Add Docker Compose deployment guide and configuration files (#36507)

- Add comprehensive Docker Compose deployment guide article - Add docker-compose.yml with Fleet, MySQL, and Redis services - Add env.example template with configuration options - Include TLS setup options for both reverse proxy and direct TLS - Add troubleshooting and production considerations Resolves #33774
2025-12-04 12:11:59 -05:00
parent 30a1dcb302
commit 58e254f1e4
3 changed files with 496 additions and 0 deletions
@@ -0,0 +1,115 @@
+volumes:
+  mysql:
+  redis:
+  data:
+  logs:
+  vulndb:
+
+services:
+  mysql:
+    image: mysql
+    platform: linux/x86_64
+    environment:
+      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
+      - MYSQL_DATABASE=${MYSQL_DATABASE}
+      - MYSQL_USER=${MYSQL_USER}
+      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
+    volumes:
+      - mysql:/var/lib/mysql
+    cap_add:
+      - SYS_NICE
+    healthcheck:
+      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -u$$MYSQL_USER -p$$MYSQL_PASSWORD --silent || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+    ports:
+      - "3306:3306"
+    restart: unless-stopped
+
+  redis:
+    image: redis
+    command: ["redis-server", "--appendonly", "yes"]
+    volumes:
+      - redis:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+    ports:
+      - "6379:6379"
+    restart: unless-stopped
+
+  fleet-init:
+    image: alpine:latest
+    volumes:
+      - logs:/logs
+      - data:/data
+      - vulndb:/vulndb
+    command: sh -c "chown -R 100:101 /logs /data /vulndb"
+
+  fleet:
+    image: fleetdm/fleet
+    platform: linux/x86_64
+    depends_on:
+      mysql:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      fleet-init:
+        condition: service_completed_successfully
+    command: sh -c "/usr/bin/fleet prepare db --no-prompt && /usr/bin/fleet serve"
+    environment:
+      # In-cluster service addresses (no hostnames/ports on the host)
+      - FLEET_REDIS_ADDRESS=redis:6379
+      - FLEET_MYSQL_ADDRESS=mysql:3306
+      - FLEET_MYSQL_DATABASE=${MYSQL_DATABASE}
+      - FLEET_MYSQL_USERNAME=${MYSQL_USER}
+      - FLEET_MYSQL_PASSWORD=${MYSQL_PASSWORD}
+      # Fleet HTTP listener
+      - FLEET_SERVER_ADDRESS=${FLEET_SERVER_ADDRESS}:${FLEET_SERVER_PORT}
+      - FLEET_SERVER_TLS=${FLEET_SERVER_TLS}
+      # TLS Certificate paths (only needed if FLEET_SERVER_TLS=true)
+      - FLEET_SERVER_CERT=${FLEET_SERVER_CERT}
+      - FLEET_SERVER_KEY=${FLEET_SERVER_KEY}
+      # Secrets
+      - FLEET_SERVER_PRIVATE_KEY=${FLEET_SERVER_PRIVATE_KEY}     # Run 'openssl rand -base64 32' to generate
+      - FLEET_LICENSE_KEY=${FLEET_LICENSE_KEY}
+      # System tuning & other options
+      - FLEET_SESSION_DURATION=${FLEET_SESSION_DURATION}
+      - FLEET_LOGGING_JSON=${FLEET_LOGGING_JSON}
+      - FLEET_OSQUERY_STATUS_LOG_PLUGIN=${FLEET_OSQUERY_STATUS_LOG_PLUGIN}
+      - FLEET_FILESYSTEM_STATUS_LOG_FILE=${FLEET_FILESYSTEM_STATUS_LOG_FILE}
+      - FLEET_FILESYSTEM_RESULT_LOG_FILE=${FLEET_FILESYSTEM_RESULT_LOG_FILE}
+      - FLEET_OSQUERY_LABEL_UPDATE_INTERVAL=${FLEET_OSQUERY_LABEL_UPDATE_INTERVAL}
+      - FLEET_VULNERABILITIES_CURRENT_INSTANCE_CHECKS=${FLEET_VULNERABILITIES_CURRENT_INSTANCE_CHECKS}
+      - FLEET_VULNERABILITIES_DATABASES_PATH=${FLEET_VULNERABILITIES_DATABASES_PATH}
+      - FLEET_VULNERABILITIES_PERIODICITY=${FLEET_VULNERABILITIES_PERIODICITY}
+      # Optional S3 info
+      - FLEET_S3_SOFTWARE_INSTALLERS_BUCKET=${FLEET_S3_SOFTWARE_INSTALLERS_BUCKET}
+      - FLEET_S3_SOFTWARE_INSTALLERS_ACCESS_KEY_ID=${FLEET_S3_SOFTWARE_INSTALLERS_ACCESS_KEY_ID}
+      - FLEET_S3_SOFTWARE_INSTALLERS_SECRET_ACCESS_KEY=${FLEET_S3_SOFTWARE_INSTALLERS_SECRET_ACCESS_KEY}
+      - FLEET_S3_SOFTWARE_INSTALLERS_FORCE_S3_PATH_STYLE=${FLEET_S3_SOFTWARE_INSTALLERS_FORCE_S3_PATH_STYLE}
+      # Override FLEET_S3_SOFTWARE_INSTALLERS_ENDPOINT_URL when using a different S3 compatible 
+      # object storage backend (such as Minio) or running S3 locally with localstack.
+      # Leave this blank to use the default S3 service endpoint.
+      - FLEET_S3_SOFTWARE_INSTALLERS_ENDPOINT_URL=${FLEET_S3_SOFTWARE_INSTALLERS_ENDPOINT_URL}
+      # Minio users must set FLEET_S3_SOFTWARE_INSTALLERS_REGION to any nonempty value (eg. minio),
+      # as Minio does not support region discovery.
+      - FLEET_S3_SOFTWARE_INSTALLERS_REGION=${FLEET_S3_SOFTWARE_INSTALLERS_REGION}
+    ports:
+      - "${FLEET_SERVER_PORT}:${FLEET_SERVER_PORT}"   # UI/API
+      - "8220:8220"   # osquery enroll/TLS endpoint
+    volumes:
+      - data:/fleet
+      - logs:/logs
+      - vulndb:${FLEET_VULNERABILITIES_DATABASES_PATH}
+      - ./certs/fleet.crt:/fleet/fleet.crt:ro
+      - ./certs/fleet.key:/fleet/fleet.key:ro
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:${FLEET_SERVER_PORT}/healthz"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+    restart: unless-stopped
@@ -0,0 +1,48 @@
+# MySQL Configuration
+MYSQL_ROOT_PASSWORD=change_this_root_password
+MYSQL_DATABASE=fleet
+MYSQL_USER=fleet
+MYSQL_PASSWORD=change_this_fleet_password
+
+# Fleet Server Configuration
+# Generate a random key with: openssl rand -base64 32
+FLEET_SERVER_PRIVATE_KEY=change_this_private_key
+
+# Fleet HTTP Listener Configuration
+FLEET_SERVER_ADDRESS=0.0.0.0
+FLEET_SERVER_PORT=1337
+
+# TLS Configuration
+# Set to 'true' if Fleet handles TLS directly (requires certificates in ./certs/)
+# Set to 'false' if using a reverse proxy or load balancer for TLS termination
+FLEET_SERVER_TLS=true
+
+# TLS Certificate paths (only needed if FLEET_SERVER_TLS=true)
+FLEET_SERVER_CERT=/fleet/fleet.crt
+FLEET_SERVER_KEY=/fleet/fleet.key
+
+# Fleet License (optional - leave empty for free tier)
+FLEET_LICENSE_KEY=
+
+# Fleet Session & Logging
+FLEET_SESSION_DURATION=24h
+FLEET_LOGGING_JSON=true
+
+# Fleet Osquery Configuration
+FLEET_OSQUERY_STATUS_LOG_PLUGIN=filesystem
+FLEET_FILESYSTEM_STATUS_LOG_FILE=/logs/osqueryd.status.log
+FLEET_FILESYSTEM_RESULT_LOG_FILE=/logs/osqueryd.results.log
+FLEET_OSQUERY_LABEL_UPDATE_INTERVAL=1h
+
+# Fleet Vulnerabilities
+FLEET_VULNERABILITIES_CURRENT_INSTANCE_CHECKS=yes
+FLEET_VULNERABILITIES_DATABASES_PATH=/vulndb
+FLEET_VULNERABILITIES_PERIODICITY=1h
+
+# S3 Configuration (optional - leave empty if not using S3)
+FLEET_S3_SOFTWARE_INSTALLERS_BUCKET=
+FLEET_S3_SOFTWARE_INSTALLERS_ACCESS_KEY_ID=
+FLEET_S3_SOFTWARE_INSTALLERS_SECRET_ACCESS_KEY=
+FLEET_S3_SOFTWARE_INSTALLERS_FORCE_S3_PATH_STYLE=
+FLEET_S3_SOFTWARE_INSTALLERS_ENDPOINT_URL=
+FLEET_S3_SOFTWARE_INSTALLERS_REGION=