docker-compose.yaml

#version: "3.8"

# For DataNode setup, graylog starts with a preflight UI, this is a change from just using OpenSearch/Elasticsearch.
# Please take a look at the README at the top of this repo or the regular docs for more info.

services:
  mongodb:
    container_name: graylog_mongodb-01
    hostname: "mongodb"
    image: "mongo:6.0"
    healthcheck:
      test: echo 'db.runCommand("ping").ok' | mongosh localhost:27017/test --quiet
      interval: 10s
      timeout: 10s
      retries: 5
      start_period: 15s
    volumes:
      - "mongodb_data:/data/db"
    restart: "unless-stopped"

  # For DataNode setup, graylog starts with a preflight UI, this is a change from just using OpenSearch/Elasticsearch.
  # Please take a look at the README at the top of this repo or the regular docs for more info.
  datanode:
    container_name: graylog-datanode-01
    image: "${DATANODE_IMAGE:-graylog/graylog-datanode:6.0}"
    hostname: "datanode"
    environment:
      GRAYLOG_DATANODE_NODE_ID_FILE: "/var/lib/graylog-datanode/node-id"
      GRAYLOG_DATANODE_PASSWORD_SECRET: "${GRAYLOG_PASSWORD_SECRET:?Please configure GRAYLOG_PASSWORD_SECRET in the .env file}"
      GRAYLOG_DATANODE_ROOT_PASSWORD_SHA2: "${GRAYLOG_ROOT_PASSWORD_SHA2:?Please configure GRAYLOG_ROOT_PASSWORD_SHA2 in the .env file}"
      GRAYLOG_DATANODE_MONGODB_URI: "mongodb://mongodb:27017/graylog"
    ulimits:
      memlock:
        hard: -1
        soft: -1
      nofile:
        soft: 65536
        hard: 65536
    ports:
      - "8999:8999/tcp"   # DataNode API
      - "9200:9200/tcp"
      - "9300:9300/tcp"
    volumes:
      - "graylog-datanode:/var/lib/graylog-datanode"
    restart: "on-failure"

  graylog:
    container_name: graylog-server-01
    hostname: "graylog"
    image: "${GRAYLOG_IMAGE:-graylog/graylog:6.0}"
    depends_on:
      mongodb:
        condition: "service_healthy"
        restart: true
    entrypoint: "/usr/bin/tini --  /docker-entrypoint.sh"
    environment:
      GRAYLOG_NODE_ID_FILE: "/usr/share/graylog/data/data/node-id"
      GRAYLOG_PASSWORD_SECRET: "${GRAYLOG_PASSWORD_SECRET:?Please configure GRAYLOG_PASSWORD_SECRET in the .env file}"
      GRAYLOG_ROOT_PASSWORD_SHA2: "${GRAYLOG_ROOT_PASSWORD_SHA2:?Please configure GRAYLOG_ROOT_PASSWORD_SHA2 in the .env file}"
      GRAYLOG_HTTP_BIND_ADDRESS: "0.0.0.0:9000"
        #GRAYLOG_HTTP_EXTERNAL_URI: "http://localhost:9000/"
      GRAYLOG_HTTP_EXTERNAL_URI: "http://kag-lnx-containerhost01.kauffmangas.lcl:9000/"
      GRAYLOG_MONGODB_URI: "mongodb://mongodb:27017/graylog"
    ports:
      #    - "5044:5044/tcp"   # Beats
      - "5114:5114/udp"   # Syslog
      - "5115:5115/udp"   # Syslog
      - "5116:5116/udp"   # Syslog
      - "5117:5117/udp"   # Syslog
      #- "5140:5140/udp"   # Syslog
      #- "5140:5140/tcp"   # Syslog
      #- "5555:5555/tcp"   # RAW TCP
      #- "5555:5555/udp"   # RAW UDP
      - "9000:9000/tcp"   # Server API
      - "12201:12201/tcp" # GELF TCP
      - "12201:12201/udp" # GELF UDP
    #- "10000:10000/tcp" # Custom TCP port
    #- "10000:10000/udp" # Custom UDP port
      - "13301:13301/tcp" # Forwarder data
      - "13302:13302/tcp" # Forwarder config
    volumes:
      - "graylog_data:/usr/share/graylog/data"
      - "graylog_journal:/usr/share/graylog/data/journal"
      - "graylog_etc:/etc/graylog"
      - "graylog_geolite2:/usr/share/GeoIP:ro"
    restart: "unless-stopped"
  
  geoipupdate:
    container_name: graylog_geoipupdate
    hostname: "geoipupdate"
    image: maxmindinc/geoipupdate
    restart: unless-stopped
    environment:
      GEOIPUPDATE_ACCOUNT_ID: "${GEOIPUPDATE_ACCOUNT_ID:?Please configure GEOIPUPDATE_ACCOUNT_ID in the .env file}"
      GEOIPUPDATE_LICENSE_KEY: "${GEOIPUPDATE_LICENSE_KEY:?Please configure GEOIPUPDATE_LICENSE_KEY in the .env file}"
      GEOIPUPDATE_EDITION_IDS: "${GEOIPUPDATE_EDITION_IDS:?Please configure GEOIPUPDATE_EDITION_IDS in the .env file}"
      GEOIPUPDATE_FREQUENCY: "${GEOIPUPDATE_FREQUENCY:?Please configure GEOIPUPDATE_FREQUENCY in the .env file}"
      GEOIPUPDATE_VERBOSE: "${GEOIPUPDATE_VERBOSE:?Please configure GEOIPUPDATE_VERBOSE in the .env file}"
    # networks:
    #   - geoipupdate
    volumes:
      - "graylog_geolite2:/usr/share/GeoIP"

volumes:
  mongodb_data:
  graylog-datanode:
  graylog_data:
  graylog_journal:
  graylog_etc:
  graylog_geolite2: