# -----------------------------------------------------------------------
# CrowdSec Dashy — Docker Compose
#
# Prerequisites:
#   1. Register the UI as a CrowdSec machine BEFORE starting this stack:
#      docker exec crowdsec cscli machines add crowdsec-dashy --password changeme -a
#
#   2. Edit the environment variables below (especially passwords).
#
# cscli bind-mount:
#   The UI needs the cscli binary for bouncer/machine/hub/metrics management.
#   If CrowdSec is running in Docker, extract the binary from the image:
#     docker cp crowdsec:/usr/local/bin/cscli /usr/local/bin/cscli
#   Then the bind-mount below works automatically.
#
#   If cscli is NOT available, those sections will show a degradation banner
#   and all LAPI-based features (decisions, alerts) continue to work normally.
# -----------------------------------------------------------------------

services:
  crowdsec:
    image: crowdsecurity/crowdsec:latest
    container_name: crowdsec
    restart: unless-stopped
    environment:
      GID: "1000"
      COLLECTIONS: "crowdsecurity/linux crowdsecurity/nginx"
    volumes:
      - crowdsec-db:/var/lib/crowdsec/data
      - crowdsec-config:/etc/crowdsec
      - /var/log:/var/log:ro
    networks:
      - cs-internal

  crowdsec-dashy:
    build: .
    # Or use a published image:
    # image: ghcr.io/your-org/crowdsec-dashy:latest
    container_name: crowdsec-dashy
    restart: unless-stopped
    ports:
      - "8080:8080"
    environment:
      PORT: ":8080"
      CROWDSEC_API_URL: "http://crowdsec:8080"
      CROWDSEC_API_LOGIN: "crowdsec-dashy"          # match what you registered above
      CROWDSEC_API_PASSWORD: "changeme"           # CHANGE THIS
      CSCLI_PATH: "/usr/local/bin/cscli"
      UI_USERNAME: "admin"                        # UI Basic Auth login
      UI_PASSWORD: "changeme"                     # CHANGE THIS
      UI_SESSION_SECRET: "replace-with-32-random-chars-here"  # CHANGE THIS
      POLL_INTERVAL_SEC: "15"
    volumes:
      # Bind-mount cscli binary from host (or from crowdsec container)
      # See setup instructions above
      - /usr/local/bin/cscli:/usr/local/bin/cscli:ro
    networks:
      - cs-internal
    depends_on:
      - crowdsec

networks:
  cs-internal:
    driver: bridge

volumes:
  crowdsec-db:
  crowdsec-config: