71 lines
3.4 KiB
PowerShell
71 lines
3.4 KiB
PowerShell
$ErrorActionPreference = "Stop"
|
|
Set-Location $PSScriptRoot
|
|
if (-not (Get-Command docker -ErrorAction SilentlyContinue)) { throw "Docker fehlt." }
|
|
docker compose version | Out-Null
|
|
function Hex([int]$bytes) { $b = New-Object byte[] $bytes; [Security.Cryptography.RandomNumberGenerator]::Fill($b); return ([BitConverter]::ToString($b)).Replace("-","").ToLower() }
|
|
if (-not (Test-Path .env)) {
|
|
$presetEnrollment = $env:ENROLLMENT_KEY
|
|
$enrollment = if ([string]::IsNullOrWhiteSpace($presetEnrollment)) { Hex 32 } else { $presetEnrollment }
|
|
$vals = @{
|
|
POSTGRES_PASSWORD=Hex 24; CLICKHOUSE_PASSWORD=Hex 24; ENROLLMENT_KEY=$enrollment; UI_PASSWORD=Hex 18;
|
|
GARAGE_ACCESS_KEY="GK$(Hex 16)"; GARAGE_SECRET_KEY=Hex 32; GARAGE_RPC_SECRET=Hex 32;
|
|
GARAGE_ADMIN_TOKEN=Hex 32; GARAGE_METRICS_TOKEN=Hex 32
|
|
}
|
|
@"
|
|
INGRESS_BIND=0.0.0.0
|
|
INGRESS_PORT=8090
|
|
UI_BIND=0.0.0.0
|
|
UI_PORT=8080
|
|
TENANT_ID=default
|
|
UI_USERNAME=admin
|
|
UI_PASSWORD=$($vals.UI_PASSWORD)
|
|
POSTGRES_PASSWORD=$($vals.POSTGRES_PASSWORD)
|
|
CLICKHOUSE_PASSWORD=$($vals.CLICKHOUSE_PASSWORD)
|
|
ENROLLMENT_KEY=$($vals.ENROLLMENT_KEY)
|
|
GARAGE_ACCESS_KEY=$($vals.GARAGE_ACCESS_KEY)
|
|
GARAGE_SECRET_KEY=$($vals.GARAGE_SECRET_KEY)
|
|
GARAGE_RPC_SECRET=$($vals.GARAGE_RPC_SECRET)
|
|
GARAGE_ADMIN_TOKEN=$($vals.GARAGE_ADMIN_TOKEN)
|
|
GARAGE_METRICS_TOKEN=$($vals.GARAGE_METRICS_TOKEN)
|
|
GARAGE_BUCKET=siem-raw
|
|
EVENT_RETENTION_DAYS=90
|
|
ROLLUP_RETENTION_DAYS=730
|
|
RAW_RETENTION=720h
|
|
RAW_ARCHIVE_ENABLED=true
|
|
KAFKA_RETENTION_MS=86400000
|
|
KAFKA_PARTITIONS=6
|
|
DETECTOR_INTERVAL=30s
|
|
DETECTOR_LOOKBACK=20m
|
|
UI_QUERY_LIMIT=500
|
|
"@ | Set-Content .env
|
|
}
|
|
$envMap=@{}; Get-Content .env | ForEach-Object { if ($_ -match '^([^#=]+)=(.*)$') {$envMap[$matches[1]]=$matches[2]} }
|
|
if (-not $envMap.ContainsKey('UI_USERNAME')) { $envMap['UI_USERNAME']='admin'; Add-Content .env "UI_USERNAME=admin" }
|
|
if (-not $envMap.ContainsKey('UI_PASSWORD') -or [string]::IsNullOrWhiteSpace($envMap['UI_PASSWORD'])) { $envMap['UI_PASSWORD']=Hex 18; Add-Content .env "UI_PASSWORD=$($envMap.UI_PASSWORD)" }
|
|
(Get-Content deploy/garage/garage.toml.template -Raw).Replace('__GARAGE_RPC_SECRET__',$envMap.GARAGE_RPC_SECRET).Replace('__GARAGE_ADMIN_TOKEN__',$envMap.GARAGE_ADMIN_TOKEN).Replace('__GARAGE_METRICS_TOKEN__',$envMap.GARAGE_METRICS_TOKEN) | Set-Content deploy/garage/garage.toml
|
|
(Get-Content deploy/clickhouse/init.sql.template -Raw).Replace('__EVENT_RETENTION_DAYS__',$envMap.EVENT_RETENTION_DAYS).Replace('__ROLLUP_RETENTION_DAYS__',$envMap.ROLLUP_RETENTION_DAYS) | Set-Content deploy/clickhouse/init.sql
|
|
Write-Host "Baue und starte Greenfield SIEM ..."
|
|
docker compose build --pull
|
|
docker compose up -d --remove-orphans
|
|
|
|
Write-Host "Pruefe Dienste ..."
|
|
$healthy = $false
|
|
for ($i = 0; $i -lt 60; $i++) {
|
|
try {
|
|
Invoke-WebRequest -UseBasicParsing -TimeoutSec 2 "http://127.0.0.1:$($envMap.UI_PORT)/readyz" | Out-Null
|
|
Invoke-WebRequest -UseBasicParsing -TimeoutSec 2 "http://127.0.0.1:$($envMap.INGRESS_PORT)/readyz" | Out-Null
|
|
$healthy = $true
|
|
break
|
|
} catch {
|
|
Start-Sleep -Seconds 2
|
|
}
|
|
}
|
|
if (-not $healthy) { throw "Deployment gestartet, Healthcheck noch nicht gruen. Pruefe: docker compose ps; docker compose logs" }
|
|
Write-Host ""
|
|
Write-Host "Greenfield SIEM laeuft."
|
|
Write-Host "UI: http://127.0.0.1:$($envMap.UI_PORT)/ui"
|
|
Write-Host "Ingress: http://127.0.0.1:$($envMap.INGRESS_PORT)/ingest"
|
|
Write-Host "UI-Login: $($envMap.UI_USERNAME) / $($envMap.UI_PASSWORD)"
|
|
Write-Host "Enrollment-Key: $($envMap.ENROLLMENT_KEY)"
|
|
Write-Host "Secrets stehen in .env (Datei schuetzen und sichern)."
|