docker-compose.yml

services:
  # PostgreSQL Database
  database:
    image: postgres:15-alpine
    container_name: exfil-database
    environment:
      POSTGRES_DB: exfilsentry
      POSTGRES_USER: exfilsentry
      POSTGRES_PASSWORD: password
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./containers/database/init.sql:/docker-entrypoint-initdb.d/init.sql
    networks:
      - exfil-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U exfilsentry"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Backend API (Control Server)
  backend:
    build:
      context: ./containers/backend
      dockerfile: Dockerfile
    container_name: exfil-backend
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=postgresql://exfilsentry:password@database:5432/exfilsentry
      - DEBUG=true
      - ATTACKER_URL=http://attacker:5000
      - DOCKER_HOST=unix:///var/run/docker.sock
      - SUPABASE_URL=${SUPABASE_URL:-}
      - SUPABASE_JWT_SECRET=${SUPABASE_JWT_SECRET:-}
    depends_on:
      database:
        condition: service_healthy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:rw
      - ./containers/backend:/app
      - vnc_logs:/vnc_logs
    cap_add:
      - NET_ADMIN
    networks:
      - exfil-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Frontend React App (Dashboard)
  frontend:
    build:
      context: ./containers/frontend
      dockerfile: Dockerfile
    container_name: exfil-frontend
    ports:
      - "3000:3000"
    environment:
      - REACT_APP_API_URL=
      - CHOKIDAR_USEPOLLING=true
    volumes:
      - ./containers/frontend:/app
      - /app/node_modules
      
    networks:
      - exfil-network
    depends_on:
      - backend

  # Detector Container (Zeek Analysis + Signature Detection)
  detector:
    build:
      context: ./containers/detector
      dockerfile: Dockerfile
    container_name: exfil-detector
    environment:
      - DATABASE_URL=postgresql://exfilsentry:password@database:5432/exfilsentry
      - NETWORK_INTERFACE=any
      - DEBUG=true
      # Signature Detection Configuration
      - DETECTION_MODE=both  # Options: behavioral, signature, both
      - ENABLE_ZEEK=true
      - ENABLE_SCAPY=true
      - MIN_SEVERITY=medium  # Options: low, medium, high, critical
      - CAPTURE_DIR=/app/captures
      - SIGNATURE_OUTPUT_DIR=/app/signature_logs
    depends_on:
      database:
        condition: service_healthy
    volumes:
      - ./containers/detector:/app
      - capture_data:/app/captures
    networks:
      - exfil-network
    cap_add:
      - NET_ADMIN
      - NET_RAW
    privileged: true

  # Packet Capture Sidecar for TigerVNC - shares network namespace with victim
  capture-tigervnc:
    image: nicolaka/netshoot:latest
    container_name: capture-tigervnc
    network_mode: "service:victim-tigervnc"
    command: >
      sh -c "tcpdump -i any -U -w /captures/tigervnc.pcap -C 10 -W 5 -s 0 'port 5900 or port 5901'"
    volumes:
      - capture_data:/captures
    cap_add:
      - NET_ADMIN
      - NET_RAW
    depends_on:
      - victim-tigervnc

  # Packet Capture Sidecar for RealVNC - shares network namespace with victim  
  capture-realvnc:
    image: nicolaka/netshoot:latest
    container_name: capture-realvnc
    network_mode: "service:victim-realvnc"
    command: >
      sh -c "tcpdump -i any -U -w /captures/realvnc.pcap -C 10 -W 5 -s 0 'port 5900 or port 5901'"
    volumes:
      - capture_data:/captures
    cap_add:
      - NET_ADMIN
      - NET_RAW
    depends_on:
      - victim-realvnc

  # Attacker Container (VNC Attack Simulator)
  attacker:
    build:
      context: ./containers/attacker
      dockerfile: Dockerfile
    container_name: exfil-attacker
    ports:
      - "8001:5000"
    environment:
      - VICTIM_TIGERVNC_HOST=victim-tigervnc
      - VICTIM_REALVNC_HOST=victim-realvnc
      - VNC_PASSWORD=vncpass
    volumes:
      - ./containers/attacker:/app
      # Share Zeek logs with attacker so it can simulate/push notices for testing
      - ./containers/detector/zeek_logs:/shared/zeek_logs:rw
    networks:
      - exfil-network
    depends_on:
      - victim-tigervnc
      - victim-realvnc

  # TigerVNC Victim Container
  victim-tigervnc:
    build:
      context: ./containers/victim-tigervnc
      dockerfile: Dockerfile
    container_name: exfil-victim-tigervnc
    ports:
      - "5900:5900"
    volumes:
      - vnc_logs:/vnc_logs
    networks:
      - exfil-network
    hostname: victim-tigervnc
    tty: true

  # RealVNC Victim Container
  victim-realvnc:
    build:
      context: ./containers/victim-realvnc
      dockerfile: Dockerfile
    container_name: exfil-victim-realvnc
    ports:
      - "5901:5901"
    volumes:
      - vnc_logs:/vnc_logs
    networks:
      - exfil-network
    hostname: victim-realvnc

  #adminer, not neccessary, but you can view the database through the gui using this.  
  adminer:
    image: adminer:latest
    container_name: exfil-adminer
    ports:
      - "8080:8080"
    networks:
      - exfil-network
    depends_on:
      - database
  # System: PostgreSQL
  # Server: database
  # Username: exfilsentry
  # Password: password
  # Database: exfilsentry

volumes:
  postgres_data:
  capture_data:
  vnc_logs:

networks:
  exfil-network:
    driver: bridge