102 lines
2.5 KiB
Plaintext
102 lines
2.5 KiB
Plaintext
# ============================================================
|
|
# Greenfield SIEM - complete configuration
|
|
# deploy.sh / deploy.ps1 creates .env and replaces CHANGE_ME.
|
|
# ============================================================
|
|
|
|
# Public SIEM endpoints
|
|
INGRESS_BIND=0.0.0.0
|
|
INGRESS_PORT=8090
|
|
UI_BIND=0.0.0.0
|
|
UI_PORT=8080
|
|
TENANT_ID=default
|
|
UI_USERNAME=admin
|
|
UI_PASSWORD=CHANGE_ME
|
|
ENROLLMENT_KEY=CHANGE_ME
|
|
|
|
# Ingress limits
|
|
MAX_BODY_BYTES=8388608
|
|
MAX_BATCH_EVENTS=1000
|
|
|
|
# PostgreSQL control plane
|
|
POSTGRES_IMAGE=postgres:18.4-alpine
|
|
POSTGRES_DB=siem
|
|
POSTGRES_USER=siem
|
|
POSTGRES_PASSWORD=CHANGE_ME
|
|
POSTGRES_BIND=127.0.0.1
|
|
POSTGRES_PORT=5432
|
|
|
|
# ClickHouse event store
|
|
CLICKHOUSE_IMAGE=clickhouse/clickhouse-server:26.3.17.56
|
|
CLICKHOUSE_DB=siem
|
|
CLICKHOUSE_USER=siem
|
|
CLICKHOUSE_PASSWORD=CHANGE_ME
|
|
CLICKHOUSE_GRAFANA_PASSWORD=CHANGE_ME
|
|
CLICKHOUSE_HTTP_BIND=127.0.0.1
|
|
CLICKHOUSE_HTTP_PORT=8123
|
|
CLICKHOUSE_NATIVE_BIND=127.0.0.1
|
|
CLICKHOUSE_NATIVE_PORT=9000
|
|
EVENT_RETENTION_DAYS=90
|
|
ROLLUP_RETENTION_DAYS=730
|
|
|
|
# Redpanda durable ingest queue
|
|
REDPANDA_IMAGE=docker.redpanda.com/redpandadata/redpanda:v26.1.13
|
|
REDPANDA_CONSOLE_IMAGE=docker.redpanda.com/redpandadata/console:v3.8.0
|
|
REDPANDA_BIND=127.0.0.1
|
|
REDPANDA_KAFKA_PORT=19092
|
|
REDPANDA_ADMIN_PORT=19644
|
|
REDPANDA_CONSOLE_BIND=127.0.0.1
|
|
REDPANDA_CONSOLE_PORT=8081
|
|
REDPANDA_SMP=2
|
|
REDPANDA_LOG_LEVEL=info
|
|
KAFKA_TOPIC=siem-events
|
|
KAFKA_GROUP=siem-processor-v1
|
|
KAFKA_PARTITIONS=6
|
|
KAFKA_RETENTION_MS=86400000
|
|
|
|
# Garage S3-compatible raw archive
|
|
GARAGE_IMAGE=dxflrs/garage:v2.3.0
|
|
ALPINE_IMAGE=alpine:3.22
|
|
GARAGE_BIND=127.0.0.1
|
|
GARAGE_S3_PORT=3900
|
|
GARAGE_ADMIN_PORT=3903
|
|
GARAGE_BUCKET=siem-raw
|
|
GARAGE_ACCESS_KEY=CHANGE_ME
|
|
GARAGE_SECRET_KEY=CHANGE_ME
|
|
GARAGE_RPC_SECRET=CHANGE_ME
|
|
GARAGE_ADMIN_TOKEN=CHANGE_ME
|
|
GARAGE_METRICS_TOKEN=CHANGE_ME
|
|
GARAGE_LOG_LEVEL=garage=info
|
|
RAW_ARCHIVE_ENABLED=true
|
|
RAW_RETENTION=720h
|
|
ARCHIVE_UPLOAD_INTERVAL_SECONDS=30
|
|
|
|
# Detector / API
|
|
DETECTOR_INTERVAL=30s
|
|
DETECTOR_LOOKBACK=20m
|
|
UI_QUERY_LIMIT=500
|
|
|
|
|
|
# Grafana analyst dashboards
|
|
GRAFANA_IMAGE=grafana/grafana:13.1
|
|
GRAFANA_BIND=0.0.0.0
|
|
GRAFANA_PORT=3000
|
|
GRAFANA_PUBLIC_URL=
|
|
GRAFANA_ADMIN_USER=admin
|
|
GRAFANA_ADMIN_PASSWORD=CHANGE_ME
|
|
GRAFANA_CLICKHOUSE_PLUGIN_VERSION=4.20.0
|
|
|
|
# Prometheus
|
|
PROMETHEUS_IMAGE=prom/prometheus:v3.13.1
|
|
PROMETHEUS_BIND=127.0.0.1
|
|
PROMETHEUS_PORT=9090
|
|
PROMETHEUS_RETENTION=30d
|
|
|
|
# Raw uploader and application image
|
|
RCLONE_IMAGE=rclone/rclone:1.74.4
|
|
APP_IMAGE=greenfield-siem-app:local
|
|
|
|
# Deployment compatibility / automatic conflict handling
|
|
AUTO_PORTS=true
|
|
CLICKHOUSE_CPU_PROBE=true
|
|
CLICKHOUSE_FALLBACK_IMAGE=clickhouse/clickhouse-server:26.3.17.56
|