nova-launch/docker-compose.elk.yml at main · leofoxcode-oss/nova-launch · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
##############################################################################
# ELK Stack + HashiCorp Vault — Nova Launch
# Issues: #894 (ELK), #896 (Vault)
#
# Usage:
#   docker compose -f docker-compose.yml -f docker-compose.elk.yml up -d
##############################################################################

version: '3.8'

services:
  # ── Elasticsearch ───────────────────────────────────────────────────────────
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.13.0
    container_name: nova-elasticsearch
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=true
      - ELASTIC_PASSWORD=${ELASTICSEARCH_PASSWORD:-changeme}
      - ES_JAVA_OPTS=-Xms512m -Xmx512m
      - xpack.security.http.ssl.enabled=false
    ports:
      - "9200:9200"
    volumes:
      - elasticsearch_data:/usr/share/elasticsearch/data
    healthcheck:
      test: ["CMD-SHELL", "curl -sf -u elastic:${ELASTICSEARCH_PASSWORD:-changeme} http://localhost:9200/_cluster/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

  # ── Logstash ─────────────────────────────────────────────────────────────────
  logstash:
    image: docker.elastic.co/logstash/logstash:8.13.0
    container_name: nova-logstash
    depends_on:
      elasticsearch:
        condition: service_healthy
    environment:
      - ELASTICSEARCH_HOST=elasticsearch
      - ELASTICSEARCH_PORT=9200
      - ELASTICSEARCH_USER=elastic
      - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD:-changeme}
      - LOGSTASH_DEBUG=${LOGSTASH_DEBUG:-false}
    ports:
      - "5044:5044"   # Beats input
      - "5000:5000"   # TCP JSON input
    volumes:
      - ./monitoring/elk/logstash.conf:/usr/share/logstash/pipeline/nova.conf:ro
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:9600/_node/stats || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

  # ── Kibana ───────────────────────────────────────────────────────────────────
  kibana:
    image: docker.elastic.co/kibana/kibana:8.13.0
    container_name: nova-kibana
    depends_on:
      elasticsearch:
        condition: service_healthy
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=elastic
      - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD:-changeme}
      - XPACK_SECURITY_ENABLED=true
    ports:
      - "5601:5601"
    volumes:
      - kibana_data:/usr/share/kibana/data
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:5601/api/status || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 90s

  # ── Filebeat (ships container logs to Logstash) ───────────────────────────
  filebeat:
    image: docker.elastic.co/beats/filebeat:8.13.0
    container_name: nova-filebeat
    user: root
    depends_on:
      logstash:
        condition: service_healthy
    volumes:
      - ./monitoring/elk/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - LOGSTASH_HOST=logstash
    command: filebeat -e -strict.perms=false

  # ── HashiCorp Vault ──────────────────────────────────────────────────────────
  vault:
    image: hashicorp/vault:1.16
    container_name: nova-vault
    cap_add:
      - IPC_LOCK
    environment:
      - VAULT_ADDR=http://0.0.0.0:8200
      - VAULT_API_ADDR=http://0.0.0.0:8200
    ports:
      - "8200:8200"
    volumes:
      - vault_data:/vault/data
      - vault_logs:/vault/logs
      - ./monitoring/vault/vault-config.hcl:/vault/config/vault.hcl:ro
    command: vault server -config=/vault/config/vault.hcl
    healthcheck:
      test: ["CMD-SHELL", "vault status -address=http://127.0.0.1:8200 2>&1 | grep -E 'Initialized|Sealed' || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

volumes:
  elasticsearch_data:
  kibana_data:
  vault_data:
  vault_logs: