docker-compose.yml

services:
  web:
    build:
      context: .
      dockerfile: docker/web/Dockerfile
      args:
        SMTP_HOST: ${SMTP_HOST}
    image: ${CI_REGISTRY_IMAGE}/phishingator_web:${CI_COMMIT_REF_SLUG}
    container_name: phishingator-${ORG}-web
    restart: always
    depends_on:
      database:
        condition: service_started
      ldap-migrator:
        condition: service_completed_successfully
    volumes:
      - /phishingator-data/${ORG}/logs:/var/www/phishingator/logs
      - /phishingator-data/${ORG}/websites-templates/sites-config:/var/www/phishingator/templates/sites-config
      - /phishingator-data/${ORG}/websites-templates/websites:/var/www/phishingator/templates/websites:ro
      - /phishingator-data/${ORG}/certs/ldap.crt:/etc/ssl/certs/ldap.crt:ro
    environment:
      - ORG
      - ORG_DOMAIN
      - WEB_HOST
      - WEB_URL
      - EMAILS_ALLOWED_DOMAINS
      - CSRF_KEY
      - PHISHINGATOR_TOKEN
      - DOMAINER_ALLOWED_IP
      - MONITORING_ALLOWED_IP
      - MONITORING_SKIP_TEST_CREDS_INVALID
      - FRAUDULENT_HOSTS
      - DB_HOST
      - DB_USERNAME
      - DB_PASSWORD
      - DB_DATABASE
      - LDAP_HOSTNAME
      - LDAP_PORT
      - LDAP_USERNAME
      - LDAP_PASSWORD
      - LDAP_BASE_DN
      - LDAP_USERS_DN
      - LDAP_USER_ATTR_ID
      - LDAP_USER_ATTR_FULLNAME
      - LDAP_USER_ATTR_FIRSTNAME
      - LDAP_USER_ATTR_SURNAME
      - LDAP_USER_ATTR_EMAIL
      - LDAP_USER_ATTR_GROUPS
      - LDAP_GROUPS_DN
      - LDAP_GROUPS_ATTR_MEMBER
      - LDAP_DEPARTMENTS_DN
      - LDAP_ROOT_DEPARTMENTS_FILTER_DN
      - INDEPENDENT_DEPARTMENTS
      - LDAP_MIGRATOR_HOST
      - OIDC_METADATA_URL
      - OIDC_CLIENT_ID
      - OIDC_CLIENT_SECRET
      - OIDC_IDP_FILTER
      - OIDC_CRYPTO_PASSPHRASE
      - SMTP_HOST
      - SMTP_PORT
      - SMTP_TLS
      - SMTP_USERNAME
      - SMTP_PASSWORD
      - TEST_USERNAME
      - TEST_USERNAME_LDAP_SUFFIX
      - TEST_PASSWORD
      - ITS_URL
      - NOTIFICATION_SENDER
      - AUTHENTICATION_TYPE
      - AUTHENTICATION_USERNAME_TO_LOWERCASE
      - AUTHENTICATION_LDAP_HOST
      - AUTHENTICATION_LDAP_PORT
      - AUTHENTICATION_LDAP_USER_PREFIX
      - AUTHENTICATION_LDAP_USER_SUFFIX
      - AUTHENTICATION_WEB_URL
      - AUTHENTICATION_WEB_INPUT_USERNAME
      - AUTHENTICATION_WEB_INPUT_PASSWORD
      - AUTHENTICATION_WEB_RESPONSE_CODE
      - AUTHENTICATION_WEB_RESPONSE_OUTPUT
      - AUTHENTICATION_M365_URL
      - AUTHENTICATION_M365_CLIENT_ID
      - AUTHENTICATION_M365_CLIENT_SECRET
      - AUTHENTICATION_M365_USER_SUFFIX
      - AUTHENTICATION_IMAP_ARGS
      - AUTHENTICATION_POLICY_MIN_LENGTH
      - AUTHENTICATION_POLICY_MIN_CHARS_GROUPS
      - AUTHENTICATION_POLICY_ALLOW_CONTAIN_USERNAME
      - PASSWORD_LEVEL_ANONYMIZATION
      - PHISHING_WEBSITE_IGNORED_USER_AGENTS
      - PHISHING_WEBSITE_IGNORED_IP
      - CAMPAIGN_STATS_AGGREGATION
      - CAMPAIGN_STATS_BLUR_IDENTITIES
      - CAMPAIGN_DEFAULT_ONSUBMIT_ACTION
      - CAMPAIGN_ACTIVE_HIDE_EMAILS
      - USER_PREFER_EMAIL
    networks:
      - web-net
      - database-net
      - scheduler-net
      - ldap-net

  database:
    build:
      context: .
      dockerfile: docker/database/Dockerfile
    image: ${CI_REGISTRY_IMAGE}/phishingator_database:${CI_COMMIT_REF_SLUG}
    container_name: phishingator-${ORG}-database
    restart: always
    depends_on:
      ldap-migrator:
        condition: service_completed_successfully
    environment:
      - MYSQL_USER=${DB_USERNAME}
      - MYSQL_ROOT_PASSWORD=${DB_PASSWORD}
      - MYSQL_DATABASE=${DB_DATABASE}
    volumes:
      - /phishingator-data/${ORG}/database:/var/lib/mysql/
      - /phishingator-data/${ORG}/database-dumps:/phishingator-dumps
    networks:
      - database-net

  scheduler:
    build:
      context: .
      dockerfile: docker/scheduler/Dockerfile
    image: ${CI_REGISTRY_IMAGE}/phishingator_scheduler:${CI_COMMIT_REF_SLUG}
    container_name: phishingator-${ORG}-scheduler
    restart: always
    depends_on:
      - web
    environment:
      - PHISHINGATOR_TOKEN
    networks:
      - scheduler-net

  ldap-migrator:
    build:
      context: .
      dockerfile: docker/ldap-migrator/Dockerfile
    image: ${CI_REGISTRY_IMAGE}/phishingator_ldap_migrator:${CI_COMMIT_REF_SLUG}
    container_name: phishingator-${ORG}-ldap-migrator
    restart: no
    environment:
      - LDAP_MIGRATOR_HOST
      - LDAP_MIGRATOR_USER
      - LDAP_MIGRATOR_PASS
      - LDAP_MIGRATOR_BASE_DN
    volumes:
      - /phishingator-data/${ORG}/certs/ldap.crt:/etc/ssl/certs/ldap.crt:ro
      - /phishingator-data/${ORG}/ldap:/phishingator/ldap
    networks:
      - ldap-migrator-net

  ldap:
    image: osixia/openldap:1.5.0
    container_name: phishingator-${ORG}-ldap
    restart: always
    environment:
      - LDAP_DOMAIN=${LDAP_LOCAL_DOMAIN}
      - LDAP_ORGANISATION=${LDAP_LOCAL_ORGANISATION}
      - LDAP_BASE_DN=${LDAP_LOCAL_BASE_DN}
      - LDAP_ADMIN_PASSWORD=${LDAP_LOCAL_ADMIN_PASSWORD}
      - LDAP_CONFIG_PASSWORD=${LDAP_LOCAL_CONFIG_PASSWORD}
      - LDAP_READONLY_USER=true
      - LDAP_READONLY_USER_USERNAME=${LDAP_LOCAL_READONLY_USER_USERNAME}
      - LDAP_READONLY_USER_PASSWORD=${LDAP_LOCAL_READONLY_USER_PASSWORD}
    depends_on:
      ldap-migrator:
        condition: service_completed_successfully
    volumes:
      - /phishingator-data/${ORG}/ldap/users.ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom/bootstrap.ldif:ro
    command: --copy-service
    networks:
      - ldap-net

  waf:
    build:
      context: .
      dockerfile: docker/waf/Dockerfile
    image: ${CI_REGISTRY_IMAGE}/phishingator_waf:${CI_COMMIT_REF_SLUG}
    container_name: phishingator-${ORG}-waf
    restart: always
    depends_on:
      - web
    environment:
      - PARANOIA=1
      - ANOMALY_INBOUND=10
      - ANOMALY_OUTBOUND=5
      - BACKEND=http://phishingator-${ORG}-web
      - REMOTEIP_INT_PROXY=172.18.0.0/16
      - MODSEC_REQ_BODY_NOFILES_LIMIT=524288
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik
      - traefik.http.routers.${CI_COMMIT_REF_SLUG}-phishingator-https.rule=Host(`$WEB_HOST`)
      - traefik.http.routers.${CI_COMMIT_REF_SLUG}-phishingator-https.entrypoints=websecure
      - traefik.http.routers.${CI_COMMIT_REF_SLUG}-phishingator-https.tls.certresolver=leresolver
      - traefik.http.routers.${CI_COMMIT_REF_SLUG}-phishingator-https.service=${CI_COMMIT_REF_SLUG}-phishingator-waf
      - traefik.http.routers.${CI_COMMIT_REF_SLUG}-phishingator-http.rule=Host(`$WEB_HOST`)
      - traefik.http.routers.${CI_COMMIT_REF_SLUG}-phishingator-http.entrypoints=web
      - traefik.http.routers.${CI_COMMIT_REF_SLUG}-phishingator-http.middlewares=redirect-to-https
      - traefik.http.routers.${CI_COMMIT_REF_SLUG}-phishingator-fraudulent-https.rule=$FRAUDULENT_HOSTS_TRAEFIK
      - traefik.http.routers.${CI_COMMIT_REF_SLUG}-phishingator-fraudulent-https.entrypoints=websecure
      - traefik.http.routers.${CI_COMMIT_REF_SLUG}-phishingator-fraudulent-https.tls.certresolver=leresolver
      - traefik.http.routers.${CI_COMMIT_REF_SLUG}-phishingator-fraudulent-https.service=${CI_COMMIT_REF_SLUG}-phishingator-waf
      - traefik.http.routers.${CI_COMMIT_REF_SLUG}-phishingator-fraudulent-http.rule=$FRAUDULENT_HOSTS_TRAEFIK
      - traefik.http.routers.${CI_COMMIT_REF_SLUG}-phishingator-fraudulent-http.entrypoints=web
      - traefik.http.routers.${CI_COMMIT_REF_SLUG}-phishingator-fraudulent-http.service=${CI_COMMIT_REF_SLUG}-phishingator-waf
      - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https
      - traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true
      - traefik.http.services.${CI_COMMIT_REF_SLUG}-phishingator-waf.loadbalancer.server.port=8080
    networks:
      - web-net
      - traefik

networks:
  web-net:
  database-net:
  scheduler-net:
  ldap-migrator-net:
  ldap-net:
  traefik:
    external: true