agentsniff/docker-compose.yml at main · ThirdKeyAI/agentsniff · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
services:
  agentsniff:
    build: .
    container_name: agentsniff
    ports:
      - "9090:9090"
    environment:
      - AGENTSNIFF_TARGET_NETWORK=192.168.1.0/24
      - AGENTSNIFF_API_ENABLED=true
      # Alerting (uncomment to enable)
      # - AGENTSNIFF_ALERT_ENABLED=true
      # - AGENTSNIFF_WEBHOOK_URL=https://hooks.example.com/agentsniff
      # - AGENTSNIFF_SMTP_HOST=smtp.example.com
      # - AGENTSNIFF_SMTP_PORT=587
      # - AGENTSNIFF_SMTP_USER=alerts@example.com
      # - AGENTSNIFF_SMTP_PASSWORD=your-password
      # - AGENTSNIFF_SMTP_FROM=agentsniff@example.com
      # - AGENTSNIFF_SMTP_TO=admin@example.com,security@example.com
    # Network mode: host gives full network visibility for passive monitoring
    # Use bridge mode for active scanning only
    network_mode: host
    cap_add:
      - NET_RAW      # Required for passive DNS and TLS monitoring
      - NET_ADMIN    # Required for network interface access
    restart: unless-stopped
    volumes:
      # Optional: mount config file
      - ./agentsniff.yaml:/app/agentsniff.yaml:ro
      # Optional: persist scan results
      - ./results:/app/results

  # Alternative: bridge network mode (active scanning only, no passive monitoring)
  # agentsniff-bridge:
  #   build: .
  #   container_name: agentsniff-bridge
  #   ports:
  #     - "9090:9090"
  #   environment:
  #     - AGENTSNIFF_TARGET_NETWORK=192.168.1.0/24
  #     - AGENTSNIFF_ENABLE_DNS_MONITOR=false
  #     - AGENTSNIFF_ENABLE_TLS_FINGERPRINT=false
  #     - AGENTSNIFF_ENABLE_TRAFFIC_ANALYZER=false
  #   restart: unless-stopped