ai-security-xdr/haobang-security-dm/syslog-serve/docker-compose/docker-compose-serve-prod.yaml

# ============================================
# Syslog Serve 部署配置 (探针端)
# ============================================
# 使用方法: docker-compose -f docker-compose-serve.yaml up -d
# ============================================

version: '3.8'

services:
  # ============================================
  # Syslog Serve - 探针采集服务 (探针端)
  # ============================================
  syslog-serve:
    build:
      context: ./serve-dm
      dockerfile: Dockerfile
    image: syslog-serve-dm:v1.2.1
    container_name: syslog-serve-dm
    restart: unless-stopped
    environment:
      # 环境配置
      - SPRING_PROFILES_ACTIVE=prod
      - SYSLOG_SERVER_ENABLED=true
      # 设备上送日志为 UTF-8；显式声明，Netty 与 WAL 共用 Spring 配置。
      - SYSLOG_CHARSET=UTF-8
      # 128KiB 及以上走大日志 Topic，单条最多接纳 6MiB；WAL/Dispatcher 均按字节背压。
      - SYSLOG_MAX_FRAME_LENGTH=6291456
      - SYSLOG_MESSAGE_MAX_BYTES=6291456
      - SYSLOG_LARGE_MESSAGE_THRESHOLD_BYTES=131072
      - SYSLOG_WAL_MAX_PENDING_BYTES=268435456
      - SYSLOG_DISPATCH_MAX_INFLIGHT_BYTES=268435456
      - TZ=Asia/Shanghai
      # 探针标识ID
      - APP_SERVICE_DEVICE_COLLECT_ID=1
      # 数据库配置
      - SPRING_DATASOURCE_URL=jdbc:dm://192.168.4.99:5237
      - SPRING_DATASOURCE_USERNAME=SYSDBA
      - SPRING_DATASOURCE_PASSWORD=caZ2TcmXNSW8L2Ap
      - SPRING_DATASOURCE_DRIVER_CLASS_NAME=dm.jdbc.driver.DmDriver
      - SPRING_DATASOURCE_HIKARI_SCHEMA=\"PUBLIC\"


      # Redis配置
      - SPRING_REDIS_HOST=192.168.4.99
      - SPRING_REDIS_PORT=6379
      - SPRING_REDIS_PASSWORD=redis_GdGWte
      - SPRING_REDIS_DATABASE=0
      - SPRING_REDIS_TIMEOUT=2000
      - SPRING_CACHE_REDIS_TIME_TO_LIVE=600000
      # Kafka配置
      - SPRING_KAFKA_PRODUCER_BOOTSTRAP_SERVERS=192.168.4.99:9092
      - SPRING_KAFKA_PRODUCER_TOPIC=agent-01-syslog-topic
      - KAFKA_PRODUCER_LARGE_TOPIC=agent-01-syslog-topic.large
      - KAFKA_PRODUCER_MAX_REQUEST_SIZE=33554432
      # 仅兼容仍使用独立原文归档的旧版 JAR；当前 WAL 版本已删除该 Java 实现。
      - SYSLOG_RAW_ARCHIVE_ENABLED=false
      - SYSLOG_RAW_ARCHIVE_DIRECTORY=/data/syslog-archive
      - SYSLOG_RAW_ARCHIVE_QUEUE_CAPACITY=10000
      - SYSLOG_RAW_ARCHIVE_FLUSH_RECORDS=200
      - SYSLOG_RAW_ARCHIVE_FLUSH_INTERVAL_MS=200
      - SYSLOG_RAW_ARCHIVE_SEGMENT_MAX_BYTES=268435456
      # 0 表示不自动删除，交由客户归档系统管理；也可按审批后的天数覆盖。
      - SYSLOG_RAW_ARCHIVE_RETENTION_DAYS=${SYSLOG_RAW_ARCHIVE_RETENTION_DAYS:-0}
      # V2 已启用：新接入事件以 WAL v3 固化 point_time_ns。
      - SYSLOG_POINT_TIME_WRITE_ENABLED=true
    # 防火墙配置
      - FIREWALL_ENABLED=true
      - FIREWALL_API_KEY=your-secure-api-key
      # 联动配置 (syslog-consumer 地址)
      - INTERLOCKING_ENABLED=true
      - INTERLOCKING_API_BASE_URL=http://192.168.4.99:8089/xdrservice/interlocking
      - INTERLOCKING_API_KEY=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
      # 探针心跳配置
      - PROBE_HEARTBEAT_ENABLED=true
      - PROBE_HEARTBEAT_INTERVAL_SECONDS=60
      - PROBE_HEARTBEAT_INITIAL_DELAY_MS=5000
      - PROBE_PLATFORM_API_URL=http://192.168.4.99:8089/xdrservice/interlocking/probe/heartbeat

      # 定时任务配置
      - SPRING_TASK_SCHEDULING_POOL_SIZE=5
      # JVM配置
      - JAVA_OPTS=-Xms2048m -Xmx4096m -XX:+UseG1GC
    ports:
      - "8189:8189"  # API端口
      - "514:514/udp"  # Syslog UDP
      - "514:514/tcp"  # Syslog TCP
    volumes:
      - /home/syslog/logs:/app/logs
      # 原始日志必须放在宿主机持久化盘，不能写入容器临时层。
      - /home/syslog/raw-archive:/data/syslog-archive
    networks:
      - xdr-network
    cap_add:
      - NET_BIND_SERVICE
    privileged: true

# ============================================
# 网络配置
# ============================================
networks:
  xdr-network:
    driver: bridge