# ============================================================
# VULNERABLE Docker Compose — CTF Challenge Resource
# ============================================================
# This configuration contains INTENTIONAL security weaknesses
# for educational / CTF use only. DO NOT deploy in production.
# ============================================================

version: "3.8"

services:

  # ----------------------------------------------------------
  # Web application
  # ----------------------------------------------------------
  webapp:
    image: ctf-target/webapp:latest
    # FINDING: Running in privileged mode — full host kernel access
    privileged: true
    # FINDING: Using host network — bypasses Docker network isolation
    network_mode: host
    # FINDING: Running as root (no user directive)
    environment:
      # FINDING: Passwords in environment variables (visible in docker inspect)
      - DB_HOST=db
      - DB_USER=admin
      - DB_PASSWORD=SuperSecret123!
      - DB_NAME=production
      - REDIS_URL=redis://redis:6379
      - SECRET_KEY=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
      - JWT_SECRET=my-jwt-secret-never-change-this
      - AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
      - AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
      - ADMIN_EMAIL=admin@ctf-target.com
      - ADMIN_PASSWORD=admin123
      - DEBUG=true
    volumes:
      # FINDING: Docker socket mounted — allows container escape
      - /var/run/docker.sock:/var/run/docker.sock
      # FINDING: Sensitive host paths mounted
      - /etc:/host-etc:ro
      - /root/.ssh:/root/.ssh:ro
      - ./app:/app
    ports:
      - "0.0.0.0:80:80"
      - "0.0.0.0:443:443"
      # FINDING: Debug port exposed to all interfaces
      - "0.0.0.0:5678:5678"
      # FINDING: Node inspector exposed
      - "0.0.0.0:9229:9229"
    # FINDING: No resource limits (CPU, memory)
    # Missing: deploy.resources.limits
    # FINDING: No health check defined
    # Missing: healthcheck
    # FINDING: No read-only root filesystem
    # Missing: read_only: true
    restart: always
    # FINDING: No security_opt — default seccomp/apparmor may be disabled
    # FINDING: Adding all Linux capabilities
    cap_add:
      - ALL

  # ----------------------------------------------------------
  # Database
  # ----------------------------------------------------------
  db:
    image: mysql:5.7
    # FINDING: Running as root (default for mysql image, but should override)
    environment:
      # FINDING: Weak root password in environment variable
      - MYSQL_ROOT_PASSWORD=root
      - MYSQL_DATABASE=production
      - MYSQL_USER=admin
      - MYSQL_PASSWORD=SuperSecret123!
    ports:
      # FINDING: Database port exposed to all interfaces (should be internal only)
      - "0.0.0.0:3306:3306"
    volumes:
      - db-data:/var/lib/mysql
      # FINDING: Custom config could weaken security defaults
      - ./mysql-conf:/etc/mysql/conf.d
    # FINDING: No resource limits
    # FINDING: No health check
    # FINDING: No read-only root filesystem

  # ----------------------------------------------------------
  # Redis cache
  # ----------------------------------------------------------
  redis:
    image: redis:6-alpine
    # FINDING: No password set (requirepass not configured)
    command: redis-server --appendonly yes
    ports:
      # FINDING: Redis exposed to all interfaces without authentication
      - "0.0.0.0:6379:6379"
    # FINDING: No resource limits
    # FINDING: No health check
    # FINDING: Running as root

  # ----------------------------------------------------------
  # Elasticsearch
  # ----------------------------------------------------------
  elasticsearch:
    image: elasticsearch:7.17.0
    environment:
      - discovery.type=single-node
      # FINDING: Security explicitly disabled
      - xpack.security.enabled=false
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ports:
      # FINDING: Elasticsearch exposed without authentication
      - "0.0.0.0:9200:9200"
      - "0.0.0.0:9300:9300"
    # FINDING: No resource limits
    # FINDING: No health check

  # ----------------------------------------------------------
  # MongoDB
  # ----------------------------------------------------------
  mongodb:
    image: mongo:5.0
    # FINDING: No authentication enabled (--auth flag missing)
    ports:
      # FINDING: MongoDB exposed to all interfaces without auth
      - "0.0.0.0:27017:27017"
    volumes:
      - mongo-data:/data/db
    # FINDING: No resource limits
    # FINDING: No health check
    # FINDING: Running as root

  # ----------------------------------------------------------
  # Debug / admin tools (should not be in production)
  # ----------------------------------------------------------
  adminer:
    image: adminer:latest
    ports:
      # FINDING: Database admin tool exposed publicly
      - "0.0.0.0:8080:8080"
    # FINDING: No resource limits
    # FINDING: Running as root

  redis-commander:
    image: rediscommander/redis-commander:latest
    environment:
      - REDIS_HOSTS=local:redis:6379
    ports:
      # FINDING: Redis management UI exposed publicly
      - "0.0.0.0:8081:8081"

  # ----------------------------------------------------------
  # Portainer — container management
  # ----------------------------------------------------------
  portainer:
    image: portainer/portainer-ce:latest
    volumes:
      # FINDING: Docker socket mounted (full container management access)
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer-data:/data
    ports:
      # FINDING: Container management UI exposed publicly
      - "0.0.0.0:9000:9000"

volumes:
  db-data:
  mongo-data:
  portainer-data:

# FINDING: No custom network defined — all services on default bridge
# Missing: networks with proper segmentation (frontend, backend, data tier)