chore: sync main -> dev - #266
Merged
Merged
Conversation
…components--raes-env-packs chore(main): release 3.6.0
…components--raes-env-packs chore(main): release 3.6.1
chore: release fix
…components--raes-env-packs chore(main): release 3.6.2
chore: promote dev to main
…components--raes-env-packs chore(main): release 3.7.0
…yout The soc-certificate-profile/v1 outputs declared a clean ideal layout (ca/lab-ca.crt, thehive/thehive.p12, shuffle/...) that did not match the files the backend CA generator actually issues. Declare the produced layout instead: lab-ca.pem / lab-ca.key at the root, <service>/server.pem + server.key, the thehive PKCS#12 keystore as keystore.p12 + keystore.p12.password, and the shuffle cert under the shuffle-frontend service directory. A consuming backend can now find every declared output.
…onment Both crash-looped at boot for want of their operational environment: mariadb needs MYSQL_ROOT_PASSWORD (+ db/user/password), and opensearch needs OPENSEARCH_INITIAL_ADMIN_PASSWORD (+ single-node discovery and heap). Declare these through the runtime environment so a realizing backend brings them up configured. Fixed lab credentials, matching the range's established values.
Tempo crash-looped with 'unknown backend' because it had no config: declare its -config.file startup command and the tempo.yaml (local trace storage over the tempo_data volume) as node content, delivered to the image node as a read-only bind mount by the backend.
Both wazuh-agent sidecars crash-looped with 'WAZUH_MANAGER is required'. Declare the agent environment (manager target = the wazuh-manager service, agent name, tailed log path and format) alongside the existing forwarding_agents desired state so the agent entrypoint enrolls against the manager.
…script) The one-shot index initializer had no source at all, so a dependency reference to it failed with 'container never created'. Declare its elasticsearch image, its /bin/sh entrypoint, and its index-init script as node content so it is realized and runs to pre-create Cortex's keyword mappings before Cortex starts.
Declare the wazuh-indexer/manager/dashboard runtime.environment so the cluster is realized from the SDL rather than a hand-authored backend definition: indexer JVM opts; manager INDEXER_URL + operator-secret INDEXER/API creds + filebeat SSL paths; dashboard INDEXER/DASHBOARD/API operator-secret creds + WAZUH_API_URL. Operator secrets are authored empty and supplied by the operator .env; DNS references use the hyphenated service names. First increment of realizing wazuh generically (aptl #875 Cluster A).
…#259) The wazuh-indexer image's bundled opensearch.yml points TLS material at /etc/wazuh-indexer/certs, which the OpenSearch SecurityManager policy denies reading; the range's certs are issued into /usr/share/wazuh-indexer/certs. Declare the indexer security config as content pointing at that path, with the range's nodes_dn/admin_dn, so the cluster comes up on its own PKI. Generic realization of the wazuh indexer (aptl #875 Cluster A).
Declare opensearch_dashboards.yml (dashboard->indexer over TLS at /usr/share/wazuh-dashboard/certs) and wazuh.yml (dashboard->manager API, wazuh-wui fixture cred) as content, with hyphenated service DNS names (wazuh-indexer / wazuh-manager) since the generic realization uses the Compose service name as the DNS name. Completes the wazuh dashboard's declared desired-state (aptl #875).
…ement (#259) suricata: declare the run entrypoint (docker-entrypoint -c suricata.yaml --pcap), the NET_ADMIN/NET_RAW/SYS_NICE capabilities the sensor needs, and a boot-clean suricata.yaml (HOME_NET 172.20.0.0/16, eve.json output for the SIEM, command socket enabled) + a local.rules baseline; MISP/Suricata rules load live over the command socket per the sensor declaration. cortex-index-init: add the security-net placement + thehive-es dependency so the one-shot index bootstrap can reach elasticsearch (it was on no network, exiting curl code 6). (aptl #875)
…aps (#259) - suricata: run the engine directly instead of via docker-entrypoint.sh, whose chown of /etc/suricata/* fails on the read-only config content mount. - cortex-index-init: wait for thehive-es to accept connections before creating the Cortex index (a one-shot depends_on orders start, not readiness). - ad: grant CAP_SYS_ADMIN + CAP_NET_ADMIN so Samba AD DC provisioning can set sysvol NT ACLs (was failing NT_STATUS_ACCESS_DENIED with no caps). (aptl #875)
… 512m heap) (#259) thehive-es declared no environment, so Elasticsearch ran with xpack.security on, no single-node discovery, and an auto-sized JVM heap of ~1/4 host RAM (31 GB on a 125 GB host) that destabilized it under load (exit 0 -> restart loop). Declare the env the original stack used: discovery.type=single-node, xpack.security.enabled false, disk-threshold off, ES_JAVA_OPTS=-Xms512m -Xmx512m. (aptl #875)
…ive) (#259) Declare the SOC services' application configuration as content instead of leaving them on image defaults: - otel-collector: OTLP receivers -> batch -> tempo exporter (aptl-tempo:4317); - grafana: Tempo datasource (http://aptl-tempo:3200); - cortex: Elasticsearch backend (http://thehive-es:9200), local+key auth (HTTP); - thehive: backend command (--cql-hostnames thehive-cassandra, --es-hostnames thehive-es, --cortex-hostnames cortex, lucene index) + JVM heap cap. All inter-service references use the hyphenated service DNS names. TheHive HTTPS termination + the Cortex API key are delivered via env_file from generated secrets (keystore password, cortex-apikey) and remain a follow-up pending an env_file affordance for generated secrets. (aptl #875)
cortex-index-init creates the Cortex ES index and exits 0; declare runtime.container.autoremove so the backend emits restart:no and does not loop the finished one-shot. (aptl #875)
…component builds kali-ssh-proxy, webapp-proxy, and kali-capture were bare nodes with no source, so an env-pack boot had nothing to realize. Declare each as a contained component build (aptl-contained-component-build profile): - kali-ssh-proxy / webapp-proxy: the TCP-forwarder image, published on loopback (2023 / 8080). webapp-proxy reuses the ssh-proxy build context with an environment override targeting the webapp (172.20.1.20:8080); ssh-proxy relies on the image's Kali defaults. - kali-capture: the OBS-003 capture sidecar, sharing Kali's network namespace (namespaces.network.target_node_ref: kali) and holding the AUDIT_CONTROL/AUDIT_WRITE/SYS_PACCT/NET_RAW capabilities; its volume mount stays authored under persistent_volumes.
The kali-ssh-proxy and kali-capture Dockerfiles moved to root-relative COPY paths so they build under the contained-component-build profile; update the declared materialization-specification digests to match the new context.
The pre-refactor range published the Wazuh indexer (9200), manager (1514/1515/514-udp/55000), and dashboard (443->5601) on host loopback. Restore those declarations: the authenticated readiness gate probes the indexer over 9200 and the manager API over 55000, so without them a boot comes up healthy but fails the gate; the dashboard 443 binding is the operator-facing SOC UI.
The Wazuh indexer initializes its security index from internal_users.yml on
first boot. Without it the indexer used its bundled demo users, whose admin
hash does not match the operator's INDEXER_PASSWORD ('SecretPassword'), so
every authenticated consumer (readiness gate, manager filebeat, dashboard)
got 401. Restore the file the pre-refactor range mounted; its admin hash is
the bcrypt of the password APTL hydrates into .env, so auth succeeds.
…ing source Two exact requirements the SDL declared but the range did not realize, which RAES 3.3.0's SEM-218 gate correctly rejected: - misp-suricata-sync MISP_VERIFY_SSL was declared valueless; the lab default 'false' (ADR-022: MISP self-signs, no lab CA) was leaking in from the operator .env out of band. Declare it so it is realized range content. - wazuh-sidecar-db tailed /logs/pg_log/postgresql.log, a path nothing delivered after the db moved to a generic-base apt PostgreSQL 15 install (which logs to /var/log/postgresql/postgresql-15-main.log). Add a db_logs volume shared db -> /var/log/postgresql and sidecar -> /logs, and point the forwarder at the real file, so database activity genuinely reaches the SIEM.
…components--raes-env-packs chore(main): release 3.8.0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated back-merge (ADR 0008): brings release commit(s) from
mainintodevso the branches stay in sync. Merge to keep dev current.