services:
  mongodb:
    image: mongo:7.0.37
    container_name: graylog-mongodb
    restart: unless-stopped
    mem_limit: 1g
    volumes:
      - mongo_data:/data/db
    networks:
      - graylog-net

  opensearch:
    image: opensearchproject/opensearch:2.15.0
    container_name: graylog-opensearch
    restart: unless-stopped
    mem_limit: 3g
    environment:
      - cluster.name=graylog-cluster
      - node.name=opensearch-node1
      - discovery.type=single-node
      - "OPENSEARCH_JAVA_OPTS=-Xms2g -Xmx2g"
      - plugins.security.disabled=true
      - plugins.security.ssl.http.enabled=false
      - DISABLE_INSTALL_DEMO_CONFIG=true
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - os_data:/usr/share/opensearch/data
    networks:
      - graylog-net

  graylog:
    image: graylog/graylog:7.1.5-1
    container_name: graylog-server
    restart: unless-stopped
    mem_limit: 3g
    depends_on:
      - mongodb
      - opensearch
    environment:
      - GRAYLOG_PASSWORD_SECRET=${GRAYLOG_PASSWORD_SECRET}
      - GRAYLOG_ROOT_PASSWORD_SHA2=${GRAYLOG_ROOT_PASSWORD_SHA2}
      - GRAYLOG_HTTP_EXTERNAL_URI=${GRAYLOG_HTTP_EXTERNAL_URI}
      - GRAYLOG_MONGODB_URI=mongodb://mongodb:27017/graylog
      - GRAYLOG_ELASTICSEARCH_HOSTS=http://opensearch:9200
      - "GRAYLOG_SERVER_JAVA_OPTS=-Xms1g -Xmx1g -XX:NewRatio=1 -server -XX:+UseG1GC"
    ports:
      - "9000:9000/tcp"
      - "514:514/udp"    # standard syslog port - most network gear can't be pointed anywhere else
      - "1514:1514/udp"  # kept for equipment that *can* use a custom port
      - "5140:5140/udp"
    volumes:
      - graylog_data:/usr/share/graylog/data
    networks:
      - graylog-net

networks:
  graylog-net:
    driver: bridge

volumes:
  mongo_data:
  os_data:
  graylog_data: