89 lines
3.4 KiB
Bash
Executable File
89 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env sh
|
|
set -eu
|
|
cd "$(dirname "$0")"
|
|
command -v docker >/dev/null 2>&1 || { echo "Docker fehlt." >&2; exit 1; }
|
|
docker compose version >/dev/null 2>&1 || { echo "Docker Compose Plugin fehlt." >&2; exit 1; }
|
|
|
|
PRESET_ENROLLMENT_KEY="${ENROLLMENT_KEY:-}"
|
|
randhex(){ n="$1"; if command -v openssl >/dev/null 2>&1; then openssl rand -hex "$n"; else dd if=/dev/urandom bs="$n" count=1 2>/dev/null | od -An -tx1 | tr -d ' \n'; fi; }
|
|
http_ok(){
|
|
url="$1"
|
|
if command -v curl >/dev/null 2>&1; then curl -fsS "$url" >/dev/null 2>&1; return $?; fi
|
|
if command -v wget >/dev/null 2>&1; then wget -q -O /dev/null "$url" >/dev/null 2>&1; return $?; fi
|
|
return 2
|
|
}
|
|
if [ ! -f .env ]; then
|
|
POSTGRES_PASSWORD="$(randhex 24)"
|
|
CLICKHOUSE_PASSWORD="$(randhex 24)"
|
|
ENROLLMENT_KEY="${PRESET_ENROLLMENT_KEY:-$(randhex 32)}"
|
|
UI_PASSWORD="$(randhex 18)"
|
|
GARAGE_ACCESS_KEY="GK$(randhex 16)"
|
|
GARAGE_SECRET_KEY="$(randhex 32)"
|
|
GARAGE_RPC_SECRET="$(randhex 32)"
|
|
GARAGE_ADMIN_TOKEN="$(randhex 32)"
|
|
GARAGE_METRICS_TOKEN="$(randhex 32)"
|
|
cat > .env <<EOT
|
|
INGRESS_BIND=0.0.0.0
|
|
INGRESS_PORT=8090
|
|
UI_BIND=0.0.0.0
|
|
UI_PORT=8080
|
|
TENANT_ID=default
|
|
UI_USERNAME=admin
|
|
UI_PASSWORD=$UI_PASSWORD
|
|
POSTGRES_PASSWORD=$POSTGRES_PASSWORD
|
|
CLICKHOUSE_PASSWORD=$CLICKHOUSE_PASSWORD
|
|
ENROLLMENT_KEY=$ENROLLMENT_KEY
|
|
GARAGE_ACCESS_KEY=$GARAGE_ACCESS_KEY
|
|
GARAGE_SECRET_KEY=$GARAGE_SECRET_KEY
|
|
GARAGE_RPC_SECRET=$GARAGE_RPC_SECRET
|
|
GARAGE_ADMIN_TOKEN=$GARAGE_ADMIN_TOKEN
|
|
GARAGE_METRICS_TOKEN=$GARAGE_METRICS_TOKEN
|
|
GARAGE_BUCKET=siem-raw
|
|
EVENT_RETENTION_DAYS=90
|
|
ROLLUP_RETENTION_DAYS=730
|
|
RAW_RETENTION=720h
|
|
RAW_ARCHIVE_ENABLED=true
|
|
KAFKA_RETENTION_MS=86400000
|
|
KAFKA_PARTITIONS=6
|
|
DETECTOR_INTERVAL=30s
|
|
DETECTOR_LOOKBACK=20m
|
|
UI_QUERY_LIMIT=500
|
|
EOT
|
|
chmod 600 .env 2>/dev/null || true
|
|
fi
|
|
set -a; . ./.env; set +a
|
|
UI_USERNAME="${UI_USERNAME:-admin}"
|
|
if [ -z "${UI_PASSWORD:-}" ]; then
|
|
UI_PASSWORD="$(randhex 18)"
|
|
printf '\nUI_USERNAME=%s\nUI_PASSWORD=%s\n' "$UI_USERNAME" "$UI_PASSWORD" >> .env
|
|
export UI_USERNAME UI_PASSWORD
|
|
fi
|
|
sed -e "s/__GARAGE_RPC_SECRET__/$GARAGE_RPC_SECRET/g" -e "s/__GARAGE_ADMIN_TOKEN__/$GARAGE_ADMIN_TOKEN/g" -e "s/__GARAGE_METRICS_TOKEN__/$GARAGE_METRICS_TOKEN/g" deploy/garage/garage.toml.template > deploy/garage/garage.toml
|
|
sed -e "s/__EVENT_RETENTION_DAYS__/${EVENT_RETENTION_DAYS:-90}/g" -e "s/__ROLLUP_RETENTION_DAYS__/${ROLLUP_RETENTION_DAYS:-730}/g" deploy/clickhouse/init.sql.template > deploy/clickhouse/init.sql
|
|
chmod 600 deploy/garage/garage.toml 2>/dev/null || true
|
|
|
|
echo "Baue und starte Greenfield SIEM ..."
|
|
docker compose build --pull
|
|
docker compose up -d --remove-orphans
|
|
|
|
echo "Prüfe Dienste ..."
|
|
if command -v curl >/dev/null 2>&1 || command -v wget >/dev/null 2>&1; then
|
|
i=0
|
|
while [ "$i" -lt 60 ]; do
|
|
if http_ok "http://127.0.0.1:${UI_PORT:-8080}/readyz" && http_ok "http://127.0.0.1:${INGRESS_PORT:-8090}/readyz"; then break; fi
|
|
i=$((i+1)); sleep 2
|
|
done
|
|
if [ "$i" -ge 60 ]; then echo "Deployment gestartet, Healthcheck noch nicht grün. Prüfe: docker compose ps && docker compose logs" >&2; exit 1; fi
|
|
else
|
|
echo "Hinweis: curl/wget fehlt; HTTP-Healthcheck wird übersprungen."
|
|
docker compose ps
|
|
fi
|
|
|
|
echo
|
|
echo "Greenfield SIEM läuft."
|
|
echo "UI: http://127.0.0.1:${UI_PORT:-8080}/ui"
|
|
echo "Ingress: http://127.0.0.1:${INGRESS_PORT:-8090}/ingest"
|
|
echo "UI-Login: $UI_USERNAME / $UI_PASSWORD"
|
|
echo "Enrollment-Key: $ENROLLMENT_KEY"
|
|
echo "Secrets stehen in .env (Datei schützen und sichern)."
|