feat: bundle XTM One in the default stack

[azubiolo-filigran]

✅ Tested: OpenCTI + XTM One Docker Setup

Clean docker compose up -d from scratch — verified end-to-end.

Steps to reproduce

# 1. Clone repos side-by-side
git clone git@github.com:OpenCTI-Platform/docker.git opencti-docker
git clone git@github.com:XTM-One-Platform/xtm-one.git xtm-one
cd opencti-docker
git checkout feat/xtm-one-default

# 2. Create .env from sample (only 3 values MUST be changed)
cp .env.sample .env
sed -i "s/OPENCTI_ADMIN_TOKEN=ChangeMe_UUIDv4/OPENCTI_ADMIN_TOKEN=$(uuidgen)/" .env
sed -i "s|OPENCTI_ENCRYPTION_KEY=ChangeMeWithGeneratedBase64Key|OPENCTI_ENCRYPTION_KEY=$(openssl rand -base64 32)|" .env
sed -i "s/XTM_ONE_SECRET_KEY=ChangeMeWithGeneratedRandomString/XTM_ONE_SECRET_KEY=$(openssl rand -hex 32)/" .env

# 3. Build and start
docker compose up -d --build

# 4. Wait (~1-2 min) then verify
docker compose ps  # all services healthy

Note: The compose file has build: context: ../xtm-one directives for xtm-one and xtm-one-worker services. This requires the xtm-one repo cloned adjacent to this repo. Alternatively, remove the build: blocks and pull a pre-built image.

Credentials

Service	URL	Email	Password
OpenCTI	http://localhost:8080	admin@opencti.io	changeme
XTM One	http://localhost:4000	admin@opencti.io	changeme

What was verified

• All 23 services start healthy (infra, OpenCTI, connectors, workers, XTM One, XTM Composer)
• OpenCTI auto-registers with XTM One (status=active, heartbeat flowing)
• XTM One integration shows status=connected, base_url=http://opencti:8080
• JWT auth from XTM One → OpenCTI GraphQL works (iss=http://xtm-one:4000, aud=http://opencti:8080)
• JWKS endpoint reachable cross-container

Key fixes in this commit

1. APP__BASE_URL=http://opencti:8080 — JWT audience validation must match the internal hostname
2. BASE_URL=http://xtm-one:4000 — JWT issuer + JWKS fetch must use internal hostname
3. XTM_ONE_ADMIN_EMAIL=admin@opencti.io — must match OpenCTI admin so JWT email resolves
4. Build directives — build: context: ../xtm-one for local builds without registry access

Dependency

Requires XTM-One-Platform/xtm-one#1070 (fix/platform-registration-api-url-override) — adds OPENCTI_API_URL env var support so the registration stores the internal Docker URL in the integration config instead of the platform-reported external URL.

[gregoirelafay]

Updated: Build from local XTM One clone

The compose file now includes build: context: ../xtm-one directives for xtm-one and xtm-one-worker services. Updated steps:

# Clone both repos side-by-side
git clone git@github.com:OpenCTI-Platform/docker.git opencti-docker
git clone git@github.com:XTM-One-Platform/xtm-one.git xtm-one
cd opencti-docker
git checkout feat/xtm-one-default

# Create .env and start
cp .env.sample .env
sed -i "s/OPENCTI_ADMIN_TOKEN=ChangeMe_UUIDv4/OPENCTI_ADMIN_TOKEN=$(uuidgen)/" .env
sed -i "s|OPENCTI_ENCRYPTION_KEY=ChangeMeWithGeneratedBase64Key|OPENCTI_ENCRYPTION_KEY=$(openssl rand -base64 32)|" .env
sed -i "s/XTM_ONE_SECRET_KEY=ChangeMeWithGeneratedRandomString/XTM_ONE_SECRET_KEY=$(openssl rand -hex 32)/" .env

# Build and start
docker compose up -d --build

Note: Requires xtm-one repo cloned at ../xtm-one (adjacent to this repo). Alternatively, remove the build: blocks if you have access to the registry images.

from #574

[gregoirelafay]

tested locally, LGTM