docker-compose.yml

services:

  traefik:
    image: docker.io/traefik
    command:
      - '--api.dashboard=true'
      - '--api.insecure=false'
      - '--certificatesresolvers.letsencrypt.acme.email=postmaster@e-hacking.de'
      - '--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge=true'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53'
      - '--entrypoints.web.address=:${PORT_HTTP}'
      - '--entrypoints.web.http.sanitizePath=false'
      - '--entrypoints.websecure.address=:${PORT_HTTPS}'
      - '--entrypoints.websecure.http.sanitizePath=false'
      - '--entrypoints.websecure.http.tls=true'
      - '--entrypoints.tcpsecure.address=:${PORT_TCP}'  # ← Separater Port für TCP
      - '--providers.docker=true'
      #- "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
    ports:
      - "${PORT_HTTP}:${PORT_HTTP}"
      - "${PORT_HTTPS}:${PORT_HTTPS}"
      - "${PORT_TCP}:${PORT_TCP}"
    env_file:
      - cloudflare.env
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    restart: on-failure
    networks:
      - ehacking
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.middlewares.basicauth.basicauth.users=${BASICAUTH_USERS}'
      - 'traefik.http.routers.dashboard.rule=Host(`${DASHBOARD_HOST}`)'
      - 'traefik.http.routers.dashboard.entrypoints=websecure'
      - 'traefik.http.routers.dashboard.tls=true'
      - 'traefik.http.routers.dashboard.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.dashboard.service=api@internal'
      - 'traefik.http.routers.dashboard.middlewares=basicauth'

# root module: lading page with all available modules for selection
  root:
    image: ghcr.io/ehacking-websec/ehacking/root:latest
    depends_on:
      traefik:
        required: true
        condition: service_started
    env_file:
      - .env
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.root.entrypoints=websecure'
      - 'traefik.http.routers.root.rule=(Host(`${HOST1}`) || Host(`${HOST2}`))'
      - 'traefik.http.routers.root.tls=true'
      - 'traefik.http.routers.root.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.root.priority=1'
      - 'traefik.http.services.root.loadbalancer.server.port=80'
    restart: on-failure
    networks:
      - ehacking

# JSON module
  json-sec:
    image: ghcr.io/ehacking-websec/ehacking/json-sec
    depends_on:
      traefik:
        required: true
        condition: service_started
    env_file:
      - .env
      - flags_json-sec.env
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.json-sec.entrypoints=websecure'
      - 'traefik.http.routers.json-sec.rule=(Host(`${JSON_HOST}`) && PathPrefix(`${BASE_PATH_JSON}`))'
      - 'traefik.http.routers.json-sec.tls=true'
      - 'traefik.http.routers.json-sec.tls.certresolver=letsencrypt'
      - 'traefik.http.services.json-sec.loadbalancer.server.port=80'
    restart: on-failure
    networks:
      - ehacking

# OpenID Connect module
  oidc:
    image: ghcr.io/ehacking-websec/ehacking/oidc
    depends_on:
      traefik:
        required: true
        condition: service_started
    env_file:
      - .env
    environment:
      - ATTACKER_URL=https://${ATTACKER_HOST}:${PORT_HTTPS}
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.oidc.entrypoints=websecure'
      - 'traefik.http.routers.oidc.rule=( (Host(`${SP_HOST}`) && PathPrefix(`${BASE_PATH_OIDC_SP}`)) || (Host(`${SPA_HOST}`) && PathPrefix(`${BASE_PATH_OIDC_SP}`)) || (Host(`${IDP_HOST}`) && PathPrefix(`${BASE_PATH_OIDC_IDP}`)) || (Host(`${RS_HOST}`) && PathPrefix(`${BASE_PATH_OIDC_IDP}`)) )'
      - 'traefik.http.routers.oidc.tls=true'
      - 'traefik.http.routers.oidc.tls.certresolver=letsencrypt'
      - 'traefik.http.services.oidc.loadbalancer.server.port=80'
    restart: on-failure
    networks:
      - ehacking
    links:
      - traefik:${SP_HOST}
      - traefik:${SPA_HOST}
      - traefik:${IDP_HOST}
      - traefik:${RS_HOST}

# REST module
  rest-api-sec:
    image: ghcr.io/ehacking-websec/ehacking/rest-api-sec
    depends_on:
      traefik:
        required: true
        condition: service_started
    ports:
      - 30003:8787
    env_file:
      - .env
      - flags_rest-api-sec.env
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.rest-api-sec.entrypoints=websecure'
      - 'traefik.http.routers.rest-api-sec.rule=(Host(`${REST_HOST}`) && PathPrefix(`${BASE_PATH_REST}`))'
      - 'traefik.http.routers.rest-api-sec.tls=true'
      - 'traefik.http.routers.rest-api-sec.tls.certresolver=letsencrypt'
      - 'traefik.http.services.rest-api-sec.loadbalancer.server.port=80'
    restart: on-failure
    networks:
      - ehacking

  couchdb:
    image: docker.io/couchdb:latest
    environment:
      COUCHDB_USER: "root"
      COUCHDB_PASSWORD: "super_secure"
    restart: on-failure
    networks:
      - ehacking
    labels:
      - "traefik.enable=true"
      - "com.centurylinklabs.watchtower.enable=true"

# SAML module
  saml:
    image: ghcr.io/ehacking-websec/ehacking/saml
    depends_on:
      traefik:
        required: true
        condition: service_started
    ports:
      - 30004:8787
    env_file:
      - .env
      - flags_saml.env
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.saml.entrypoints=websecure'
      - 'traefik.http.routers.saml.rule= (Host(`${SP_HOST}`) && PathPrefix(`/sp`)) || (Host(`${IDP_HOST}`) && PathPrefix(`/idp`))'
      - 'traefik.http.routers.saml.tls=true'
      - 'traefik.http.routers.saml.tls.certresolver=letsencrypt'
      - 'traefik.http.services.saml.loadbalancer.server.port=80'
    extra_hosts:
      # - "${SP_HOST}:127.0.0.1"
      # - "${IDP_HOST}:127.0.0.1"
      - "${ATTACKER_HOST}:127.0.0.1"
    restart: on-failure
    networks:
      - ehacking
    links:
      - traefik:${SP_HOST}
      - traefik:${IDP_HOST}

# SOAP module:
  soap-sec:
    image: ghcr.io/ehacking-websec/ehacking/soap-sec
    depends_on:
      traefik:
        required: true
        condition: service_started
      axis2-flag:
        required: true
        condition: service_started
      axis2-fake:
        required: true
        condition: service_started
    ports:
      - 30007:8787
    env_file:
      - .env
      - flags_soap-sec.env
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.soap-sec.entrypoints=websecure'
      - 'traefik.http.routers.soap-sec.rule=(Host(`${SOAP_HOST}`))'
      - 'traefik.http.routers.soap-sec.tls=true'
      - 'traefik.http.routers.soap-sec.tls.certresolver=letsencrypt'
      - 'traefik.http.services.soap-sec.loadbalancer.server.port=80'
    restart: on-failure
    networks:
      - ehacking
      - soap-internal

# SOAP module: real flag service (private network only)
  axis2-flag:
    image: ghcr.io/ehacking-websec/ehacking/axis2-flag:latest
    env_file:
      - flags_axis2-flag.env
    restart: on-failure
    networks:
      - soap-internal
    expose:
      - "8080"

# SOAP module: fake-flag service (publicly available)
  axis2-fake:
    image: ghcr.io/ehacking-websec/ehacking/axis2-flag:latest
    depends_on:
      traefik:
        required: true
        condition: service_started
    restart: on-failure
    networks:
      - ehacking
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.axis2-fake.entrypoints=websecure'
      - 'traefik.http.routers.axis2-fake.rule=(Host(`${SOAP_HOST}`) && PathPrefix(`/axis2/services/`))'
      - 'traefik.http.routers.axis2-fake.priority=10000'
      - "traefik.http.routers.axis2-fake.tls.certresolver=letsencrypt"
      - 'traefik.http.services.axis2-fake.loadbalancer.server.port=8080'


# Web security module
  web-sec:
    image: ghcr.io/ehacking-websec/ehacking/web-sec
    depends_on:
      traefik:
        required: true
        condition: service_started
    env_file:
      - .env
    # TODO: Check if we really need these (since they are in .env)
    # environment:
    #   SP_HOST: ${SP_HOST}
    #   IDP_HOST: ${IDP_HOST}
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.web-sec.entrypoints=websecure'
      - 'traefik.http.routers.web-sec.rule=(Host(`${WEBSEC_HOST}`) && PathPrefix(`${BASE_PATH_WEBSEC}`))'
      - 'traefik.http.routers.web-sec.tls=true'
      - 'traefik.http.routers.web-sec.tls.certresolver=letsencrypt'
      - 'traefik.http.services.web-sec.loadbalancer.server.port=80'
    restart: on-failure
    networks:
      - ehacking

# XML module
  xml-sec:
    image: ghcr.io/ehacking-websec/ehacking/xml-sec
    depends_on:
      traefik:
        required: true
        condition: service_started
    env_file:
      - .env
      - flags_xml-sec.env
    volumes:
      - "./flag_xxe1.txt:/etc/flag_xxe1.txt:ro"
      - "./flag_xxe2.txt:/etc/flag_xxe2.txt:ro"
      - "./flag_xslt1.xml:/etc/flag_xslt1.xml:ro"
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.xml-sec.entrypoints=websecure'
      - 'traefik.http.routers.xml-sec.rule=(Host(`${XML_HOST}`) && PathPrefix(`/xml-sec`))'
      - 'traefik.http.routers.xml-sec.tls=true'
      - 'traefik.http.routers.xml-sec.tls.certresolver=letsencrypt'
      - 'traefik.http.services.xml-sec.loadbalancer.server.port=80'
    restart: on-failure
    networks:
      - ehacking
  attacker:
    image: mendhak/http-https-echo:31
    depends_on:
      - traefik
    expose:
      - "8080"
      - "8443"
    restart: on-failure
    networks:
      - ehacking
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.attacker.entrypoints=websecure"
      - "traefik.http.routers.attacker.rule=( Host(`${ATTACKER_HOST}`) || HostRegexp(`^.+\\.${ATTACKER_HOST}$`) )"
      - 'traefik.http.routers.attacker.tls.certresolver=letsencrypt'
      - "traefik.http.services.attacker.loadbalancer.server.port=8080"

  rookies:
    image: ghcr.io/ehacking-websec/rookies:latest
    pull_policy: always
    depends_on:
      - traefik
    env_file:
      - .env
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.rookies.entrypoints=websecure"
      - "traefik.http.routers.rookies.rule=Host(`${ROOKIES_HOST}`)"
      - "traefik.http.services.rookies.loadbalancer.server.port=3000"
      - "traefik.http.routers.rookies.tls.certresolver=letsencrypt"
      - "com.centurylinklabs.watchtower.enable=true"
    restart: on-failure
    networks:
      - ehacking

  # Passkeys
  passkeys-app:
    image: ghcr.io/ehacking-websec/fun-with-flags-and-passkeys:latest
    restart: on-failure
    pull_policy: always
    networks:
      - ehacking
    depends_on:
      - traefik
      - passkeys-mongo
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.passkeys.entrypoints=websecure"
      - "traefik.http.routers.passkeys.rule=Host(`${PASSKEYS_HOST}`)"
      - "traefik.http.services.passkeys.loadbalancer.server.port=3000"
      - "traefik.http.routers.passkeys.tls.certresolver=letsencrypt"
      - "com.centurylinklabs.watchtower.enable=true"
    volumes:
      - passkeys-instance-data:/app/data/instances
    environment:
      - NODE_ENV=production
      - SESSION_SECRET=${PASSKEYS_SESSION_SECRET}
      - RP_ID=${PASSKEYS_RP_ID}
      - ORIGIN=${PASSKEYS_ORIGIN}
      - USE_MONGO=true
      - MONGO_URI=mongodb://passkeys-mongo:27017/funwithflags

  passkeys-mongo:
    image: mongo:4
    restart: on-failure
    networks:
      - ehacking
    volumes:
      - passkeys-mongo-data:/data/db

  # Crawling Maze
  crawling-maze:
    image: ghcr.io/ehacking-websec/crawling-maze:latest
    restart: on-failure
    pull_policy: always
    networks:
      - ehacking
    expose:
      - "8080"
    depends_on:
      - traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.crawling-maze.entrypoints=websecure"
      - "traefik.http.routers.crawling-maze.rule=Host(`${CRAWLING_MAZE_HOST}`)"
      - "traefik.http.routers.crawling-maze.tls.certresolver=letsencrypt"
      - "traefik.http.services.crawling-maze.loadbalancer.server.port=8080"
      - "com.centurylinklabs.watchtower.enable=true"
    volumes:
      - crawling-maze-sessions:/var/lib/crawling-maze/sessions
    environment:
      - FLASK_SECRET_KEY=secret
    env_file:
      - flags_crawling-maze.env

  # Watchtower
  watchtower:
    image: docker.io/nickfedor/watchtower
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - TZ=Europe/Berlin
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_LABEL_ENABLE=true
      - WATCHTOWER_INCLUDE_RESTARTING=true
      # - WATCHTOWER_RUN_ONCE=true
      # Field name   | Mandatory? | Allowed values  | Allowed special characters
      # ----------   | ---------- | --------------  | --------------------------
      # Seconds      | Yes        | 0-59            | * / , -
      # Minutes      | Yes        | 0-59            | * / , -
      # Hours        | Yes        | 0-23            | * / , -
      # Day of month | Yes        | 1-31            | * / , - ?
      # Month        | Yes        | 1-12 or JAN-DEC | * / , -
      # Day of week  | Yes        | 0-6 or SUN-SAT  | * / , - ?
      - WATCHTOWER_SCHEDULE=0 0 7 * * * # every day on 7am
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    restart: on-failure

# Recruiting platform
  recruiting-challenge:
    image: ghcr.io/ehacking-websec/recruiting/challenge:latest
    pull_policy: always
    depends_on:
      traefik:
        required: true
        condition: service_started
    environment:
      PORT: "3000"
      REGISTRY_DB_PATH: /data/registry.db
      URL_STYLE: subdomain
      BOT_INTERNAL_SECRET: ${BOT_INTERNAL_SECRET:-bot-secret-11cde19f9d2f5b99-change-me-in-prod}
      BOT_PUBLIC_ORIGIN: https://${RECRUITING_BOT_HOST}
      CHALLENGE_PUBLIC_ORIGIN: https://${RECRUITING_CHALLENGE_HOST}
    volumes:
      - recruiting-data:/data
    labels:
      - "traefik.enable=true"
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.http.routers.recruiting-challenge.entrypoints=websecure"
      - "traefik.http.routers.recruiting-challenge.rule=Host(`${RECRUITING_CHALLENGE_HOST}`) || HostRegexp(`^.+\\.${RECRUITING_CHALLENGE_HOST}$$`)"
      - "traefik.http.routers.recruiting-challenge.tls=true"
      - "traefik.http.routers.recruiting-challenge.tls.certresolver=letsencrypt"
      - "traefik.http.routers.recruiting-challenge.tls.domains[0].main=${RECRUITING_TIER_HOST}"
      - "traefik.http.routers.recruiting-challenge.tls.domains[0].sans=*.${RECRUITING_TIER_HOST},*.${RECRUITING_CHALLENGE_HOST}"
      - "traefik.http.services.recruiting-challenge.loadbalancer.server.port=3000"
    restart: on-failure
    networks:
      - ehacking

  recruiting-bot:
    image: ghcr.io/ehacking-websec/recruiting/bot:latest
    pull_policy: always
    init: true
    depends_on:
      traefik:
        required: true
        condition: service_started
      recruiting-challenge:
        required: true
        condition: service_started
    environment:
      PORT: "1337"
      REGISTRY_DB_PATH: /data/registry.db
      CHALLENGE_PUBLIC_ORIGIN: https://${RECRUITING_CHALLENGE_HOST}
      CHALLENGE_INTERNAL_ORIGIN: http://recruiting-challenge:3000
      BOT_INTERNAL_SECRET: ${BOT_INTERNAL_SECRET:-bot-secret-11cde19f9d2f5b99-change-me-in-prod}
      BOT_PUBLIC_ORIGIN: https://${RECRUITING_BOT_HOST}
      BOT_REPORT_RATE_LIMIT: "2"
    volumes:
      - recruiting-data:/data
    # Puppeteer + Firefox is the heaviest piece — cap RAM so a stuck
    # browser can't crowd the host and cpus so bursty reports don't
    # starve challenge + instructor.
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.5"
    labels:
      - "traefik.enable=true"
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.http.routers.recruiting-bot.entrypoints=websecure"
      - "traefik.http.routers.recruiting-bot.rule=Host(`${RECRUITING_BOT_HOST}`)"
      - "traefik.http.routers.recruiting-bot.tls=true"
      - "traefik.http.routers.recruiting-bot.tls.certresolver=letsencrypt"
      - "traefik.http.services.recruiting-bot.loadbalancer.server.port=1337"
    restart: on-failure
    networks:
      - ehacking

  recruiting-instructor:
    image: ghcr.io/ehacking-websec/recruiting/instructor:latest
    pull_policy: always
    depends_on:
      traefik:
        required: true
        condition: service_started
      recruiting-challenge:
        required: true
        condition: service_started
    environment:
      PORT: "3000"
      REGISTRY_DB_PATH: /data/registry.db
      URL_STYLE: subdomain
      CHALLENGE_PUBLIC_ORIGIN: https://${RECRUITING_CHALLENGE_HOST}
      BOT_PUBLIC_ORIGIN: https://${RECRUITING_BOT_HOST}
    volumes:
      - recruiting-data:/data
    labels:
      - "traefik.enable=true"
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.http.routers.recruiting-instructor.entrypoints=websecure"
      - "traefik.http.routers.recruiting-instructor.rule=Host(`${RECRUITING_INSTRUCTOR_HOST}`)"
      - "traefik.http.routers.recruiting-instructor.tls=true"
      - "traefik.http.routers.recruiting-instructor.tls.certresolver=letsencrypt"
      - "traefik.http.routers.recruiting-instructor.middlewares=basicauth"
      - "traefik.http.services.recruiting-instructor.loadbalancer.server.port=3000"
    restart: on-failure
    networks:
      - ehacking

networks:
  ehacking:
  soap-internal:

volumes:
  passkeys-instance-data:
  passkeys-mongo-data:
  recruiting-data:
  crawling-maze-sessions: