From 31878d6ffc988c66731ca2e62df06a3f8118d7f7 Mon Sep 17 00:00:00 2001 From: Xor290 Date: Sat, 2 May 2026 18:59:22 +0200 Subject: [PATCH] chore: add monitoring stack --- monitoring/.env | 8 + monitoring/crowdsec/acquis.yaml | 22 +++ monitoring/docker-compose.yml | 173 ++++++++++++++++++ monitoring/nginx/nginx.conf | 77 ++++++++ monitoring/wazuh/config/certs.yml | 10 + .../wazuh_dashboard/opensearch_dashboards.yml | 12 ++ .../config/wazuh_indexer/wazuh.indexer.yml | 44 +++++ monitoring/wazuh/generate-certs.sh | 34 ++++ 8 files changed, 380 insertions(+) create mode 100644 monitoring/.env create mode 100644 monitoring/crowdsec/acquis.yaml create mode 100644 monitoring/docker-compose.yml create mode 100644 monitoring/nginx/nginx.conf create mode 100644 monitoring/wazuh/config/certs.yml create mode 100644 monitoring/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml create mode 100644 monitoring/wazuh/config/wazuh_indexer/wazuh.indexer.yml create mode 100755 monitoring/wazuh/generate-certs.sh diff --git a/monitoring/.env b/monitoring/.env new file mode 100644 index 00000000..a69851b5 --- /dev/null +++ b/monitoring/.env @@ -0,0 +1,8 @@ +# Dozzle +DOZZLE_USERNAME=admin_mln_monitoring +DOZZLE_PASSWORD=dX753n05Jo4T6B66cR + +# Wazuh — changer TOUS ces mots de passe avant de déployer +WAZUH_INDEXER_PASSWORD=9qB523OjLyFSp6vMpH! +WAZUH_API_PASSWORD=myAJYqnemF544nsD33! +WAZUH_DASHBOARD_PASSWORD=E9Jpr6586kQ3wYrCS2! diff --git a/monitoring/crowdsec/acquis.yaml b/monitoring/crowdsec/acquis.yaml new file mode 100644 index 00000000..a54e4da8 --- /dev/null +++ b/monitoring/crowdsec/acquis.yaml @@ -0,0 +1,22 @@ +# Logs nginx depuis le container Docker +source: docker +container_name: + - monitoring_nginx +labels: + type: nginx + +--- +# Logs SSH du VPS hôte +source: file +filenames: + - /var/log/auth.log +labels: + type: syslog + +--- +# Logs système du VPS hôte +source: file +filenames: + - /var/log/syslog +labels: + type: syslog diff --git a/monitoring/docker-compose.yml b/monitoring/docker-compose.yml new file mode 100644 index 00000000..0c41a9d7 --- /dev/null +++ b/monitoring/docker-compose.yml @@ -0,0 +1,173 @@ +services: + # ─── Dozzle ─────────────────────────────────────────────── + dozzle: + image: amir20/dozzle:latest + container_name: dozzle + restart: unless-stopped + volumes: + - /var/run/docker.sock:/var/run/docker.sock:ro + environment: + DOZZLE_BASE: / + DOZZLE_USERNAME: ${DOZZLE_USERNAME} + DOZZLE_PASSWORD: ${DOZZLE_PASSWORD} + DOZZLE_REMOTE_AGENT: "5.181.0.112:7007|demo-uber|VPS,185.234.9.102:7007|mln-uber|VPS" + networks: + - monitoring_net + + # ─── Nginx ──────────────────────────────────────────────── + nginx: + image: nginx:alpine + container_name: monitoring_nginx + restart: unless-stopped + ports: + - "80:80" + - "443:443" + volumes: + - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro + - ./nginx/certs:/etc/nginx/certs:ro + - nginx_logs:/var/log/nginx + depends_on: + - dozzle + - wazuh.dashboard + networks: + - monitoring_net + + # ─── Wazuh Manager ──────────────────────────────────────── + wazuh.manager: + image: wazuh/wazuh-manager:4.9.2 + hostname: wazuh.manager + container_name: wazuh_manager + restart: unless-stopped + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 655360 + hard: 655360 + ports: + - "1514:1514" # Communication agents + - "1515:1515" # Enrôlement agents + - "514:514/udp" # Syslog entrant + environment: + - INDEXER_URL=https://wazuh.indexer:9200 + - INDEXER_USERNAME=admin + - INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD} + - FILEBEAT_SSL_VERIFICATION_MODE=full + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem + - SSL_CERTIFICATE=/etc/ssl/filebeat.pem + - SSL_KEY=/etc/ssl/filebeat.key + - API_USERNAME=wazuh-wui + - API_PASSWORD=${WAZUH_API_PASSWORD} + volumes: + - wazuh_api_configuration:/var/ossec/api/configuration + - wazuh_etc:/var/ossec/etc + - wazuh_logs:/var/ossec/logs + - wazuh_queue:/var/ossec/queue + - wazuh_var_multigroups:/var/ossec/var/multigroups + - wazuh_integrations:/var/ossec/integrations + - wazuh_active_response:/var/ossec/active-response/bin + - wazuh_agentless:/var/ossec/agentless + - wazuh_wodles:/var/ossec/wodles + - filebeat_etc:/etc/filebeat + - filebeat_var:/var/lib/filebeat + - ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem + - ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem + - ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key + networks: + - monitoring_net + + # ─── Wazuh Indexer (OpenSearch) ─────────────────────────── + wazuh.indexer: + image: wazuh/wazuh-indexer:4.9.2 + hostname: wazuh.indexer + container_name: wazuh_indexer + restart: unless-stopped + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + environment: + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" + - INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD} + volumes: + - wazuh_indexer_data:/var/lib/wazuh-indexer + - ./wazuh/certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem + - ./wazuh/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key + - ./wazuh/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem + - ./wazuh/certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem + - ./wazuh/certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem + - ./wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml + networks: + - monitoring_net + + # ─── Wazuh Dashboard ────────────────────────────────────── + wazuh.dashboard: + image: wazuh/wazuh-dashboard:4.9.2 + hostname: wazuh.dashboard + container_name: wazuh_dashboard + restart: unless-stopped + environment: + - INDEXER_USERNAME=admin + - INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD} + - WAZUH_API_URL=https://wazuh.manager + - DASHBOARD_USERNAME=kibanaserver + - DASHBOARD_PASSWORD=${WAZUH_DASHBOARD_PASSWORD} + - API_USERNAME=wazuh-wui + - API_PASSWORD=${WAZUH_API_PASSWORD} + volumes: + - ./wazuh/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem + - ./wazuh/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem + - ./wazuh/certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem + - ./wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml + depends_on: + - wazuh.indexer + - wazuh.manager + networks: + - monitoring_net + + # ─── CrowdSec ───────────────────────────────────────────── + crowdsec: + image: crowdsecurity/crowdsec:latest + container_name: crowdsec + restart: unless-stopped + environment: + GID: "1000" + COLLECTIONS: "crowdsecurity/nginx crowdsecurity/linux crowdsecurity/sshd" + volumes: + - ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml + - crowdsec_db:/var/lib/crowdsec/data + - crowdsec_config:/etc/crowdsec + - /var/log/auth.log:/var/log/auth.log:ro + - /var/log/syslog:/var/log/syslog:ro + - nginx_logs:/var/log/nginx:ro + - /var/run/docker.sock:/var/run/docker.sock:ro + networks: + - monitoring_net + +networks: + monitoring_net: + driver: bridge + +volumes: + # Wazuh + wazuh_api_configuration: + wazuh_etc: + wazuh_logs: + wazuh_queue: + wazuh_var_multigroups: + wazuh_integrations: + wazuh_active_response: + wazuh_agentless: + wazuh_wodles: + filebeat_etc: + filebeat_var: + wazuh_indexer_data: + # CrowdSec + crowdsec_db: + crowdsec_config: + # Partagé entre nginx et crowdsec + nginx_logs: diff --git a/monitoring/nginx/nginx.conf b/monitoring/nginx/nginx.conf new file mode 100644 index 00000000..939ca807 --- /dev/null +++ b/monitoring/nginx/nginx.conf @@ -0,0 +1,77 @@ +worker_processes auto; + +events { + worker_connections 1024; +} + +http { + # Redirect HTTP -> HTTPS + server { + listen 80; + server_name _; + return 301 https://$host$request_uri; + } + + # ── Dozzle ────────────────────────────────────────────── + server { + listen 443 ssl; + server_name dozzle.uber-stup.club; + + ssl_certificate /etc/nginx/certs/fullchain.pem; + ssl_certificate_key /etc/nginx/certs/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + + access_log /var/log/nginx/dozzle_access.log; + error_log /var/log/nginx/dozzle_error.log; + + location / { + proxy_pass http://dozzle:8080; + proxy_http_version 1.1; + proxy_set_header Connection ""; + proxy_buffering off; + proxy_cache off; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 3600s; + } + } + + # ── Wazuh Dashboard ───────────────────────────────────── + server { + listen 443 ssl; + server_name wazuh.uber-stup.club; + + ssl_certificate /etc/nginx/certs/fullchain.pem; + ssl_certificate_key /etc/nginx/certs/privkey.pem; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + + access_log /var/log/nginx/wazuh_access.log; + error_log /var/log/nginx/wazuh_error.log; + + location / { + proxy_pass https://wazuh.dashboard:5601; + + proxy_ssl_verify off; + + proxy_http_version 1.1; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + proxy_read_timeout 300s; + + proxy_hide_header Content-Security-Policy; + proxy_hide_header X-Frame-Options; + proxy_hide_header X-XSS-Protection; + } + } +} diff --git a/monitoring/wazuh/config/certs.yml b/monitoring/wazuh/config/certs.yml new file mode 100644 index 00000000..077dc66a --- /dev/null +++ b/monitoring/wazuh/config/certs.yml @@ -0,0 +1,10 @@ +nodes: + indexer: + - name: wazuh.indexer + ip: "wazuh.indexer" + server: + - name: wazuh.manager + ip: "wazuh.manager" + dashboard: + - name: wazuh.dashboard + ip: "wazuh.dashboard" diff --git a/monitoring/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml b/monitoring/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml new file mode 100644 index 00000000..d1abcf1d --- /dev/null +++ b/monitoring/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml @@ -0,0 +1,12 @@ +server.host: 0.0.0.0 +server.port: 5601 +opensearch.hosts: https://wazuh.indexer:9200 +opensearch.ssl.verificationMode: certificate +opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] +opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"] +opensearch_security.multitenancy.enabled: false +opensearch_security.readonly_mode.roles: ["kibana_read_only"] +server.ssl.enabled: true +server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem" +server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" +uiSettings.overrides.defaultRoute: /app/wz-home diff --git a/monitoring/wazuh/config/wazuh_indexer/wazuh.indexer.yml b/monitoring/wazuh/config/wazuh_indexer/wazuh.indexer.yml new file mode 100644 index 00000000..c5bd84f9 --- /dev/null +++ b/monitoring/wazuh/config/wazuh_indexer/wazuh.indexer.yml @@ -0,0 +1,44 @@ +network.host: "0.0.0.0" +node.name: "wazuh.indexer" +cluster.initial_master_nodes: + - "wazuh.indexer" +cluster.name: "wazuh-cluster" + +path.data: /var/lib/wazuh-indexer +path.logs: /var/log/wazuh-indexer + +plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem +plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key +plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem +plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem +plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key +plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem +plugins.security.ssl.http.enabled: true +plugins.security.ssl.transport.enforce_hostname_verification: false +plugins.security.ssl.transport.resolve_hostname: false + +plugins.security.authcz.admin_dn: + - "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" +plugins.security.nodes_dn: + - "CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" + +plugins.security.check_snapshot_restore_write_privileges: true +plugins.security.enable_snapshot_restore_privilege: true +plugins.security.restapi.roles_enabled: + - "all_access" + - "security_rest_api_access" + +plugins.security.system_indices.enabled: true +plugins.security.system_indices.indices: + - ".opendistro-alerting-config" + - ".opendistro-alerting-alert*" + - ".opendistro-anomaly-results*" + - ".opendistro-anomaly-detector*" + - ".opendistro-anomaly-checkpoints" + - ".opendistro-anomaly-detection-state" + - ".opendistro-reports-*" + - ".opendistro-notifications-*" + - ".opendistro-notebooks" + - ".opensearch-observability" + - ".opendistro-asynchronous-search-response*" + - ".replication-metadata-store" diff --git a/monitoring/wazuh/generate-certs.sh b/monitoring/wazuh/generate-certs.sh new file mode 100755 index 00000000..4268bdcc --- /dev/null +++ b/monitoring/wazuh/generate-certs.sh @@ -0,0 +1,34 @@ +#!/bin/bash +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +CERTS_DIR="$SCRIPT_DIR/certs" + +mkdir -p "$CERTS_DIR" +cd /tmp + +echo "[*] Téléchargement de l'outil de génération de certificats Wazuh..." +curl -sO https://packages.wazuh.com/4.9/wazuh-certs-tool.sh +cp "$SCRIPT_DIR/config/certs.yml" config.yml + +echo "[*] Génération des certificats..." +bash wazuh-certs-tool.sh -A + +echo "[*] Extraction des certificats..." +tar -xf wazuh-install-files.tar + +cp wazuh-install-files/wazuh.indexer.pem "$CERTS_DIR/" +cp wazuh-install-files/wazuh.indexer-key.pem "$CERTS_DIR/" +cp wazuh-install-files/wazuh.manager.pem "$CERTS_DIR/" +cp wazuh-install-files/wazuh.manager-key.pem "$CERTS_DIR/" +cp wazuh-install-files/wazuh.dashboard.pem "$CERTS_DIR/" +cp wazuh-install-files/wazuh.dashboard-key.pem "$CERTS_DIR/" +cp wazuh-install-files/root-ca.pem "$CERTS_DIR/" +cp wazuh-install-files/root-ca.pem "$CERTS_DIR/root-ca-manager.pem" +cp wazuh-install-files/admin.pem "$CERTS_DIR/" +cp wazuh-install-files/admin-key.pem "$CERTS_DIR/" + +chmod 640 "$CERTS_DIR"/*.pem +rm -rf /tmp/wazuh-install-files /tmp/wazuh-install-files.tar /tmp/wazuh-certs-tool.sh /tmp/config.yml + +echo "[OK] Certificats générés dans $CERTS_DIR"