docker-compose.yml

# ═════════════════════════════════════════════════════════════════════════════════
# VANTAGE: Enterprise Security Operations Hub - Docker Compose Orchestration
# Gophish + ProjectDiscovery Tools + Postfix + Caddy Reverse Proxy
# ═════════════════════════════════════════════════════════════════════════════════

services:

  # ─────────────────────────────────────────────────────────────────────────────
  # Core: Vantage Application (Gophish + Scanner Engine)
  # ─────────────────────────────────────────────────────────────────────────────
  vantage-core:
    # 'image' lets the VPS just 'docker compose pull' a prebuilt image from GHCR
    # instead of building from source (slow on HDD-backed VPS — see CI workflow).
    # 'build' is kept so local dev (`docker compose build`) still works without CI.
    image: ghcr.io/yusufarbc/vantage:latest
    build:
      context: .
      dockerfile: Dockerfile
    container_name: vantage_core
    restart: always

    # Linux Capabilities: CRITICAL for network operations
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - SYS_PTRACE

    # Kernel networking device: Required for TUN/TAP tunneling
    devices:
      - /dev/net/tun:/dev/net/tun

    # Port mappings using global variables
    ports:
      # Admin UI (bound to localhost for secure access)
      - target: 3333
        published: "${HOST_ADMIN_PORT:-3333}"
        host_ip: 127.0.0.1
        mode: ingress

      # Chisel Reverse Tunnel Listener (agents connect here, must be public)
      - target: 9090
        published: "${HOST_CHISEL_PORT:-9090}"
        mode: ingress

    # Persistent storage volumes
    volumes:
      # Database persistence (SQLite)
      - ./vantage_data:/opt/vantage/db

      # Nuclei templates caching (avoid re-downloading on restart)
      - nuclei_templates:/home/vantage/.nuclei-templates

      # Nuclei configuration
      - nuclei_config:/home/vantage/.config/nuclei

    # Environment configuration
    environment:
      # Database
      - DB_TYPE=sqlite3
      - DB_PATH=/opt/vantage/db/vantage.db

      # Gophish Admin
      - GOPHISH_ADMIN_BIND=0.0.0.0:3333
      - GOPHISH_ADMIN_TLS=false
      # Set on first run so the initial admin password is known up front
      # instead of having to be grepped out of container logs.
      - GOPHISH_INITIAL_ADMIN_PASSWORD=${GOPHISH_INITIAL_ADMIN_PASSWORD:-}
      # Needed so the entrypoint can set admin_server.trusted_origins —
      # without it, every POST behind Caddy fails CSRF's referer check.
      - ADMIN_DOMAIN=${ADMIN_DOMAIN:-localhost}

      # SMTP Relay (Postfix)
      - SMTP_HOST=postfix
      - SMTP_PORT=25

      # Reverse Tunnel (Chisel)
      - CHISEL_SERVER_PORT=9090

      # System Status page: read-only container health, via the docker-proxy
      # sidecar (never the real docker.sock — see its service comment)
      - DOCKER_PROXY_URL=http://docker-proxy:2375

      # Logging
      - LOG_LEVEL=info

    # Resource limits (prevent runaway resource usage). Defaults assume the
    # documented minimum spec (4 CPU / 8GB RAM). On smaller VPS, override
    # CORE_CPU_LIMIT/CORE_CPU_RESERVATION/CORE_MEM_LIMIT/CORE_MEM_RESERVATION
    # in .env — Docker rejects a 'cpus' value above the host's actual core count.
    deploy:
      resources:
        limits:
          cpus: '${CORE_CPU_LIMIT:-4}'
          memory: ${CORE_MEM_LIMIT:-4G}
        reservations:
          cpus: '${CORE_CPU_RESERVATION:-2}'
          memory: ${CORE_MEM_RESERVATION:-2G}

    # Health check: Ensure service is responding
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:3333/" ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

    # Network configuration
    networks:
      - vantage-net

    depends_on:
      postfix:
        condition: service_started
      docker-proxy:
        condition: service_started

    # Logging configuration
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
        labels: "service=vantage-core"

  # ─────────────────────────────────────────────────────────────────────────────
  # Mail: Postfix SMTP Relay (for Gophish phishing email delivery)
  # ─────────────────────────────────────────────────────────────────────────────
  postfix:
    image: mwader/postfix-relay:latest
    container_name: vantage_postfix
    restart: always

    # Internal network only (no external ports needed)
    networks:
      - vantage-net

    # Persist DKIM keys (regenerating them would invalidate the DNS TXT record)
    volumes:
      - opendkim_keys:/etc/opendkim/keys

    environment:
      # Postfix hostname — must match the server's PTR/rDNS record for direct sending
      - POSTFIX_myhostname=${MAIL_HOSTNAME:-vantage.local}

      # Allow vantage-core to relay
      - POSTFIX_mynetworks=172.20.0.0/16

      # DKIM-sign outgoing mail for this domain (must match the "From" address domain
      # used in Gophish sending profiles). Public key ends up in /etc/opendkim/keys/<domain>/mail.txt
      - OPENDKIM_DOMAINS=${MAIL_DOMAIN:-vantage.local}
      - OPENDKIM_RequireSafeKeys=no

    # Resource limits — see CORE_CPU_LIMIT comment above for the override pattern
    deploy:
      resources:
        limits:
          cpus: '${POSTFIX_CPU_LIMIT:-1}'
          memory: ${POSTFIX_MEM_LIMIT:-512M}
        reservations:
          cpus: '${POSTFIX_CPU_RESERVATION:-0.5}'
          memory: ${POSTFIX_MEM_RESERVATION:-256M}

    healthcheck:
      test: [ "CMD", "postfix", "status" ]
      interval: 30s
      timeout: 10s
      retries: 3

    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "2"
        labels: "service=postfix"

  # ─────────────────────────────────────────────────────────────────────────────
  # Proxy: Caddy Reverse Proxy (TLS termination + Basic Auth + Admin Obfuscation)
  # ─────────────────────────────────────────────────────────────────────────────
  caddy:
    image: caddy:2.7-alpine
    container_name: vantage_caddy
    restart: always

    # Port mappings using global variables
    ports:
      # Public HTTP/HTTPS reverse proxy access (Let's Encrypt auto-TLS)
      - target: 80
        published: "${HOST_PHISH_HTTP_PORT:-80}"
        mode: ingress
      - target: 443
        published: "${HOST_PHISH_HTTPS_PORT:-443}"
        mode: ingress

    volumes:
      # Caddy configuration
      - ./Caddyfile:/etc/caddy/Caddyfile:ro

      # TLS certificates persistence
      - caddy_data:/data
      - caddy_config:/config

      # Persistent Caddy access and audit logs
      - ./vantage_data/caddy_logs:/var/log/caddy

    networks:
      - vantage-net

    environment:
      CADDY_EMAIL: "${CADDY_EMAIL:-admin@vantage.local}"
      ADMIN_DOMAIN: "${ADMIN_DOMAIN:-localhost}"
      PHISH_DOMAIN: "${DOMAIN:-localhost}"
      ADMIN_PATH_SECRET: "${ADMIN_PATH_SECRET:-vantage-ops-secret-777}"
      ADMIN_PASS_HASH: "${ADMIN_PASS_HASH:-disabled}"

    depends_on:
      - vantage-core

    healthcheck:
      test: [ "CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:2019/config/" ]
      interval: 30s
      timeout: 10s
      retries: 3

    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "2"
        labels: "service=caddy"

  # ─────────────────────────────────────────────────────────────────────────────
  # Docker Socket Proxy: read-only, container-list-only view of the Docker API
  # for the System Status page. vantage-core never touches /var/run/docker.sock
  # directly — only this proxy does, and it's locked down to GET /containers/*
  # (CONTAINERS=1, everything else defaults to 0: no exec, no volumes, no images,
  # no POST of any kind). A compromised vantage-core can read container health,
  # nothing more — it can't start/stop/exec containers or escape to the host.
  # ─────────────────────────────────────────────────────────────────────────────
  docker-proxy:
    image: tecnativa/docker-socket-proxy:latest
    container_name: vantage_docker_proxy
    restart: always

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

    environment:
      - CONTAINERS=1
      - POST=0

    networks:
      - vantage-net

    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "2"
        labels: "service=docker-proxy"

# ═════════════════════════════════════════════════════════════════════════════════
# NETWORKS
# ═════════════════════════════════════════════════════════════════════════════════
networks:
  vantage-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16

# ═════════════════════════════════════════════════════════════════════════════════
# VOLUMES
# ═════════════════════════════════════════════════════════════════════════════════
volumes:
  # Nuclei templates (downloaded on first run, cached thereafter)
  nuclei_templates:
    driver: local

  # Nuclei configuration
  nuclei_config:
    driver: local

  # Caddy certificates (Let's Encrypt auto-renewal)
  caddy_data:
    driver: local

  # Caddy configuration
  caddy_config:
    driver: local

  # OpenDKIM keys (persisted so the DNS DKIM TXT record stays valid across restarts)
  opendkim_keys:
    driver: local