redis
      - mwdb-core
    deploy:
      resources:
        limits:
          memory: 8G
        reservations:
          memory: 4G

  # --- AutoPiff Stage 6: Scoring & Ranking ---
  karton-driver-ranking:
    restart: unless-stopped
    build:
      context: ../AutoPiff
      dockerfile: services/karton-ranking/Dockerfile
    environment: *custom_karton_env
    volumes:
      - ../AutoPiff/rules:/app/rules:ro
    depends_on:
      - karton-system
      - minio
      - karton-redis

  # --- AutoPiff Stage 7: Report Generation ---
  karton-driver-report:
    restart: unless-stopped
    build:
      context: ../AutoPiff
      dockerfile: services/karton-report/Dockerfile
    environment: *custom_karton_env
    depends_on:
      - karton-system
      - minio
      - karton-redis
      - mwdb-core

  # --- AutoPiff Alerter: Telegram alerts for high-scoring findings ---
  autopiff-alerter:
    restart: unless-stopped
    build:
      context: ../AutoPiff
      dockerfile: services/autopiff-alerter/Dockerfile
    environment:
      <<: *custom_karton_env
      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
      TELEGRAM_CHAT_ID: ${TELEGRAM_CHAT_ID:-}
      AUTOPIFF_SCORE_THRESHOLD: "8.0"
    depends_on:
      - karton-system
      - minio
      - karton-redis

  # --- DriverAtlas Triage: scores every driver's attack surface ---
  autopiff-driver-triage:
    restart: unless-stopped
    build:
      context: ../AutoPiff
      dockerfile: services/karton-driver-triage/Dockerfile
      additional_contexts:
        driveratlas-src: ../DriverAtlas
    environment:
      <<: *custom_karton_env
      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
      TELEGRAM_CHAT_ID: ${TELEGRAM_CHAT_ID:-}
      DRIVERATLAS_SCORE_THRESHOLD: "8.0"
    depends_on:
      - karton-system
      - minio
      - karton-redis
      - mwdb-core

  # --- AutoPiff Driver Monitor: polls for new driver versions ---
  autopiff-driver-monitor:
    restart: unless-stopped
    build:
      context: ../AutoPiff
      dockerfile: services/driver-monitor/Dockerfile
    environment:
      <<: *custom_karton_env
      VT_API_KEY: ${VT_API_KEY:-}
      WINBINDEX_INTERVAL_HOURS: "6"
      VT_INTERVAL_HOURS: "4"
    volumes:
      - ../AutoPiff/services/driver-monitor/watchlist.yaml:/app/watchlist.yaml:ro
    depends_on:
      - karton-redis
      - mwdb-core

volumes:
  mwdb-postgres-data:
  minio-data:
  mwdb-uploads-data: