ai-security-xdr/haobang-security-dm/syslog-serve/docker-compose/docker-compose-serve-prod.yaml

# ============================================
# Syslog Serve 部署配置 (探针端)
# ============================================
# 使用方法: docker-compose -f docker-compose-serve.yaml up -d
# ============================================

version: '3.8'

services:
  # ============================================
  # Syslog Serve - 探针采集服务 (探针端)
  # ============================================
  syslog-serve:
    build:
      context: ./serve-dm
      dockerfile: Dockerfile
    image: syslog-serve-dm:v1.2.1
    container_name: syslog-serve-dm
    restart: unless-stopped
    environment:
      # 环境配置
      - SPRING_PROFILES_ACTIVE=prod
      - SYSLOG_SERVER_ENABLED=true
      # 设备上送日志为 UTF-8；显式声明，Netty 与 WAL 共用 Spring 配置。
      - SYSLOG_CHARSET=UTF-8
      # WAL 与应用日志共用宿主机挂载，但使用独立子目录，便于识别和清理。
      - SYSLOG_WAL_DIRECTORY=/app/logs/syslog-wal
      # 128KiB 及以上走大日志 Topic，单条最多接纳 6MiB；WAL/Dispatcher 均按字节背压。
      - SYSLOG_MAX_FRAME_LENGTH=6291456
      - SYSLOG_MESSAGE_MAX_BYTES=6291456
      - SYSLOG_LARGE_MESSAGE_THRESHOLD_BYTES=131072
      # 200KiB/条容量基线：2GiB 字节预算在 70% 时约 7,300 条 / 1.4GiB 触发 TCP 背压。
      - SYSLOG_WAL_QUEUE_CAPACITY=20000
      - SYSLOG_WAL_MAX_PENDING_BYTES=2147483648
      - SYSLOG_WAL_HIGH_WATERMARK_PERCENT=70
      - SYSLOG_WAL_LOW_WATERMARK_PERCENT=40
      - SYSLOG_WAL_FLUSH_RECORDS=200
      - SYSLOG_WAL_FLUSH_INTERVAL_MS=100
      - SYSLOG_WAL_SEGMENT_MAX_BYTES=2147483648
      - SYSLOG_DISPATCH_WORKER_THREADS=8
      - SYSLOG_DISPATCH_MAX_INFLIGHT=5000
      - SYSLOG_DISPATCH_MAX_INFLIGHT_BYTES=1073741824
      # false：无效设备正文不进 WAL，仅按缓存周期打印 IP；true：写 WAL 和逐条 Terminal 审计。
      - SYSLOG_DISPATCH_TERMINAL_RECORD_ENABLED=false
      - TZ=Asia/Shanghai
      # 探针标识ID
      - APP_SERVICE_DEVICE_COLLECT_ID=1
      # 数据库配置
      - SPRING_DATASOURCE_URL=jdbc:dm://192.168.4.99:5237
      - SPRING_DATASOURCE_USERNAME=SYSDBA
      - SPRING_DATASOURCE_PASSWORD=caZ2TcmXNSW8L2Ap
      - SPRING_DATASOURCE_DRIVER_CLASS_NAME=dm.jdbc.driver.DmDriver
      - SPRING_DATASOURCE_HIKARI_SCHEMA=\"PUBLIC\"


      # Redis配置
      - SPRING_REDIS_HOST=192.168.4.99
      - SPRING_REDIS_PORT=6379
      - SPRING_REDIS_PASSWORD=redis_GdGWte
      - SPRING_REDIS_DATABASE=0
      - SPRING_REDIS_TIMEOUT=2000
      - SPRING_CACHE_REDIS_TIME_TO_LIVE=600000
      # Kafka配置
      - SPRING_KAFKA_PRODUCER_BOOTSTRAP_SERVERS=192.168.4.99:9092
      - SPRING_KAFKA_PRODUCER_TOPIC=agent-01-syslog-topic
      - KAFKA_PRODUCER_LARGE_TOPIC=agent-01-syslog-topic.large
      - KAFKA_PRODUCER_MAX_REQUEST_SIZE=33554432
      - SPRING_KAFKA_PRODUCER_PROPERTIES_BUFFER_MEMORY=536870912
      # 仅兼容仍使用独立原文归档的旧版 JAR；当前 WAL 版本已删除该 Java 实现。
      - SYSLOG_RAW_ARCHIVE_ENABLED=false
      - SYSLOG_RAW_ARCHIVE_DIRECTORY=/data/syslog-archive
      - SYSLOG_RAW_ARCHIVE_QUEUE_CAPACITY=10000
      - SYSLOG_RAW_ARCHIVE_FLUSH_RECORDS=200
      - SYSLOG_RAW_ARCHIVE_FLUSH_INTERVAL_MS=200
      - SYSLOG_RAW_ARCHIVE_SEGMENT_MAX_BYTES=268435456
      # 0 表示不自动删除，交由客户归档系统管理；也可按审批后的天数覆盖。
      - SYSLOG_RAW_ARCHIVE_RETENTION_DAYS=${SYSLOG_RAW_ARCHIVE_RETENTION_DAYS:-0}
      # V2 已启用：新接入事件以 WAL v3 固化 point_time_ns。
      - SYSLOG_POINT_TIME_WRITE_ENABLED=true
    # 防火墙配置
      - FIREWALL_ENABLED=true
      - FIREWALL_API_KEY=your-secure-api-key
      # 联动配置 (syslog-consumer 地址)
      - INTERLOCKING_ENABLED=true
      - INTERLOCKING_API_BASE_URL=http://192.168.4.99:8089/xdrservice/interlocking
      - INTERLOCKING_API_KEY=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
      # 探针心跳配置
      - PROBE_HEARTBEAT_ENABLED=true
      - PROBE_HEARTBEAT_INTERVAL_SECONDS=60
      - PROBE_HEARTBEAT_INITIAL_DELAY_MS=5000
      - PROBE_PLATFORM_API_URL=http://192.168.4.99:8089/xdrservice/interlocking/probe/heartbeat

      # 定时任务配置
      - SPRING_TASK_SCHEDULING_POOL_SIZE=5
      # JAVA_TOOL_OPTIONS 会被 JVM 自动读取；Dockerfile 的启动命令不会展开 JAVA_OPTS。
      - JAVA_TOOL_OPTIONS=-Xms8g -Xmx24g -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:MaxDirectMemorySize=8g -XX:+ExitOnOutOfMemoryError
    ports:
      - "8189:8189"  # API端口
      - "514:514/udp"  # Syslog UDP
      - "514:514/tcp"  # Syslog TCP
    volumes:
      # 宿主机 /home/syslog/logs/syslog-wal 对应容器内 WAL 目录 /app/logs/syslog-wal。
      - /home/syslog/logs:/app/logs
    networks:
      - xdr-network
    cap_add:
      - NET_BIND_SERVICE
    privileged: true

# ============================================
# 网络配置
# ============================================
networks:
  xdr-network:
    driver: bridge