# Ansible managed
# Stack BunkerWeb 1.6.17 : WAF + scheduler + UI + MariaDB + Redis
# Mode split, applis sur 192.168.200.62
x-db-env: &db-env
  DATABASE_URI: "mariadb+pymysql://bunkerweb:CHANGEME@bw-db:3306/db"

x-api-env: &api-env
  API_WHITELIST_IP: "127.0.0.0/8 10.20.30.0/24"

services:
  bunkerweb:
    image: bunkerity/bunkerweb:1.6.17
    container_name: bunkerweb
    restart: unless-stopped
    ports:
      - "80:8080/tcp"
      - "443:8443/tcp"
      - "443:8443/udp"   # HTTP/3 (QUIC)
    labels:
      - "bunkerweb.INSTANCE=yes"
    environment:
      <<: [*db-env, *api-env]
    networks:
      - bw-universe
      - bw-services

  bw-scheduler:
    image: bunkerity/bunkerweb-scheduler:1.6.17
    container_name: bw-scheduler
    restart: unless-stopped
    depends_on:
      - bunkerweb
      - bw-db
      - bw-redis
    volumes:
      - bw-storage:/data
    environment:
      <<: [*db-env, *api-env]
      BUNKERWEB_INSTANCES: "bunkerweb"
      SERVER_NAME: "www.bwpoc.internal shop.bwpoc.internal api.bwpoc.internal bwui.bwpoc.internal"
      # --- Réglages globaux ---
      MULTISITE: "yes"
      DISABLE_DEFAULT_SERVER: "yes"
      SERVE_FILES: "no"
      GENERATE_SELF_SIGNED_SSL: "yes"
      AUTO_REDIRECT_HTTP_TO_HTTPS: "yes"
      USE_MODSECURITY: "yes"
      USE_MODSECURITY_CRS: "yes"
      MODSECURITY_CRS_VERSION: "4"
      USE_BAD_BEHAVIOR: "yes"
      BAD_BEHAVIOR_THRESHOLD: "10"
      BAD_BEHAVIOR_COUNT_TIME: "1m"
      BAD_BEHAVIOR_BAN_TIME: "5m"
      USE_BLACKLIST: "yes"
      BLACKLIST_USER_AGENT: "PoC-EvilBot"
      USE_GZIP: "yes"
      USE_BROTLI: "yes"
      USE_REDIS: "yes"
      REDIS_HOST: "bw-redis"
      REDIS_PASSWORD: "CHANGEME"
      SEND_ANONYMOUS_REPORT: "no"
      # --- www.bwpoc.internal ---
      www.bwpoc.internal_USE_REVERSE_PROXY: "yes"
      www.bwpoc.internal_REVERSE_PROXY_URL: "/"
      www.bwpoc.internal_REVERSE_PROXY_HOST: "http://192.168.200.62:8081"
      www.bwpoc.internal_SELF_SIGNED_SSL_SUBJ: "/CN=www.bwpoc.internal/"
      www.bwpoc.internal_USE_ANTIBOT: "javascript"
      www.bwpoc.internal_LIMIT_REQ_RATE: "10r/s"
      # --- shop.bwpoc.internal ---
      shop.bwpoc.internal_USE_REVERSE_PROXY: "yes"
      shop.bwpoc.internal_REVERSE_PROXY_URL: "/"
      shop.bwpoc.internal_REVERSE_PROXY_HOST: "http://192.168.200.62:8082"
      shop.bwpoc.internal_SELF_SIGNED_SSL_SUBJ: "/CN=shop.bwpoc.internal/"
      shop.bwpoc.internal_REVERSE_PROXY_WS: "yes"
      shop.bwpoc.internal_LIMIT_REQ_RATE: "30r/s"
      shop.bwpoc.internal_COOKIE_FLAGS: "* SameSite=Lax"
      # --- api.bwpoc.internal ---
      api.bwpoc.internal_USE_REVERSE_PROXY: "yes"
      api.bwpoc.internal_REVERSE_PROXY_URL: "/"
      api.bwpoc.internal_REVERSE_PROXY_HOST: "http://192.168.200.62:8083"
      api.bwpoc.internal_SELF_SIGNED_SSL_SUBJ: "/CN=api.bwpoc.internal/"
      api.bwpoc.internal_ALLOWED_METHODS: "GET|POST|HEAD"
      api.bwpoc.internal_MAX_CLIENT_SIZE: "1m"
      api.bwpoc.internal_LIMIT_REQ_RATE: "5r/s"
      api.bwpoc.internal_CUSTOM_CONF_MODSEC_poc-rule: "SecRule ARGS:poc \"@streq attack\" \"id:10001,phase:2,deny,status:403,log,msg:'PoC BunkerWeb : regle maison'\""
      # --- bwui.bwpoc.internal ---
      bwui.bwpoc.internal_USE_REVERSE_PROXY: "yes"
      bwui.bwpoc.internal_REVERSE_PROXY_URL: "/"
      bwui.bwpoc.internal_REVERSE_PROXY_HOST: "http://bw-ui:7000"
      bwui.bwpoc.internal_SELF_SIGNED_SSL_SUBJ: "/CN=bwui.bwpoc.internal/"
      bwui.bwpoc.internal_USE_TEMPLATE: "ui"
    networks:
      - bw-universe
      - bw-db

  bw-ui:
    image: bunkerity/bunkerweb-ui:1.6.17
    container_name: bw-ui
    restart: unless-stopped
    depends_on:
      - bw-db
    volumes:
      - bw-ui-data:/data   # secrets Flask, clés TOTP et Biscuit
    environment:
      <<: *db-env
      ADMIN_USERNAME: "admin"
      ADMIN_PASSWORD: "CHANGEME"
      TZ: "Europe/Paris"
    networks:
      - bw-universe
      - bw-db

  bw-db:
    image: mariadb:11
    container_name: bw-db
    restart: unless-stopped
    command: --max-allowed-packet=67108864
    environment:
      MYSQL_RANDOM_ROOT_PASSWORD: "yes"
      MYSQL_DATABASE: "db"
      MYSQL_USER: "bunkerweb"
      MYSQL_PASSWORD: "CHANGEME"
    volumes:
      - bw-data:/var/lib/mysql
    networks:
      - bw-db

  bw-redis:
    image: redis:8-alpine
    container_name: bw-redis
    restart: unless-stopped
    command: ["redis-server", "--requirepass", "CHANGEME", "--save", "60", "1"]
    volumes:
      - bw-redis:/data
    networks:
      - bw-universe

volumes:
  bw-data:
  bw-storage:
  bw-ui-data:
  bw-redis:

networks:
  bw-universe:
    name: bw-universe
    ipam:
      driver: default
      config:
        - subnet: 10.20.30.0/24   # seul réseau autorisé à parler à l'API BunkerWeb
  bw-services:
    name: bw-services             # réseau des applis (mode single), créé par Ansible
    external: true
  bw-db:
    name: bw-db