# Acauã stack: Zeek captures traffic and writes hourly-rotated logs; Acauã
# reads them read-only and serves the API and the web dashboard.
#
#   cp .env.example .env              # set ZEEK_INTERFACE (authorized network only)
#   docker compose pull && docker compose up -d      # operators: published image
#   docker compose up -d --build                     # developers: build locally
name: acaua

services:
  zeek:
    image: ${ZEEK_IMAGE:-zeek/zeek:9.0.1}
    network_mode: host
    cap_drop: [ALL]
    cap_add: [NET_RAW, NET_ADMIN]
    working_dir: /logs
    command:
      - zeek
      - -i
      - ${ZEEK_INTERFACE:-eth0}
      - Log::default_logdir=/logs
      - Log::default_rotation_interval=1hr
      - Log::default_rotation_dir=/logs/archive
    volumes:
      - zeek-logs:/logs
    restart: unless-stopped

  acaua:
    image: ${ACAUA_IMAGE:-git.lucasrguerra.dev.br/ciberfauna/acaua}:${ACAUA_VERSION:-latest}
    build: .
    ports:
      - "${ACAUA_PUBLISH:-127.0.0.1:8787}:8787"
    volumes:
      - zeek-logs:/data/zeek:ro
      - acaua-data:/data/acaua
    read_only: true
    tmpfs:
      - /tmp
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped

volumes:
  zeek-logs:
  acaua-data: