sendnrw/siem-backend
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Funktionsrollback
Some checks failed
release-tag / release-image (push) Failing after 1m8s
Details

Browse Source
This commit is contained in:
jbergner
2026-07-24 07:17:38 +02:00
parent a4ff984914
commit e9d9583f28
38 changed files with 3243 additions and 364 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
deploy.sh
View File

@@ -45,12 +45,12 @@ while IFS= read -r line || [ -n "$line" ]; do
done < .env.example
# Generate secrets only if absent/blank/placeholder. Existing installations keep their credentials.
for key in POSTGRES_PASSWORD CLICKHOUSE_PASSWORD UI_PASSWORD GARAGE_SECRET_KEY GARAGE_RPC_SECRET GARAGE_ADMIN_TOKEN GARAGE_METRICS_TOKEN; do
for key in POSTGRES_PASSWORD CLICKHOUSE_PASSWORD CLICKHOUSE_GRAFANA_PASSWORD UI_PASSWORD GRAFANA_ADMIN_PASSWORD GARAGE_SECRET_KEY GARAGE_RPC_SECRET GARAGE_ADMIN_TOKEN GARAGE_METRICS_TOKEN; do
val="$(get_env "$key")"
if [ -z "$val" ] || [ "$val" = "CHANGE_ME" ]; then
case "$key" in
POSTGRES_PASSWORD|CLICKHOUSE_PASSWORD) val="$(randhex 24)" ;;
UI_PASSWORD) val="$(randhex 18)" ;;
POSTGRES_PASSWORD|CLICKHOUSE_PASSWORD|CLICKHOUSE_GRAFANA_PASSWORD) val="$(randhex 24)" ;;
UI_PASSWORD|GRAFANA_ADMIN_PASSWORD) val="$(randhex 18)" ;;
*) val="$(randhex 32)" ;;
esac
set_env "$key" "$val"
@@ -73,7 +73,7 @@ chmod 600 .env 2>/dev/null || true
# Validate required settings without sourcing .env as shell code. Docker Compose parses
# .env itself; this also keeps values with shell-special characters safe.
for key in POSTGRES_PASSWORD CLICKHOUSE_PASSWORD UI_PASSWORD ENROLLMENT_KEY GARAGE_ACCESS_KEY GARAGE_SECRET_KEY GARAGE_RPC_SECRET GARAGE_ADMIN_TOKEN GARAGE_METRICS_TOKEN; do
for key in POSTGRES_PASSWORD CLICKHOUSE_PASSWORD CLICKHOUSE_GRAFANA_PASSWORD UI_PASSWORD GRAFANA_ADMIN_PASSWORD ENROLLMENT_KEY GARAGE_ACCESS_KEY GARAGE_SECRET_KEY GARAGE_RPC_SECRET GARAGE_ADMIN_TOKEN GARAGE_METRICS_TOKEN; do
val="$(get_env "$key")"
if [ -z "$val" ] || [ "$val" = "CHANGE_ME" ]; then
echo "Ungültige .env: $key fehlt oder ist noch CHANGE_ME." >&2
@@ -92,6 +92,16 @@ UI_USERNAME_VALUE="$(get_env UI_USERNAME)"; [ -n "$UI_USERNAME_VALUE" ] || UI_US
UI_PASSWORD_VALUE="$(get_env UI_PASSWORD)"
ENROLLMENT_KEY_VALUE="$(get_env ENROLLMENT_KEY)"
echo "Prüfe Host-Kompatibilität und Portbelegung ..."
./preflight.sh
# preflight may have changed ports or the ClickHouse image. Read final values again.
UI_PORT_VALUE="$(get_env UI_PORT)"; [ -n "$UI_PORT_VALUE" ] || UI_PORT_VALUE=8080
INGRESS_PORT_VALUE="$(get_env INGRESS_PORT)"; [ -n "$INGRESS_PORT_VALUE" ] || INGRESS_PORT_VALUE=8090
GRAFANA_PORT_VALUE="$(get_env GRAFANA_PORT)"; [ -n "$GRAFANA_PORT_VALUE" ] || GRAFANA_PORT_VALUE=3000
CLICKHOUSE_HTTP_PORT_VALUE="$(get_env CLICKHOUSE_HTTP_PORT)"; [ -n "$CLICKHOUSE_HTTP_PORT_VALUE" ] || CLICKHOUSE_HTTP_PORT_VALUE=8123
CLICKHOUSE_NATIVE_PORT_VALUE="$(get_env CLICKHOUSE_NATIVE_PORT)"; [ -n "$CLICKHOUSE_NATIVE_PORT_VALUE" ] || CLICKHOUSE_NATIVE_PORT_VALUE=9000
# Validate the final config before pulling/building anything.
echo "Prüfe Compose-Konfiguration ..."
docker compose config >/dev/null
@@ -110,12 +120,13 @@ http_ok() {
echo "Prüfe Readiness ..."
i=0
while [ "$i" -lt 90 ]; do
api_ok=0; ingress_ok=0; ch_ok=0; garage_ok=0
api_ok=0; ingress_ok=0; ch_ok=0; garage_ok=0; grafana_ok=0
http_ok "http://127.0.0.1:${UI_PORT_VALUE}/readyz" && api_ok=1 || true
http_ok "http://127.0.0.1:${INGRESS_PORT_VALUE}/readyz" && ingress_ok=1 || true
docker compose exec -T clickhouse clickhouse-client --user "${CLICKHOUSE_USER_VALUE}" --password "${CLICKHOUSE_PASSWORD_VALUE}" --query 'SELECT 1' >/dev/null 2>&1 && ch_ok=1 || true
docker compose exec -T garage /garage status >/dev/null 2>&1 && garage_ok=1 || true
if [ "$api_ok" -eq 1 ] && [ "$ingress_ok" -eq 1 ] && [ "$ch_ok" -eq 1 ] && [ "$garage_ok" -eq 1 ]; then
http_ok "http://127.0.0.1:${GRAFANA_PORT_VALUE}/api/health" && grafana_ok=1 || true
if [ "$api_ok" -eq 1 ] && [ "$ingress_ok" -eq 1 ] && [ "$ch_ok" -eq 1 ] && [ "$garage_ok" -eq 1 ] && [ "$grafana_ok" -eq 1 ]; then
break
fi
i=$((i+1))
@@ -126,7 +137,7 @@ if [ "$i" -ge 90 ]; then
echo "Mindestens ein Dienst wurde nicht bereit. Diagnose:" >&2
docker compose ps >&2 || true
echo >&2
docker compose logs --tail=120 garage clickhouse clickhouse-schema postgres postgres-schema redpanda redpanda-init ingress processor api >&2 || true
docker compose logs --tail=120 garage clickhouse clickhouse-schema postgres postgres-schema redpanda redpanda-init ingress processor detector api grafana >&2 || true
exit 1
fi
@@ -134,6 +145,8 @@ echo
echo "Greenfield SIEM läuft."
echo "UI: http://127.0.0.1:${UI_PORT_VALUE}/ui"
echo "Ingress: http://127.0.0.1:${INGRESS_PORT_VALUE}/ingest"
echo "Grafana: http://127.0.0.1:${GRAFANA_PORT_VALUE}/"
echo "Grafana-Login: $(get_env GRAFANA_ADMIN_USER) / $(get_env GRAFANA_ADMIN_PASSWORD)"
echo "UI-Login: ${UI_USERNAME_VALUE} / ${UI_PASSWORD_VALUE}"
echo "ClickHouse: user=${CLICKHOUSE_USER_VALUE} db=${CLICKHOUSE_DB_VALUE} http=127.0.0.1:${CLICKHOUSE_HTTP_PORT_VALUE} native=127.0.0.1:${CLICKHOUSE_NATIVE_PORT_VALUE}"
echo "Enrollment-Key: ${ENROLLMENT_KEY_VALUE}"