chore: add monitoring stack
This commit is contained in:
@@ -0,0 +1,8 @@
|
|||||||
|
# Dozzle
|
||||||
|
DOZZLE_USERNAME=admin_mln_monitoring
|
||||||
|
DOZZLE_PASSWORD=dX753n05Jo4T6B66cR
|
||||||
|
|
||||||
|
# Wazuh — changer TOUS ces mots de passe avant de déployer
|
||||||
|
WAZUH_INDEXER_PASSWORD=9qB523OjLyFSp6vMpH!
|
||||||
|
WAZUH_API_PASSWORD=myAJYqnemF544nsD33!
|
||||||
|
WAZUH_DASHBOARD_PASSWORD=E9Jpr6586kQ3wYrCS2!
|
||||||
@@ -0,0 +1,22 @@
|
|||||||
|
# Logs nginx depuis le container Docker
|
||||||
|
source: docker
|
||||||
|
container_name:
|
||||||
|
- monitoring_nginx
|
||||||
|
labels:
|
||||||
|
type: nginx
|
||||||
|
|
||||||
|
---
|
||||||
|
# Logs SSH du VPS hôte
|
||||||
|
source: file
|
||||||
|
filenames:
|
||||||
|
- /var/log/auth.log
|
||||||
|
labels:
|
||||||
|
type: syslog
|
||||||
|
|
||||||
|
---
|
||||||
|
# Logs système du VPS hôte
|
||||||
|
source: file
|
||||||
|
filenames:
|
||||||
|
- /var/log/syslog
|
||||||
|
labels:
|
||||||
|
type: syslog
|
||||||
@@ -0,0 +1,173 @@
|
|||||||
|
services:
|
||||||
|
# ─── Dozzle ───────────────────────────────────────────────
|
||||||
|
dozzle:
|
||||||
|
image: amir20/dozzle:latest
|
||||||
|
container_name: dozzle
|
||||||
|
restart: unless-stopped
|
||||||
|
volumes:
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||||
|
environment:
|
||||||
|
DOZZLE_BASE: /
|
||||||
|
DOZZLE_USERNAME: ${DOZZLE_USERNAME}
|
||||||
|
DOZZLE_PASSWORD: ${DOZZLE_PASSWORD}
|
||||||
|
DOZZLE_REMOTE_AGENT: "5.181.0.112:7007|demo-uber|VPS,185.234.9.102:7007|mln-uber|VPS"
|
||||||
|
networks:
|
||||||
|
- monitoring_net
|
||||||
|
|
||||||
|
# ─── Nginx ────────────────────────────────────────────────
|
||||||
|
nginx:
|
||||||
|
image: nginx:alpine
|
||||||
|
container_name: monitoring_nginx
|
||||||
|
restart: unless-stopped
|
||||||
|
ports:
|
||||||
|
- "80:80"
|
||||||
|
- "443:443"
|
||||||
|
volumes:
|
||||||
|
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
|
||||||
|
- ./nginx/certs:/etc/nginx/certs:ro
|
||||||
|
- nginx_logs:/var/log/nginx
|
||||||
|
depends_on:
|
||||||
|
- dozzle
|
||||||
|
- wazuh.dashboard
|
||||||
|
networks:
|
||||||
|
- monitoring_net
|
||||||
|
|
||||||
|
# ─── Wazuh Manager ────────────────────────────────────────
|
||||||
|
wazuh.manager:
|
||||||
|
image: wazuh/wazuh-manager:4.9.2
|
||||||
|
hostname: wazuh.manager
|
||||||
|
container_name: wazuh_manager
|
||||||
|
restart: unless-stopped
|
||||||
|
ulimits:
|
||||||
|
memlock:
|
||||||
|
soft: -1
|
||||||
|
hard: -1
|
||||||
|
nofile:
|
||||||
|
soft: 655360
|
||||||
|
hard: 655360
|
||||||
|
ports:
|
||||||
|
- "1514:1514" # Communication agents
|
||||||
|
- "1515:1515" # Enrôlement agents
|
||||||
|
- "514:514/udp" # Syslog entrant
|
||||||
|
environment:
|
||||||
|
- INDEXER_URL=https://wazuh.indexer:9200
|
||||||
|
- INDEXER_USERNAME=admin
|
||||||
|
- INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
|
||||||
|
- FILEBEAT_SSL_VERIFICATION_MODE=full
|
||||||
|
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
|
||||||
|
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
|
||||||
|
- SSL_KEY=/etc/ssl/filebeat.key
|
||||||
|
- API_USERNAME=wazuh-wui
|
||||||
|
- API_PASSWORD=${WAZUH_API_PASSWORD}
|
||||||
|
volumes:
|
||||||
|
- wazuh_api_configuration:/var/ossec/api/configuration
|
||||||
|
- wazuh_etc:/var/ossec/etc
|
||||||
|
- wazuh_logs:/var/ossec/logs
|
||||||
|
- wazuh_queue:/var/ossec/queue
|
||||||
|
- wazuh_var_multigroups:/var/ossec/var/multigroups
|
||||||
|
- wazuh_integrations:/var/ossec/integrations
|
||||||
|
- wazuh_active_response:/var/ossec/active-response/bin
|
||||||
|
- wazuh_agentless:/var/ossec/agentless
|
||||||
|
- wazuh_wodles:/var/ossec/wodles
|
||||||
|
- filebeat_etc:/etc/filebeat
|
||||||
|
- filebeat_var:/var/lib/filebeat
|
||||||
|
- ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
|
||||||
|
- ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
|
||||||
|
- ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
|
||||||
|
networks:
|
||||||
|
- monitoring_net
|
||||||
|
|
||||||
|
# ─── Wazuh Indexer (OpenSearch) ───────────────────────────
|
||||||
|
wazuh.indexer:
|
||||||
|
image: wazuh/wazuh-indexer:4.9.2
|
||||||
|
hostname: wazuh.indexer
|
||||||
|
container_name: wazuh_indexer
|
||||||
|
restart: unless-stopped
|
||||||
|
ulimits:
|
||||||
|
memlock:
|
||||||
|
soft: -1
|
||||||
|
hard: -1
|
||||||
|
nofile:
|
||||||
|
soft: 65536
|
||||||
|
hard: 65536
|
||||||
|
environment:
|
||||||
|
- "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
|
||||||
|
- INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
|
||||||
|
volumes:
|
||||||
|
- wazuh_indexer_data:/var/lib/wazuh-indexer
|
||||||
|
- ./wazuh/certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
|
||||||
|
- ./wazuh/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||||
|
- ./wazuh/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||||
|
- ./wazuh/certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
|
||||||
|
- ./wazuh/certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
|
||||||
|
- ./wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
|
||||||
|
networks:
|
||||||
|
- monitoring_net
|
||||||
|
|
||||||
|
# ─── Wazuh Dashboard ──────────────────────────────────────
|
||||||
|
wazuh.dashboard:
|
||||||
|
image: wazuh/wazuh-dashboard:4.9.2
|
||||||
|
hostname: wazuh.dashboard
|
||||||
|
container_name: wazuh_dashboard
|
||||||
|
restart: unless-stopped
|
||||||
|
environment:
|
||||||
|
- INDEXER_USERNAME=admin
|
||||||
|
- INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
|
||||||
|
- WAZUH_API_URL=https://wazuh.manager
|
||||||
|
- DASHBOARD_USERNAME=kibanaserver
|
||||||
|
- DASHBOARD_PASSWORD=${WAZUH_DASHBOARD_PASSWORD}
|
||||||
|
- API_USERNAME=wazuh-wui
|
||||||
|
- API_PASSWORD=${WAZUH_API_PASSWORD}
|
||||||
|
volumes:
|
||||||
|
- ./wazuh/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
|
||||||
|
- ./wazuh/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
|
||||||
|
- ./wazuh/certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
|
||||||
|
- ./wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
|
||||||
|
depends_on:
|
||||||
|
- wazuh.indexer
|
||||||
|
- wazuh.manager
|
||||||
|
networks:
|
||||||
|
- monitoring_net
|
||||||
|
|
||||||
|
# ─── CrowdSec ─────────────────────────────────────────────
|
||||||
|
crowdsec:
|
||||||
|
image: crowdsecurity/crowdsec:latest
|
||||||
|
container_name: crowdsec
|
||||||
|
restart: unless-stopped
|
||||||
|
environment:
|
||||||
|
GID: "1000"
|
||||||
|
COLLECTIONS: "crowdsecurity/nginx crowdsecurity/linux crowdsecurity/sshd"
|
||||||
|
volumes:
|
||||||
|
- ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
|
||||||
|
- crowdsec_db:/var/lib/crowdsec/data
|
||||||
|
- crowdsec_config:/etc/crowdsec
|
||||||
|
- /var/log/auth.log:/var/log/auth.log:ro
|
||||||
|
- /var/log/syslog:/var/log/syslog:ro
|
||||||
|
- nginx_logs:/var/log/nginx:ro
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||||
|
networks:
|
||||||
|
- monitoring_net
|
||||||
|
|
||||||
|
networks:
|
||||||
|
monitoring_net:
|
||||||
|
driver: bridge
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
# Wazuh
|
||||||
|
wazuh_api_configuration:
|
||||||
|
wazuh_etc:
|
||||||
|
wazuh_logs:
|
||||||
|
wazuh_queue:
|
||||||
|
wazuh_var_multigroups:
|
||||||
|
wazuh_integrations:
|
||||||
|
wazuh_active_response:
|
||||||
|
wazuh_agentless:
|
||||||
|
wazuh_wodles:
|
||||||
|
filebeat_etc:
|
||||||
|
filebeat_var:
|
||||||
|
wazuh_indexer_data:
|
||||||
|
# CrowdSec
|
||||||
|
crowdsec_db:
|
||||||
|
crowdsec_config:
|
||||||
|
# Partagé entre nginx et crowdsec
|
||||||
|
nginx_logs:
|
||||||
@@ -0,0 +1,77 @@
|
|||||||
|
worker_processes auto;
|
||||||
|
|
||||||
|
events {
|
||||||
|
worker_connections 1024;
|
||||||
|
}
|
||||||
|
|
||||||
|
http {
|
||||||
|
# Redirect HTTP -> HTTPS
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
server_name _;
|
||||||
|
return 301 https://$host$request_uri;
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Dozzle ──────────────────────────────────────────────
|
||||||
|
server {
|
||||||
|
listen 443 ssl;
|
||||||
|
server_name dozzle.uber-stup.club;
|
||||||
|
|
||||||
|
ssl_certificate /etc/nginx/certs/fullchain.pem;
|
||||||
|
ssl_certificate_key /etc/nginx/certs/privkey.pem;
|
||||||
|
ssl_protocols TLSv1.2 TLSv1.3;
|
||||||
|
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||||
|
|
||||||
|
access_log /var/log/nginx/dozzle_access.log;
|
||||||
|
error_log /var/log/nginx/dozzle_error.log;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://dozzle:8080;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Connection "";
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_cache off;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_read_timeout 3600s;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Wazuh Dashboard ─────────────────────────────────────
|
||||||
|
server {
|
||||||
|
listen 443 ssl;
|
||||||
|
server_name wazuh.uber-stup.club;
|
||||||
|
|
||||||
|
ssl_certificate /etc/nginx/certs/fullchain.pem;
|
||||||
|
ssl_certificate_key /etc/nginx/certs/privkey.pem;
|
||||||
|
ssl_protocols TLSv1.2 TLSv1.3;
|
||||||
|
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||||
|
|
||||||
|
access_log /var/log/nginx/wazuh_access.log;
|
||||||
|
error_log /var/log/nginx/wazuh_error.log;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass https://wazuh.dashboard:5601;
|
||||||
|
|
||||||
|
proxy_ssl_verify off;
|
||||||
|
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Real-IP $remote_addr;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
|
||||||
|
proxy_set_header Upgrade $http_upgrade;
|
||||||
|
proxy_set_header Connection "upgrade";
|
||||||
|
|
||||||
|
proxy_read_timeout 300s;
|
||||||
|
|
||||||
|
proxy_hide_header Content-Security-Policy;
|
||||||
|
proxy_hide_header X-Frame-Options;
|
||||||
|
proxy_hide_header X-XSS-Protection;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
nodes:
|
||||||
|
indexer:
|
||||||
|
- name: wazuh.indexer
|
||||||
|
ip: "wazuh.indexer"
|
||||||
|
server:
|
||||||
|
- name: wazuh.manager
|
||||||
|
ip: "wazuh.manager"
|
||||||
|
dashboard:
|
||||||
|
- name: wazuh.dashboard
|
||||||
|
ip: "wazuh.dashboard"
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
server.host: 0.0.0.0
|
||||||
|
server.port: 5601
|
||||||
|
opensearch.hosts: https://wazuh.indexer:9200
|
||||||
|
opensearch.ssl.verificationMode: certificate
|
||||||
|
opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"]
|
||||||
|
opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
|
||||||
|
opensearch_security.multitenancy.enabled: false
|
||||||
|
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
|
||||||
|
server.ssl.enabled: true
|
||||||
|
server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem"
|
||||||
|
server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem"
|
||||||
|
uiSettings.overrides.defaultRoute: /app/wz-home
|
||||||
@@ -0,0 +1,44 @@
|
|||||||
|
network.host: "0.0.0.0"
|
||||||
|
node.name: "wazuh.indexer"
|
||||||
|
cluster.initial_master_nodes:
|
||||||
|
- "wazuh.indexer"
|
||||||
|
cluster.name: "wazuh-cluster"
|
||||||
|
|
||||||
|
path.data: /var/lib/wazuh-indexer
|
||||||
|
path.logs: /var/log/wazuh-indexer
|
||||||
|
|
||||||
|
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||||
|
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||||
|
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||||
|
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||||
|
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||||
|
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||||
|
plugins.security.ssl.http.enabled: true
|
||||||
|
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||||
|
plugins.security.ssl.transport.resolve_hostname: false
|
||||||
|
|
||||||
|
plugins.security.authcz.admin_dn:
|
||||||
|
- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
|
||||||
|
plugins.security.nodes_dn:
|
||||||
|
- "CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
|
||||||
|
|
||||||
|
plugins.security.check_snapshot_restore_write_privileges: true
|
||||||
|
plugins.security.enable_snapshot_restore_privilege: true
|
||||||
|
plugins.security.restapi.roles_enabled:
|
||||||
|
- "all_access"
|
||||||
|
- "security_rest_api_access"
|
||||||
|
|
||||||
|
plugins.security.system_indices.enabled: true
|
||||||
|
plugins.security.system_indices.indices:
|
||||||
|
- ".opendistro-alerting-config"
|
||||||
|
- ".opendistro-alerting-alert*"
|
||||||
|
- ".opendistro-anomaly-results*"
|
||||||
|
- ".opendistro-anomaly-detector*"
|
||||||
|
- ".opendistro-anomaly-checkpoints"
|
||||||
|
- ".opendistro-anomaly-detection-state"
|
||||||
|
- ".opendistro-reports-*"
|
||||||
|
- ".opendistro-notifications-*"
|
||||||
|
- ".opendistro-notebooks"
|
||||||
|
- ".opensearch-observability"
|
||||||
|
- ".opendistro-asynchronous-search-response*"
|
||||||
|
- ".replication-metadata-store"
|
||||||
Executable
+34
@@ -0,0 +1,34 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
CERTS_DIR="$SCRIPT_DIR/certs"
|
||||||
|
|
||||||
|
mkdir -p "$CERTS_DIR"
|
||||||
|
cd /tmp
|
||||||
|
|
||||||
|
echo "[*] Téléchargement de l'outil de génération de certificats Wazuh..."
|
||||||
|
curl -sO https://packages.wazuh.com/4.9/wazuh-certs-tool.sh
|
||||||
|
cp "$SCRIPT_DIR/config/certs.yml" config.yml
|
||||||
|
|
||||||
|
echo "[*] Génération des certificats..."
|
||||||
|
bash wazuh-certs-tool.sh -A
|
||||||
|
|
||||||
|
echo "[*] Extraction des certificats..."
|
||||||
|
tar -xf wazuh-install-files.tar
|
||||||
|
|
||||||
|
cp wazuh-install-files/wazuh.indexer.pem "$CERTS_DIR/"
|
||||||
|
cp wazuh-install-files/wazuh.indexer-key.pem "$CERTS_DIR/"
|
||||||
|
cp wazuh-install-files/wazuh.manager.pem "$CERTS_DIR/"
|
||||||
|
cp wazuh-install-files/wazuh.manager-key.pem "$CERTS_DIR/"
|
||||||
|
cp wazuh-install-files/wazuh.dashboard.pem "$CERTS_DIR/"
|
||||||
|
cp wazuh-install-files/wazuh.dashboard-key.pem "$CERTS_DIR/"
|
||||||
|
cp wazuh-install-files/root-ca.pem "$CERTS_DIR/"
|
||||||
|
cp wazuh-install-files/root-ca.pem "$CERTS_DIR/root-ca-manager.pem"
|
||||||
|
cp wazuh-install-files/admin.pem "$CERTS_DIR/"
|
||||||
|
cp wazuh-install-files/admin-key.pem "$CERTS_DIR/"
|
||||||
|
|
||||||
|
chmod 640 "$CERTS_DIR"/*.pem
|
||||||
|
rm -rf /tmp/wazuh-install-files /tmp/wazuh-install-files.tar /tmp/wazuh-certs-tool.sh /tmp/config.yml
|
||||||
|
|
||||||
|
echo "[OK] Certificats générés dans $CERTS_DIR"
|
||||||
Reference in New Issue
Block a user