fleet-edr/docker-compose.quickstart.yml at main · getvictor/fleet-edr · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
# Single-VM getting-started stack: MySQL + the EDR server + Caddy.
#
# Caddy terminates public HTTPS with automatic Let's Encrypt certificates and
# reverse-proxies to the server over the private Docker network, so the operator
# manages zero certificates and there is NO content-inspecting WAF in the path
# (unlike a managed PaaS edge). Bring it up with ./bootstrap.sh, which generates
# the secret files and .env this stack expects. Full walkthrough:
# docs/quickstart-vm.md. For high availability, use
# packaging/docker-compose-multi-replica.yml instead.

services:
  mysql:
    image: mysql:8.4.9@sha256:c36050afdca850f23cef85703f84c7531a5ae155a11b5ee1c60acb09937c4084
    restart: unless-stopped
    # Single MySQL instance: no replica and no point-in-time recovery, so the
    # binary log is pure overhead. Disabling it drops a per-commit fsync and
    # roughly halves write volume, which directly relieves the disk-bound event
    # store. Further ingest tuning (commit durability, buffer pool, flush pacing)
    # is disk-specific, so it is not defaulted here; see "Tuning MySQL for ingest
    # throughput" in docs/quickstart-vm.md.
    command:
      - --skip-log-bin
    environment:
      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/mysql_root
      MYSQL_DATABASE: edr
    volumes:
      - edr-mysql-data:/var/lib/mysql
    secrets:
      - mysql_root
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping --silent 2>/dev/null || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 10s

  # ClickHouse event archive (ADR-0015): the durable event store the server writes ingested events to and reads them back
  # from. Reachable only on the private compose network (no host port), same posture as mysql. The default user is
  # passwordless; the DSN rides a docker secret so a password can be added later without editing this file.
  clickhouse:
    image: clickhouse/clickhouse-server:24.8@sha256:1ffa82edee000a42c09313bd9f1293d94c570aee74babc1b3ca9983a35fa597b
    restart: unless-stopped
    environment:
      CLICKHOUSE_DB: edr
      # Required for the default user to authenticate over the network with an empty password; without it the server's
      # ClickHouse ping fails with code 516 (AUTHENTICATION_FAILED). Mirrors the dev/demo clickhouse service.
      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"
    ulimits:
      # ClickHouse opens many files; the stock 1024 soft limit trips "too many open files" under load.
      nofile:
        soft: 262144
        hard: 262144
    volumes:
      - edr-clickhouse-data:/var/lib/clickhouse
    healthcheck:
      test: ["CMD", "clickhouse-client", "--query", "SELECT 1"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 10s

  server:
    # Pin EDR_VERSION in .env to a release tag for production; bootstrap.sh warns
    # when it defaults to `latest`.
    image: ghcr.io/getvictor/fleet-edr-server:${EDR_VERSION:-latest}
    restart: unless-stopped
    depends_on:
      mysql:
        condition: service_healthy
      clickhouse:
        condition: service_healthy
    # Pass .env through to the server so any server variable (OIDC/SSO, session
    # timeouts, JIT provisioning, etc.) can be set there without editing this
    # file. The explicit `environment:` keys below take precedence over .env, so
    # the security-critical wiring (proxy-terminated TLS, trusted proxies, the
    # secret *_FILE paths) cannot be overridden by accident. See
    # docs/quickstart-vm.md ("Set server configuration").
    env_file:
      - .env
    environment:
      # DSN + secrets are read from files (docker secrets) so no password lands
      # in `docker inspect`. EDR_DSN is blank so the *_FILE path wins.
      EDR_DSN: ""
      EDR_DSN_FILE: /run/secrets/edr_dsn
      EDR_ENROLL_SECRET_FILE: /run/secrets/enroll_secret
      EDR_SECRET_KEY_FILE: /run/secrets/secret_key
      # ClickHouse event archive DSN (ADR-0015). Passwordless on the private network; blank env so the *_FILE path wins.
      EDR_CLICKHOUSE_DSN: ""
      EDR_CLICKHOUSE_DSN_FILE: /run/secrets/clickhouse_dsn
      # Caddy terminates TLS in front; the server listens plaintext on the
      # private Docker network only. It is never published to the host, so the
      # only way in is through Caddy.
      EDR_LISTEN_ADDR: "0.0.0.0:8088"
      EDR_TLS_TERMINATED_BY_PROXY: "1"
      # Trust X-Forwarded-For only from the Docker bridge network (Caddy). The
      # default Compose address pool lives inside 172.16.0.0/12.
      EDR_TRUSTED_PROXIES: "172.16.0.0/12"
      # Break-glass WebAuthn binds credentials to the public host, so both must
      # equal your domain.
      EDR_BREAKGLASS_RP_ID: ${EDR_DOMAIN}
      EDR_BREAKGLASS_RP_ORIGINS: https://${EDR_DOMAIN}
      # Sign in with the break-glass admin, then configure SSO under Admin
      # settings -> Single sign-on; it applies at runtime and survives restarts.
      # See docs/quickstart-vm.md ("Single sign-on (OIDC)"). The server always
      # boots without OIDC config (issue #512).
      EDR_LOG_LEVEL: ${EDR_LOG_LEVEL:-info}
      EDR_LOG_FORMAT: "json"
      # Event retention window. 7 days (not the 30-day server default) keeps the
      # MySQL disk bounded: events are the dominant store and grow ~8-10 GB per
      # day per busy host (index-heavy rows). Interim value pending the storage
      # rework in getvictor/fleet-edr#408; raise it once that lands and disk per
      # event drops. Alerts are never pruned by retention, so this only bounds
      # raw-event lookback. Override in .env if you have the disk for more.
      EDR_RETENTION_DAYS: ${EDR_RETENTION_DAYS:-7}
      # OTel export (optional). Set OTEL_EXPORTER_OTLP_ENDPOINT in .env to an
      # OTLP/gRPC collector to turn on traces, metrics, and logs; leave it unset
      # to keep telemetry off. The URL scheme picks the transport: http:// is
      # plaintext, https:// uses TLS. OTEL_EXPORTER_OTLP_HEADERS carries an
      # auth/ingestion token (e.g. SigNoz Cloud); OTEL_RESOURCE_ATTRIBUTES sets
      # deployment.environment and any other resource tags. See
      # docs/quickstart-vm.md ("Send telemetry to a collector").
      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
      OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
      OTEL_RESOURCE_ATTRIBUTES: ${OTEL_RESOURCE_ATTRIBUTES:-}
      OTEL_SERVICE_NAME: fleet-edr-server
    secrets:
      - enroll_secret
      - edr_dsn
      - secret_key
      - clickhouse_dsn

  caddy:
    image: caddy:2
    restart: unless-stopped
    depends_on:
      - server
    environment:
      EDR_DOMAIN: ${EDR_DOMAIN}
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./packaging/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config

volumes:
  edr-mysql-data:
  edr-clickhouse-data:
  caddy-data:
  caddy-config:

secrets:
  mysql_root:
    file: ./secrets/mysql_root
  enroll_secret:
    file: ./secrets/enroll_secret
  edr_dsn:
    file: ./secrets/edr_dsn
  secret_key:
    file: ./secrets/secret_key
  clickhouse_dsn:
    file: ./secrets/clickhouse_dsn