services:
  haproxy:
    image: haproxy:3.4.5-alpine
    container_name: haproxy
    user: "0:0"
    cap_add:
      - NET_BIND_SERVICE
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /srv/nfs/infra/haproxy/conf:/usr/local/etc/haproxy:ro
      - /srv/nfs/infra/haproxy/certs:/etc/haproxy/certs:ro
      - /srv/nfs/infra/haproxy/logs:/var/log/haproxy

      # SPOA Lua/Templates (выдаются spoa-bouncer, читаются haproxy)
      - /srv/nfs/infra/haproxy/crowdsec/lua:/usr/lib/crowdsec-haproxy-spoa-bouncer/lua:ro
      - /srv/nfs/infra/haproxy/crowdsec/templates:/var/lib/crowdsec-haproxy-spoa-bouncer/html:ro
    networks:
      - interdock
    depends_on:
      - crowdsec
      - crowdsec_spoa_bouncer
    restart: unless-stopped

  crowdsec:
    image: crowdsecurity/crowdsec:latest
    container_name: crowdsec
    restart: unless-stopped
    env_file:
      - /srv/nfs/infra/haproxy/.env
    ports:
      - "127.0.0.1:8087:8087"
    environment:
      COLLECTIONS: "crowdsecurity/haproxy"
      GID: "${DOCKER_GID}"
    volumes:
      # CrowdSec persist -> NFS
      - /srv/nfs/infra/haproxy/crowdsec/data:/var/lib/crowdsec/data/
      - /srv/nfs/infra/haproxy/crowdsec/config:/etc/crowdsec/

      # acquisition
      #- /srv/nfs/infra/haproxy/crowdsec/acquis.d:/etc/crowdsec/acquis.d:ro

      # docker logs datasource
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - interdock

  crowdsec_spoa_bouncer:
    image: crowdsecurity/spoa-bouncer:latest
    container_name: crowdsec-spoa-bouncer
    restart: unless-stopped
    env_file:
      - /srv/nfs/infra/haproxy/.env
    depends_on:
      - crowdsec
    environment:
      CROWDSEC_URL: "http://crowdsec:8080/"
      LISTEN_TCP: "0.0.0.0:9000"
      CROWDSEC_KEY: "${BOUNCER_KEY_SPOA}"
    volumes:
      # SPOA bouncer пишет lua/templates в NFS, haproxy читает их
      - /srv/nfs/infra/haproxy/crowdsec/lua:/usr/lib/crowdsec-haproxy-spoa-bouncer/lua/
      - /srv/nfs/infra/haproxy/crowdsec/templates:/var/lib/crowdsec-haproxy-spoa-bouncer/html/
    networks:
      - interdock

networks:
  interdock:
    external: true