Skip to content

Commit 1f18508

Browse files
codeyourwebcodeyourweb
committed
set elastic secondary node optional and define certificates in docker volumes to avoid desync between host and containers
1 parent 25fa75b commit 1f18508

File tree

9 files changed

+127
-75
lines changed

9 files changed

+127
-75
lines changed

‎.env‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
COMPOSE_PROFILES=sftp,phpmyadmin,kibana,internal-monitoring
2+
ELASTICSEARCH_CLUSTER_MODE=single-node
13
SENTINELKIT_FRONTEND_HOSTNAME=sentinel-kit.local
24
SENTINELKIT_BACKEND_HOSTNAME=backend.sentinel-kit.local
35
SENTINELKIT_PMA_HOSTNAME=phpmyadmin.sentinel-kit.local

‎.env.default‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
COMPOSE_PROFILES=sftp,es-secondary-node,phpmyadmin,kibana,internal-monitoring
2+
ELASTICSEARCH_CLUSTER_MODE=multi-node
3+
SENTINELKIT_FRONTEND_HOSTNAME=sentinel-kit.local
4+
SENTINELKIT_BACKEND_HOSTNAME=backend.sentinel-kit.local
5+
SENTINELKIT_PMA_HOSTNAME=phpmyadmin.sentinel-kit.local
6+
SENTINELKIT_KIBANA_HOSTNAME=kibana.sentinel-kit.local
7+
SENTINELKIT_GRAFANA_HOSTNAME=grafana.sentinel-kit.local
8+
SENTINELKIT_DATAMONITOR_SERVER_TOKEN=9561ffd1b6de615286b9e52a9d5bc3226970449700c9461bdbe4225730b47b20
9+
BACKEND_JWT_PASSPHRASE=f164cfc913d2faf65a1b7bc8ccd4aa8b11b5958bce7c20c8cf159a576f8a75f7
10+
MYSQL_ROOT_PASSWORD=sentinel-kit_r00tp4ssw0rd
11+
MYSQL_USER=sentinel-kit_user
12+
MYSQL_PASSWORD=sentinel-kit_passwd
13+
MYSQL_DATABASE=sentinel-kit_db
14+
GF_SECURITY_ADMIN_USER=sentinel-kit_grafana_admin
15+
GF_SECURITY_ADMIN_PASSWORD=sentinel-kit_grafana_password
16+
SFTP_USER=sentinel-kit_sftp_user
17+
SFTP_PASSWORD=sentinel-kit_sftp_passwd
18+
ELASTICSTACK_VERSION=9.2.0
19+
ELASTICSEARCH_CLUSTER_NAME=sentinel-kit-elasticsearch-cluster
20+
ELASTICSEARCH_LICENSE=basic
21+
ELASTICSEARCH_MEMORY_LIMIT=4294967296
22+
ELASTICSEARCH_PASSWORD=sentinelkit_elastic_passwd

‎.gitignore‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
/.env.local
22
/.env.local.php
33
/.env.*.local
4-
/config/certificates/caddy_server/*
5-
/config/certificates/elasticsearch/*
6-
/config/certificates/jwt/*
74
/config/yara_ruleset/*
85
/config/sigma_ruleset/*
96
/data/caddy_logs/*

‎clean-user-data.ps1‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Remove-Item ./data/caddy_logs/* -Recurse -Force
2+
Remove-Item ./data/ftp_data/* -Recurse -Force
3+
Remove-Item ./data/grafana/* -Recurse -Force
4+
Remove-Item ./data/kibana/* -Recurse -Force
5+
Remove-Item ./data/mysql_data/* -Recurse -Force
6+
docker compose down -v

‎clean-user-data.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
rm -rf ./data/caddy_logs/*
2+
rm -rf ./data/ftp_data/*
3+
rm -rf ./data/grafana/*
4+
rm -rf ./data/kibana/*
5+
rm -rf ./data/mysql_data/*
6+
docker compose down -v

‎config/elasticsearch/ca-setup.sh‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
#!/bin/sh
2+
if [ x$ELASTICSEARCH_PASSWORD == x ]; then
3+
echo "Set the ELASTICSEARCH_PASSWORD environment variable in the .env file";
4+
exit 1;
5+
fi;
6+
7+
if [ ! -f config/certs/ca/ca.crt ]; then
8+
echo "Creating CA";
9+
bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
10+
unzip -o config/certs/ca.zip -d config/certs;
11+
rm -f config/certs/ca.zip;
12+
fi;
13+
14+
if [ ! -f config/certs/certs.zip ]; then
15+
echo "Creating certs";
16+
cat <<EOF > config/certs/instances.yml
17+
instances:
18+
- name: sentinel-kit-db-elasticsearch-es01
19+
dns:
20+
- sentinel-kit-db-elasticsearch-es01
21+
- localhost
22+
ip:
23+
- 127.0.0.1
24+
EOF
25+
26+
# optional secondary node (Multi-node)
27+
if [ "$ELASTICSEARCH_CLUSTER_MODE" == "multi-node" ]; then
28+
echo "Cluster mode is multi-node, adding es02 cert entry.";
29+
cat <<EOF >> config/certs/instances.yml
30+
- name: sentinel-kit-db-elasticsearch-es02
31+
dns:
32+
- sentinel-kit-db-elasticsearch-es02
33+
- localhost
34+
ip:
35+
- 127.0.0.1
36+
EOF
37+
else
38+
echo "Cluster mode is single-node, only es01 cert will be created.";
39+
fi;
40+
41+
bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key;
42+
unzip -o config/certs/certs.zip -d config/certs;
43+
rm -f config/certs/certs.zip;
44+
fi;
45+
46+
echo "Setting file permissions"
47+
chown -R root:root config/certs;
48+
find . -type d -exec chmod 750 \{\} \;;
49+
find . -type f -exec chmod 640 \{\} \;;
50+
echo "Waiting for Elasticsearch availability";
51+
until curl -s --cacert config/certs/ca/ca.crt https://sentinel-kit-db-elasticsearch-es01:9200 | grep -q "missing authentication credentials"; do sleep 30; done;
52+
echo "Setting kibana_system password";
53+
until curl -s -X POST --cacert config/certs/ca/ca.crt -u "elastic:${ELASTICSEARCH_PASSWORD}" -H "Content-Type: application/json" https://sentinel-kit-db-elasticsearch-es01:9200/_security/user/kibana_system/_password -d "{\"password\":\"s3nt1n3lkit_k1b4n4_syst3m_p4sswd\"}" | grep -q "^{}"; do sleep 10; done;
54+
echo "All done!"

‎docker-compose.yml‎

Lines changed: 31 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,9 @@ services:
3232
- CORS_ALLOW_ORIGIN=https://${SENTINELKIT_FRONTEND_HOSTNAME}
3333
volumes:
3434
- ./config/docker-config/backend-entrypoint.sh:/usr/local/bin/backend-entrypoint.sh:ro
35-
- ./config/certificates/jwt:/var/www/html/config/jwt
3635
- ./sentinel-kit_server_backend:/var/www/html:delegated
3736
- ./sentinel-kit_server_backend/public:/var/www/html/public:delegated
37+
- sentinel-kit_certificates_jwt:/var/www/html/config/jwt
3838
- sentinel-kit_server_backend_vendor_cache:/var/www/html/vendor
3939
- sentinel-kit_server_backend_var_cache:/var/www/html/var
4040
stdin_open: true
@@ -59,9 +59,6 @@ services:
5959
volumes:
6060
- ./config/fluentbit_server:/fluent-bit/etc
6161
- ./data/log_ingest_data:/var/log:ro
62-
ports:
63-
- "24224:24224"
64-
- "24224:24224/udp"
6562
networks:
6663
- sentinel-kit-network
6764
depends_on:
@@ -79,6 +76,7 @@ services:
7976
networks:
8077
- sentinel-kit-network
8178
working_dir: /home/${SFTP_USER}/uploads
79+
profiles: ["sftp"]
8280

8381
sentinel-kit-db-mysql:
8482
container_name: sentinel-kit-db-mysql
@@ -109,8 +107,8 @@ services:
109107
- "443:443"
110108
volumes:
111109
- ./config/caddy_server/Caddyfile:/etc/caddy/Caddyfile
112-
- ./config/certificates/caddy_server:/data/caddy/pki/authorities/local
113110
- ./data/caddy_logs:/var/log/caddy
111+
- sentinel-kit_certificates_caddy:/data/caddy/pki/authorities/local
114112
- sentinel-kit_server_caddy_data:/data
115113
- sentinel-kit_server_caddy_config:/config
116114
networks:
@@ -120,56 +118,20 @@ services:
120118
- sentinel-kit-app-backend
121119
- sentinel-kit-db-mysql
122120

123-
sentinel-kit-db-elasticsearch-setup:
121+
sentinel-kit-conf-elasticsearch-setup:
124122
image: docker.elastic.co/elasticsearch/elasticsearch:${ELASTICSTACK_VERSION}
125-
container_name: sentinel-kit-db-elasticsearch-setup
123+
container_name: sentinel-kit-conf-elasticsearch-setup
126124
restart: on-failure
127125
volumes:
128-
- ./config/certificates/elasticsearch:/usr/share/elasticsearch/config/certs
126+
- sentinel-kit_certificates_elasticsearch:/usr/share/elasticsearch/config/certs
127+
- ./config/elasticsearch/ca-setup.sh:/usr/share/elasticsearch/ca-setup.sh:ro
129128
user: "0"
130-
command: >
131-
bash -c '
132-
if [ x${ELASTICSEARCH_PASSWORD} == x ]; then
133-
echo "Set the ELASTICSEARCH_PASSWORD environment variable in the .env file";
134-
exit 1;
135-
fi;
136-
if [ ! -f config/certs/ca.zip ]; then
137-
echo "Creating CA";
138-
bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
139-
unzip config/certs/ca.zip -d config/certs;
140-
fi;
141-
if [ ! -f config/certs/certs.zip ]; then
142-
echo "Creating certs";
143-
echo -ne \
144-
"instances:\n"\
145-
" - name: sentinel-kit-db-elasticsearch-es01\n"\
146-
" dns:\n"\
147-
" - sentinel-kit-db-elasticsearch-es01\n"\
148-
" - localhost\n"\
149-
" ip:\n"\
150-
" - 127.0.0.1\n"\
151-
" - name: sentinel-kit-db-elasticsearch-es02\n"\
152-
" dns:\n"\
153-
" - sentinel-kit-db-elasticsearch-es02\n"\
154-
" - localhost\n"\
155-
" ip:\n"\
156-
" - 127.0.0.1\n"\
157-
> config/certs/instances.yml;
158-
bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key;
159-
unzip config/certs/certs.zip -d config/certs;
160-
fi;
161-
echo "Setting file permissions"
162-
chown -R root:root config/certs;
163-
find . -type d -exec chmod 750 \{\} \;;
164-
find . -type f -exec chmod 640 \{\} \;;
165-
echo "Waiting for Elasticsearch availability";
166-
until curl -s --cacert config/certs/ca/ca.crt https://sentinel-kit-db-elasticsearch-es01:9200 | grep -q "missing authentication credentials"; do sleep 30; done;
167-
echo "Setting kibana_system password";
168-
until curl -s -X POST --cacert config/certs/ca/ca.crt -u "elastic:${ELASTICSEARCH_PASSWORD}" -H "Content-Type: application/json" https://sentinel-kit-db-elasticsearch-es01:9200/_security/user/kibana_system/_password -d "{\"password\":\"s3nt1n3lkit_k1b4n4_syst3m_p4sswd\"}" | grep -q "^{}"; do sleep 10; done;
169-
echo "All done!";
170-
'
129+
command: 'sh -c "/usr/share/elasticsearch/ca-setup.sh"'
130+
environment:
131+
- ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD}
132+
- ELASTICSEARCH_CLUSTER_MODE=${ELASTICSEARCH_CLUSTER_MODE}
171133
healthcheck:
172-
test: ["CMD-SHELL", "[ -f config/certs/es01/es01.crt ]"]
134+
test: ["CMD-SHELL", "[ -f /usr/share/elasticsearch/config/certs/es01/es01.crt ]"]
173135
interval: 1s
174136
timeout: 5s
175137
retries: 120
@@ -178,18 +140,17 @@ services:
178140

