# Local-only vulnerability lab for Drupal 11.4.9.
#
#   SA-CORE-2026-014 / CVE-2026-108097  field_ui      RCE
#   SA-CORE-2026-015 / CVE-2026-108515  link          stored XSS
#   SA-CORE-2026-016 / CVE-2026-108514  navigation    stored XSS
#
# Nothing here leaves your machine. Do not point it at a site you do not own.
#
# The Drupal project is mounted from ./drupal (populated by
# lab/scripts/fetch-drupal.sh) and uses the drupal/drupal layout, so the
# image's document root needs no modification.
#
# Override LAB_DRUPAL_DIR to reuse a Drupal 11.4.9 tree you already have:
#   LAB_DRUPAL_DIR=/path/to/drupal-11.4.9 docker compose up
name: drupal-vuln-lab

services:
  db:
    image: mariadb:11.4
    environment:
      MARIADB_DATABASE: drupal
      MARIADB_USER: drupal
      MARIADB_PASSWORD: drupal
      MARIADB_ROOT_PASSWORD: root
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 5s
      timeout: 5s
      retries: 30
    volumes:
      - db_data:/var/lib/mysql

  web:
    build:
      context: .
    depends_on:
      db:
        condition: service_healthy
    ports:
      - "${LAB_HTTP_PORT:-8080}:80"
    environment:
      DRUPAL_DB_HOST: db
      DRUPAL_DB_PORT: 3306
      DRUPAL_DB_USER: drupal
      DRUPAL_DB_PASSWORD: drupal
      DRUPAL_DB_NAME: drupal
    volumes:
      # The Drupal 11.4.9 project (document root).
      - "${LAB_DRUPAL_DIR:-./drupal}:/var/www/html"
      # The lab modules, mounted so they can be edited without a rebuild.
      - ./lab/modules:/var/www/html/web/modules/custom:ro

  # One-shot provisioning: installs Drupal and creates the lab content.
  provision:
    build:
      context: .
    depends_on:
      db:
        condition: service_healthy
      web:
        condition: service_started
    environment:
      DRUPAL_DB_HOST: db
      DRUPAL_DB_PORT: 3306
      DRUPAL_DB_USER: drupal
      DRUPAL_DB_PASSWORD: drupal
      DRUPAL_DB_NAME: drupal
      LAB_HTTP_PORT: "${LAB_HTTP_PORT:-8080}"
    volumes:
      - "${LAB_DRUPAL_DIR:-./drupal}:/var/www/html"
      - ./lab/modules:/var/www/html/web/modules/custom:ro
      - ./lab/scripts:/opt/lab:ro
    entrypoint: ["/bin/bash", "/opt/lab/provision.sh"]

volumes:
  db_data: