Vollständiges Redesign

2026-07-23 14:45:35 +02:00
parent 42db7d18f6
commit c49bfa1c34
58 changed files with 2781 additions and 18124 deletions
@@ -0,0 +1,88 @@
+#!/usr/bin/env sh
+set -eu
+cd "$(dirname "$0")"
+command -v docker >/dev/null 2>&1 || { echo "Docker fehlt." >&2; exit 1; }
+docker compose version >/dev/null 2>&1 || { echo "Docker Compose Plugin fehlt." >&2; exit 1; }
+
+PRESET_ENROLLMENT_KEY="${ENROLLMENT_KEY:-}"
+randhex(){ n="$1"; if command -v openssl >/dev/null 2>&1; then openssl rand -hex "$n"; else dd if=/dev/urandom bs="$n" count=1 2>/dev/null | od -An -tx1 | tr -d ' \n'; fi; }
+http_ok(){
+  url="$1"
+  if command -v curl >/dev/null 2>&1; then curl -fsS "$url" >/dev/null 2>&1; return $?; fi
+  if command -v wget >/dev/null 2>&1; then wget -q -O /dev/null "$url" >/dev/null 2>&1; return $?; fi
+  return 2
+}
+if [ ! -f .env ]; then
+  POSTGRES_PASSWORD="$(randhex 24)"
+  CLICKHOUSE_PASSWORD="$(randhex 24)"
+  ENROLLMENT_KEY="${PRESET_ENROLLMENT_KEY:-$(randhex 32)}"
+  UI_PASSWORD="$(randhex 18)"
+  GARAGE_ACCESS_KEY="GK$(randhex 16)"
+  GARAGE_SECRET_KEY="$(randhex 32)"
+  GARAGE_RPC_SECRET="$(randhex 32)"
+  GARAGE_ADMIN_TOKEN="$(randhex 32)"
+  GARAGE_METRICS_TOKEN="$(randhex 32)"
+  cat > .env <<EOT
+INGRESS_BIND=0.0.0.0
+INGRESS_PORT=8090
+UI_BIND=0.0.0.0
+UI_PORT=8080
+TENANT_ID=default
+UI_USERNAME=admin
+UI_PASSWORD=$UI_PASSWORD
+POSTGRES_PASSWORD=$POSTGRES_PASSWORD
+CLICKHOUSE_PASSWORD=$CLICKHOUSE_PASSWORD
+ENROLLMENT_KEY=$ENROLLMENT_KEY
+GARAGE_ACCESS_KEY=$GARAGE_ACCESS_KEY
+GARAGE_SECRET_KEY=$GARAGE_SECRET_KEY
+GARAGE_RPC_SECRET=$GARAGE_RPC_SECRET
+GARAGE_ADMIN_TOKEN=$GARAGE_ADMIN_TOKEN
+GARAGE_METRICS_TOKEN=$GARAGE_METRICS_TOKEN
+GARAGE_BUCKET=siem-raw
+EVENT_RETENTION_DAYS=90
+ROLLUP_RETENTION_DAYS=730
+RAW_RETENTION=720h
+RAW_ARCHIVE_ENABLED=true
+KAFKA_RETENTION_MS=86400000
+KAFKA_PARTITIONS=6
+DETECTOR_INTERVAL=30s
+DETECTOR_LOOKBACK=20m
+UI_QUERY_LIMIT=500
+EOT
+  chmod 600 .env 2>/dev/null || true
+fi
+set -a; . ./.env; set +a
+UI_USERNAME="${UI_USERNAME:-admin}"
+if [ -z "${UI_PASSWORD:-}" ]; then
+  UI_PASSWORD="$(randhex 18)"
+  printf '\nUI_USERNAME=%s\nUI_PASSWORD=%s\n' "$UI_USERNAME" "$UI_PASSWORD" >> .env
+  export UI_USERNAME UI_PASSWORD
+fi
+sed -e "s/__GARAGE_RPC_SECRET__/$GARAGE_RPC_SECRET/g" -e "s/__GARAGE_ADMIN_TOKEN__/$GARAGE_ADMIN_TOKEN/g" -e "s/__GARAGE_METRICS_TOKEN__/$GARAGE_METRICS_TOKEN/g" deploy/garage/garage.toml.template > deploy/garage/garage.toml
+sed -e "s/__EVENT_RETENTION_DAYS__/${EVENT_RETENTION_DAYS:-90}/g" -e "s/__ROLLUP_RETENTION_DAYS__/${ROLLUP_RETENTION_DAYS:-730}/g" deploy/clickhouse/init.sql.template > deploy/clickhouse/init.sql
+chmod 600 deploy/garage/garage.toml 2>/dev/null || true
+
+echo "Baue und starte Greenfield SIEM ..."
+docker compose build --pull
+docker compose up -d --remove-orphans
+
+echo "Prüfe Dienste ..."
+if command -v curl >/dev/null 2>&1 || command -v wget >/dev/null 2>&1; then
+  i=0
+  while [ "$i" -lt 60 ]; do
+    if http_ok "http://127.0.0.1:${UI_PORT:-8080}/readyz" && http_ok "http://127.0.0.1:${INGRESS_PORT:-8090}/readyz"; then break; fi
+    i=$((i+1)); sleep 2
+  done
+  if [ "$i" -ge 60 ]; then echo "Deployment gestartet, Healthcheck noch nicht grün. Prüfe: docker compose ps && docker compose logs" >&2; exit 1; fi
+else
+  echo "Hinweis: curl/wget fehlt; HTTP-Healthcheck wird übersprungen."
+  docker compose ps
+fi
+
+echo
+echo "Greenfield SIEM läuft."
+echo "UI:      http://127.0.0.1:${UI_PORT:-8080}/ui"
+echo "Ingress: http://127.0.0.1:${INGRESS_PORT:-8090}/ingest"
+echo "UI-Login: $UI_USERNAME / $UI_PASSWORD"
+echo "Enrollment-Key: $ENROLLMENT_KEY"
+echo "Secrets stehen in .env (Datei schützen und sichern)."