179141
sentinel-kit-db-elasticsearch-es01:
180142
depends_on:
181-
- sentinel-kit-db-elasticsearch-setup
143+
- sentinel-kit-conf-elasticsearch-setup
182144
image: docker.elastic.co/elasticsearch/elasticsearch:${ELASTICSTACK_VERSION}
183145
container_name: sentinel-kit-db-elasticsearch-es01
184146
restart: on-failure
185147
volumes:
186-
- ./config/certificates/elasticsearch:/usr/share/elasticsearch/config/certs
148+
- sentinel-kit_certificates_elasticsearch:/usr/share/elasticsearch/config/certs
187149
- sentinel-kit_db_elasticsearch_es01_data:/usr/share/elasticsearch/data
188150
environment:
189151
- node.name=sentinel-kit-db-elasticsearch-es01
190152
- cluster.name=${ELASTICSEARCH_CLUSTER_NAME}
191-
- cluster.initial_master_nodes=sentinel-kit-db-elasticsearch-es01,sentinel-kit-db-elasticsearch-es02
192-
- discovery.seed_hosts=sentinel-kit-db-elasticsearch-es02
153+
- cluster.initial_master_nodes=sentinel-kit-db-elasticsearch-es01
193154
- ELASTIC_PASSWORD=${ELASTICSEARCH_PASSWORD}
194155
- bootstrap.memory_lock=true
195156
- xpack.security.enabled=true
@@ -224,16 +185,17 @@ services:
224185
sentinel-kit-db-elasticsearch-es02:
225186
depends_on:
226187
- sentinel-kit-db-elasticsearch-es01
188+
- sentinel-kit-conf-elasticsearch-setup
227189
image: docker.elastic.co/elasticsearch/elasticsearch:${ELASTICSTACK_VERSION}
228190
container_name: sentinel-kit-db-elasticsearch-es02
229191
restart: on-failure
230192
volumes:
231-
- ./config/certificates/elasticsearch:/usr/share/elasticsearch/config/certs
193+
- sentinel-kit_certificates_elasticsearch:/usr/share/elasticsearch/config/certs
232194
- sentinel-kit_db_elasticsearch_es02_data:/usr/share/elasticsearch/data
233195
environment:
234196
- node.name=sentinel-kit-db-elasticsearch-es02
235197
- cluster.name=${ELASTICSEARCH_CLUSTER_NAME}
236-
- cluster.initial_master_nodes=sentinel-kit-db-elasticsearch-es01,sentinel-kit-db-elasticsearch-es02
198+
- cluster.initial_master_nodes=sentinel-kit-db-elasticsearch-es01
237199
- discovery.seed_hosts=sentinel-kit-db-elasticsearch-es01
238200
- ELASTIC_PASSWORD=${ELASTICSEARCH_PASSWORD}
239201
- bootstrap.memory_lock=true
@@ -265,6 +227,7 @@ services:
265227
retries: 120
266228
networks:
267229
- sentinel-kit-network
230+
profiles: ["es-secondary-node"]
268231

269232
sentinel-kit-utils-kibana:
270233
container_name: sentinel-kit-utils-kibana
@@ -273,21 +236,17 @@ services:
273236
depends_on:
274237
sentinel-kit-db-elasticsearch-es01:
275238
condition: service_healthy
276-
sentinel-kit-db-elasticsearch-es02:
277-
condition: service_healthy
278-
sentinel-kit-db-elasticsearch-setup:
279-
condition: service_completed_successfully
280239
image: docker.elastic.co/kibana/kibana:${ELASTICSTACK_VERSION}
281240
volumes:
282-
- ./config/certificates/elasticsearch:/usr/share/kibana/config/certs
241+
- sentinel-kit_certificates_elasticsearch:/usr/share/kibana/config/certs/elasticsearch:ro
283242
- ./data/kibana:/usr/share/kibana/data
284243
environment:
285244
- SERVERNAME=sentinel-kit-utils-kibana
286245
- KIBANA_FLEET_PACKAGE_UPDATE_ENABLED=false
287246
- ELASTICSEARCH_HOSTS=https://sentinel-kit-db-elasticsearch-es01:9200
288247
- ELASTICSEARCH_USERNAME=kibana_system
289248
- ELASTICSEARCH_PASSWORD=s3nt1n3lkit_k1b4n4_syst3m_p4sswd
290-
- ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/ca/ca.crt
249+
- ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config/certs/elasticsearch/ca/ca.crt
291250
mem_limit: ${ELASTICSEARCH_MEMORY_LIMIT}
292251
healthcheck:
293252
test:
@@ -300,6 +259,7 @@ services:
300259
retries: 120
301260
networks:
302261
- sentinel-kit-network
262+
profiles: ["kibana"]
303263

304264
sentinel-kit-utils-prometheus:
305265
container_name: sentinel-kit-utils-prometheus
@@ -311,6 +271,7 @@ services:
311271
- sentinel-kit-network
312272
depends_on:
313273
- sentinel-kit-server-fluentbit
274+
profiles: ["internal-monitoring"]
314275

315276
sentinel-kit-utils-grafana:
316277
container_name: sentinel-kit-utils-grafana
@@ -319,7 +280,7 @@ services:
319280
restart: on-failure
320281
user: "0"
321282
volumes:
322-
- ./config/certificates/elasticsearch/ca/ca.crt:/etc/grafana/certs/elasticsearch-ca.crt:ro
283+
- sentinel-kit_certificates_elasticsearch:/etc/grafana/certs/elasticsearch:ro
323284
- ./data/grafana:/var/lib/grafana
324285
- ./config/grafana/datasources:/etc/grafana/provisioning/datasources
325286
- ./config/grafana/dashboards:/etc/grafana/provisioning/dashboards
@@ -337,9 +298,10 @@ services:
337298
- /bin/sh
338299
- -c
339300
- |
340-
cp /etc/grafana/certs/elasticsearch-ca.crt /usr/local/share/ca-certificates/elasticsearch-ca.crt
301+
cp /etc/grafana/certs/elasticsearch/ca/ca.crt /usr/local/share/ca-certificates/elasticsearch-ca.crt
341302
update-ca-certificates
342303
/run.sh
304+
profiles: ["internal-monitoring"]
343305

344306
sentinel-kit-utils-phpmyadmin:
345307
container_name: sentinel-kit-utils-phpmyadmin
@@ -353,7 +315,7 @@ services:
353315
- sentinel-kit-network
354316
depends_on:
355317
- sentinel-kit-db-mysql
356-
318+
profiles: ["phpmyadmin"]
357319
networks:
358320
sentinel-kit-network:
359321
driver: bridge
@@ -365,4 +327,7 @@ volumes:
365327
sentinel-kit_db_elasticsearch_es02_data:
366328
sentinel-kit_server_backend_vendor_cache:
367329
sentinel-kit_server_backend_var_cache:
368-
sentinel-kit_server_backend_public:
330+
sentinel-kit_server_backend_public:
331+
sentinel-kit_certificates_elasticsearch:
332+
sentinel-kit_certificates_caddy:
333+
sentinel-kit_certificates_jwt:

0 commit comments

Comments
 (0)