86 lines
2.5 KiB
YAML
86 lines
2.5 KiB
YAML
services:
|
|
splunk:
|
|
image: splunk/splunk:9.4.2
|
|
container_name: splunk
|
|
restart: unless-stopped
|
|
ports:
|
|
- "8000:8000" # Splunk Web
|
|
- "8088:8088" # HEC
|
|
- "8089:8089" # Management API
|
|
environment:
|
|
SPLUNK_START_ARGS: --accept-license
|
|
SPLUNK_PASSWORD: ${SPLUNK_PASSWORD:-Str0ngP@ss!9}
|
|
SPLUNK_HEC_TOKEN: ${SPLUNK_HEC_TOKEN:-dev-0123456789abcdef}
|
|
volumes:
|
|
- splunk-etc:/opt/splunk/etc
|
|
- splunk-var:/opt/splunk/var
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "curl -sk https://localhost:8089/services/server/info | grep -q version"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 30
|
|
|
|
poller:
|
|
build:
|
|
context: .
|
|
dockerfile: poller/Dockerfile
|
|
container_name: splunk-poller
|
|
restart: unless-stopped
|
|
depends_on:
|
|
splunk:
|
|
condition: service_healthy
|
|
environment:
|
|
# Splunk connection (to containerized Splunk)
|
|
SPLUNK_HOST: splunk
|
|
SPLUNK_PORT: "8089"
|
|
SPLUNK_USER: admin
|
|
SPLUNK_PW: ${SPLUNK_PASSWORD:-Str0ngP@ss!9}
|
|
SPLUNK_VERIFY_SSL: "false"
|
|
# What to read
|
|
SPLUNK_INDEX: intesa_payments
|
|
SPLUNK_SOURCETYPE: intesa:bonifico
|
|
INITIAL_LOOKBACK: -24h@h
|
|
# Polling / chunking
|
|
SLEEP_SECONDS: "60"
|
|
MAX_CHUNK_BYTES: "1800000"
|
|
CREATE_INDEX_IF_MISSING: "true"
|
|
# Sink: file (local chunks volume). Switch to blob/blob+sb later.
|
|
SINK: file
|
|
OUTDIR: /app/out
|
|
# Azure creds only if SINK=blob or blob+sb
|
|
AZURE_STORAGE_CONNECTION_STRING: ${AZURE_STORAGE_CONNECTION_STRING:-}
|
|
AZURE_STORAGE_CONTAINER: ${AZURE_STORAGE_CONTAINER:-bank-logs}
|
|
AZURE_SERVICEBUS_CONNECTION_STRING: ${AZURE_SERVICEBUS_CONNECTION_STRING:-}
|
|
AZURE_SERVICEBUS_QUEUE: ${AZURE_SERVICEBUS_QUEUE:-log-chunks}
|
|
AZURE_COMPRESS: "true"
|
|
volumes:
|
|
- chunks:/app/out
|
|
|
|
agent-api:
|
|
build:
|
|
context: .
|
|
dockerfile: api/Dockerfile
|
|
container_name: agent-api
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- poller
|
|
ports:
|
|
- "8080:8080"
|
|
# Load envs (Azure OpenAI & Mailtrap) from your local .env
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
# Let the agent read chunks from the shared volume
|
|
CHUNK_DIR: /app/out
|
|
TOP_K: "12"
|
|
# If you want the API to pull blobs directly, ensure these exist in .env or here:
|
|
# AZURE_STORAGE_CONNECTION_STRING: ...
|
|
# AZURE_STORAGE_CONTAINER: bank-logs
|
|
volumes:
|
|
- chunks:/app/out
|
|
|
|
volumes:
|
|
splunk-etc:
|
|
splunk-var:
|
|
chunks:
|