services: # ============================================ # 防火墙路由容器（核心网络控制） # ============================================ firewall: build: ./docker/firewall container_name: lab-firewall hostname: firewall cap_add: - NET_ADMIN sysctls: - net.ipv4.ip_forward=1 networks: internet: ipv4_address: 172.16.0.1 dmz: ipv4_address: 10.10.1.1 office: ipv4_address: 10.10.2.1 production: ipv4_address: 10.10.3.1 core: ipv4_address: 10.10.4.1 restart: unless-stopped # ============================================ # 攻击者机器（起点） # ============================================ attacker: build: ./docker/attacker container_name: lab-attacker hostname: attacker cap_add: - NET_ADMIN networks: internet: ipv4_address: 172.16.0.2 dmz: ipv4_address: 10.10.1.2 volumes: - ./flags:/root/flags stdin_open: true tty: true restart: unless-stopped # ============================================ # DMZ 区（4台主机） # ============================================ web-dmz: build: ./test-services/Tomcat container_name: lab-web-dmz hostname: web-dmz networks: dmz: ipv4_address: 10.10.1.10 volumes: - ./flags/flag1.txt:/usr/local/tomcat/webapps/ROOT/flag1.txt:ro restart: unless-stopped mail-dmz: build: ./test-services/SMTP container_name: lab-mail-dmz hostname: mail-dmz networks: dmz: ipv4_address: 10.10.1.11 restart: unless-stopped ftp-dmz: image: bogem/ftp container_name: lab-ftp-dmz hostname: ftp-dmz environment: - FTP_USER=admin - FTP_PASS=123456 - PASV_ADDRESS=10.10.1.12 networks: dmz: ipv4_address: 10.10.1.12 volumes: - ./flags/flag2.txt:/home/vsftpd/flag2.txt:ro - ./flags/office_key:/home/vsftpd/.ssh/office_key:ro - ./flags/clues/dmz_clue.txt:/home/vsftpd/next_step.txt:ro restart: unless-stopped vpn-gateway: build: ./test-services/SSH container_name: lab-vpn-gateway hostname: vpn-gateway networks: dmz: ipv4_address: 10.10.1.13 office: ipv4_address: 10.10.2.2 volumes: - ./flags/flag3.txt:/etc/flag3.txt:ro - ./docker/services/dmz/vpn-gateway/authorized_keys:/root/.ssh/authorized_keys - ./docker/services/dmz/vpn-gateway/frps.ini:/etc/frp/frps.ini:ro - ./docker/services/dmz/vpn-gateway/start-frps.sh:/usr/local/bin/start-frps:ro restart: unless-stopped # ============================================ # 办公网（5台主机） # ============================================ pc-vnc: build: ./test-services/VNC container_name: lab-pc-vnc hostname: pc-vnc networks: office: ipv4_address: 10.10.2.20 environment: - VNC_PASSWORD=password volumes: - ./flags/flag11.txt:/root/Desktop/flag11.txt:ro restart: unless-stopped pc-ssh: build: ./test-services/SSH container_name: lab-pc-ssh hostname: pc-ssh networks: office: ipv4_address: 10.10.2.21 volumes: - ./docker/services/office/pc-ssh/.bash_history:/root/.bash_history:ro restart: unless-stopped backup-server: build: ./test-services/Rsync container_name: lab-backup-server hostname: backup-server networks: office: ipv4_address: 10.10.2.22 volumes: - ./flags/flag4.txt:/data/backup/credentials/flag4.txt:ro - ./flags/clues/prod_redis.conf:/data/backup/credentials/prod_redis.conf:ro - ./flags/clues/prod_hosts.txt:/data/backup/credentials/prod_hosts.txt:ro - ./flags/prod_jump_key:/data/backup/credentials/ssh_keys/prod_jump_key:ro restart: unless-stopped printer: build: ./test-services/SMB container_name: lab-printer hostname: printer networks: office: ipv4_address: 10.10.2.23 volumes: - ./flags/flag13.txt:/shared/documents/flag13.txt:ro - ./flags/clues/printer_info.txt:/shared/documents/printer_info.txt:ro restart: unless-stopped oldpc-telnet: build: ./test-services/Telnet container_name: lab-oldpc-telnet hostname: oldpc-telnet networks: office: ipv4_address: 10.10.2.24 volumes: - ./flags/flag12.txt:/root/flag12.txt:ro restart: unless-stopped # ============================================ # 生产网（5台主机） # ============================================ app-web: build: ./test-services/Tomcat container_name: lab-app-web hostname: app-web networks: production: ipv4_address: 10.10.3.30 restart: unless-stopped cache-redis: build: ./test-services/Redis container_name: lab-cache-redis hostname: cache-redis networks: production: ipv4_address: 10.10.3.31 command: redis-server --bind 0.0.0.0 --protected-mode no --requirepass redis123 volumes: - ./docker/services/production/redis/init.sh:/docker-entrypoint-initdb.d/init.sh:ro restart: unless-stopped mq-rabbit: image: rabbitmq:3-management container_name: lab-mq-rabbit hostname: mq-rabbit environment: RABBITMQ_DEFAULT_USER: admin RABBITMQ_DEFAULT_PASS: rabbit123 networks: production: ipv4_address: 10.10.3.32 restart: unless-stopped mq-activemq: build: ./test-services/ActiveMQ container_name: lab-mq-activemq hostname: mq-activemq networks: production: ipv4_address: 10.10.3.33 restart: unless-stopped search-es: image: docker.elastic.co/elasticsearch/elasticsearch:7.9.3 container_name: lab-search-es hostname: search-es environment: - discovery.type=single-node - xpack.security.enabled=false networks: production: ipv4_address: 10.10.3.34 volumes: - ./docker/services/production/elasticsearch/init-es.sh:/usr/local/bin/init-es.sh:ro restart: unless-stopped # ============================================ # 核心网（5台主机） # ============================================ db-mysql: image: mysql:latest container_name: lab-db-mysql hostname: db-mysql environment: MYSQL_ROOT_PASSWORD: Password MYSQL_DATABASE: secrets networks: core: ipv4_address: 10.10.4.40 volumes: - ./docker/services/core/mysql/init.sql:/docker-entrypoint-initdb.d/init.sql:ro restart: unless-stopped db-mssql: image: mcr.microsoft.com/mssql/server:2022-latest container_name: lab-db-mssql hostname: db-mssql environment: ACCEPT_EULA: Y MSSQL_SA_PASSWORD: P@ssword123 MSSQL_PID: Express networks: core: ipv4_address: 10.10.4.41 volumes: - ./docker/services/core/mssql/init.sql:/docker-entrypoint-initdb.d/init.sql:ro restart: unless-stopped db-postgres: image: postgres:latest container_name: lab-db-postgres hostname: db-postgres environment: POSTGRES_USER: postgres POSTGRES_PASSWORD: postgres123 POSTGRES_DB: business networks: core: ipv4_address: 10.10.4.42 volumes: - ./docker/services/core/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql:ro restart: unless-stopped db-mongo: image: mongo:latest container_name: lab-db-mongo hostname: db-mongo environment: MONGO_INITDB_ROOT_USERNAME: admin MONGO_INITDB_ROOT_PASSWORD: mongo123 networks: core: ipv4_address: 10.10.4.43 volumes: - ./docker/services/core/mongo/init.js:/docker-entrypoint-initdb.d/init.js:ro restart: unless-stopped dc-ldap: build: ./test-services/LDAP container_name: lab-dc-ldap hostname: dc-ldap environment: LDAP_ORGANISATION: "TargetCorp" LDAP_DOMAIN: "target.corp" LDAP_BASE_DN: "dc=target,dc=corp" LDAP_ADMIN_PASSWORD: "Admin123" networks: core: ipv4_address: 10.10.4.44 restart: unless-stopped # ============================================ # 后端 API（flag 验证和进度管理） # ============================================ lab-api: build: ./backend container_name: lab-api hostname: lab-api networks: internet: ipv4_address: 172.16.0.100 ports: - "8888:8888" volumes: - ./flags:/app/flags:ro - ./backend/data:/app/data restart: unless-stopped # ============================================ # 前端 Web UI # ============================================ lab-web: build: ./frontend container_name: lab-web hostname: lab-web networks: internet: ipv4_address: 172.16.0.101 ports: - "3000:3000" environment: - VITE_API_URL=http://172.16.0.100:8888 restart: unless-stopped # ============================================ # 网络定义（5层网络架构） # ============================================ networks: internet: driver: bridge ipam: config: - subnet: 172.16.0.0/24 gateway: 172.16.0.254 dmz: driver: bridge ipam: config: - subnet: 10.10.1.0/24 gateway: 10.10.1.254 office: driver: bridge internal: true # 无直接外网访问 ipam: config: - subnet: 10.10.2.0/24 gateway: 10.10.2.254 production: driver: bridge internal: true ipam: config: - subnet: 10.10.3.0/24 gateway: 10.10.3.254 core: driver: bridge internal: true ipam: config: - subnet: 10.10.4.0/24 gateway: 10.10.4.254 # ============================================ # 数据卷 # ============================================ volumes: mysql_data: postgres_data: mongo_data: redis_data: