docker-compose.yml

services:
  postfix:
    build: ./deploy/postfix
    image: dmarc-msp-postfix
    container_name: parsedmarc-postfix
    ports:
      - "${SMTP_BIND_IP:-0.0.0.0}:25:25"
      - "${SMTP_BIND_IP:-0.0.0.0}:587:587"
    volumes:
      - maildir:/var/mail/dmarc
      - certs:/etc/letsencrypt:ro
    environment:
      - MSP_DOMAIN=${MSP_DOMAIN:-dmarc.msp-example.com}
    depends_on:
      certbot:
        condition: service_healthy
    networks:
      - frontend
    restart: unless-stopped

  parsedmarc:
    image: ghcr.io/domainaware/parsedmarc:latest
    container_name: parsedmarc
    volumes:
      - maildir:/var/mail/dmarc
      - ./domain_map.yaml:/etc/parsedmarc_domain_map.yaml:ro
    environment:
      - PARSEDMARC_GENERAL_SAVE_AGGREGATE=true
      - PARSEDMARC_GENERAL_SAVE_FORENSIC=false
      - PARSEDMARC_GENERAL_SAVE_SMTP_TLS=true
      - PARSEDMARC_GENERAL_INDEX_PREFIX_DOMAIN_MAP=/etc/parsedmarc_domain_map.yaml
      - PARSEDMARC_GENERAL_IPINFO_API_TOKEN=${IPINFO_API_TOKEN}
      - PARSEDMARC_MAILDIR_MAILDIR_PATH=/var/mail/dmarc/Maildir
      - PARSEDMARC_MAILDIR_CREATE=true
      - PARSEDMARC_MAILBOX_WATCH=true
      - PARSEDMARC_MAILBOX_DELETE=false
      - PARSEDMARC_OPENSEARCH_HOSTS=https://opensearch:9200
      - PARSEDMARC_OPENSEARCH_USER=admin
      - PARSEDMARC_OPENSEARCH_PASSWORD=${OPENSEARCH_ADMIN_PASSWORD}
      - PARSEDMARC_OPENSEARCH_SSL=true
      - PARSEDMARC_OPENSEARCH_SKIP_CERTIFICATE_VERIFICATION=true
    depends_on:
      opensearch:
        condition: service_healthy
    networks:
      - frontend
      - backend
    restart: unless-stopped

  opensearch:
    image: opensearchproject/opensearch:3
    container_name: parsedmarc-opensearch
    environment:
      - cluster.name=dmarc-msp
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
      - OPENSEARCH_INITIAL_ADMIN_PASSWORD=${OPENSEARCH_ADMIN_PASSWORD}
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - opensearch-data:/usr/share/opensearch/data
      - certs:/etc/letsencrypt:ro
    expose:
      - "9200"
    networks:
      - backend
    healthcheck:
      test: ["CMD-SHELL", "curl -sk https://localhost:9200/_cluster/health -u admin:${OPENSEARCH_ADMIN_PASSWORD} | grep -qE '\"status\":\"(green|yellow)\"'"]
      interval: 10s
      timeout: 5s
      retries: 30
    restart: unless-stopped

  opensearch-dashboards:
    image: opensearchproject/opensearch-dashboards:3
    container_name: parsedmarc-dashboards
    environment:
      - OPENSEARCH_HOSTS=["https://opensearch:9200"]
    volumes:
      - ./deploy/dashboards/branding/:/usr/share/opensearch-dashboards/src/core/server/core_app/assets/branding:ro
      - ./deploy/dashboards/opensearch_dashboards.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml

    depends_on:
      opensearch:
        condition: service_healthy
    networks:
      - frontend
      - backend
    restart: unless-stopped

  nginx:
    build: ./deploy/nginx
    image: dmarc-msp-nginx
    container_name: parsedmarc-nginx
    ports:
      - "${HTTP_BIND_IP:-0.0.0.0}:80:80"
      - "${HTTP_BIND_IP:-0.0.0.0}:443:443"
    volumes:
      - certs:/etc/letsencrypt
      - certbot-webroot:/var/www/certbot:ro
      - ./.well-known:/var/www/well-known/.well-known:ro
    environment:
      - MSP_DOMAIN=${MSP_DOMAIN:-dmarc.msp-example.com}
      - DNS_RESOLVER=${DNS_RESOLVER:-127.0.0.11}
    networks:
      - frontend
    restart: unless-stopped

  certbot:
    image: certbot/certbot
    container_name: parsedmarc-certbot
    volumes:
      - certs:/etc/letsencrypt
      - certbot-webroot:/var/www/certbot
      - ./deploy/certbot/entrypoint.sh:/entrypoint.sh:ro
      - /var/run/docker.sock:/var/run/docker.sock
      - /usr/bin/docker:/usr/bin/docker:ro
    environment:
      - MSP_DOMAIN=${MSP_DOMAIN:-dmarc.msp-example.com}
      - CERTBOT_EMAIL=${CERTBOT_EMAIL:-}
    entrypoint: ["/bin/sh", "/entrypoint.sh"]
    healthcheck:
      test: ["CMD-SHELL", "test -f /etc/letsencrypt/live/${MSP_DOMAIN:-dmarc.msp-example.com}/fullchain.pem"]
      interval: 5s
      timeout: 2s
      retries: 60
    depends_on:
      - nginx
    networks:
      - frontend
    restart: unless-stopped

  dmarc-msp:
    build: .
    image: dmarc-msp
    container_name: dmarc-msp
    command: ["dmarcmsp", "serve"]
    ports:
      - "127.0.0.1:8000:8000"
    environment:
      - OPENSEARCH_ADMIN_PASSWORD=${OPENSEARCH_ADMIN_PASSWORD}
      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN:-}
      # Uncomment for your DNS provider:
      # - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID:-}
      # - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY:-}
      # - AZURE_CLIENT_ID=${AZURE_CLIENT_ID:-}
      # - AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET:-}
      # - AZURE_TENANT_ID=${AZURE_TENANT_ID:-}
    # GCP requires a service account key file — uncomment if using GCP:
    # secrets:
    #   - gcp_sa_key
    volumes:
      - ./dmarc-msp.yml:/etc/dmarc-msp/config.yml:ro
      - ./opensearch/opensearch_dashboards.ndjson:/etc/dmarc-msp/opensearch_dashboards.ndjson:ro
      - ./domain_map.yaml:/etc/parsedmarc_domain_map.yaml
      - maildir:/var/mail/dmarc
      - msp-data:/var/lib/dmarc-msp
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      opensearch:
        condition: service_healthy
    networks:
      - frontend
      - backend
    restart: unless-stopped

networks:
  frontend:
  backend:
    internal: true

volumes:
  maildir:
  opensearch-data:
  certs:
  certbot-webroot:
  msp-data:

# Uncomment if using GCP DNS (the only provider that requires a key file).
# secrets:
#   gcp_sa_key:
#     file: ./secrets/gcp_sa_key.json