docker-compose.yml

---
version: "3.2"

secrets:
  postgres_password:
    file: ./src/secrets/postgres-password
  postgres_username:
    file: ./src/secrets/postgres-username
  private_ssh_key:
    file: ./src/secrets/private-ssh-key
  rdp_password:
    file: ./src/secrets/rdp-password
  rdp_username:
    file: ./src/secrets/rdp-username
  vnc_password:
    file: ./src/secrets/vnc-password
  vnc_username:
    file: ./src/secrets/vnc-username
  windows_sftp_base:
    file: ./src/secrets/windows-sftp-base

volumes:
  dbdata:

services:
  init-guac-db:
    command:
      - /bin/sh
      - -c
      - |
        test -e /init/initdb.sql &&
        echo 'init file already exists' ||
        /opt/guacamole/bin/initdb.sh --postgres > /init/00_initdb.sql
    image: guacamole/guacamole:1.5.1
    logging:
      driver: json-file
      options:
        max-size: 100m
    volumes:
      - source: ./dbinit
        target: /init
        type: bind

  guacd:
    container_name: guacd
    image: guacamole/guacd:1.5.1
    logging:
      driver: json-file
      options:
        max-size: 100m
    restart: always

  postgres:
    container_name: postgres
    depends_on:
      - init-guac-db
    environment:
      POSTGRES_DB: guacamole_db
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres-password
      POSTGRES_USER_FILE: /run/secrets/postgres-username
    image: postgres:15
    logging:
      driver: json-file
      options:
        max-size: 100m
    restart: always
    secrets:
      - source: postgres_password
        target: postgres-password
      - source: postgres_username
        target: postgres-username
    volumes:
      - read_only: true
        source: ./dbinit
        target: /docker-entrypoint-initdb.d
        type: bind
      - source: dbdata
        target: /var/lib/postgresql/data
        type: volume

  guacamole:
    cap_add:
      # Required to allow listening on privileged port 80
      - NET_BIND_SERVICE
    command:
      - /bin/sh
      - -c
      - |
        export POSTGRES_USER=$$(cat /run/secrets/postgres-username);
        export POSTGRES_PASSWORD=$$(cat /run/secrets/postgres-password);
        /opt/guacamole/bin/start.sh
    container_name: guacamole
    depends_on:
      - guacd
      - postgres
    environment:
      GUACD_HOSTNAME: guacd
      GUACD_PORT: 4822
      HEADER_ENABLED: "true"
      POSTGRES_DATABASE: guacamole_db
      POSTGRES_HOSTNAME: postgres
      POSTGRES_PORT: 5432
    image: guacamole/guacamole:1.5.1
    logging:
      driver: json-file
      options:
        max-size: 100m
    ports:
      - "127.0.0.1:80:8080/tcp"
    restart: always
    secrets:
      - source: postgres_password
        target: postgres-password
      - source: postgres_username
        target: postgres-username

  guacscanner:
    depends_on:
      - postgres
    image: cisagov/guacscanner:1.1.15
    logging:
      driver: json-file
      options:
        max-size: 100m
    restart: always
    secrets:
      - source: postgres_password
        target: postgres-password
      - source: postgres_username
        target: postgres-username
      - source: private_ssh_key
        target: private-ssh-key
      - source: rdp_password
        target: rdp-password
      - source: rdp_username
        target: rdp-username
      - source: vnc_password
        target: vnc-password
      - source: vnc_username
        target: vnc-username
      - source: windows_sftp_base
        target: windows-sftp-base