docker-compose.yml

version: "3.8"
services:
  cassandra:
    image: cassandra:3.11
    container_name: cassandra
    restart: unless-stopped
    hostname: cassandra
    environment:
      - MAX_HEAP_SIZE=1G
      - HEAP_NEWSIZE=1G
      - CASSANDRA_CLUSTER_NAME=thp
    volumes:
      - ./vol/cassandra/data:/var/lib/cassandra/data
    networks:
      - backend

  thehive:
    image: 'thehiveproject/thehive4:latest'
    container_name: thehive
    restart: unless-stopped
    depends_on:
      - cassandra
      - traefik
    ports:
      - '0.0.0.0:9000:9000'
    volumes:
      - ./vol/thehive/application.conf:/etc/thehive/application.conf
      - ./vol/thehive/data:/opt/thp/thehive/data
      - ./vol/thehive/index:/opt/thp/thehive/index
    command: '--no-config --no-config-secret'
    networks:
      - proxy
      - backend
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.thehivedocker.entrypoints=https"
      - "traefik.http.routers.thehivedocker.rule=Host(`${THEHIVE_HOST}`)"
      - "traefik.http.routers.thehivedocker.service=thehivedocker"
      - "traefik.http.routers.thehivedocker.tls=true"
      - "traefik.http.services.thehivedocker.loadbalancer.server.port=9000"
      - "traefik.http.routers.thehivedocker.tls.certresolver=mytlschallenge"

      - "traefik.http.routers.thehivedocker_http.entrypoints=http"
      - "traefik.http.routers.thehivedocker_http.rule=Host(`${THEHIVE_HOST}`)"
      - "traefik.http.routers.thehivedocker_http.middlewares=traefik-redirectscheme"
      - "traefik.http.middlewares.traefik-redirectscheme.redirectscheme.scheme=https"

  traefik:
    image: traefik:v2.3.3
    environment:
      - AWS_HOSTED_ZONE_ID=${AWS_HOSTED_ZONE_ID}
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
    restart: always
    container_name: traefik
    ports:
      - "80:80"
      - "443:443"
    command:
      - --api.insecure=true # set to 'false' on production
      - --api.dashboard=true
      - --api.debug=false
      - --log.level=DEBUG
      - --providers.docker=true
      - --providers.docker.swarmMode=false
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=proxy
      - --entrypoints.http.address=:80
      - --entrypoints.https.address=:443
      - --certificatesResolvers.mytlschallenge.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory # Generates LE test certificates.  Can be removed for production
      - --certificatesResolvers.mytlschallenge.acme.dnsChallenge=true
      - --certificatesResolvers.mytlschallenge.acme.dnsChallenge.provider=route53
      - --certificatesresolvers.mytlschallenge.acme.email=${LE_EMAIL}
      - --certificatesresolvers.mytlschallenge.acme.storage=/letsencrypt/acme.json

    volumes:
      - "letsencrypt:/letsencrypt"
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - proxy

    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.entrypoints=https"
      - "traefik.http.routers.api.rule=Host(`${TRAEFIK_HOST}`)"
      - "traefik.http.routers.api.service=api@internal"
      - "traefik.http.routers.api.tls=true"
      - "traefik.http.services.api.loadbalancer.server.port=8080"
      - "traefik.http.routers.api.tls.certresolver=mytlschallenge"

      - "traefik.http.routers.api_http.entrypoints=http"
      - "traefik.http.routers.api_http.rule=Host(`${TRAEFIK_HOST}`)"
      - "traefik.http.routers.api_http.middlewares=traefik-redirectscheme"
      - "traefik.http.middlewares.traefik-redirectscheme.redirectscheme.scheme=https"

networks:
  backend:
  proxy:
    external: true

volumes:
  letsencrypt: