docker-compose.yml

# =============================================================================
# RedAmon - Unified Docker Compose
# =============================================================================
# Start:  docker compose up -d
# Stop:   docker compose down
# Logs:   docker compose logs -f
# Build:  docker compose --profile tools build
# =============================================================================

services:

  # ===========================================================================
  # Databases
  # ===========================================================================

  postgres:
    image: postgres:16-alpine
    container_name: redamon-postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-redamon}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-redamon_secret}
      POSTGRES_DB: ${POSTGRES_DB:-redamon}
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-redamon} -d ${POSTGRES_DB:-redamon}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - redamon

  neo4j:
    image: neo4j:5.26-community
    container_name: redamon-neo4j
    environment:
      NEO4J_AUTH: neo4j/${NEO4J_PASSWORD:-changeme123}
      NEO4J_PLUGINS: '["apoc"]'
      NEO4J_dbms_security_procedures_unrestricted: apoc.*
      NEO4J_dbms_security_procedures_allowlist: apoc.*
    ports:
      - "${NEO4J_HTTP_PORT:-7474}:7474"
      - "${NEO4J_BOLT_PORT:-7687}:7687"
    volumes:
      - neo4j_data:/data
      - neo4j_logs:/logs
      - neo4j_import:/var/lib/neo4j/import
      - neo4j_plugins:/plugins
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:7474"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - redamon

  # ===========================================================================
  # Recon Scanner Image (build only — not a running service)
  # Build with: docker compose --profile tools build
  # ===========================================================================

  recon:
    build:
      context: .
      dockerfile: recon/Dockerfile
      network: host
    image: redamon-recon:latest
    profiles: ["tools"]

  # ===========================================================================
  # Backend Services
  # ===========================================================================

  recon-orchestrator:
    build: ./recon_orchestrator
    container_name: redamon-recon-orchestrator
    ports:
      - "${RECON_ORCH_PORT:-8010}:8010"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./recon_orchestrator:/app
      - ./recon:/app/recon:ro
      - ./recon/output:/app/recon/output:rw
    environment:
      RECON_PATH: ${PWD}/recon
      RECON_IMAGE: redamon-recon:latest
      # Forwarded to spawned recon containers (host network, so localhost)
      NVD_API_KEY: ${NVD_API_KEY:-}
      NEO4J_URI: bolt://localhost:7687
      NEO4J_USER: neo4j
      NEO4J_PASSWORD: ${NEO4J_PASSWORD:-changeme123}
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8010/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    networks:
      - redamon

  kali-sandbox:
    build:
      context: ./mcp
      dockerfile: kali-sandbox/Dockerfile
      network: host
    container_name: redamon-kali
    dns:
      - 8.8.8.8
      - 8.8.4.4
    hostname: kali-sandbox
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - SYS_PTRACE
    security_opt:
      - seccomp:unconfined
    ports:
      - "${MCP_NAABU_PORT:-8000}:8000"
      - "${MCP_CURL_PORT:-8001}:8001"
      - "${MCP_NUCLEI_PORT:-8002}:8002"
      - "${MCP_METASPLOIT_PORT:-8003}:8003"
      - "8013:8013"
      - "4444:4444"
    volumes:
      - ./mcp/servers:/opt/mcp_servers
      - ./mcp/output:/opt/output
      - ./mcp/nuclei-templates:/opt/nuclei-templates:ro
    environment:
      PYTHONUNBUFFERED: "1"
      MCP_TRANSPORT: sse
      MCP_HOST: 0.0.0.0
      NAABU_PORT: "8000"
      CURL_PORT: "8001"
      NUCLEI_PORT: "8002"
      METASPLOIT_PORT: "8003"
      MSF_PROGRESS_PORT: "8013"
      MSF_AUTO_UPDATE: "${MSF_AUTO_UPDATE:-true}"
      NUCLEI_AUTO_UPDATE: "${NUCLEI_AUTO_UPDATE:-true}"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python3", "-c", "import socket; s=socket.socket(); s.connect(('localhost', 8000)); s.close()"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 180s
    networks:
      redamon:
      pentest-net:

  agent:
    build: ./agentic
    container_name: redamon-agent
    ports:
      - "${AGENT_PORT:-8090}:8080"
    environment:
      # Neo4j (internal docker network)
      NEO4J_URI: bolt://neo4j:7687
      NEO4J_USER: neo4j
      NEO4J_PASSWORD: ${NEO4J_PASSWORD:-changeme123}
      # AI provider keys (from root .env)
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      TAVILY_API_KEY: ${TAVILY_API_KEY:-}
      # WebSocket config
      WS_HEARTBEAT_INTERVAL: "30"
      WS_TIMEOUT: "300"
      WS_MAX_MESSAGE_SIZE: "10485760"
      # MCP tool servers (internal docker network)
      MCP_CURL_URL: http://kali-sandbox:8001/sse
      MCP_NAABU_URL: http://kali-sandbox:8000/sse
      MCP_METASPLOIT_URL: http://kali-sandbox:8003/sse
      MCP_METASPLOIT_PROGRESS_URL: http://kali-sandbox:8013/progress
      # Webapp API (internal docker network)
      WEBAPP_API_URL: http://webapp:3000
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - ./agentic:/app
      - ./agentic/logs:/app/logs
    depends_on:
      neo4j:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 60s
      timeout: 60s
      retries: 3
      start_period: 30s
    networks:
      - redamon

  # ===========================================================================
  # Frontend
  # ===========================================================================

  # One-time init: syncs Prisma schema to PostgreSQL, then exits
  webapp-init:
    image: node:22-alpine
    working_dir: /app
    command: >
      sh -c "npm install prisma@6 --save-dev 2>&1 | tail -1 &&
             npx prisma db push --skip-generate --schema ./prisma/schema.prisma"
    volumes:
      - ./webapp/prisma:/app/prisma
      - webapp_prisma_cache:/app/node_modules
    environment:
      DATABASE_URL: "postgresql://${POSTGRES_USER:-redamon}:${POSTGRES_PASSWORD:-redamon_secret}@postgres:5432/${POSTGRES_DB:-redamon}"
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - redamon
    restart: "no"

  webapp:
    build: ./webapp
    container_name: redamon-webapp
    ports:
      - "${WEBAPP_PORT:-3000}:3000"
    environment:
      # PostgreSQL (Prisma)
      DATABASE_URL: "postgresql://${POSTGRES_USER:-redamon}:${POSTGRES_PASSWORD:-redamon_secret}@postgres:5432/${POSTGRES_DB:-redamon}"
      # Neo4j (server-side graph queries)
      NEO4J_URI: bolt://neo4j:7687
      NEO4J_USER: neo4j
      NEO4J_PASSWORD: ${NEO4J_PASSWORD:-changeme123}
      # Backend services (server-side API routes → internal docker network)
      RECON_ORCHESTRATOR_URL: http://recon-orchestrator:8010
      AGENT_API_URL: http://agent:8080
      AGENT_WS_URL: ws://agent:8080/ws/agent
      # Recon container connects via host network, needs host-accessible webapp URL
      WEBAPP_URL: http://localhost:${WEBAPP_PORT:-3000}
    depends_on:
      postgres:
        condition: service_healthy
      neo4j:
        condition: service_healthy
      webapp-init:
        condition: service_completed_successfully
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    networks:
      - redamon

# =============================================================================
# Networks
# =============================================================================

networks:
  redamon:
    name: redamon-network
    driver: bridge
  pentest-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/16

# =============================================================================
# Volumes
# =============================================================================

volumes:
  postgres_data:
  neo4j_data:
  neo4j_logs:
  neo4j_import:
  neo4j_plugins:
  webapp_prisma_cache: