docker-compose.yml

# `restart: always` (not `unless-stopped`): podman-restart.service is what
# brings the stack back after a reboot, and older podman filters it on
# `restart-policy=always`, which would skip `unless-stopped` entirely.
# bin/init-podman.sh enables that unit.

# Clients name their resolver by address — a service name is rejected
# outright (`ParseAddr("dns"): unable to parse IP`). Hence the pinned
# subnet on the `ehacking` network and the one static address in the file.
x-dns: &dns
  - ${DNS_RESOLVER_IP:-10.53.0.53}

x-depends-on-dns: &depends-on-dns
  dns:
    required: true
    condition: service_started

services:

  traefik:
    image: docker.io/traefik
    command:
      - '--api.dashboard=true'
      - '--api.insecure=false'
      - '--certificatesresolvers.letsencrypt.acme.email=postmaster@e-hacking.de'
      - '--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge=true'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53'
      - '--entrypoints.web.address=:${PORT_HTTP}'
      - '--entrypoints.web.http.sanitizePath=false'
      - '--entrypoints.websecure.address=:${PORT_HTTPS}'
      - '--entrypoints.websecure.http.sanitizePath=false'
      - '--entrypoints.websecure.http.tls=true'
      - '--providers.docker=true'
      - '--providers.docker.network=ehacking'
      - '--providers.file.directory=/etc/traefik/dynamic'
      - '--providers.file.watch=true'
      #- "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
    # Host side ≠ container side: HOST_PORT_* is only where the host
    # publishes. PORT_* must stay 80/443 — see README → "Ports".
    ports:
      - "${HOST_PORT_HTTP:-80}:${PORT_HTTP}"
      - "${HOST_PORT_HTTPS:-443}:${PORT_HTTPS}"
    env_file:
      - cloudflare.env
    volumes:
      - "letsencrypt:/letsencrypt"
      - "./traefik/dynamic:/etc/traefik/dynamic:ro"
      # Socket mount string is set by bin/runtime-env.sh. Under docker
      # the default kicks in (host docker socket, read-only). Under
      # podman, runtime-env.sh emits the podman socket path with `:Z`
      # (SELinux private relabel) so rootless setups work.
      - "${TRAEFIK_SOCK_MOUNT:-/var/run/docker.sock:/var/run/docker.sock:ro}"
    restart: always
    networks:
      # No aliases needed any more. They covered five hostnames back when
      # each one had to be listed; the `dns` service now answers for both
      # whole zones, including the catcher's unbounded salt subdomains.
      - ehacking
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.dashboard.rule=Host(`${DASHBOARD_HOST}`)'
      - 'traefik.http.routers.dashboard.entrypoints=websecure'
      - 'traefik.http.routers.dashboard.tls=true'
      - 'traefik.http.routers.dashboard.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.dashboard.service=api@internal'
      - 'traefik.http.routers.dashboard.middlewares=basicauth@file'

# In-network resolver: makes the platform's own hostnames — including the
# catcher's unbounded per-salt subdomains — resolve to traefik from inside
# the containers. See dns/Corefile for the full rationale.
  dns:
    image: docker.io/coredns/coredns:1.14.7
    # The image runs as UID 65532, which does not survive rootless podman:
    # that UID maps into the subuid range, so it can neither traverse the
    # operator's home directory to read the mounted Corefile (podman logs:
    # `open /etc/coredns/Corefile: permission denied`, on a crash loop) nor
    # bind the privileged port 53 (docker sets
    # net.ipv4.ip_unprivileged_port_start=0 in every container, podman does
    # not — same reason compose.podman.yml sets it on the WildFly services).
    # Under rootless podman container-root IS the unprivileged host user, so
    # this grants nothing on the host and fixes both.
    user: "0:0"
    command:
      - '-conf'
      - '/etc/coredns/Corefile'
    volumes:
      # `:z` = shared SELinux relabel. Without it the container is denied
      # the file on an enforcing host and crash-loops with
      # `open /etc/coredns/Corefile: permission denied`. Same reason
      # bin/runtime-env.sh labels the podman socket mount.
      - './dns/Corefile:/etc/coredns/Corefile:ro,z'
    environment:
      # The zones live in .env; the Corefile reads them via {$ZONE_*} so
      # they are not written down twice.
      - ZONE_PLATFORM=${HOST1}
      - ZONE_CATCHER=${CATCHER_HOST}
    networks:
      ehacking:
        # The only static address in the stack.
        ipv4_address: ${DNS_RESOLVER_IP:-10.53.0.53}
    expose:
      - "53/udp"
      - "53/tcp"
    restart: always

# security.txt (RFC 9116) for every host this traefik serves —
# e-hacking.de, its subdomains, e-attacker.de and the catcher/recruiting
# salt subdomains alike. Content: well-known/security.txt; `just up`
# warns when its Expires: date runs out (bin/security-txt.sh).
#
# The router has no Host() on purpose, and needs no certresolver: traefik
# picks the certificate by SNI from the store the other routers fill.
# Priority 50000 beats every module router (highest otherwise:
# axis2-fake, 10000). Without an explicit value traefik ranks by rule
# length, and the long oidc rule would win.
#
# 🚨 A challenge that wants its OWN security.txt for teaching purposes
# overrides it with a host-scoped router above 50000 on its own service.
# `service=` must name a service declared via traefik.http.services.<name>
# — the docker provider's auto-generated one is called `<name>-<project>`:
#   - 'traefik.http.routers.foo-security-txt.entrypoints=websecure'
#   - 'traefik.http.routers.foo-security-txt.rule=Host(`${FOO_HOST}`) && Path(`/.well-known/security.txt`)'
#   - 'traefik.http.routers.foo-security-txt.tls=true'
#   - 'traefik.http.routers.foo-security-txt.priority=60000'
#   - 'traefik.http.routers.foo-security-txt.service=foo'
  security-txt:
    image: docker.io/library/busybox:1.37.0
    # Same reason as dns above: under rootless podman an in-container
    # non-root UID maps into the subuid range and cannot traverse the
    # operator's home to reach the mount. Container-root is the
    # unprivileged host user there, so this grants nothing on the host.
    user: "0:0"
    # Serves files only — busybox httpd lists no directories and runs no
    # CGI without an explicit config.
    command: ['httpd', '-f', '-p', '8080', '-h', '/www']
    volumes:
      # The directory, not the file: a single-file bind mount pins the
      # inode, so a `git pull` or `sed -i` renewing Expires: would stay
      # invisible until the container is recreated. `:z` as for dns.
      - './well-known:/www/.well-known:ro,z'
    depends_on:
      traefik:
        required: true
        condition: service_started
    restart: always
    networks:
      - ehacking
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.security-txt.entrypoints=websecure'
      - 'traefik.http.routers.security-txt.rule=Path(`/.well-known/security.txt`)'
      - 'traefik.http.routers.security-txt.tls=true'
      - 'traefik.http.routers.security-txt.priority=50000'
      - 'traefik.http.routers.security-txt.middlewares=security-txt-headers'
      # RFC 9116 §3 asks for an explicit charset; busybox sends bare text/plain.
      - 'traefik.http.middlewares.security-txt-headers.headers.customresponseheaders.Content-Type=text/plain; charset=utf-8'
      - 'traefik.http.services.security-txt.loadbalancer.server.port=8080'

# root module: lading page with all available modules for selection
  root:
    image: ghcr.io/ehacking-websec/ehacking/root:latest
    depends_on:
      dns:
        required: true
        condition: service_started
      traefik:
        required: true
        condition: service_started
    # menu links point at the other modules' public hostnames;
    # that name only resolves through the in-network resolver.
    dns: *dns
    env_file:
      - .env
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.root.entrypoints=websecure'
      - 'traefik.http.routers.root.rule=(Host(`${HOST1}`) || Host(`${HOST2}`))'
      - 'traefik.http.routers.root.tls=true'
      - 'traefik.http.routers.root.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.root.priority=1'
      - 'traefik.http.services.root.loadbalancer.server.port=80'
    restart: always
    networks:
      - ehacking

# JSON module
  json-sec:
    image: ghcr.io/ehacking-websec/ehacking/json-sec
    profiles: [json]
    depends_on:
      dns:
        required: true
        condition: service_started
      traefik:
        required: true
        condition: service_started
    # jku/x5u fetch a student-supplied URL — typically their catcher;
    # that name only resolves through the in-network resolver.
    dns: *dns
    env_file:
      - .env
      - flags_json-sec.env
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.json-sec.entrypoints=websecure'
      - 'traefik.http.routers.json-sec.rule=(Host(`${JSON_HOST}`) && PathPrefix(`${BASE_PATH_JSON}`))'
      - 'traefik.http.routers.json-sec.tls=true'
      - 'traefik.http.routers.json-sec.tls.certresolver=letsencrypt'
      - 'traefik.http.services.json-sec.loadbalancer.server.port=80'
    restart: always
    networks:
      - ehacking

# OpenID Connect module
  oidc:
    image: ghcr.io/ehacking-websec/ehacking/oidc
    profiles: [oidc]
    depends_on:
      dns:
        required: true
        condition: service_started
      traefik:
        required: true
        condition: service_started
    # the SP fetches <salt>.${CATCHER_HOST}/.well-known/... server-side;
    # that name only resolves through the in-network resolver.
    dns: *dns
    env_file:
      - .env
      - path: credentials.env
        required: false
      - flags_oidc.env
    environment:
      # Internal address of the victim-bot service. BotProxyServlet relays
      # /__bot-proxy/* POSTs from the student's browser to this host so the
      # bot endpoint stays same-origin and the bot's hostname is not leaked
      # into the rendered page source.
      - BOT_URL=http://victim-bot:1338
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.oidc.entrypoints=websecure'
      - 'traefik.http.routers.oidc.rule=( (Host(`${SP_HOST}`) && PathPrefix(`${BASE_PATH_OIDC_SP}`)) || (Host(`${SPA_HOST}`) && PathPrefix(`${BASE_PATH_OIDC_SP}`)) || (Host(`${IDP_HOST}`) && PathPrefix(`${BASE_PATH_OIDC_IDP}`)) || (Host(`${RS_HOST}`) && PathPrefix(`${BASE_PATH_OIDC_IDP}`)) )'
      - 'traefik.http.routers.oidc.tls=true'
      - 'traefik.http.routers.oidc.tls.certresolver=letsencrypt'
      - 'traefik.http.services.oidc.loadbalancer.server.port=80'
    restart: always
    networks:
      - ehacking
    # Public-hostname DNS resolution is provided by aliases on the
    # traefik service — see traefik.networks.ehacking.aliases.

# REST module
  rest-api-sec:
    image: ghcr.io/ehacking-websec/ehacking/rest-api-sec
    profiles: [rest]
    depends_on:
      dns:
        required: true
        condition: service_started
      traefik:
        required: true
        condition: service_started
    # SSRF challenges call out to a student-supplied URL;
    # that name only resolves through the in-network resolver.
    dns: *dns
    env_file:
      - .env
      - flags_rest-api-sec.env
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.rest-api-sec.entrypoints=websecure'
      - 'traefik.http.routers.rest-api-sec.rule=(Host(`${REST_HOST}`) && PathPrefix(`${BASE_PATH_REST}`))'
      - 'traefik.http.routers.rest-api-sec.tls=true'
      - 'traefik.http.routers.rest-api-sec.tls.certresolver=letsencrypt'
      - 'traefik.http.services.rest-api-sec.loadbalancer.server.port=80'
    restart: always
    networks:
      - ehacking

  couchdb:
    image: docker.io/couchdb:latest
    profiles: [rest]
    environment:
      COUCHDB_USER: "root"
      COUCHDB_PASSWORD: "super_secure"
    restart: always
    networks:
      - ehacking
    labels:
      - "traefik.enable=true"
      - "com.centurylinklabs.watchtower.enable=true"

