akvorado/docker/docker-compose.yml

---
version: "3"

volumes:
  akvorado-zookeeper:
  akvorado-kafka:
  akvorado-geoip:
  akvorado-clickhouse:
  akvorado-run:
  akvorado-console-db:

services:
  zookeeper:
    image: bitnami/zookeeper:3.8
    environment:
      - ALLOW_ANONYMOUS_LOGIN=yes
      - ZOO_ENABLE_PROMETHEUS_METRICS=yes
      - ZOO_4LW_COMMANDS_WHITELIST=srvr,mntr,ruok
    restart: unless-stopped
    expose:
      - 2181/tcp
      - 2888/tcp
      - 3888/tcp
      - 7000/tcp                # Prometheus metrics
    volumes:
      - akvorado-zookeeper:/bitnami/zookeeper
    healthcheck:
      interval: 20s
      timeout: 10s
      retries: 3
      test: ["CMD-SHELL", "echo ruok | nc -w3 127.0.0.1 2181 | grep -xFq imok"]

  kafka:
    image: bitnami/kafka:3.5
    environment:
      - KAFKA_ZOOKEEPER_PROTOCOL=PLAINTEXT
      - KAFKA_CFG_ZOOKEEPER_CONNECT=zookeeper:2181
      - KAFKA_CFG_DELETE_TOPIC_ENABLE=true
      - KAFKA_CFG_LISTENERS=PLAINTEXT://:9092
      - KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=PLAINTEXT:PLAINTEXT
      - KAFKA_CFG_ADVERTISED_LISTENERS=PLAINTEXT://kafka:9092
      - KAFKA_CFG_INTER_BROKER_LISTENER_NAME=PLAINTEXT
      - JMX_PORT=5555
    restart: unless-stopped
    depends_on:
      - zookeeper
    volumes:
      - akvorado-kafka:/bitnami/kafka
    healthcheck:
      interval: 20s
      timeout: 10s
      retries: 3
      test: ["CMD", "env", "-u", "JMX_PORT", "kafka-topics.sh", "--list", "--bootstrap-server", "kafka:9092"]

  redis:
    image: bitnami/redis:7.2
    environment:
      - ALLOW_EMPTY_PASSWORD=yes
    restart: unless-stopped
    healthcheck:
      interval: 20s
      timeout: 10s
      retries: 3
      test: ["CMD-SHELL", "timeout 3 redis-cli ping | grep -q PONG"]

  akvorado-service: &akvorado-image
    image: ghcr.io/akvorado/akvorado:latest
    command: version
  akvorado-orchestrator:
    <<: *akvorado-image
    restart: unless-stopped
    command: orchestrator /etc/akvorado/akvorado.yaml
    volumes:
      - ../config:/etc/akvorado:ro
      - akvorado-geoip:/usr/share/GeoIP:ro
      # If you prefer to use geo IP databases from host, comment the
      # above line and uncomment this one:
      # - /usr/share/GeoIP:/usr/share/GeoIP:ro
    labels:
      - traefik.enable=true
      - traefik.http.routers.akvorado-orchestrator.entrypoints=private # it exposes configuration files with passwords
      - traefik.http.routers.akvorado-orchestrator.rule=PathPrefix(`/api/v0/orchestrator`)
      - traefik.http.services.akvorado-orchestrator.loadbalancer.server.port=8080
  akvorado-console:
    <<: *akvorado-image
    restart: unless-stopped
    depends_on:
      - redis
      - clickhouse
    command: console http://akvorado-orchestrator:8080
    volumes:
      - akvorado-console-db:/run/akvorado
    labels:
      - traefik.enable=true
      - traefik.http.routers.akvorado-console.rule=PathPrefix(`/`)
      - traefik.http.routers.akvorado-console.middlewares=console-auth-headers
      - traefik.http.middlewares.console-auth-headers.headers.customrequestheaders.Remote-User=alfred
      - traefik.http.middlewares.console-auth-headers.headers.customrequestheaders.Remote-Name=Alfred Pennyworth
      - traefik.http.middlewares.console-auth-headers.headers.customrequestheaders.Remote-Email=alfred@example.com
      - traefik.http.services.akvorado-console.loadbalancer.server.port=8080
  akvorado-inlet:
    <<: *akvorado-image
    ports:
      - 2055:2055/udp
      - 6343:6343/udp
      - 10179:10179/tcp
    restart: unless-stopped
    command: inlet http://akvorado-orchestrator:8080
    volumes:
      - akvorado-run:/run/akvorado
    labels:
      - traefik.enable=true
      - traefik.http.routers.akvorado-inlet.rule=PathPrefix(`/api/v0/inlet`)
      - traefik.http.services.akvorado-inlet.loadbalancer.server.port=8080
      - akvorado.conntrack.fix=true
  akvorado-conntrack-fixer:
    <<: *akvorado-image
    cap_add:
      - NET_ADMIN
    command: conntrack-fixer
    restart: unless-stopped
    network_mode: host
    healthcheck:
      disable: true
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  clickhouse:
    image: clickhouse/clickhouse-server:23.8
    volumes:
      - ../orchestrator/clickhouse/data/docker-entrypoint.sh:/entrypoint-override.sh:ro
      - akvorado-clickhouse:/var/lib/clickhouse
    entrypoint: /entrypoint-override.sh
    environment:
      - CLICKHOUSE_INIT_TIMEOUT=60
    restart: unless-stopped
    healthcheck:
      interval: 30s
      timeout: 10s
      retries: 3
      test: ["CMD", "wget", "-T", "1", "--spider", "--no-proxy", "http://clickhouse:8123"]
    labels:
      - traefik.enable=true
      - traefik.http.routers.clickhouse.entrypoints=private
      - traefik.http.routers.clickhouse.rule=PathPrefix(`/clickhouse`)
      - traefik.http.routers.clickhouse.middlewares=clickhouse-strip
      - traefik.http.middlewares.clickhouse-strip.stripprefix.prefixes=/clickhouse
      - traefik.http.services.clickhouse.loadbalancer.server.port=8123

  traefik:
    image: traefik:2.6
    restart: unless-stopped
    command:
      - --api=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.private.address=:8080
      - --entrypoints.public.address=:8081
    ports:
      # Port 8080 is considered private as it exposes sensible unauthenticated
      # services (ClickHouse, configuration, ...). Therefore, it is only exposed
      # on the loopback. Port 8081 is the one you can expose to users. If you
      # want to change these ports, leave "8080/tcp" and "8081/tcp" unchanged:
      # you can modify the IP/port on the left.
      - 127.0.0.1:8080:8080/tcp
      - 8081:8081/tcp
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro