Xor290/projet_gestion_commande
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: add monitoring stack

Browse Source
This commit is contained in:
Xor290
2026-05-02 18:59:22 +02:00
parent e93ad8c9f0
commit 31878d6ffc
8 changed files with 380 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
monitoring/.env
+8
View File
@@ -0,0 +1,8 @@
# Dozzle
DOZZLE_USERNAME=admin_mln_monitoring
DOZZLE_PASSWORD=dX753n05Jo4T6B66cR
# Wazuh — changer TOUS ces mots de passe avant de déployer
WAZUH_INDEXER_PASSWORD=9qB523OjLyFSp6vMpH!
WAZUH_API_PASSWORD=myAJYqnemF544nsD33!
WAZUH_DASHBOARD_PASSWORD=E9Jpr6586kQ3wYrCS2!
monitoring/crowdsec/acquis.yaml
+22
View File
@@ -0,0 +1,22 @@
# Logs nginx depuis le container Docker
source: docker
container_name:
- monitoring_nginx
labels:
type: nginx
---
# Logs SSH du VPS hôte
source: file
filenames:
- /var/log/auth.log
labels:
type: syslog
---
# Logs système du VPS hôte
source: file
filenames:
- /var/log/syslog
labels:
type: syslog
monitoring/docker-compose.yml
+173
View File
@@ -0,0 +1,173 @@
services:
# ─── Dozzle ───────────────────────────────────────────────
dozzle:
image: amir20/dozzle:latest
container_name: dozzle
restart: unless-stopped
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
environment:
DOZZLE_BASE: /
DOZZLE_USERNAME: ${DOZZLE_USERNAME}
DOZZLE_PASSWORD: ${DOZZLE_PASSWORD}
DOZZLE_REMOTE_AGENT: "5.181.0.112:7007|demo-uber|VPS,185.234.9.102:7007|mln-uber|VPS"
networks:
- monitoring_net
# ─── Nginx ────────────────────────────────────────────────
nginx:
image: nginx:alpine
container_name: monitoring_nginx
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
- ./nginx/certs:/etc/nginx/certs:ro
- nginx_logs:/var/log/nginx
depends_on:
- dozzle
- wazuh.dashboard
networks:
- monitoring_net
# ─── Wazuh Manager ────────────────────────────────────────
wazuh.manager:
image: wazuh/wazuh-manager:4.9.2
hostname: wazuh.manager
container_name: wazuh_manager
restart: unless-stopped
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 655360
hard: 655360
ports:
- "1514:1514" # Communication agents
- "1515:1515" # Enrôlement agents
- "514:514/udp" # Syslog entrant
environment:
- INDEXER_URL=https://wazuh.indexer:9200
- INDEXER_USERNAME=admin
- INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
- FILEBEAT_SSL_VERIFICATION_MODE=full
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
- SSL_KEY=/etc/ssl/filebeat.key
- API_USERNAME=wazuh-wui
- API_PASSWORD=${WAZUH_API_PASSWORD}
volumes:
- wazuh_api_configuration:/var/ossec/api/configuration
- wazuh_etc:/var/ossec/etc
- wazuh_logs:/var/ossec/logs
- wazuh_queue:/var/ossec/queue
- wazuh_var_multigroups:/var/ossec/var/multigroups
- wazuh_integrations:/var/ossec/integrations
- wazuh_active_response:/var/ossec/active-response/bin
- wazuh_agentless:/var/ossec/agentless
- wazuh_wodles:/var/ossec/wodles
- filebeat_etc:/etc/filebeat
- filebeat_var:/var/lib/filebeat
- ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
- ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
- ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
networks:
- monitoring_net
# ─── Wazuh Indexer (OpenSearch) ───────────────────────────
wazuh.indexer:
image: wazuh/wazuh-indexer:4.9.2
hostname: wazuh.indexer
container_name: wazuh_indexer
restart: unless-stopped
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 65536
hard: 65536
environment:
- "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
- INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
volumes:
- wazuh_indexer_data:/var/lib/wazuh-indexer
- ./wazuh/certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
- ./wazuh/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key
- ./wazuh/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem
- ./wazuh/certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
- ./wazuh/certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
- ./wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
networks:
- monitoring_net
# ─── Wazuh Dashboard ──────────────────────────────────────
wazuh.dashboard:
image: wazuh/wazuh-dashboard:4.9.2
hostname: wazuh.dashboard
container_name: wazuh_dashboard
restart: unless-stopped
environment:
- INDEXER_USERNAME=admin
- INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
- WAZUH_API_URL=https://wazuh.manager
- DASHBOARD_USERNAME=kibanaserver
- DASHBOARD_PASSWORD=${WAZUH_DASHBOARD_PASSWORD}
- API_USERNAME=wazuh-wui
- API_PASSWORD=${WAZUH_API_PASSWORD}
volumes:
- ./wazuh/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
- ./wazuh/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
- ./wazuh/certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
- ./wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
depends_on:
- wazuh.indexer
- wazuh.manager
networks:
- monitoring_net
# ─── CrowdSec ─────────────────────────────────────────────
crowdsec:
image: crowdsecurity/crowdsec:latest
container_name: crowdsec
restart: unless-stopped
environment:
GID: "1000"
COLLECTIONS: "crowdsecurity/nginx crowdsecurity/linux crowdsecurity/sshd"
volumes:
- ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
- crowdsec_db:/var/lib/crowdsec/data
- crowdsec_config:/etc/crowdsec
- /var/log/auth.log:/var/log/auth.log:ro
- /var/log/syslog:/var/log/syslog:ro
- nginx_logs:/var/log/nginx:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
networks:
- monitoring_net
networks:
monitoring_net:
driver: bridge
volumes:
# Wazuh
wazuh_api_configuration:
wazuh_etc:
wazuh_logs:
wazuh_queue:
wazuh_var_multigroups:
wazuh_integrations:
wazuh_active_response:
wazuh_agentless:
wazuh_wodles:
filebeat_etc:
filebeat_var:
wazuh_indexer_data:
# CrowdSec
crowdsec_db:
crowdsec_config:
# Partagé entre nginx et crowdsec
nginx_logs:
monitoring/nginx/nginx.conf
+77
View File
@@ -0,0 +1,77 @@
worker_processes auto;
events {
worker_connections 1024;
}
http {
# Redirect HTTP -> HTTPS
server {
listen 80;
server_name _;
return 301 https://$host$request_uri;
}
# ── Dozzle ──────────────────────────────────────────────
server {
listen 443 ssl;
server_name dozzle.uber-stup.club;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/dozzle_access.log;
error_log /var/log/nginx/dozzle_error.log;
location / {
proxy_pass http://dozzle:8080;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering off;
proxy_cache off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 3600s;
}
}
# ── Wazuh Dashboard ─────────────────────────────────────
server {
listen 443 ssl;
server_name wazuh.uber-stup.club;
ssl_certificate /etc/nginx/certs/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
access_log /var/log/nginx/wazuh_access.log;
error_log /var/log/nginx/wazuh_error.log;
location / {
proxy_pass https://wazuh.dashboard:5601;
proxy_ssl_verify off;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 300s;
proxy_hide_header Content-Security-Policy;
proxy_hide_header X-Frame-Options;
proxy_hide_header X-XSS-Protection;
}
}
}
monitoring/wazuh/config/certs.yml
+10
View File
@@ -0,0 +1,10 @@
nodes:
indexer:
- name: wazuh.indexer
ip: "wazuh.indexer"
server:
- name: wazuh.manager
ip: "wazuh.manager"
dashboard:
- name: wazuh.dashboard
ip: "wazuh.dashboard"
monitoring/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml
+12
View File
@@ -0,0 +1,12 @@
server.host: 0.0.0.0
server.port: 5601
opensearch.hosts: https://wazuh.indexer:9200
opensearch.ssl.verificationMode: certificate
opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"]
opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
opensearch_security.multitenancy.enabled: false
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
server.ssl.enabled: true
server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem"
server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem"
uiSettings.overrides.defaultRoute: /app/wz-home
monitoring/wazuh/config/wazuh_indexer/wazuh.indexer.yml
+44
View File
@@ -0,0 +1,44 @@
network.host: "0.0.0.0"
node.name: "wazuh.indexer"
cluster.initial_master_nodes:
- "wazuh.indexer"
cluster.name: "wazuh-cluster"
path.data: /var/lib/wazuh-indexer
path.logs: /var/log/wazuh-indexer
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.http.enabled: true
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.transport.resolve_hostname: false
plugins.security.authcz.admin_dn:
- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
plugins.security.nodes_dn:
- "CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.restapi.roles_enabled:
- "all_access"
- "security_rest_api_access"
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices:
- ".opendistro-alerting-config"
- ".opendistro-alerting-alert*"
- ".opendistro-anomaly-results*"
- ".opendistro-anomaly-detector*"
- ".opendistro-anomaly-checkpoints"
- ".opendistro-anomaly-detection-state"
- ".opendistro-reports-*"
- ".opendistro-notifications-*"
- ".opendistro-notebooks"
- ".opensearch-observability"
- ".opendistro-asynchronous-search-response*"
- ".replication-metadata-store"
monitoring/wazuh/generate-certs.sh
Executable
+34
View File
@@ -0,0 +1,34 @@
#!/bin/bash
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
CERTS_DIR="$SCRIPT_DIR/certs"
mkdir -p "$CERTS_DIR"
cd /tmp
echo "[*] Téléchargement de l'outil de génération de certificats Wazuh..."
curl -sO https://packages.wazuh.com/4.9/wazuh-certs-tool.sh
cp "$SCRIPT_DIR/config/certs.yml" config.yml
echo "[*] Génération des certificats..."
bash wazuh-certs-tool.sh -A
echo "[*] Extraction des certificats..."
tar -xf wazuh-install-files.tar
cp wazuh-install-files/wazuh.indexer.pem "$CERTS_DIR/"
cp wazuh-install-files/wazuh.indexer-key.pem "$CERTS_DIR/"
cp wazuh-install-files/wazuh.manager.pem "$CERTS_DIR/"
cp wazuh-install-files/wazuh.manager-key.pem "$CERTS_DIR/"
cp wazuh-install-files/wazuh.dashboard.pem "$CERTS_DIR/"
cp wazuh-install-files/wazuh.dashboard-key.pem "$CERTS_DIR/"
cp wazuh-install-files/root-ca.pem "$CERTS_DIR/"
cp wazuh-install-files/root-ca.pem "$CERTS_DIR/root-ca-manager.pem"
cp wazuh-install-files/admin.pem "$CERTS_DIR/"
cp wazuh-install-files/admin-key.pem "$CERTS_DIR/"
chmod 640 "$CERTS_DIR"/*.pem
rm -rf /tmp/wazuh-install-files /tmp/wazuh-install-files.tar /tmp/wazuh-certs-tool.sh /tmp/config.yml
echo "[OK] Certificats générés dans $CERTS_DIR"