# SAML module
  saml:
    image: ghcr.io/ehacking-websec/ehacking/saml
    profiles: [saml]
    depends_on:
      dns:
        required: true
        condition: service_started
      traefik:
        required: true
        condition: service_started
    # cross-SP flows reference the catcher's hostnames;
    # that name only resolves through the in-network resolver.
    dns: *dns
    env_file:
      - .env
      - path: credentials.env
        required: false
      - flags_saml.env
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.saml.entrypoints=websecure'
      - 'traefik.http.routers.saml.rule= (Host(`${SP_HOST}`) && PathPrefix(`/sp`)) || (Host(`${IDP_HOST}`) && PathPrefix(`/idp`))'
      - 'traefik.http.routers.saml.tls=true'
      - 'traefik.http.routers.saml.tls.certresolver=letsencrypt'
      - 'traefik.http.services.saml.loadbalancer.server.port=80'
    restart: always
    networks:
      - ehacking
    # Public-hostname DNS resolution is provided by aliases on the
    # traefik service — see traefik.networks.ehacking.aliases.

# SOAP module:
  soap-sec:
    image: ghcr.io/ehacking-websec/ehacking/soap-sec
    profiles: [soap]
    depends_on:
      dns:
        required: true
        condition: service_started
      traefik:
        required: true
        condition: service_started
      axis2-flag:
        required: true
        condition: service_started
      axis2-fake:
        required: true
        condition: service_started
    # out-of-band XXE exfiltration to a student's catcher;
    # that name only resolves through the in-network resolver.
    dns: *dns
    env_file:
      - .env
      - flags_soap-sec.env
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.soap-sec.entrypoints=websecure'
      - 'traefik.http.routers.soap-sec.rule=(Host(`${SOAP_HOST}`))'
      - 'traefik.http.routers.soap-sec.tls=true'
      - 'traefik.http.routers.soap-sec.tls.certresolver=letsencrypt'
      - 'traefik.http.services.soap-sec.loadbalancer.server.port=80'
    restart: always
    networks:
      - ehacking
      - soap-internal

# SOAP module: real flag service (private network only)
  axis2-flag:
    image: ghcr.io/ehacking-websec/ehacking/axis2-flag:latest
    profiles: [soap]
    env_file:
      - flags_axis2-flag.env
    restart: always
    networks:
      - soap-internal
    expose:
      - "8080"

# SOAP module: fake-flag service (publicly available)
  axis2-fake:
    image: ghcr.io/ehacking-websec/ehacking/axis2-flag:latest
    profiles: [soap]
    depends_on:
      traefik:
        required: true
        condition: service_started
    restart: always
    networks:
      - ehacking
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.axis2-fake.entrypoints=websecure'
      - 'traefik.http.routers.axis2-fake.rule=(Host(`${SOAP_HOST}`) && PathPrefix(`/axis2/services/`))'
      - 'traefik.http.routers.axis2-fake.priority=10000'
      - "traefik.http.routers.axis2-fake.tls.certresolver=letsencrypt"
      - 'traefik.http.services.axis2-fake.loadbalancer.server.port=8080'


# Web security module
  web-sec:
    image: ghcr.io/ehacking-websec/ehacking/web-sec
    profiles: [web]
    depends_on:
      dns:
        required: true
        condition: service_started
      traefik:
        required: true
        condition: service_started
    # cross-origin challenges reference the platform's own hosts;
    # that name only resolves through the in-network resolver.
    dns: *dns
    env_file:
      - .env
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.web-sec.entrypoints=websecure'
      - 'traefik.http.routers.web-sec.rule=(Host(`${WEBSEC_HOST}`) && PathPrefix(`${BASE_PATH_WEBSEC}`))'
      - 'traefik.http.routers.web-sec.tls=true'
      - 'traefik.http.routers.web-sec.tls.certresolver=letsencrypt'
      - 'traefik.http.services.web-sec.loadbalancer.server.port=80'
    restart: always
    networks:
      - ehacking

# XML module
  xml-sec:
    image: ghcr.io/ehacking-websec/ehacking/xml-sec
    profiles: [xml]
    depends_on:
      dns:
        required: true
        condition: service_started
      traefik:
        required: true
        condition: service_started
    # out-of-band XXE exfiltration to a student's catcher;
    # that name only resolves through the in-network resolver.
    dns: *dns
    env_file:
      - .env
      - flags_xml-sec.env
    volumes:
      - "./flag_xxe1.txt:/etc/flag_xxe1.txt:ro"
      - "./flag_xxe2.txt:/etc/flag_xxe2.txt:ro"
      - "./flag_xslt1.xml:/etc/flag_xslt1.xml:ro"
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.xml-sec.entrypoints=websecure'
      - 'traefik.http.routers.xml-sec.rule=(Host(`${XML_HOST}`) && PathPrefix(`/xml-sec`))'
      - 'traefik.http.routers.xml-sec.tls=true'
      - 'traefik.http.routers.xml-sec.tls.certresolver=letsencrypt'
      - 'traefik.http.services.xml-sec.loadbalancer.server.port=80'
    restart: always
    networks:
      - ehacking
  # Catcher / Attacker service
  catcher:
    image: ghcr.io/ehacking-websec/ehacking/catcher:latest
    # Catcher is the cross-module attacker target. Tagged with every
    # module that drives traffic at it, so it auto-starts whenever any
    # of them is enabled. Adjust if a module is added/removed.
    profiles: [catcher, oidc, saml]
    pull_policy: always
    depends_on:
      - dns
      - traefik
    # the mSP template posts token-exchange calls at the honest IdP;
    # that name only resolves through the in-network resolver.
    dns: *dns
    env_file:
      - .env
      - path: credentials.env
        required: false
    environment:
      - PORT=3000
      - CATCHER_DB_PATH=/data/registry.db
      - CATCHER_PUBLIC_PORT=${PORT_HTTPS}
    volumes:
      - catcher-data:/data
    labels:
      - "traefik.enable=true"
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.http.routers.catcher.entrypoints=websecure"
      - "traefik.http.routers.catcher.rule=Host(`${CATCHER_HOST}`) || HostRegexp(`^.+\\.${CATCHER_HOST}$$`)"
      - "traefik.http.routers.catcher.tls=true"
      - "traefik.http.routers.catcher.tls.certresolver=letsencrypt"
      # DNS-01 issues a wildcard cert covering every per-salt subdomain in
      # one go — no per-host links: dance like the local-dev stack needs.
      - "traefik.http.routers.catcher.tls.domains[0].main=${CATCHER_HOST}"
      - "traefik.http.routers.catcher.tls.domains[0].sans=*.${CATCHER_HOST}"
      - "traefik.http.services.catcher.loadbalancer.server.port=3000"
    restart: always
    networks:
      - ehacking
    # Catcher's mSP template POSTs token-exchange / userinfo requests at
    # the honest IdP. Public-hostname resolution is provided by aliases
    # on the traefik service — see traefik.networks.ehacking.aliases.

  # Victim-bot
  victim-bot:
    image: ghcr.io/ehacking-websec/ehacking/victim-bot:latest
    profiles: [oidc]
    pull_policy: always
    init: true
    depends_on:
      - dns
      - oidc
    # the headless browser follows links onto catcher subdomains;
    # that name only resolves through the in-network resolver.
    dns: *dns
    env_file:
      - .env
      - path: credentials.env
        required: false
      - flags_oidc.env
    environment:
      - PORT=1338
      - BOT_REPORT_RATE_LIMIT=${BOT_REPORT_RATE_LIMIT:-6}
      - OEMMES_USERNAME=oemmes
      - USER307_USERNAME=user307
      - BOT_OIDC_LOGIN_URL=https://${IDP_HOST}:${PORT_HTTPS}${BASE_PATH_OIDC_IDP}/login.xhtml
      - BOT_OIDC_LOGGED_IN_PROBE=https://${IDP_HOST}:${PORT_HTTPS}${BASE_PATH_OIDC_IDP}/index.xhtml
      - BOT_OIDC_ALLOWED_ORIGINS=https://${SP_HOST}:${PORT_HTTPS},https://${SPA_HOST}:${PORT_HTTPS},https://${IDP_HOST}:${PORT_HTTPS},https://${CATCHER_HOST}:${PORT_HTTPS}
      - BOT_OIDC_ALLOWED_ATTACKS=secure:or-1,secure:or-2,secure:or-3,secure:or-4,secure:redir-2,secure:cr-1,cr-2:cr-2,cr-3:cr-3,secure:cr-4,secure:xss-1,trc-1:secure,trc-2:secure
    expose:
      - "1338"
    restart: always
    networks:
      - ehacking
    labels:
      - "traefik.enable=false"
      - "com.centurylinklabs.watchtower.enable=true"
    # Public-hostname resolution (SP/SPA/IDP/CATCHER) is provided by
    # aliases on the traefik service — see traefik.networks.ehacking.aliases.

  rookies:
    image: ghcr.io/ehacking-websec/rookies:latest
    profiles: [rookies]
    pull_policy: always
    depends_on:
      - traefik
    env_file:
      - .env
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.rookies.entrypoints=websecure"
      - "traefik.http.routers.rookies.rule=Host(`${ROOKIES_HOST}`)"
      - "traefik.http.services.rookies.loadbalancer.server.port=3000"
      - "traefik.http.routers.rookies.tls.certresolver=letsencrypt"
      - "com.centurylinklabs.watchtower.enable=true"
    restart: always
    networks:
      - ehacking

  # Passkeys
  passkeys-app:
    image: ghcr.io/ehacking-websec/fun-with-flags-and-passkeys:latest
    profiles: [passkeys]
    restart: always
    pull_policy: always
    networks:
      - ehacking
    depends_on:
      - traefik
      - passkeys-mongo
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.passkeys.entrypoints=websecure"
      - "traefik.http.routers.passkeys.rule=Host(`${PASSKEYS_HOST}`)"
      - "traefik.http.services.passkeys.loadbalancer.server.port=3000"
      - "traefik.http.routers.passkeys.tls.certresolver=letsencrypt"
      - "com.centurylinklabs.watchtower.enable=true"
    volumes:
      - passkeys-instance-data:/app/data/instances
    env_file:
      - .env
      - path: passkeys.env
        required: false
    environment:
      - PORT=3000
      - NODE_ENV=production
      - RP_ID=${PASSKEYS_RP_ID}
      - ORIGIN=${PASSKEYS_ORIGIN}
      - USE_MONGO=true
      - MONGO_URI=mongodb://passkeys-mongo:27017/funwithflags
      - INSTANCE_MAX_AGE_MS=86400000 # 24 hours
      - CLEANUP_INTERVAL_MS=3600000 # 1 hour

  passkeys-mongo:
    image: mongo:4
    profiles: [passkeys]
    restart: always
    pull_policy: always
    networks:
      - ehacking
    volumes:
      - passkeys-mongo-data:/data/db

  # Crawling Maze
  crawling-maze:
    image: ghcr.io/ehacking-websec/crawling-maze:latest
    profiles: [maze]
    restart: always
    pull_policy: always
    networks:
      - ehacking
    expose:
      - "8080"
    depends_on:
      - traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.crawling-maze.entrypoints=websecure"
      - "traefik.http.routers.crawling-maze.rule=Host(`${CRAWLING_MAZE_HOST}`)"
      - "traefik.http.routers.crawling-maze.tls.certresolver=letsencrypt"
      - "traefik.http.services.crawling-maze.loadbalancer.server.port=8080"
      - "com.centurylinklabs.watchtower.enable=true"
    volumes:
      - crawling-maze-sessions:/var/lib/crawling-maze/sessions
    environment:
      - FLASK_SECRET_KEY=secret
    env_file:
      - flags_crawling-maze.env

  # Noodle: beginner CTF (CSRF + IDOR) with a Chromium admin bot.
  # The bot only loads pages from 127.0.0.1 inside the container, so it
  # needs neither the in-network resolver nor access to other services.
  noodle:
    image: ghcr.io/ehacking-websec/noodle:latest
    profiles: [noodle]
    pull_policy: always
    depends_on:
      traefik:
        required: true
        condition: service_started
    environment:
      PUBLIC_URL: https://${NOODLE_HOST}
    env_file:
      - flags_noodle.env
    # Chromium needs some memory; 1 GB is plenty for the default bot
    # concurrency.
    deploy:
      resources:
        limits:
          memory: 1G
    labels:
      - "traefik.enable=true"
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.http.routers.noodle.entrypoints=websecure"
      - "traefik.http.routers.noodle.rule=Host(`${NOODLE_HOST}`)"
      - "traefik.http.routers.noodle.tls=true"
      - "traefik.http.routers.noodle.tls.certresolver=letsencrypt"
      - "traefik.http.services.noodle.loadbalancer.server.port=3000"
    restart: always
    networks:
      - ehacking

# Recruiting platform
  recruiting-challenge:
    image: ghcr.io/ehacking-websec/recruiting/challenge:latest
    profiles: [recruiting]
    pull_policy: always
    depends_on:
      traefik:
        required: true
        condition: service_started
    environment:
      PORT: "3000"
      REGISTRY_DB_PATH: /data/registry.db
      URL_STYLE: subdomain
      BOT_INTERNAL_SECRET: ${BOT_INTERNAL_SECRET:-bot-secret-11cde19f9d2f5b99-change-me-in-prod}
      BOT_PUBLIC_ORIGIN: https://${RECRUITING_BOT_HOST}
      CHALLENGE_PUBLIC_ORIGIN: https://${RECRUITING_CHALLENGE_HOST}
    volumes:
      - recruiting-data:/data
    labels:
      - "traefik.enable=true"
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.http.routers.recruiting-challenge.entrypoints=websecure"
      - "traefik.http.routers.recruiting-challenge.rule=Host(`${RECRUITING_CHALLENGE_HOST}`) || HostRegexp(`^.+\\.${RECRUITING_CHALLENGE_HOST}$$`)"
      - "traefik.http.routers.recruiting-challenge.tls=true"
      - "traefik.http.routers.recruiting-challenge.tls.certresolver=letsencrypt"
      - "traefik.http.routers.recruiting-challenge.tls.domains[0].main=${RECRUITING_TIER_HOST}"
      - "traefik.http.routers.recruiting-challenge.tls.domains[0].sans=*.${RECRUITING_TIER_HOST},*.${RECRUITING_CHALLENGE_HOST}"
      - "traefik.http.services.recruiting-challenge.loadbalancer.server.port=3000"
    restart: always
    networks:
      - ehacking

  recruiting-bot:
    image: ghcr.io/ehacking-websec/recruiting/bot:latest
    profiles: [recruiting]
    pull_policy: always
    init: true
    depends_on:
      dns:
        required: true
        condition: service_started
      traefik:
        required: true
        condition: service_started
      recruiting-challenge:
        required: true
        condition: service_started
    # puppeteer navigates CHALLENGE_PUBLIC_ORIGIN;
    # that name only resolves through the in-network resolver.
    dns: *dns
    environment:
      PORT: "1337"
      REGISTRY_DB_PATH: /data/registry.db
      CHALLENGE_PUBLIC_ORIGIN: https://${RECRUITING_CHALLENGE_HOST}
      CHALLENGE_INTERNAL_ORIGIN: http://recruiting-challenge:3000
      BOT_INTERNAL_SECRET: ${BOT_INTERNAL_SECRET:-bot-secret-11cde19f9d2f5b99-change-me-in-prod}
      BOT_PUBLIC_ORIGIN: https://${RECRUITING_BOT_HOST}
      BOT_REPORT_RATE_LIMIT: "2"
    volumes:
      - recruiting-data:/data
    # Puppeteer + Firefox is the heaviest piece — cap RAM so a stuck
    # browser can't crowd the host and cpus so bursty reports don't
    # starve challenge + instructor.
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.5"
    labels:
      - "traefik.enable=true"
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.http.routers.recruiting-bot.entrypoints=websecure"
      - "traefik.http.routers.recruiting-bot.rule=Host(`${RECRUITING_BOT_HOST}`)"
      - "traefik.http.routers.recruiting-bot.tls=true"
      - "traefik.http.routers.recruiting-bot.tls.certresolver=letsencrypt"
      - "traefik.http.services.recruiting-bot.loadbalancer.server.port=1337"
    restart: always
    networks:
      - ehacking

  recruiting-instructor:
    image: ghcr.io/ehacking-websec/recruiting/instructor:latest
    profiles: [recruiting]
    pull_policy: always
    depends_on:
      traefik:
        required: true
        condition: service_started
      recruiting-challenge:
        required: true
        condition: service_started
    environment:
      PORT: "3000"
      REGISTRY_DB_PATH: /data/registry.db
      URL_STYLE: subdomain
      CHALLENGE_PUBLIC_ORIGIN: https://${RECRUITING_CHALLENGE_HOST}
      BOT_PUBLIC_ORIGIN: https://${RECRUITING_BOT_HOST}
    volumes:
      - recruiting-data:/data
    labels:
      - "traefik.enable=true"
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.http.routers.recruiting-instructor.entrypoints=websecure"
      - "traefik.http.routers.recruiting-instructor.rule=Host(`${RECRUITING_INSTRUCTOR_HOST}`)"
      - "traefik.http.routers.recruiting-instructor.tls=true"
      - "traefik.http.routers.recruiting-instructor.tls.certresolver=letsencrypt"
      - "traefik.http.routers.recruiting-instructor.middlewares=basicauth@file"
      - "traefik.http.services.recruiting-instructor.loadbalancer.server.port=3000"
    restart: always
    networks:
      - ehacking

  # Watchtower
  watchtower:
    image: docker.io/nickfedor/watchtower
    volumes:
      # See traefik above — same mount-string ENV plumbing for podman :Z.
      - "${WATCHTOWER_SOCK_MOUNT:-/var/run/docker.sock:/var/run/docker.sock}"
    environment:
      - TZ=Europe/Berlin
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_LABEL_ENABLE=true
      - WATCHTOWER_INCLUDE_RESTARTING=true
      # - WATCHTOWER_RUN_ONCE=true
      # Field name   | Mandatory? | Allowed values  | Allowed special characters
      # ----------   | ---------- | --------------  | --------------------------
      # Seconds      | Yes        | 0-59            | * / , -
      # Minutes      | Yes        | 0-59            | * / , -
      # Hours        | Yes        | 0-23            | * / , -
      # Day of month | Yes        | 1-31            | * / , - ?
      # Month        | Yes        | 1-12 or JAN-DEC | * / , -
      # Day of week  | Yes        | 0-6 or SUN-SAT  | * / , - ?
      - WATCHTOWER_SCHEDULE=0 0 7 * * * # every day on 7am
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    restart: always

networks:
  # Pinned so the `dns` service can hold a fixed address: a client can
  # only name its resolver by IP, and an address is only assignable on a
  # network with a user-configured subnet. Check it does not collide
  # with an existing network on the host (`podman network ls`).
  ehacking:
    name: ehacking
    ipam:
      config:
        - subnet: ${EHACKING_SUBNET:-10.53.0.0/24}
  soap-internal:

volumes:
  catcher-data:
  crawling-maze-sessions:
  letsencrypt:
  passkeys-instance-data:
  passkeys-mongo-data:
  recruiting-data: