services:
  # MongoDB - stores Graylog configuration and metadata
  mongodb:
    image: mongo:6.0
    container_name: ${CONTAINER_NAME}_mongodb
    volumes:
      - mongodb_data:/data/db
    restart: unless-stopped
    networks:
      - graylog-net

  # OpenSearch - stores and indexes log data
  opensearch:
    image: opensearchproject/opensearch:2
    container_name: ${CONTAINER_NAME}_opensearch
    environment:
      - "OPENSEARCH_JAVA_OPTS=${OPENSEARCH_JAVA_OPTS:--Xms1g -Xmx1g}"
      - "bootstrap.memory_lock=true"
      - "discovery.type=single-node"
      - "action.auto_create_index=false"
      - "plugins.security.disabled=true"
      - "DISABLE_INSTALL_DEMO_CONFIG=true"
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - opensearch_data:/usr/share/opensearch/data
    restart: unless-stopped
    networks:
      - graylog-net

  # Graylog - the main log management application
  graylog:
    image: graylog/graylog:6.1
    container_name: ${CONTAINER_NAME}
    environment:
      - GRAYLOG_PASSWORD_SECRET=${GRAYLOG_PASSWORD_SECRET:-somepasswordpepper}
      - GRAYLOG_ROOT_PASSWORD_SHA2=${GRAYLOG_ROOT_PASSWORD_SHA2:-8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918}
      - GRAYLOG_HTTP_EXTERNAL_URI=${GRAYLOG_HTTP_EXTERNAL_URI:-http://localhost:9000/}
      - GRAYLOG_HTTP_BIND_ADDRESS=0.0.0.0:9000
      - GRAYLOG_ELASTICSEARCH_HOSTS=http://opensearch:9200
      - GRAYLOG_MONGODB_URI=mongodb://mongodb:27017/graylog
      - GRAYLOG_TIMEZONE=${GRAYLOG_TIMEZONE:-UTC}
    entrypoint: /usr/bin/tini -- wait-for-it opensearch:9200 -- /docker-entrypoint.sh
    volumes:
      - graylog_data:/usr/share/graylog/data
    restart: unless-stopped
    depends_on:
      - mongodb
      - opensearch
    ports:
      # Graylog web interface and REST API
      - "${WEB_PORT:-9000}:9000"
      # GELF UDP
      - "${GELF_UDP_PORT:-12201}:12201/udp"
      # GELF TCP
      - "${GELF_TCP_PORT:-12202}:12202"
      # Syslog UDP
      - "${SYSLOG_UDP_PORT:-1514}:1514/udp"
      # Syslog TCP
      - "${SYSLOG_TCP_PORT:-1515}:1515"
      # Beats
      - "${BEATS_PORT:-5044}:5044"
    networks:
      - graylog-net

networks:
  graylog-net:
    driver: bridge

volumes:
  mongodb_data:
  opensearch_data:
  graylog_data: