docker-compose.yml

x-logging: &default-logging
  driver: json-file
  options:
    max-size: "50m"
    max-file: "5"
    compress: "true"

x-healthcheck-defaults: &healthcheck-defaults
  interval: 30s
  timeout: 10s
  retries: 3

services:
  nginx:
    build:
      context: .
      dockerfile: docker/Dockerfile.nginx
    image: threatscope/nginx:${IMAGE_TAG:-latest}
    container_name: threatscope_nginx
    ports:
      - "${NGINX_PORT:-80}:80"
    volumes:
      - ./docker/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./docker/nginx-security.conf:/etc/nginx/snippets/security.conf:ro
    depends_on:
      backend:
        condition: service_healthy
      frontend:
        condition: service_healthy
    networks:
      - threatscope
    restart: unless-stopped
    logging: *default-logging
    healthcheck:
      <<: *healthcheck-defaults
      test: ["CMD", "curl", "-sf", "http://localhost/health"]
      start_period: 10s

  frontend:
    build:
      context: .
      dockerfile: docker/Dockerfile.frontend
      args:
        VITE_API_URL: ""
    image: threatscope/frontend:${IMAGE_TAG:-latest}
    container_name: threatscope_frontend
    networks:
      - threatscope
    restart: unless-stopped
    logging: *default-logging
    healthcheck:
      <<: *healthcheck-defaults
      test: ["CMD", "curl", "-sf", "http://localhost/"]
      start_period: 10s

  backend:
    build:
      context: .
      dockerfile: docker/Dockerfile.backend
    image: threatscope/backend:${IMAGE_TAG:-latest}
    container_name: threatscope_backend
    privileged: true
    env_file:
      - path: .env
        required: false
    volumes:
      - threatscope_data:/app/data
      - ./rules:/app/rules:ro
      - ./prompts:/app/prompts:ro
      - ./.claude:/app/.claude:ro
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - THREATSCOPE_ENVIRONMENT=production
      - THREATSCOPE_DEBUG=false
      - THREATSCOPE_DB_PATH=/app/data/tasks.db
      - THREATSCOPE_GHIDRA_SERVICE_MODE=subprocess
      - THREATSCOPE_GHIDRA_SERVICE_HOST=ghidra
      - THREATSCOPE_GHIDRA_BASE_HTTP_PORT=8000
      - THREATSCOPE_DIEC_URL=http://diec:8000
      - THREATSCOPE_DIEC_ENABLED=true
      - THREATSCOPE_CAPA_RULES_PATH=/app/rules/capa
      - THREATSCOPE_ANALYSIS_DEFAULT_TIMEOUT=${ANALYSIS_TIMEOUT:-300}
      - THREATSCOPE_GDB_ENABLED=${GDB_ENABLED:-true}
      - THREATSCOPE_GDB_SERVICE_MODE=sse
      - THREATSCOPE_GDB_MCP_URL=http://gdb:8081/sse
      - THREATSCOPE_THREAT_INTEL_VIRUSTOTAL_ENABLED=${THREATSCOPE_THREAT_INTEL_VIRUSTOTAL_ENABLED:-false}
      - THREATSCOPE_THREAT_INTEL_VIRUSTOTAL_API_KEY=${THREATSCOPE_THREAT_INTEL_VIRUSTOTAL_API_KEY:-}
      - THREATSCOPE_THREAT_INTEL_TIX_ENABLED=${THREATSCOPE_THREAT_INTEL_TIX_ENABLED:-false}
      - THREATSCOPE_THREAT_INTEL_TIX_APP_ID=${THREATSCOPE_THREAT_INTEL_TIX_APP_ID:-}
      - THREATSCOPE_THREAT_INTEL_TIX_APP_KEY=${THREATSCOPE_THREAT_INTEL_TIX_APP_KEY:-}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:?ANTHROPIC_API_KEY is required}
      - ANTHROPIC_BASE_URL=${ANTHROPIC_BASE_URL:-}
      - ANTHROPIC_MODEL=${ANTHROPIC_MODEL:-claude-sonnet-4-20250514}
      - LANGFUSE_PUBLIC_KEY=${LANGFUSE_PUBLIC_KEY:-}
      - LANGFUSE_SECRET_KEY=${LANGFUSE_SECRET_KEY:-}
      - LANGFUSE_HOST=${LANGFUSE_HOST:-}
    depends_on:
      ghidra:
        condition: service_healthy
      diec:
        condition: service_healthy
      gdb:
        condition: service_healthy
    networks:
      - threatscope
    restart: unless-stopped
    logging: *default-logging
    healthcheck:
      <<: *healthcheck-defaults
      test: ["CMD", "curl", "-sf", "http://localhost:8000/health"]
      start_period: 30s

  ghidra:
    build:
      context: .
      dockerfile: docker/Dockerfile.ghidra
    image: threatscope/ghidra:${IMAGE_TAG:-latest}
    container_name: threatscope_ghidra
    volumes:
      - threatscope_data:/app/data
    environment:
      - GHIDRA_INSTALL_DIR=/ghidra
      - GHIDRA_HTTP_PORT=8000
      - GHIDRA_HTTP_URL=http://localhost:8000
      - GHIDRA_UPLOAD_DIR=/app/data/uploads
      - GHIDRA_MCP_ALLOW_ORIGINS=*
      - JAVA_OPTS=-Xms512m -Xmx3g -XX:+UseG1GC -XX:MaxGCPauseMillis=200
    networks:
      - threatscope
    restart: unless-stopped
    logging: *default-logging
    deploy:
      resources:
        limits:
          memory: 4G
    healthcheck:
      <<: *healthcheck-defaults
      test: ["CMD", "curl", "-sf", "http://localhost:8000/health"]
      start_period: 120s
      retries: 5

  diec:
    build:
      context: .
      dockerfile: docker/Dockerfile.diec
    image: threatscope/diec:${IMAGE_TAG:-latest}
    container_name: threatscope_diec
    environment:
      - DIEC_TIMEOUT=${DIEC_TIMEOUT:-60}
    networks:
      - threatscope
    restart: unless-stopped
    logging: *default-logging
    healthcheck:
      <<: *healthcheck-defaults
      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
      start_period: 10s

  gdb:
    build:
      context: .
      dockerfile: docker/Dockerfile.gdb
    image: threatscope/gdb-mcp:${IMAGE_TAG:-latest}
    container_name: threatscope_gdb
    volumes:
      - threatscope_data:/app/data
    environment:
      - GDB_PATH=/usr/bin/gdb
      - GDB_MCP_LOG_LEVEL=INFO
      - GDB_MCP_MODE=sse
      - GDB_MCP_HOST=0.0.0.0
      - GDB_MCP_PORT=8081
    cap_add:
      - SYS_PTRACE
    security_opt:
      - seccomp:unconfined
    networks:
      - threatscope
    restart: unless-stopped
    logging: *default-logging
    healthcheck:
      <<: *healthcheck-defaults
      test: ["CMD", "curl", "-sf", "http://localhost:8081/health"]
      start_period: 10s

  gdb-target:
    image: ubuntu:22.04
    container_name: threatscope_gdb_target
    command: ["sleep", "infinity"]
    volumes:
      - threatscope_data:/app/data
    cap_add:
      - SYS_PTRACE
    security_opt:
      - seccomp:unconfined
    network_mode: "none"
    restart: unless-stopped
    logging: *default-logging

networks:
  threatscope:
    driver: bridge
    name: threatscope

volumes:
  threatscope_data:
    driver: local
    name: threatscope_data