Add Wazuh indexer cluster configuration

2022-01-26 17:15:08 -03:00
parent d294ff5cd0
commit 09f87ef233
18 changed files with 227 additions and 178 deletions
@@ -11,7 +11,7 @@ services:
      - "514:514/udp"
      - "55000:55000"
    environment:
-      - ELASTICSEARCH_URL=https://elasticsearch:9700
+      - ELASTICSEARCH_URL=https://wazuh-indexer:9700
      - ELASTIC_USERNAME=admin
      - ELASTIC_PASSWORD=SecretPassword
      - FILEBEAT_SSL_VERIFICATION_MODE=full
@@ -42,7 +42,7 @@ services:
    hostname: wazuh-worker
    restart: always
    environment:
-      - ELASTICSEARCH_URL=https://elasticsearch:9700
+      - ELASTICSEARCH_URL=https://wazuh-indexer:9700
      - ELASTIC_USERNAME=admin
      - ELASTIC_PASSWORD=SecretPassword
      - FILEBEAT_SSL_VERIFICATION_MODE=full
@@ -66,14 +66,15 @@ services:
      - ./production_cluster/wazuh_indexer_ssl_certs/filebeat.key:/etc/ssl/filebeat.key
      - ./production_cluster/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf

-  elasticsearch:
-    image: wazuh/wazuh-indexer:4.3.0
-    hostname: elasticsearch
+  wazuh-indexer:
+    image: wazuh-indexer
+    hostname: wazuh-indexer
    restart: always
    ports:
      - "9700:9700"
    environment:
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true"
+      - "ES_JAVA_OPTS=-Xms1g -Xmx1g"
+      - "NODE_TYPE=master"
    ulimits:
      memlock:
        soft: -1
@@ -82,21 +83,22 @@ services:
        soft: 65536
        hard: 65536
    volumes:
-      - elastic-data-1:/var/lib/wazuh-indexer
+      - wazuh-indexer-data-1:/var/lib/wazuh-indexer
      - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/wazuh-indexer/certs/root-ca.pem
-      - ./production_cluster/wazuh_indexer_ssl_certs/node1.key:/etc/wazuh-indexer/certs/node1.key
-      - ./production_cluster/wazuh_indexer_ssl_certs/node1.pem:/etc/wazuh-indexer/certs/node1.pem
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer.key:/etc/wazuh-indexer/certs/wazuh-indexer.key
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer.pem:/etc/wazuh-indexer/certs/wazuh-indexer.pem
      - ./production_cluster/wazuh_indexer_ssl_certs/admin.pem:/etc/wazuh-indexer/certs/admin.pem
      - ./production_cluster/wazuh_indexer_ssl_certs/admin.key:/etc/wazuh-indexer/certs/admin.key
-      - ./production_cluster/elastic_opendistro/wazuh-indexer-node1.yml:/etc/wazuh-indexer/opensearch.yml
-      - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
+      - ./production_cluster/wazuh-indexer/opnesearch-node1.yml:/etc/wazuh-indexer/opensearch.yml
+      - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml

-  elasticsearch-2:
-    image: wazuh/wazuh-indexer:4.3.0
-    hostname: elasticsearch-2
+  wazuh-indexer-2:
+    image: wazuh-indexer
+    hostname: wazuh-indexer-2
    restart: always
    environment:
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true"
+      - "ES_JAVA_OPTS=-Xms1g -Xmx1g"
+      - "NODE_TYPE=worker"
    ulimits:
      memlock:
        soft: -1
@@ -105,19 +107,20 @@ services:
        soft: 65536
        hard: 65536
    volumes:
-      - elastic-data-2:/var/lib/wazuh-indexer
+      - wazuh-indexer-data-2:/var/lib/wazuh-indexer
      - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/wazuh-indexer/certs/root-ca.pem
-      - ./production_cluster/wazuh_indexer_ssl_certs/node2.key:/etc/wazuh-indexer/certs/node2.key
-      - ./production_cluster/wazuh_indexer_ssl_certs/node2.pem:/etc/wazuh-indexer/certs/node2.pem
-      - ./production_cluster/elastic_opendistro/wazuh-indexer-node2.yml:/etc/wazuh-indexer/elasticsearch.yml
-      - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer-2.key:/etc/wazuh-indexer/certs/wazuh-indexer-2.key
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer-2.pem:/etc/wazuh-indexer/certs/wazuh-indexer-2.pem
+      - ./production_cluster/wazuh-indexer/opnesearch-node2.yml:/etc/wazuh-indexer/opensearch.yml
+      - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
  
-  elasticsearch-3:
-    image: wazuh/wazuh-indexer:4.3.0
-    hostname: elasticsearch-3
+  wazuh-indexer-3:
+    image: wazuh-indexer
+    hostname: wazuh-indexer-3
    restart: always
    environment:
-      - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true"
+      - "ES_JAVA_OPTS=-Xms1g -Xmx1g"
+      - "NODE_TYPE=worker"
    ulimits:
      memlock:
        soft: -1
@@ -126,12 +129,12 @@ services:
        soft: 65536
        hard: 65536
    volumes:
-      - elastic-data-3:/var/lib/wazuh-indexer
+      - wazuh-indexer-data-3:/var/lib/wazuh-indexer
      - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/wazuh-indexer/certs/root-ca.pem
-      - ./production_cluster/wazuh_indexer_ssl_certs/node3.key:/etc/wazuh-indexer/certs/node3.key
-      - ./production_cluster/wazuh_indexer_ssl_certs/node3.pem:/etc/wazuh-indexer/certs/node3.pem
-      - ./production_cluster/elastic_opendistro/wazuh-indexer-node3.yml:/etc/wazuh-indexer/elasticsearch.yml
-      - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer-3.key:/etc/wazuh-indexer/certs/wazuh-indexer-3.key
+      - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer-3.pem:/etc/wazuh-indexer/certs/wazuh-indexer-3.pem
+      - ./production_cluster/wazuh-indexer/opnesearch-node3.yml:/etc/wazuh-indexer/opensearch.yml
+      - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
 
  kibana:
    image: wazuh/wazuh-dashboard:4.3.0
@@ -153,9 +156,9 @@ services:
      - ./production_cluster/kibana_ssl/key.pem:/etc/wazuh-dashboard/certs/key.pem

    depends_on:
-      - elasticsearch
+      - wazuh-indexer
    links:
-      - elasticsearch:elasticsearch
+      - wazuh-indexer:wazuh-indexer
      - wazuh-master:wazuh-master

  nginx:
@@ -201,6 +204,6 @@ volumes:
  worker-ossec-wodles:
  worker-filebeat-etc:
  worker-filebeat-var:
-  elastic-data-1:
-  elastic-data-2:
-  elastic-data-3:
+  wazuh-indexer-data-1:
+  wazuh-indexer-data-2:
+  wazuh-indexer-data-3: