grr Docker & Self-Hosted Deployment

# Run the GRR stack with container images fetched from the GitHub container
# registry.
#
# See https://github.com/google/grr/pkgs/container/grr
# See https://github.com/google/fleetspeak/pkgs/container/fleetspeak
#
# To run the stack follow
# https://grr-doc.readthedocs.io/en/latest/installing-and-running-grr/via-docker-compose.html
#
# To run the stack from source code, use compose.watch.yaml instead.

version: "3.8"
services:
  db:
    image: mysql:8.4
    env_file: docker_config_files/mysql/.env
    container_name: grr-db
    hostname: mysql-host
    command: [
      --max_allowed_packet=40M,
      --log_bin_trust_function_creators=1,
      --innodb_redo_log_capacity=167772160,
      --innodb_log_file_size=2500M,
      --restrict-fk-on-non-standard-key=OFF
    ]
    restart: always
    volumes:
      - ./docker_config_files/mysql/init.sh:/docker-entrypoint-initdb.d/init.sh
      - db_data:/var/lib/mysql:rw
    ports:
      - "3306:3306"
    expose:
      - "3306"
    networks:
      - server-network
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
      timeout: 5s
      retries: 10

  grr-admin-ui:
    image: ghcr.io/google/grr:latest
    container_name: grr-admin-ui
    hostname: admin-ui
    depends_on:
      db:
        condition: service_healthy
      fleetspeak-admin:
        condition: service_started
    volumes:
      - ./docker_config_files:/configs/
      # Mount a directory for the repacked client installers, so they
      # can be used in the grr-client container which mounts the same volume.
      - client_installers:/client_installers
    ports:
      - "8000:8000"
    expose:
      - "8000"
    networks:
      - server-network
    entrypoint: [
      "/bin/bash",
      "-c",
      "/configs/server/repack_clients.sh && grr_server -component admin_ui -config /configs/server/grr.server.yaml --verbose"
    ]
    healthcheck:
      # As soon as any files have been written to the /client_installer we
      # assume the service is healthy.
      test: "/configs/healthchecks/grr-admin-ui.sh"
      timeout: 10s
      retries: 10

  grr-fleetspeak-frontend:
    image: ghcr.io/google/grr:latest
    container_name: grr-fleetspeak-frontend
    hostname: grr-fleetspeak-frontend
    depends_on:
      db:
        condition: service_healthy
    volumes:
      - ./docker_config_files:/configs
    expose:
      - "11111"
    restart: always
    networks:
      - server-network
    command:
      - -component
      - frontend
      - -config
      - /configs/server/grr.server.yaml
      - --verbose

  fleetspeak-admin:
    image: ghcr.io/google/fleetspeak:latest
    container_name: fleetspeak-admin
    hostname: fleetspeak-admin
    depends_on:
      db:
        condition: service_healthy
    networks:
      - server-network
    expose:
      - "4444"
    volumes:
      - ./docker_config_files:/configs
    entrypoint: [
      "server",
      "-components_config",
      "/configs/server/textservices/admin.components.config",
      "-services_config",
      "/configs/server/grr_frontend.service",
      "-alsologtostderr",
      "-v",
      "1000"
    ]

  fleetspeak-frontend:
    image: ghcr.io/google/fleetspeak:latest
    container_name: fleetspeak-frontend
    hostname: fleetspeak-frontend
    depends_on:
      db:
        condition: service_healthy
    networks:
      - server-network
    expose:
      - "4443"
      - "10000"
    volumes:
      - ./docker_config_files:/configs
    entrypoint: [
      "server",
      "-components_config",
      "/configs/server/textservices/frontend.components.config",
      "-services_config",
      "/configs/server/grr_frontend.service",
      "-alsologtostderr",
      "-v",
      "1000"
    ]

  grr-worker:
    image: ghcr.io/google/grr:latest
    container_name: grr-worker
    volumes:
      - ./docker_config_files:/configs
    hostname: grr-worker
    depends_on:
      db:
        condition: service_healthy
    restart: always
    networks:
      - server-network
    command:
      - -component
      - worker
      - -config
      - /configs/server/grr.server.yaml
      - --verbose

  grr-client:
    image: ubuntu:22.04
    container_name: grr-client
    depends_on:
      db:
        condition: service_healthy
      fleetspeak-frontend:
        condition: service_started
      grr-admin-ui:
        # Service is healthy as soon as client installers are repacked.
        condition: service_healthy
    volumes:
      - ./docker_config_files:/configs
      # Mount the client_installers folder which contains the
      # repacked templates written by the grr-admin-ui container
      - client_installers:/client_installers
      # Mount the client_state volume to preserve the clients state
      # including the client_id across restarts.
      - client_state:/client_state
    networks:
      - server-network
    entrypoint: [
      "/bin/bash",
      "-c",
      "/configs/client/install_client.sh && fleetspeak-client -config /configs/client/client.config"
    ]
    healthcheck:
      test: "/configs/healthchecks/grr-client.sh"
      timeout: 10s
      retries: 10

volumes:
  db_data:
  client_installers:
  client_state:
networks:
  server-network: