FleetDM Docker Compose (tested, needs verified)

[MatthewSH]

I was testing FleetDM and got a Docker compose working and ready to go and figured I'd share it here if anyone wants to refine it and put it in template format.

Needs improvments:

• SERVICE_FLEET_PRIVATE_KEY needs to be a magic value, not sure which is best yet
• Needs the automatic FQDN feature that's available on other templates

services:
  mysql:
    image: 'mysql:8'
    volumes:
      - 'mysql-data:/var/lib/mysql'
    environment:
      - MYSQL_ROOT_PASSWORD=$SERVICE_PASSWORD_ROOT
      - MYSQL_DATABASE=fleet
      - MYSQL_USER=$SERVICE_USER_MYSQL
      - MYSQL_PASSWORD=$SERVICE_PASSWORD_MYSQL
    healthcheck:
      test:
        - CMD
        - mysqladmin
        - ping
        - '-h'
        - 127.0.0.1
      interval: 5s
      timeout: 20s
      retries: 10
  redis:
    image: 'redis:8-alpine'
    volumes:
      - 'redis-data:/data'
    healthcheck:
      test:
        - CMD
        - redis-cli
        - PING
      interval: 5s
      timeout: 10s
      retries: 20
  fleet:
    image: 'fleetdm/fleet:latest'
    environment:
      - FLEET_SOFTWARE_INSTALLER_STORE_DIR=/opt/fleet/installers
      - FLEET_SERVER_PRIVATE_KEY=$SERVICE_FLEET_PRIVATE_KEY
      - 'FLEET_MYSQL_ADDRESS=mysql:3306'
      - FLEET_MYSQL_DATABASE=fleet
      - FLEET_MYSQL_PASSWORD=$SERVICE_PASSWORD_MYSQL
      - FLEET_MYSQL_USERNAME=$SERVICE_USER_MYSQL
      - 'FLEET_REDIS_ADDRESS=redis:6379'
      - FLEET_SERVER_TLS=false
      - PORT=8080
    volumes:
      - 'fleet-installers:/opt/fleet/installers'
      - 'fleet-data:/fleet'
      - 'fleet-logs:/logs'
      - 'fleet-vulndb:/vulndb'
    depends_on:
      mysql:
        condition: service_healthy
      redis:
        condition: service_started
    healthcheck:
      test:
        - CMD
        - wget
        - '--quiet'
        - '--tries=1'
        - '--spider'
        - 'http://localhost:8080/healthz'
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    command: 'sh -c "fleet prepare --no-prompt=true db && fleet serve"'

I did also have MDM certs too, but for that I just created a new volume and manually moved the certs in via SSH. Not the best...may need a way to do that better.