docker-compose.yml

services:
  # GitLab CE Instance
  gitlab:
    image: gitlab/gitlab-ce:latest
    container_name: gitlab-attack-lab
    hostname: gitlab
    restart: unless-stopped
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'http://gitlab'
        gitlab_rails['initial_root_password'] = ENV['GITLAB_ROOT_PASSWORD']
        gitlab_rails['smtp_enable'] = true
        gitlab_rails['smtp_address'] = "mailhog"
        gitlab_rails['smtp_port'] = 1025
        gitlab_rails['smtp_domain'] = "gitlab.local"
        gitlab_rails['smtp_authentication'] = "none"
        gitlab_rails['time_zone'] = 'UTC'
        gitlab_rails['allow_local_requests_from_web_hooks_and_services'] = true
        gitlab_rails['enable_user_signup'] = true
        nginx['listen_port'] = 80
        nginx['listen_https'] = false
        puma['worker_processes'] = 1
        puma['worker_memory'] = 128
        postgresql['max_connections'] = 100
        postgresql['shared_buffers'] = '128MB'
        redis['maxmemory'] = '128mb'
        gitaly['ruby_num_workers'] = 1
        prometheus_monitoring['enable'] = false
        sidekiq['max_concurrency'] = 5
        sidekiq['concurrency'] = 5
        gitlab_rails['pipeline_schedule_worker_cron'] = '*/5 * * * *'
        gitlab_ci['gitlab_ci_all_broken_builds'] = true
        gitlab_ci['gitlab_ci_add_pusher'] = true
    ports:
      - "${GITLAB_HTTP_PORT:-7700}:80"
      - "${GITLAB_HTTPS_PORT:-7701}:443"
      - "${GITLAB_SSH_PORT:-7702}:22"
    volumes:
      - gitlab_config:/etc/gitlab
      - gitlab_logs:/var/log/gitlab
      - gitlab_data:/var/opt/gitlab
    shm_size: '512m'
    networks:
      - lab-network
    healthcheck:
      test: ["CMD", "sh", "-c", "curl -sf http://localhost/-/health || curl -sf http://localhost/users/sign_in || true"]
      interval: 30s
      timeout: 15s
      retries: 10
      start_period: 300s
    depends_on:
      - mailhog

  # GitLab Runner - Shared (Docker executor)
  gitlab-runner-docker:
    image: gitlab/gitlab-runner:latest
    container_name: gitlab-runner-docker
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - gitlab_runner_docker_config:/etc/gitlab-runner
      - gitlab_runner_docker_builds:/builds
      - gitlab_runner_docker_cache:/cache
    networks:
      - lab-network
    environment:
      RUNNER_TOKEN_DOCKER: "${RUNNER_TOKEN_DOCKER}"
      GITLAB_URL: "${GITLAB_URL:-http://gitlab/}"
      CI_SERVER_URL: "${GITLAB_URL:-http://gitlab/}"
    depends_on:
      gitlab:
        condition: service_healthy
    entrypoint: /bin/bash
    command:
      - -c
      - |
        # Create initial config with proper concurrent setting
        mkdir -p /etc/gitlab-runner
        
        # Wait for runner token to be available
        while [ -z "$RUNNER_TOKEN_DOCKER" ]; do
          echo "Waiting for runner token to be set..."
          sleep 5
        done
        
        # Register runner using modern authentication token method
        # Note: --tag-list cannot be used with token-based auth in GitLab 19.1+
        # Tags will be set via API after registration
        gitlab-runner register \
          --non-interactive \
          --url "$GITLAB_URL" \
          --token "$RUNNER_TOKEN_DOCKER" \
          --executor docker \
          --clone-url "$GITLAB_URL" \
          --docker-image ubuntu:jammy \
          --docker-pull-policy if-not-present \
          --docker-volumes /var/run/docker.sock:/var/run/docker.sock \
          --docker-network-mode lab-network \
          --docker-privileged=false \
          --builds-dir /builds \
          --cache-dir /cache \
          --limit 5 || echo "Runner already registered"
        
        # Ensure concurrent setting is set to 4 for parallel job execution
        # This allows multiple jobs to run concurrently instead of queueing
        sed -i 's/^concurrent = .*/concurrent = 4/' /etc/gitlab-runner/config.toml || \
          sed -i '1i concurrent = 4' /etc/gitlab-runner/config.toml
        
        # Start runner
        exec gitlab-runner run

  # GitLab Runner - Shell executor (Privileged)
  gitlab-runner-shell:
    image: gitlab/gitlab-runner:latest
    container_name: gitlab-runner-shell
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - gitlab_runner_shell_config:/etc/gitlab-runner
      - gitlab_runner_shell_builds:/builds
      - gitlab_runner_shell_cache:/cache
    networks:
      - lab-network
    environment:
      RUNNER_TOKEN_SHELL: "${RUNNER_TOKEN_SHELL}"
      GITLAB_URL: "${GITLAB_URL:-http://gitlab/}"
      CI_SERVER_URL: "${GITLAB_URL:-http://gitlab/}"
    depends_on:
      gitlab:
        condition: service_healthy
    entrypoint: /bin/bash
    command:
      - -c
      - |
        # Create initial config with proper concurrent setting
        mkdir -p /etc/gitlab-runner
        
        # Wait for runner token to be available
        while [ -z "$RUNNER_TOKEN_SHELL" ]; do
          echo "Waiting for runner token to be set..."
          sleep 5
        done
        
        # Register runner using modern authentication token method
        # Note: --tag-list cannot be used with token-based auth in GitLab 19.1+
        # Tags will be set via API after registration
        gitlab-runner register \
          --non-interactive \
          --url "$GITLAB_URL" \
          --token "$RUNNER_TOKEN_SHELL" \
          --executor shell \
          --builds-dir /builds \
          --cache-dir /cache \
          --limit 5 || echo "Runner already registered"
        
        # Ensure concurrent setting is set to 4 for parallel job execution
        # This allows multiple jobs to run concurrently instead of queueing
        sed -i 's/^concurrent = .*/concurrent = 4/' /etc/gitlab-runner/config.toml || \
          sed -i '1i concurrent = 4' /etc/gitlab-runner/config.toml
        
        # Start runner
        exec gitlab-runner run

  # MailHog for email testing
  mailhog:
    image: mailhog/mailhog:latest
    container_name: mailhog
    restart: unless-stopped
    ports:
      - "7703:1025"
      - "7704:8025"
    networks:
      - lab-network

  # Pentester container with pipeleek pre-installed
  pentester:
    build:
      context: ./pentester
      dockerfile: Dockerfile
    container_name: pentester
    hostname: pentester
    restart: unless-stopped
    networks:
      - lab-network
    volumes:
      - ./pentester/workspace:/workspace
      - ./pentester/config:/root/.config
    environment:
      GITLAB_URL: "http://gitlab"
      GITLAB_TOKEN: "${PENTESTER_TOKEN:-}"
      PS1: "[pentester@lab] \\w $$ "
    command: /bin/bash -c "while true; do sleep 3600; done"

  # Lightweight Node.js webhook logger for Renovate autodiscovery exfiltration
  webhook-logger:
    image: node:20-alpine
    container_name: webhook-logger
    restart: unless-stopped
    working_dir: /app
    command: ["node", "server.js"]
    ports:
      - "7705:8084"
    volumes:
      - ./tools/webhook-logger:/app:ro
      - ./logs/webhook-logger:/logs
    networks:
      - lab-network

  # Lab Web Application
  lab-web:
    build:
      context: ./app
      dockerfile: docker/Dockerfile
    container_name: lab-web-app
    restart: unless-stopped
    ports:
      - "7706:8000"
    environment:
      APP_NAME: "GitLab Attack Lab"
      APP_ENV: production
      APP_DEBUG: "false"
      APP_KEY: "base64:${APP_KEY:-N0IWvWzAH8yFvCfq+5MZXu9kRVKmPkSLuX7ywPMiXLQ=}"
      SESSION_DRIVER: cookie
      SCENARIOS_PATH: /app/scenarios
    networks:
      - lab-network
    volumes:
      - ./lab-config/scenarios:/app/scenarios:ro
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    develop:
      watch:
        # Sync PHP sources instantly (no restart needed with built-in server)
        - action: sync
          path: ./app/app
          target: /app/app
        - action: sync
          path: ./app/config
          target: /app/config
        - action: sync
          path: ./app/routes
          target: /app/routes
        - action: sync
          path: ./app/resources/views
          target: /app/resources/views
        # Rebuild image when asset sources or dependencies change
        - action: rebuild
          path: ./app/resources/css
        - action: rebuild
          path: ./app/resources/js
        - action: rebuild
          path: ./app/composer.json
        - action: rebuild
          path: ./app/composer.lock
        - action: rebuild
          path: ./app/package.json
        - action: rebuild
          path: ./app/docker/Dockerfile

networks:
  lab-network:
    name: lab-network
    driver: bridge

volumes:
  gitlab_config:
  gitlab_logs:
  gitlab_data:
  gitlab_runner_docker_config:
  gitlab_runner_docker_builds:
  gitlab_runner_docker_cache:
  gitlab_runner_shell_config:
  gitlab_runner_shell_builds:
  gitlab_runner_shell_cache: