Docker Compose#

Minimal `docker-compose.yml`#

services:
  infraguard:
    image: ghcr.io/whispergate/infraguard:latest
    restart: unless-stopped
    ports:
      - "443:443"
    volumes:
      - ./config:/config:ro
      - ./certs:/certs:ro
      - infraguard-data:/data
    env_file: .env
    environment:
      INFRAGUARD_CONFIG: /config/config.yaml

volumes:
  infraguard-data:

`.env` File#

INFRAGUARD_TLS_CERT=/certs/fullchain.pem
INFRAGUARD_TLS_KEY=/certs/privkey.pem
INFRAGUARD_DB_PATH=/data/infraguard.db

# C2 upstreams
CS_UPSTREAM=https://10.0.0.1:443
MYTHIC_IP=10.0.0.2

# Phishing
GOPHISH_UPSTREAM=https://127.0.0.1:3333

# Alerting
DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...

Multi-Service Stack (C2 + Phishing)#

services:
  infraguard-c2:
    image: ghcr.io/whispergate/infraguard:latest
    ports: ["443:443"]
    volumes:
      - ./config/c2-config.yaml:/config/config.yaml:ro
      - ./certs:/certs:ro
      - ig-data:/data
    env_file: .env

  infraguard-phish:
    image: ghcr.io/whispergate/infraguard:latest
    ports: ["8443:443"]
    volumes:
      - ./config/phish-config.yaml:/config/config.yaml:ro
      - ./certs:/certs:ro
      - ig-phish-data:/data
    env_file: .env

  gophish:
    image: gophish/gophish
    expose: ["3333"]

volumes:
  ig-data:
  ig-phish-data:

Hot Reload#

Edit config/config.yaml while running, then send SIGHUP:

docker compose kill -s HUP infraguard

InfraGuard reloads config without dropping existing connections. The database and in-memory whitelist are preserved across reloads.

AI Assistant (Ollama)#

An optional Ollama service provides AI-assisted profile generation in the dashboard. It runs behind a Docker profile so it only starts when explicitly requested:

docker compose --profile ollama up -d

Pull the model on first run:

docker compose --profile ollama exec ollama ollama pull qwen3:8b

The dashboard container connects to Ollama via INFRAGUARD_OLLAMA_URL=http://infraguard-ollama:11434, which is set in the compose file. Model data persists in the ollama-data volume.

Resource limits: 4 CPU cores / 8 GB memory. See AI Assistant for full configuration.

Standalone Dashboard#

When running the dashboard as a separate container from the proxy, set INFRAGUARD_PROXY_API so the dashboard can forward config mutations (like profile hot-swaps) to the proxy:

services:
  dashboard:
    image: ghcr.io/whispergate/infraguard:latest
    command: dashboard
    environment:
      INFRAGUARD_PROXY_API: "http://infraguard-proxy:8080"
      INFRAGUARD_OLLAMA_URL: "http://infraguard-ollama:11434"

API Port#

The management API binds to 127.0.0.1:8080 inside the container. Expose it via a separate port mapping if needed (only on trusted networks):

ports:
  - "443:443"
  - "127.0.0.1:8080:8080"   # management API - do NOT expose publicly