rel.yml

# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
version: '3.9'

x-logging: &logging
  logging:
    driver: loki
    options:
      loki-url: 'http://host.docker.internal:3100/loki/api/v1/push'

services:
  generator:
    image: cfssl/cfssl
    profiles:
      - 'saml'
      - 'standard'
    <<: *logging
    volumes:
      - wi_certs:/certs/wi
      - wd_certs:/certs/wd
      - wm_certs:/certs/wm
      - idp_certs:/certs/idp
      - ./config/certs:/conf
    # Included to avoid docker from creating duplicated networks
    networks:
      - wz-rel
    entrypoint: /bin/bash
    command: >
      -c '
        export certs=/tmp/certs
        mkdir $$certs
      	cd $$certs

      	echo "Generating CA"
      	cfssl gencert -initca /conf/ca.json | cfssljson -bare ca

      	echo "Generating servers certificates"
      	for i in wazuh.indexer wazuh.dashboard wazuh.manager; do
      		echo "Generating cert for $$i"
      		cat /conf/host.json | \
      		sed "s/HOST/$$i/g" | \
      		cfssl gencert \
      			-ca $$certs/ca.pem \
      			-ca-key $$certs/ca-key.pem \
      			-config /conf/cfssl.json \
      			-profile=server - | \
      		cfssljson -bare $$i
      		openssl pkcs8 -topk8 -inform pem -in $$i-key.pem -outform pem -nocrypt -out $$i.key
      	done

      	echo "Generating clients certificates"
        	for i in admin saml filebeat; do
        		echo "Generating cert for $$i"
      		cat /conf/host.json | \
      		sed "s/HOST/$$i/g" | \
      		cfssl gencert \
      			-ca $$certs/ca.pem \
      			-ca-key $$certs/ca-key.pem \
      			-config /conf/cfssl.json \
      			-profile=client - | \
      		cfssljson -bare $$i
      		openssl pkcs8 -topk8 -inform pem -in $$i-key.pem -outform pem -nocrypt -out $$i.key
      	done

          echo "Setting up permissions"

          rm /certs/wi/* /certs/wd/* /certs/wm/*

          mv $$certs/wazuh.indexer* /certs/wi
          mv $$certs/admin* /certs/wi
          mv /certs/wi/admin.key /certs/wi/admin-key.pem
          cp $$certs/*ca* /certs/wi

          mv $$certs/saml* /certs/idp
          mv /certs/idp/saml.key /certs/idp/saml-key.pem
          cp $$certs/*ca* /certs/idp

          mv $$certs/wazuh.dashboard* /certs/wd
          cp $$certs/*ca* /certs/wd

          mv $$certs/*.* /certs/wm

          chmod 640 /certs/wi/* /certs/wd/* /certs/wm/*
          chown -R 1000:1000 /certs/*
          ls -alR /certs/

          sleep 300
      '
    healthcheck:
      test: ['CMD-SHELL', '[ -r /certs/wm/wazuh.manager.pem ]']
      interval: 2s
      timeout: 5s
      retries: 10

  idpsec:
    image: quay.io/keycloak/keycloak:19.0.1
    depends_on:
      generator:
        condition: service_healthy
    profiles:
      - 'saml'
    volumes:
      - wi_certs:/certs/wi
      - wd_certs:/certs/wd
      - wm_certs:/certs/wm
      - idp_certs:/certs/idp
    entrypoint: /bin/bash
    command: >
      -c '
        # trust store
        for i in /certs/idp/ca.pem /certs/wd/wazuh.dashboard.pem /certs/wi/wazuh.indexer.pem
        do
          keytool -import -alias $$(basename $$i .pem) -file $$i -keystore /certs/idp/truststore.jks -storepass SecretPassword -trustcacerts -noprompt
        done
        sleep 300
      '
    healthcheck:
      test: ['CMD-SHELL', '[ -r /certs/idp/truststore.jks ]']
      interval: 2s
      timeout: 5s
      retries: 10

  wazuh.manager:
    depends_on:
      generator:
        condition: service_healthy
    image: wazuh/wazuh-manager:${WAZUH_STACK}
    profiles:
      - 'saml'
      - 'standard'
    hostname: wazuh.manager
    networks:
      - wz-rel
      - mon
    <<: *logging
    environment:
      - INDEXER_URL=https://wazuh.indexer:9200
      - INDEXER_USERNAME=admin
      - INDEXER_PASSWORD=SecretPassword
      - FILEBEAT_SSL_VERIFICATION_MODE=full
      - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/wazuh/ca.pem
      - SSL_CERTIFICATE=/etc/ssl/wazuh/filebeat.pem
      - SSL_KEY=/etc/ssl/wazuh/filebeat.key
      - API_USERNAME=wazuh-wui
      - API_PASSWORD=MyS3cr37P450r.*-
    volumes:
      - wazuh_api_configuration:/var/ossec/api/configuration
      - wazuh_etc:/var/ossec/etc
      - wazuh_logs:/var/ossec/logs
      - wazuh_queue:/var/ossec/queue
      - wazuh_var_multigroups:/var/ossec/var/multigroups
      - wazuh_integrations:/var/ossec/integrations
      - wazuh_active_response:/var/ossec/active-response/bin
      - wazuh_agentless:/var/ossec/agentless
      - wazuh_wodles:/var/ossec/wodles
      - filebeat_etc:/etc/filebeat
      - filebeat_var:/var/lib/filebeat
      - wm_certs:/etc/ssl/wazuh
      - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf

  wazuh.indexer:
    depends_on:
      generator:
        condition: service_healthy
      idpsetup:
        condition: service_completed_successfully
        required: false
    image: wazuh/wazuh-indexer:${WAZUH_STACK}
    profiles:
      - 'saml'
      - 'standard'
    hostname: wazuh.indexer
    networks:
      - wz-rel
      - mon
    <<: *logging
    environment:
      - 'OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m'
      - 'OPENSEARCH_PATH_CONF=/usr/share/wazuh-indexer/config'
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - wazuh-indexer-data:/var/lib/wazuh-indexer
      - wi_certs:/usr/share/wazuh-indexer/config/certs/
      - idp_certs:/usr/share/wazuh-indexer/config/idp/
      - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
      - ./config/wazuh_indexer/roles.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/roles.yml
      - ./config/wazuh_indexer/roles_mapping.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/roles_mapping.yml
      - ${SEC_CONFIG_FILE}:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/config.yml
    healthcheck:
      test:
        [
          'CMD-SHELL',
          '/usr/share/wazuh-indexer/bin/opensearch-plugin list | grep -q security',
        ]
      interval: 10s
      timeout: 10s
      retries: 120

  wazuh.dashboard:
    image: wazuh/wazuh-dashboard:${WAZUH_STACK}
    profiles:
      - 'saml'
      - 'standard'
    hostname: wazuh.dashboard
    depends_on:
      wazuh.indexer:
        condition: service_healthy
    networks:
      - wz-rel
      - mon
    <<: *logging
    ports:
      - ${KIBANA_PORT}:5601
    environment:
      - INDEXER_USERNAME=admin
      - INDEXER_PASSWORD=SecretPassword
      - WAZUH_API_URL=https://wazuh.manager
      - API_USERNAME=wazuh-wui
      - API_PASSWORD=MyS3cr37P450r.*-
    volumes:
      - wd_certs:/usr/share/wazuh-dashboard/certs
      - ${WAZUH_DASHBOARD_CONF}:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
      - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml

  exporter:
    image: quay.io/prometheuscommunity/elasticsearch-exporter:latest
    profiles:
      - 'saml'
      - 'standard'
    <<: *logging
    hostname: 'exporter'
    networks:
      - wz-rel
      - mon
    command:
      - '--es.uri=https://admin:${KIBANA_PASSWORD}@wazuh-indexer:9200'
      - '--es.ssl-skip-verify'
      - '--es.all'

  idp:
    image: quay.io/keycloak/keycloak:19.0.1
    depends_on:
      idpsec:
        condition: service_healthy
    profiles:
      - 'saml'
    hostname: idp
    <<: *logging
    networks:
      - wz-rel
      - mon
    ports:
      - '8080:8080'
    environment:
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=admin
      - KC_SPI_TRUSTSTORE_FILE_PASSWORD=SecretPassword
      - KC_SPI_TRUSTSTORE_FILE_FILE=/certs/truststore.jks
    volumes:
      - keycloak-data:/var/lib/keycloak/data
      - idp_certs:/certs
    command: start-dev
    healthcheck:
      test: curl -f http://idp:8080/realms/master || exit 1
      interval: 10s
      timeout: 5s
      retries: 6

  idpsetup:
    image: badouralix/curl-jq
    depends_on:
      idp:
        condition: service_healthy
    profiles:
      - 'saml'
    hostname: idpsetup
    <<: *logging
    networks:
      - wz-rel
      - mon
    volumes:
      - wi_certs:/certs/wi
      - ./enable_saml.sh:/enable_saml.sh
    entrypoint: /bin/sh
    command: >
      -c '
       apk add bash
       bash /enable_saml.sh
       exit 0
      '

networks:
  wz-rel:
    name: ${COMPOSE_PROJECT_NAME}
    driver: bridge
  mon:
    external: true

volumes:
  wi_certs:
  wd_certs:
  wm_certs:
  idp_certs:
  wazuh_api_configuration:
  wazuh_etc:
  wazuh_logs:
  wazuh_queue:
  wazuh_var_multigroups:
  wazuh_integrations:
  wazuh_active_response:
  wazuh_agentless:
  wazuh_wodles:
  filebeat_etc:
  filebeat_var:
  wazuh-indexer-data:
  keycloak-data: