docker-compose.yml.sample

services:

  # ------------------------------------------------------------
  #                Incoming and outgoing endpoints
  # ------------------------------------------------------------
  # Endpoint of the system control panel
  hosting-control-caddy:
    container_name: hosting-control-caddy
    image: caddy:2.11-alpine
    user: 1000:1000
    runtime: sysbox-runc
    read_only: true
    environment:
      - HOSTING_DOMAIN=hosting.knf.vu.lt
      - TLS_LETSENCRYPT_EMAIL=internal # Self-Signed

      - DBGATE_AUTH_HEADER=${DBGATE_AUTH_HEADER}
    volumes:
      - ./control-modules/control-caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - ./_DATA/control-caddy/caddy_data:/data
      - ./_DATA/control-caddy/caddy_config:/config
      - ./_DATA/control-caddy/caddy_logs:/var/log/caddy
      - ./_DATA/control-caddy/certs:/config/certs:ro
    ports:
      - 80:80
      - 443:443
      - 8443:8443
    networks:
      external: {}
      isolated-control-panel: {}
      filtered-users:
        ipv4_address: 172.19.2.2
    restart: unless-stopped



  # Users servers hosted apps WEB traffic endpoint
  hosting-users-caddy:
    container_name: hosting-users-caddy
    image: caddy:2.11-alpine
    user: 1000:1000
    runtime: sysbox-runc
    read_only: true
    volumes:
      - ./_DATA/users-caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - ./_DATA/users-caddy/caddy_data:/data
      - ./_DATA/users-caddy/caddy_config:/config
      - ./_DATA/users-caddy/caddy_logs:/var/log/caddy
      - ./_DATA/users-caddy/certs:/config/certs:ro
    ports:
      - 10080:80
      - 10443:443
    networks:
      external: {}
      filtered-users:
        ipv4_address: 172.19.2.3
    restart: unless-stopped



  # SSH Router for Users
  hosting-users-ssh-router:
    container_name: hosting-users-ssh-router
    image: vuknf/hosting-users-ssh-router:latest
    user: 1000:1000
    read_only: true
    environment:
      - BACKEND_SSH_API_URL=http://hosting-control-backend:8000/api/sshrouter
      - BACKEND_SSH_API_KEY=${BACKEND_SSH_API_KEY}
    ports:
      - "10022:2222"
    networks:
      external: {}
      isolated-control-panel: {}
      filtered-users:
        ipv4_address: 172.19.2.5
    restart: unless-stopped



  # Exit container for Docker Hub API access (L4 SNI proxy)
  hosting-control-backend-exit:
    container_name: hosting-control-backend-exit
    image: vuknf/caddy-l4:2.11
    user: 1000:1000
    runtime: sysbox-runc
    read_only: true
    volumes:
      - ./control-modules/control-backend-exit/Caddyfile:/etc/caddy/Caddyfile:ro
    networks:
      isolated-control-panel:
        ipv4_address: 172.19.0.30
      external: {}
    restart: unless-stopped
  # ------------------------------------------------------------
  # ------------------------------------------------------------
  # ------------------------------------------------------------










  # ------------------------------------------------------------
  #                System Control Panel Services
  # ------------------------------------------------------------
  hosting-control-frontend:
    container_name: hosting-control-frontend

    # Docker Hub
    image: vuknf/hosting-control-frontend:latest

    # # Self-built
    # image: hosting-control-frontend
    # build:
    #   context: ./control-modules/control-frontend
    #   # dockerfile: Dockerfile                                                         # Prod
    #   dockerfile: Dockerfile.dev                                                     # Dev

    user: 1000:1000
    read_only: true
    # tmpfs:                                                                           # Dev
    #   - /home/node/.npm:uid=1000,gid=1000                                            # Dev
    # volumes:                                                                         # Dev
    #   - ./control-modules/control-frontend/app:/app                                  # Dev
    networks:
      - isolated-control-panel
      # - external                                                                     # Dev
    restart: unless-stopped



  # Control Panel Backend
  hosting-control-backend:
    container_name: hosting-control-backend

    # Docker Hub
    image: vuknf/hosting-control-backend:latest

    # # Self-built
    # image: hosting-control-backend
    # build: ./control-modules/control-backend

    user: 1000:1000
    read_only: true
    environment:
      - TMPDIR=/tmp/backend
      # - APP_DEBUG=true                                                               # Dev
      - DB_PATH=/data/database2.db
      - DJANGO_SECRET_KEY=${DJANGO_SECRET_KEY}

      - DOCKER_CONTROLLER_HOST=hosting-control-docker
      - DOCKER_CONTROLLER_PORT=8000

      - BACKEND_SSH_API_KEY=${BACKEND_SSH_API_KEY}
    tmpfs:
      - /tmp/backend:uid=1000,gid=1000
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./_DATA/control-backend:/data
      - ./_LOGS/control-backend:/logs
      # - ./control-modules/control-backend:/app                                       # Dev
    extra_hosts:
      - "auth.docker.io:172.19.0.30"
      - "registry-1.docker.io:172.19.0.30"
    networks:
      - isolated-control-panel
      - isolated-control-docker
      # - external                                                                     # Dev
    restart: unless-stopped
  # ------------------------------------------------------------
  # ------------------------------------------------------------
  # ------------------------------------------------------------








  # ------------------------------------------------------------
  #                Docker Control and Monitoring Services
  # ------------------------------------------------------------
  # System Docker Controller
  hosting-control-docker:
    container_name: hosting-control-docker

    # Docker Hub
    image: vuknf/hosting-control-docker:latest

    # # Self-built
    # image: hosting-control-docker
    # build: ./control-modules/control-docker

    read_only: true
    environment:
      # - APP_DEBUG=true                                                               # Dev
      - ROOT_DIR=${ROOT_DIR}
      - USERS_VM_DIR=SERVERS
    volumes:
      - /etc/localtime:/etc/localtime:ro

      # Users apps caddy config
      - ./_DATA/users-caddy:/users-caddy

      # Docker socket for controlling docker containers
      - /var/run/docker.sock:/var/run/docker.sock

      # VM data directories, read-only — /api/usage/disk
      - ./SERVERS:/SERVERS:ro

      # Users virtual servers persistent directories
      - ${ROOT_DIR}/SERVERS:${ROOT_DIR}/SERVERS

      # Source code
      # - ./control-modules/control-docker:/app                                        # Dev
    networks:
      - isolated-control-docker
    restart: unless-stopped



  # Proxy for accessing Users' VMs docker sockets
  hosting-control-dockersocket:
    container_name: hosting-control-dockersocket
    image: caddy:2.11-alpine
    runtime: sysbox-runc
    user: 1000:1000
    read_only: true
    volumes:
      - ./control-modules/control-dockersocket/Caddyfile:/etc/caddy/Caddyfile:ro
    networks:
      isolated-control-docker: {}
      filtered-users:
        ipv4_address: 172.19.2.11
    restart: unless-stopped



  # Container Monitoring (Cadvisor)
  hosting-control-cadvisor:
    container_name: hosting-control-cadvisor
    image: gcr.io/cadvisor/cadvisor:v0.52.1
    privileged: true
    devices:
      - /dev/kmsg
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    networks:
      - isolated-control-docker
    restart: unless-stopped

  # ------------------------------------------------------------
  # ------------------------------------------------------------
  # ------------------------------------------------------------











  # ------------------------------------------------------------
  #                    Administrator Services
  # ------------------------------------------------------------
  # Database Browser
  hosting-control-dbgate:
    container_name: hosting-control-dbgate
    image: dbgate/dbgate:7.2.3
    user: root
    read_only: true
    environment:
      WEB_ROOT: /dbgate

      BASIC_AUTH: 1
      LOGIN: dbgate
      PASSWORD: ${DBGATE_PASSWORD}

      CONNECTIONS: con1
      LABEL_con1: App Hosting Platform - SQLite
      FILE_con1: /data/database2.db
      ENGINE_con1: sqlite@dbgate-plugin-sqlite
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./_DATA/control-backend:/data
    networks:
      - isolated-control-panel
    restart: unless-stopped
  # ------------------------------------------------------------
  # ------------------------------------------------------------
  # ------------------------------------------------------------











  # ------------------------------------------------------------
  #                Documentation Services
  # ------------------------------------------------------------
  hosting-control-docs-web:
    container_name: hosting-control-docs-web
    image: linuxserver/bookstack:25.11.1
    environment:
      - PUID=1000
      - PGID=1000
      - APP_KEY=${BOOKSTACK_APP_KEY}
      - APP_URL=https://hosting.knf.vu.lt/docs
      - DB_HOST=hosting-control-docs-mariadb
      - DB_PORT=3306
      - DB_USERNAME=bookstack
      - DB_PASSWORD=bookstack
      - DB_DATABASE=bookstackapp
      - APP_DEFAULT_DARK_MODE=true
      - APP_PROXIES=*
      - APP_TIMEZONE=Europe/Vilnius
      - SESSION_LIFETIME=40320
      - DRAWIO=https://hosting.knf.vu.lt/draw/?embed=1&proto=json&spin=1&configure=1
    read_only: false
    volumes:
      - ./_DATA/control-docs/app_data:/config
    depends_on:
      - hosting-control-docs-mariadb
    networks:
      - isolated-control-panel
    restart: unless-stopped



  hosting-control-docs-mariadb:
    container_name: hosting-control-docs-mariadb
    image: linuxserver/mariadb:10.11.10
    environment:
      - PUID=1000
      - PGID=1000
      - MYSQL_ROOT_PASSWORD=bookstack
      - TZ=Europe/Vilnius
      - MYSQL_DATABASE=bookstackapp
      - MYSQL_USER=bookstack
      - MYSQL_PASSWORD=bookstack
    read_only: false
    volumes:
      - ./_DATA/control-docs/db_data:/config
    networks:
      - isolated-control-panel
    restart: unless-stopped



  hosting-control-docs-drawio:
    container_name: hosting-control-docs-drawio
    image: jgraph/drawio:29.0.3
    user: 1000:1000
    read_only: false
    networks:
      - isolated-control-panel
    restart: unless-stopped



  hosting-control-swagger:
    container_name: hosting-control-swagger
    image: swaggerapi/swagger-ui:v5.29.5
    read_only: false
    volumes:
      - ./control-modules/control-swagger/swagger.yaml:/swagger.yaml:ro
    environment:
      - SWAGGER_JSON=/swagger.yaml
      - BASE_URL=/swagger
    networks:
      - isolated-control-panel
    restart: unless-stopped
  # ------------------------------------------------------------
  # ------------------------------------------------------------
  # ------------------------------------------------------------







  # ------------------------------------------------------------
  #                Outgoing traffic management
  # ------------------------------------------------------------
  # Outgoing users traffic firewall
  hosting-users-firewall:
    container_name: hosting-users-firewall
    image: vuknf/hosting-users-firewall:latest
    user: root
    runtime: sysbox-runc
    command: >-
      sh -c "
      sysctl -w net.ipv4.ip_forward=1 &&
      iptables -F &&
      iptables -t nat -F &&
      iptables -t nat -X &&

      echo '[*] Set default policies' &&
      iptables -P FORWARD DROP &&

      echo '[*] Restrict access to local networks' &&
      iptables -A FORWARD -s 172.19.2.0/24 -d 172.16.0.0/12 -j DROP &&
      iptables -A FORWARD -s 172.19.2.0/24 -d 192.168.0.0/16 -j DROP &&
      iptables -A FORWARD -s 172.19.2.0/24 -d 10.0.0.0/8 -j DROP &&

      echo '[*] Allow VM traffic to internet' &&
      iptables -A FORWARD -s 172.19.2.0/24 -j ACCEPT &&

      echo '[*] Allow returning traffic' &&
      iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT &&

      echo '[*] NAT outgoing traffic' &&
      iptables -t nat -A POSTROUTING -s 172.19.2.0/24 -o eth1 -j MASQUERADE &&
      iptables -t nat -A POSTROUTING -s 172.19.2.0/24 -o eth0 -j MASQUERADE &&

      echo '[*] Starting DNS forwarder' &&
      dnsmasq --no-daemon --no-resolv --server=8.8.8.8 --server=1.1.1.1 --log-queries &

      echo '[*] Router configuration complete' &&
      tail -f /dev/null"
    networks:
      external: {}
      filtered-users:
        ipv4_address: 172.19.2.1
    restart: unless-stopped



  # Docker Hub cache proxy for users
  hosting-users-dockerhub-cache:
    container_name: hosting-users-dockerhub-cache
    image: registry:3.0.0
    user: 1000:1000
    runtime: sysbox-runc
    read_only: true
    environment:
      REGISTRY_PROXY_REMOTEURL: https://registry-1.docker.io
    volumes:
      - ./_DATA/users-dockerhub-cache:/var/lib/registry
    networks:
      external: {}
      filtered-users:
        ipv4_address: 172.19.2.4
    restart: unless-stopped
  # ------------------------------------------------------------
  # ------------------------------------------------------------
  # ------------------------------------------------------------









networks:
  external:
    name: external
    external: true
  isolated-control-panel:
    name: isolated-control-panel
    driver: bridge
    internal: true
    ipam:
      config:
        - subnet: 172.19.0.0/24
          gateway: 172.19.0.1
  isolated-control-docker:
    name: isolated-control-docker
    driver: bridge
    internal: true
    ipam:
      config:
        - subnet: 172.19.1.0/24
          gateway: 172.19.1.1
  filtered-users:
    name: filtered-users
    driver: bridge
    internal: false
    driver_opts:
      com.docker.network.bridge.enable_ip_masquerade: 'false'
    ipam:
      config:
        - subnet: 172.19.2.0/24
          ip_range: 172.19.2.128/25
          gateway: 172.19.2.254