docker-compose.yml

services:
  challenge:
    build:
      context: ./challenge
      target: challenge-final
      dockerfile: Dockerfile_${ARCH}
      args:
        - DEFAULT_INSTALL_SELECTION=${DEFAULT_INSTALL_SELECTION}
        - INSTALL_AFL=${INSTALL_AFL:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_ANGR_MANAGEMENT=${INSTALL_ANGR_MANAGEMENT:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_BUSYBOX=${INSTALL_BUSYBOX:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_CAPSTONE=${INSTALL_CAPSTONE:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_DESKTOP=${INSTALL_DESKTOP:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_GDB=${INSTALL_GDB:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_GECKODRIVER=${INSTALL_GECKODRIVER:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_GHIDRA=${INSTALL_GHIDRA:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_GLOW=${INSTALL_GLOW:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_IDA_FREE=${INSTALL_IDA_FREE:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_BINJA_FREE=${INSTALL_BINJA_FREE:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_KERNEL=${INSTALL_KERNEL:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_RADARE2=${INSTALL_RADARE2:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_RAPPEL=${INSTALL_RAPPEL:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_RP=${INSTALL_RP:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_TCPDUMP=${INSTALL_TCPDUMP:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_TOOLS_APT=${INSTALL_TOOLS_APT:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_TOOLS_PIP=${INSTALL_TOOLS_PIP:-${DEFAULT_INSTALL_SELECTION}}
        - INSTALL_VIRTIOFSD=${INSTALL_VIRTIOFSD:-${DEFAULT_INSTALL_SELECTION}}
        - UBUNTU_VERSION=${UBUNTU_VERSION}
        - DOJO_CHALLENGE=${DOJO_CHALLENGE}
    platform: linux/${ARCH}
    entrypoint: /bin/true
    networks:
      - user_network

  ctfd:
    container_name: ctfd
    hostname: ctfd
    build: /opt/CTFd
    platform: linux/${ARCH}
    user: root
    restart: always
    privileged: true
    entrypoint: ""
    command:
      - /bin/sh
      - -c
      - |
        patch  -i /opt/pwn.college/ctfd/0001-use-pycountry-to-replace-self-generated-country-list.patch /opt/CTFd/CTFd/utils/countries/__init__.py
        if [ "$DOJO_ENV" != "development" ]; then
          ./docker-entrypoint.sh;
        else
          FLASK_ENV=development WERKZEUG_DEBUG_PIN=off flask run --host 0.0.0.0 --port 8000;
        fi
    ulimits:
        nofile:
            soft: 32768
            hard: 1048576
    environment:
      - UPLOAD_FOLDER=/var/uploads
      - DATABASE_URL=mysql+pymysql://ctfd:ctfd@db/ctfd
      - REDIS_URL=redis://cache:6379
      - WORKERS=8
      - LOG_FOLDER=/var/log/CTFd
      - ACCESS_LOG=-
      - ERROR_LOG=-
      - REVERSE_PROXY=true
      - SERVER_SENT_EVENTS=false
      - SECRET_KEY=${SECRET_KEY}
      - DOJO_HOST=${DOJO_HOST}
      - HOST_DATA_PATH=/opt/pwn.college/data
      - INTERNET_FOR_ALL=${INTERNET_FOR_ALL}
      - VIRTUAL_HOST=${DOJO_HOST}
      - VIRTUAL_PORT=8000
      - LETSENCRYPT_HOST=${DOJO_HOST}
      - KOOK_TOKEN=${KOOK_TOKEN}
      - KOOK_GUILD_ID=${KOOK_GUILD_ID}
      - KOOK_CHANNEL_ID_AWARD=${KOOK_CHANNEL_ID_AWARD}
      - KOOK_CHANNEL_ID_WELCOME=${KOOK_CHANNEL_ID_WELCOME}
      - KOOK_CHANNEL_ID_NOTIFICATION=${KOOK_CHANNEL_ID_NOTIFICATION}
      - KOOK_CLIENT_ID=${KOOK_CLIENT_ID}
      - KOOK_CLIENT_SECRET=${KOOK_CLIENT_SECRET}
      - KOOK_APP_ID=${KOOK_APP_ID}
    volumes:
      - ./data:/var/data
      - ./data/CTFd/logs:/var/log/CTFd
      - ./data/CTFd/uploads:/var/uploads
      - ./data/homes:/var/homes:shared
      - ./data/challenges:/var/challenges:ro
      - ./data/dojos:/var/dojos
      - ./data/ssh_host_keys/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
      - ./user_firewall.allowed:/var/user_firewall.allowed:ro
      - /etc/docker/seccomp.json:/etc/docker/seccomp.json:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /opt/pwn.college/dojo_plugin:/opt/CTFd/CTFd/plugins/dojo_plugin:ro
      - /opt/pwn.college/dojo_theme:/opt/CTFd/CTFd/themes/dojo_theme:ro
    healthcheck:
      test:
        - "CMD"
        - "python"
        - "-c"
        - |
          import requests
          response = requests.get('http://localhost:8000')
          response.raise_for_status()
      interval: 10s
      timeout: 10s
      retries: 3
    depends_on:
      db:
        condition: service_healthy
        restart: true
      cache:
        condition: service_started

  db:
    container_name: db
    image: mariadb:10.4.12
    restart: always
    environment:
      - MYSQL_ROOT_PASSWORD=ctfd
      - MYSQL_USER=ctfd
      - MYSQL_PASSWORD=ctfd
      - MYSQL_DATABASE=ctfd
    ports:
      - "13306:3306"
    volumes:
      - ./data/mysql:/var/lib/mysql
    command: [mysqld, --character-set-server=utf8mb4, --collation-server=utf8mb4_unicode_ci, --wait_timeout=28800, --log-warnings=0]
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-pctfd"]
      interval: 10s
      timeout: 10s
      retries: 3

  cache:
    container_name: cache
    image: redis:4
    restart: always
    volumes:
      - ./data/redis:/data

  sshd:
    container_name: sshd
    build:
      context: ./sshd
    volumes:
      - ./data/ssh_host_keys:/etc/ssh:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - "22:22"

  nginx:
    container_name: nginx
    image: nginxproxy/nginx-proxy
    restart: always
    ports:
      - "80:80"
      - "443:443"
    environment:
      - DOCKER_HOST=unix:///tmp/${DOCKER_PSLR}/docker.sock
      - DEFAULT_HOST=${DOJO_HOST}
      - LOG_JSON=true
    volumes:
      - conf:/etc/nginx/conf.d
      - html:/usr/share/nginx/html
      - dhparam:/etc/nginx/dhparam
      - certs:/etc/nginx/certs:ro
      - ./nginx-proxy/etc/nginx/vhost.d:/etc/nginx/vhost.d
      - ./nginx-proxy/etc/passwd:/etc/passwd:ro
      - ./data/homes:/var/homes:shared
      - /var/run/docker.sock:/tmp/${DOCKER_PSLR}/docker.sock:ro
    networks:
      default:
      user_network:
        aliases:
          - nginx
        ipv4_address: 10.114.0.3

  nginx-certs:
    container_name: nginx_certs
    image: nginxproxy/acme-companion
    restart: always
    volumes_from:
      - nginx
    volumes:
      - certs:/etc/nginx/certs:rw
      - acme:/etc/acme.sh
      - /var/run/docker.sock:/var/run/docker.sock:ro

  open-webui:
    container_name: open-webui
    image: cees3/sensai:v2.37
    environment:
      - OLLAMA_BASE_URLS=http://222.20.126.129:11434
    volumes:
      - open-webui:/app/backend/data
    networks:
      user_network:
        aliases:
          - sensai
        ipv4_address: 10.114.0.2
    restart: always
    depends_on:
      - nginx


volumes:
  conf:
  html:
  dhparam:
  certs:
  acme:
  open-webui:
  
networks:
  user_network:
    name: user_network
    driver: bridge
    ipam:
      config:
        - subnet: 10.114.0.0/16
    driver_opts:
      com.docker.network.bridge.name: "user_network"
      com.docker.network.bridge.enable_icc: "false"