docker-compose.yml

volumes:
  certs:
    driver: local
services:
  setup:
    image: docker.elastic.co/elasticsearch/elasticsearch:${ELASTICSEARCH_VERSION}
    volumes:
      - certs:/usr/share/elasticsearch/config/certs
    user: "0"
    healthcheck:
      test: ["CMD-SHELL", "[ -f config/certs/es01/es01.crt ]"]
      interval: 1s
      timeout: 5s
      retries: 120
    command: >
      bash -c '
        if [ ! -f config/certs/ca.zip ]; then
          echo "Creating CA";
          bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
          unzip config/certs/ca.zip -d config/certs;
        fi;
        if [ ! -f config/certs/certs.zip ]; then
          echo "Creating certs";
          echo -ne \
          "instances:\n"\
          "  - name: es01\n"\
          "    dns:\n"\
          "      - es01\n"\
          "      - localhost\n"\
          "    ip:\n"\
          "      - 127.0.0.1\n"\
          "  - name: es02\n"\
          "    dns:\n"\
          "      - es02\n"\
          "      - localhost\n"\
          "    ip:\n"\
          "      - 127.0.0.1\n"\
          > config/certs/instances.yml;
          bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key;
          unzip config/certs/certs.zip -d config/certs;
        fi;
        echo "Setting file permissions"
        chown -R root:root config/certs;
        find . -type d -exec chmod 750 \{\} \;;
        find . -type f -exec chmod 640 \{\} \;;
      ';
  elasticsearch:
    image: "docker.elastic.co/elasticsearch/elasticsearch:${ELASTICSEARCH_VERSION}"
    container_name: elasticsearch
    environment:
      - node.name=es01
      - cluster.name=es-docker-cluster
      - network.host="0.0.0.0"
      - discovery.type=single-node
      - xpack.license.self_generated.type=trial
      - xpack.security.enabled=true
      - xpack.security.authc.api_key.enabled=true
      - xpack.security.authc.token.enabled=true
      - xpack.security.http.ssl.enabled=false
      #- xpack.security.http.ssl.enabled=true
      #- xpack.security.http.ssl.key=certs/es01/es01.key
      #- xpack.security.http.ssl.certificate=certs/es01/es01.crt
      #- xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
      #- xpack.security.transport.ssl.enabled=true
      #- xpack.security.transport.ssl.key=certs/es01/es01.key
      #- xpack.security.transport.ssl.certificate=certs/es01/es01.crt
      #- xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
      #- xpack.security.transport.ssl.verification_mode=certificate
      - bootstrap.memory_lock=true
      - "ELASTIC_USERNAME=${ELASTICSEARCH_USERNAME}"
      - "ELASTIC_PASSWORD=${ELASTICSEARCH_PASSWORD}"
    mem_limit: 4294967296  # 4g
    healthcheck:
      test: ["CMD-SHELL", "curl -s ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}@localhost:9200/_cluster/health | grep -q '\"status\":\"green\"'"]
      start_period: 10s
      interval: 10s
      timeout: 10s
      retries: 120
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - certs:/usr/share/elasticsearch/config/certs
    ports:
      - 127.0.0.1:9200:9200
  elasticsearch-remote:
    depends_on:
      setup:
        condition: service_completed_successfully
    image: "docker.elastic.co/elasticsearch/elasticsearch:${ELASTICSEARCH_VERSION}"
    container_name: elasticsearch-remote
    environment:
      - node.name=es02
      - cluster.name=es-docker-cluster2
      - network.host="0.0.0.0"
      - discovery.type=single-node
      - xpack.license.self_generated.type=trial
      - xpack.security.enabled=true
      - xpack.security.authc.api_key.enabled=true
      - xpack.security.authc.token.enabled=true
      - xpack.security.http.ssl.enabled=true
      - xpack.security.http.ssl.key=certs/es02/es02.key
      - xpack.security.http.ssl.certificate=certs/es02/es02.crt
      - xpack.security.http.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.enabled=true
      - xpack.security.transport.ssl.key=certs/es02/es02.key
      - xpack.security.transport.ssl.certificate=certs/es02/es02.crt
      - xpack.security.transport.ssl.certificate_authorities=certs/ca/ca.crt
      - xpack.security.transport.ssl.verification_mode=certificate
      - bootstrap.memory_lock=true
      - "ELASTIC_USERNAME=${ELASTICSEARCH_USERNAME}"
      - "ELASTIC_PASSWORD=${ELASTICSEARCH_PASSWORD}"
    mem_limit:  4294967296  # 4g
    healthcheck:
      test: ["CMD-SHELL", "curl -s --cacert config/certs/ca/ca.crt https://${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}@localhost:9200/_cluster/health | grep -q '\"status\":\"green\"'"]
      start_period: 10s
      interval: 10s
      timeout: 10s
      retries: 120
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - certs:/usr/share/elasticsearch/config/certs
    ports:
      - 127.0.0.1:9201:9200