docker-compose.yml

services:

  # ============================================================
  # Landing Page — always starts, no profile required
  # http://localhost:8080
  # ============================================================
  homer:
    image: b4bz/homer:latest
    container_name: homer
    ports:
      - "8080:8080"
    volumes:
      - ./homer/assets:/www/assets
    networks:
      - hackinglab
    restart: unless-stopped

  # ============================================================
  # Attacker Tools  —  docker compose --profile tools up -d
  # ============================================================
  kali:
    build: ./kali
    container_name: kali
    privileged: true
    tty: true
    networks:
      - hackinglab
    volumes:
      - ./kali:/root
    command: /bin/bash
    profiles: ["tools", "full"]

  metasploit:
    build: ./metasploit
    container_name: metasploit
    volumes:
      - ./metasploit:/home/msf/.msf4
    networks:
      - hackinglab
    profiles: ["tools", "full"]

  nmap:
    build: ./nmap
    container_name: nmap
    networks:
      - hackinglab
    profiles: ["tools", "full"]

  wireshark:
    build: ./wireshark
    container_name: wireshark
    environment:
      - DISPLAY=${DISPLAY}
    volumes:
      - /tmp/.X11-unix:/tmp/.X11-unix
      - ./wireshark:/root
    networks:
      - hackinglab
    profiles: ["tools", "full"]

  burpsuite:
    image: retenet/burpsuite
    container_name: burpsuite
    environment:
      - DISPLAY=${DISPLAY}
    volumes:
      - /tmp/.X11-unix:/tmp/.X11-unix
    networks:
      - hackinglab
    profiles: ["tools", "full"]

  # ============================================================
  # Security Scanners  —  docker compose --profile scanners up -d
  # ============================================================
  zap:
    build:
      context: ./zap
      args:
        ZAP_VERSION: 2.15.0
    container_name: zap
    ports:
      - "2582:8080"
    networks:
      - hackinglab
    profiles: ["scanners", "full"]

  openvas:
    image: grafana/openvas
    container_name: openvas
    ports:
      - "9392:9392"
    networks:
      - hackinglab
    profiles: ["scanners", "full"]

  # ============================================================
  # Vulnerable Web Applications  —  docker compose --profile web-apps up -d
  # ============================================================
  dvwa:
    build: ./dvwa
    container_name: dvwa
    ports:
      - "2580:80"
    volumes:
      - ./dvwa:/var/www/html
    networks:
      - hackinglab
    profiles: ["web-apps", "full"]

  webgoat:
    build: ./webgoat
    container_name: webgoat
    ports:
      - "2581:8080"
    networks:
      - hackinglab
    profiles: ["web-apps", "full"]

  bwapp:
    image: raesene/bwapp:latest
    platform: linux/amd64
    container_name: bwapp
    ports:
      - "2583:80"
    environment:
      - UPLOAD_ENABLED=1
      - MYSQL_DATABASE=bWAPP
      - MYSQL_USER=bWAPP
      - MYSQL_PASSWORD=bWAPP
      - MYSQL_ROOT_PASSWORD=root
    networks:
      - hackinglab
    profiles: ["web-apps", "full"]

  juice-shop:
    image: bkimminich/juice-shop:latest
    container_name: juice-shop
    ports:
      - "3000:3000"
    networks:
      - hackinglab
    profiles: ["web-apps", "full"]

  mutillidae:
    image: citizenstig/nowasp:latest
    container_name: mutillidae
    ports:
      - "2584:80"
    networks:
      - hackinglab
    profiles: ["web-apps", "full"]

  # Replaces Security Shepherd (abandoned). Covers secrets mismanagement across
  # env vars, config files, cloud metadata, and more.
  wrongsecrets:
    image: jeroenwillemsen/wrongsecrets:latest
    container_name: wrongsecrets
    ports:
      - "2585:8080"
    environment:
      - SPRING_PROFILES_ACTIVE=without-docker
    networks:
      - hackinglab
    profiles: ["web-apps", "full"]

  dvna:
    image: appsecco/dvna
    container_name: dvna
    ports:
      - "2586:9090"
    networks:
      - hackinglab
    profiles: ["web-apps", "full"]

  wordpress:
    image: wordpress:6.0
    container_name: wordpress
    ports:
      - "2587:80"
    environment:
      WORDPRESS_DB_HOST: db
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
      WORDPRESS_DB_NAME: wordpress
    volumes:
      - wordpress_data:/var/www/html
    networks:
      - hackinglab
    depends_on:
      - db
    profiles: ["web-apps", "full"]

  db:
    image: mysql:8.0
    container_name: wordpressdb
    environment:
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: wordpress
      MYSQL_ROOT_PASSWORD: root
    volumes:
      - db_data:/var/lib/mysql
    networks:
      - hackinglab
    profiles: ["web-apps", "full"]

  nodegoat:
    image: contrastsecuritydemo/nodegoat:1.3.0
    container_name: nodegoat
    ports:
      - "4000:4000"
    networks:
      - hackinglab
    profiles: ["web-apps", "full"]

  # ============================================================
  # Vulnerable APIs  —  docker compose --profile api up -d
  # ============================================================
  vulnerable_api:
    build: ./vulnerable_api
    container_name: vulnerable_api
    ports:
      - "2500:5000"
    networks:
      - hackinglab
    profiles: ["api", "full"]

  vampi:
    image: erev0s/vampi:latest
    container_name: vampi
    ports:
      - "6000:5000"
    networks:
      - hackinglab
    profiles: ["api", "full"]

  # crAPI — OWASP Completely Ridiculous API. Covers OWASP API Security Top 10.
  # Docs: https://github.com/OWASP/crAPI
  # User-facing app: http://localhost:2590
  # Email (registration/reset): http://localhost:2592
  crapi-web:
    image: crapi/crapi-web:latest
    container_name: crapi-web
    ports:
      - "2590:80"
    depends_on:
      - crapi-identity
      - crapi-community
      - crapi-workshop
    networks:
      - hackinglab
    profiles: ["api", "full"]

  crapi-identity:
    image: crapi/crapi-identity:latest
    container_name: crapi-identity
    environment:
      DB_NAME: crapi
      DB_USERNAME: admin
      DB_PASSWORD: crapipassword
      DB_HOST: crapidb
      DB_PORT: 5432
      MAILHOG_HOST: mailhog
      MAILHOG_PORT: 1025
      SERVER_PORT: 8080
      JWT_SECRET: crapi-lab-secret
    depends_on:
      - crapidb
      - mailhog
    networks:
      - hackinglab
    profiles: ["api", "full"]

  crapi-community:
    image: crapi/crapi-community:latest
    container_name: crapi-community
    environment:
      MONGO_DB_HOST: crapi-mongodb
      MONGO_DB_PORT: 27017
      MONGO_DB_NAME: crapi
      SERVER_PORT: 8087
      IDENTITY_SERVICE: http://crapi-identity:8080
    depends_on:
      - crapi-mongodb
      - crapi-identity
    networks:
      - hackinglab
    profiles: ["api", "full"]

  crapi-workshop:
    image: crapi/crapi-workshop:latest
    container_name: crapi-workshop
    environment:
      DB_NAME: crapi_workshop
      DB_USER: admin
      DB_PASSWORD: crapipassword
      DB_HOST: crapidb
      DB_PORT: 5432
      MAILHOG_HOST: mailhog
      MAILHOG_PORT: 1025
      SERVER_PORT: 8000
      IDENTITY_SERVICE: http://crapi-identity:8080
    depends_on:
      - crapidb
      - mailhog
      - crapi-identity
    networks:
      - hackinglab
    profiles: ["api", "full"]

  crapidb:
    image: postgres:14
    container_name: crapidb
    environment:
      POSTGRES_USER: admin
      POSTGRES_PASSWORD: crapipassword
      POSTGRES_DB: crapi
    volumes:
      - crapi_db_data:/var/lib/postgresql/data
    networks:
      - hackinglab
    profiles: ["api", "full"]

  crapi-mongodb:
    image: mongo:4.4
    container_name: crapi-mongodb
    volumes:
      - crapi_mongo_data:/data/db
    networks:
      - hackinglab
    profiles: ["api", "full"]

  mailhog:
    image: mailhog/mailhog:latest
    container_name: mailhog
    ports:
      - "2592:8025"
    networks:
      - hackinglab
    profiles: ["api", "full"]

networks:
  hackinglab:
    driver: bridge

volumes:
  db_data:
  wordpress_data:
  crapi_db_data:
  crapi_mongo_data: