Pub

compose.yml

@@ -27,10 +27,7 @@ services:
       start_period: 30s
 
   siem-backend:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    image: siem-backend:latest
+    image: git.send.nrw/sendnrw/siem-backend:latest
     container_name: siem-backend
     restart: unless-stopped
     env_file:
@@ -64,7 +61,7 @@ services:
       mariadb:
         condition: service_healthy
     ports:
-      - "8080:8080"
+      - "8090:8080"
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8080/healthz >/dev/null 2>&1 || exit 1"]
       interval: 30s

dot_env

@@ -0,0 +1,38 @@
+TZ=Europe/Berlin
+
+LISTEN_ADDR=:8080
+DB_DSN=eventuser:DEINPASSWORT@tcp(mariadb:3306)/eventcollector?parseTime=true&charset=utf8mb4,utf8&collation=utf8mb4_unicode_ci&loc=UTC
+
+DB_MAX_OPEN_CONNS=50
+DB_MAX_IDLE_CONNS=25
+DB_CONN_MAX_LIFETIME=3m
+DB_CONN_MAX_IDLE_TIME=1m
+
+MAX_BODY_BYTES=10485760
+HTTP_READ_TIMEOUT=15s
+HTTP_WRITE_TIMEOUT=30s
+HTTP_IDLE_TIMEOUT=60s
+
+DETECTION_INTERVAL=1m
+OFFLINE_AFTER=10m
+FAILED_LOGON_WINDOW=5m
+FAILED_LOGON_THRESHOLD=25
+REBOOT_WINDOW=15m
+REBOOT_THRESHOLD=3
+PASSWORD_SPRAY_WINDOW=5m
+PASSWORD_SPRAY_MIN_USERS=5
+PASSWORD_SPRAY_MIN_ATTEMPTS=15
+SUCCESS_AFTER_FAILURE_WINDOW=10m
+NEW_SOURCE_IP_LOOKBACK=720h
+NEW_SOURCE_IP_WINDOW=10m
+DETECTIONS_LIMIT=100
+
+MARIADB_DATABASE=eventcollector
+MARIADB_USER=eventuser
+MARIADB_PASSWORD=DEINPASSWORT
+MARIADB_ROOT_PASSWORD=ROOTPASSWORT
+
+GRAFANA_ADMIN_USER=admin
+GRAFANA_ADMIN_PASSWORD=admin
+
+ENROLLMENT_KEY=BITTE_SEHR_LANG_UND_ZUFAELLIG