chore: update

monitoring/security/docker-compose-security.yml

@@ -0,0 +1,177 @@
+services:
+    dozzle:
+        image: amir20/dozzle:latest
+        container_name: dozzle
+        restart: unless-stopped
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock:ro
+            - ./dozzle/users.yml:/data/users.yml:ro
+        environment:
+            DOZZLE_AUTH_PROVIDER: simple
+            DOZZLE_AUTH_TTL: 48h
+            DOZZLE_REMOTE_AGENT: "185.103.166.112:7007|pre-prod-uber|VPS,185.103.166.119:7007|prod-uber|VPS"
+        networks:
+            - monitoring_net
+
+    nginx:
+        image: nginx:alpine
+        container_name: monitoring_nginx
+        restart: unless-stopped
+        ports:
+            - "80:80"
+            - "443:443"
+        volumes:
+            - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+            - ./nginx/certs:/etc/nginx/certs:ro
+            - nginx_logs:/var/log/nginx
+        depends_on:
+            - dozzle
+            - wazuh.dashboard
+            - beszel
+        networks:
+            - monitoring_net
+
+    # ─── ClamAV Antivirus ────────────────────────────────────
+    clamav:
+        image: clamav/clamav:stable
+        container_name: clamav
+        restart: unless-stopped
+        environment:
+            - FRESHCLAM_CHECKS=24
+            - CLAMD_SCAN_MAX_FILESIZE=100M
+        volumes:
+            - clamav_data:/var/lib/clamav
+            - clamav_logs:/var/log/clamav
+            - /var/run/docker.sock:/var/run/docker.sock:ro
+        networks:
+            - monitoring_net
+
+    # ─── Beszel Hub ───────────────────────────────────────────
+    beszel:
+        image: henrygd/beszel:latest
+        container_name: beszel
+        restart: unless-stopped
+        volumes:
+            - beszel_data:/beszel_data
+        networks:
+            - monitoring_net
+
+    wazuh.manager:
+        image: wazuh/wazuh-manager:4.14.5
+        hostname: wazuh.manager
+        container_name: wazuh_manager
+        restart: unless-stopped
+        ulimits:
+            memlock:
+                soft: -1
+                hard: -1
+            nofile:
+                soft: 655360
+                hard: 655360
+        ports:
+            - "1514:1514" # Communication agents
+            - "1515:1515" # Enrôlement agents
+            - "514:514/udp" # Syslog entrant
+        environment:
+            - INDEXER_URL=https://wazuh.indexer:9200
+            - INDEXER_USERNAME=admin
+            - INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
+            - FILEBEAT_SSL_VERIFICATION_MODE=full
+            - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
+            - SSL_CERTIFICATE=/etc/ssl/filebeat.pem
+            - SSL_KEY=/etc/ssl/filebeat.key
+            - API_USERNAME=wazuh-wui
+            - API_PASSWORD=${WAZUH_API_PASSWORD}
+        entrypoint: ["/bin/bash", "/wazuh-custom/init.sh"]
+        volumes:
+            - ./wazuh/config/wazuh_manager/:/wazuh-custom/:ro
+            - wazuh_api_configuration:/var/ossec/api/configuration
+            - wazuh_etc:/var/ossec/etc
+            - wazuh_logs:/var/ossec/logs
+            - wazuh_queue:/var/ossec/queue
+            - wazuh_var_multigroups:/var/ossec/var/multigroups
+            - wazuh_integrations:/var/ossec/integrations
+            - wazuh_active_response:/var/ossec/active-response/bin
+            - wazuh_agentless:/var/ossec/agentless
+            - wazuh_wodles:/var/ossec/wodles
+            - filebeat_etc:/etc/filebeat
+            - filebeat_var:/var/lib/filebeat
+            - ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
+            - ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
+            - ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
+        networks:
+            - monitoring_net
+
+    # ─── Wazuh Indexer (OpenSearch) ───────────────────────────
+    wazuh.indexer:
+        image: wazuh/wazuh-indexer:4.14.5
+        hostname: wazuh.indexer
+        container_name: wazuh_indexer
+        restart: unless-stopped
+        ulimits:
+            memlock:
+                soft: -1
+                hard: -1
+            nofile:
+                soft: 65536
+                hard: 65536
+        environment:
+            - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
+            - INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
+        volumes:
+            - wazuh_indexer_data:/var/lib/wazuh-indexer
+            - ./wazuh/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
+            - ./wazuh/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
+            - ./wazuh/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
+            - ./wazuh/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
+            - ./wazuh/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
+            - ./wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
+            - ./wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
+        networks:
+            - monitoring_net
+
+    # ─── Wazuh Dashboard ──────────────────────────────────────
+    wazuh.dashboard:
+        image: wazuh/wazuh-dashboard:4.14.5
+        hostname: wazuh.dashboard
+        container_name: wazuh_dashboard
+        restart: unless-stopped
+        environment:
+            - INDEXER_USERNAME=admin
+            - INDEXER_PASSWORD=${WAZUH_INDEXER_PASSWORD}
+            - WAZUH_API_URL=https://wazuh.manager
+            - DASHBOARD_USERNAME=kibanaserver
+            - DASHBOARD_PASSWORD=${WAZUH_DASHBOARD_PASSWORD}
+            - API_USERNAME=wazuh-wui
+            - API_PASSWORD=${WAZUH_API_PASSWORD}
+        volumes:
+            - ./wazuh/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
+            - ./wazuh/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
+            - ./wazuh/certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
+            - ./wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
+        depends_on:
+            - wazuh.indexer
+            - wazuh.manager
+        networks:
+            - monitoring_net
+networks:
+    monitoring_net:
+        driver: bridge
+
+volumes:
+    wazuh_api_configuration:
+    wazuh_etc:
+    wazuh_logs:
+    wazuh_queue:
+    wazuh_var_multigroups:
+    wazuh_integrations:
+    wazuh_active_response:
+    wazuh_agentless:
+    wazuh_wodles:
+    filebeat_etc:
+    filebeat_var:
+    wazuh_indexer_data:
+    nginx_logs:
+    beszel_data:
+    clamav_data:
+    clamav_logs: