BlueHound/docker-compose.yml at main · jonafk555/BlueHound · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
services:

  # ── BlueHound API + Frontend ──────────────────────────────────
  bluehound:
    build:
      context: .
      dockerfile: Dockerfile
    image: bluehound:latest
    container_name: bluehound
    restart: unless-stopped
    ports:
      - "127.0.0.1:8443:8443"
    env_file:
      # Local secrets (never committed). Optional so `docker compose up` works
      # without a .env file present.
      - path: .env
        required: false
    environment:
      BLUEHOUND_ENV: "production"
      BLUEHOUND_API_KEY: "${BLUEHOUND_API_KEY:-}"
      BLUEHOUND_HOST: "0.0.0.0"   # must bind to all interfaces inside Docker
      BLUEHOUND_PORT: "8443"
      # Used only when LLM_BACKEND=ollama and the `llm` profile is started.
      OLLAMA_URL: "http://ollama:11434"
      OLLAMA_MODEL: "${OLLAMA_MODEL:-llama3.2}"
      OLLAMA_EMBED_MODEL: "${OLLAMA_EMBED_MODEL:-nomic-embed-text}"   # FR-4 similarity
      # Durable state for incident triage / analyst feedback / proposed rules
      # (FR-5) — written to the bluehound-state volume mounted at /data.
      BLUEHOUND_STATE_DIR: "/data"
      BLUEHOUND_TRIAGE_DB: "/data/triage_state.json"
      # FR-5 few-shot trust list (analysts whose labels feed the LLM examples).
      BLUEHOUND_TRUSTED_ANALYSTS: "${BLUEHOUND_TRUSTED_ANALYSTS:-}"
      # Comma-separated allowed CORS origins (from behind a reverse proxy, add your domain)
      ALLOWED_ORIGINS: "http://localhost:8443,http://127.0.0.1:8443"
    # No hard dependency on ollama: the analyzer degrades to heuristic when no
    # model is reachable, and ollama is opt-in via the `llm` profile.
    healthcheck:
      test: ["CMD", "python3", "-c",
             "import urllib.request; urllib.request.urlopen('http://localhost:8443/healthz')"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    volumes:
      # Durable triage / feedback / proposed-rules state (survives restarts).
      - bluehound-state:/data
      # Mount playbooks directory so rules can be edited without rebuilding
      - ./playbooks:/app/playbooks:ro
      # Optional: persist sample_data
      - ./backend/sample_data:/app/backend/sample_data:ro
    networks:
      - bluehound-net
    # Security: drop all Linux capabilities, read-only root fs (/data + /tmp stay writable)
    read_only: true
    tmpfs:
      - /tmp                      # tempfile needs writable /tmp
    cap_drop:
      - ALL

  # ── Ollama (local LLM — optional, opt-in) ────────────────────
  # Only starts with: docker compose --profile llm up
  # (plain `docker compose up` runs BlueHound alone with the heuristic fallback).
  ollama:
    image: ollama/ollama:latest
    container_name: bluehound-ollama
    restart: unless-stopped
    profiles: ["llm"]
    ports:
      - "127.0.0.1:11434:11434"   # localhost only; remove if host access is unnecessary
    volumes:
      - ollama-models:/root/.ollama   # persist downloaded models
    networks:
      - bluehound-net
    # Uncomment the following to enable GPU support (NVIDIA):
    # deploy:
    #   resources:
    #     reservations:
    #       devices:
    #         - driver: nvidia
    #           count: 1
    #           capabilities: [gpu]

volumes:
  ollama-models:
  bluehound-state:      # durable triage / feedback / proposed-rules (FR-3/FR-5)

networks:
  bluehound-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/24  # isolated subnet