chore: add monitoring stack

2026-05-02 18:59:22 +02:00
parent e93ad8c9f0
commit 31878d6ffc
8 changed files with 380 additions and 0 deletions
@@ -0,0 +1,173 @@
+services:
+    # ─── Dozzle ───────────────────────────────────────────────
+    dozzle:
+        image: amir20/dozzle:latest
+        container_name: dozzle
+        restart: unless-stopped
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock:ro
+        environment:
+            DOZZLE_BASE: /
+            DOZZLE_USERNAME: ${DOZZLE_USERNAME}
+            DOZZLE_PASSWORD: ${DOZZLE_PASSWORD}
+            DOZZLE_REMOTE_AGENT: "5.181.0.112:7007|demo-uber|VPS,185.234.9.102:7007|mln-uber|VPS"
+        networks:
+            - monitoring_net
+
+    # ─── Nginx ────────────────────────────────────────────────
+    nginx:
+        image: nginx:alpine
+        container_name: monitoring_nginx
+        restart: unless-stopped
+        ports:
+            - "80:80"
+            - "443:443"
+        volumes:
+            - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+            - ./nginx/certs:/etc/nginx/certs:ro
+            - nginx_logs:/var/log/nginx
+        depends_on:
+            - dozzle
+            - wazuh.dashboard
+        networks:
+            - monitoring_net
+
+    # ─── Wazuh Manager ────────────────────────────────────────
+    wazuh.manager:
+        image: wazuh/wazuh-manager:4.9.2
+        hostname: wazuh.manager
+        container_name: wazuh_manager
+        restart: unless-stopped
+        ulimits:
+            memlock:
+                soft: -1
+                hard: -1
+            nofile:
+                soft: 655360
+                hard: 655360
+        ports:
+            - "1514:1514" # Communication agents
+            - "1515:1515" # Enrôlement agents
+            - "514:514/udp" # Syslog entrant
+        environment:
+            - INDEXER_URL=https://wazuh.indexer:9200
+            - INDEXER_USERNAME=admin
+            - INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
+            - FILEBEAT_SSL_VERIFICATION_MODE=full
+            - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
+            - SSL_CERTIFICATE=/etc/ssl/filebeat.pem
+            - SSL_KEY=/etc/ssl/filebeat.key
+            - API_USERNAME=wazuh-wui
+            - API_PASSWORD=${WAZUH_API_PASSWORD}
+        volumes:
+            - wazuh_api_configuration:/var/ossec/api/configuration
+            - wazuh_etc:/var/ossec/etc
+            - wazuh_logs:/var/ossec/logs
+            - wazuh_queue:/var/ossec/queue
+            - wazuh_var_multigroups:/var/ossec/var/multigroups
+            - wazuh_integrations:/var/ossec/integrations
+            - wazuh_active_response:/var/ossec/active-response/bin
+            - wazuh_agentless:/var/ossec/agentless
+            - wazuh_wodles:/var/ossec/wodles
+            - filebeat_etc:/etc/filebeat
+            - filebeat_var:/var/lib/filebeat
+            - ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
+            - ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
+            - ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
+        networks:
+            - monitoring_net
+
+    # ─── Wazuh Indexer (OpenSearch) ───────────────────────────
+    wazuh.indexer:
+        image: wazuh/wazuh-indexer:4.9.2
+        hostname: wazuh.indexer
+        container_name: wazuh_indexer
+        restart: unless-stopped
+        ulimits:
+            memlock:
+                soft: -1
+                hard: -1
+            nofile:
+                soft: 65536
+                hard: 65536
+        environment:
+            - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
+            - INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
+        volumes:
+            - wazuh_indexer_data:/var/lib/wazuh-indexer
+            - ./wazuh/certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
+            - ./wazuh/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key
+            - ./wazuh/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem
+            - ./wazuh/certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
+            - ./wazuh/certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
+            - ./wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
+        networks:
+            - monitoring_net
+
+    # ─── Wazuh Dashboard ──────────────────────────────────────
+    wazuh.dashboard:
+        image: wazuh/wazuh-dashboard:4.9.2
+        hostname: wazuh.dashboard
+        container_name: wazuh_dashboard
+        restart: unless-stopped
+        environment:
+            - INDEXER_USERNAME=admin
+            - INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
+            - WAZUH_API_URL=https://wazuh.manager
+            - DASHBOARD_USERNAME=kibanaserver
+            - DASHBOARD_PASSWORD=${WAZUH_DASHBOARD_PASSWORD}
+            - API_USERNAME=wazuh-wui
+            - API_PASSWORD=${WAZUH_API_PASSWORD}
+        volumes:
+            - ./wazuh/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
+            - ./wazuh/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
+            - ./wazuh/certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
+            - ./wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
+        depends_on:
+            - wazuh.indexer
+            - wazuh.manager
+        networks:
+            - monitoring_net
+
+    # ─── CrowdSec ─────────────────────────────────────────────
+    crowdsec:
+        image: crowdsecurity/crowdsec:latest
+        container_name: crowdsec
+        restart: unless-stopped
+        environment:
+            GID: "1000"
+            COLLECTIONS: "crowdsecurity/nginx crowdsecurity/linux crowdsecurity/sshd"
+        volumes:
+            - ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
+            - crowdsec_db:/var/lib/crowdsec/data
+            - crowdsec_config:/etc/crowdsec
+            - /var/log/auth.log:/var/log/auth.log:ro
+            - /var/log/syslog:/var/log/syslog:ro
+            - nginx_logs:/var/log/nginx:ro
+            - /var/run/docker.sock:/var/run/docker.sock:ro
+        networks:
+            - monitoring_net
+
+networks:
+    monitoring_net:
+        driver: bridge
+
+volumes:
+    # Wazuh
+    wazuh_api_configuration:
+    wazuh_etc:
+    wazuh_logs:
+    wazuh_queue:
+    wazuh_var_multigroups:
+    wazuh_integrations:
+    wazuh_active_response:
+    wazuh_agentless:
+    wazuh_wodles:
+    filebeat_etc:
+    filebeat_var:
+    wazuh_indexer_data:
+    # CrowdSec
+    crowdsec_db:
+    crowdsec_config:
+    # Partagé entre nginx et crowdsec
+    nginx_logs: