From 91d5899365e8dedd10778724dfe614eebae106b8 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 1 Apr 2026 01:45:30 +0700 Subject: [PATCH 1/5] Configure certificates owner --- .gitignore | 2 + .../getting-started/deployment/multi-node.md | 2 +- .../getting-started/deployment/single-node.md | 24 ++-- multi-node/certificates-conf.sh | 104 ++++++++++++++++++ multi-node/docker-compose.yml | 40 +++---- single-node/certificates-conf.sh | 77 +++++++++++++ single-node/docker-compose.yml | 22 ++-- 7 files changed, 227 insertions(+), 44 deletions(-) create mode 100644 multi-node/certificates-conf.sh create mode 100644 single-node/certificates-conf.sh diff --git a/.gitignore b/.gitignore index eae99cb5..59dd4cb2 100644 --- a/.gitignore +++ b/.gitignore @@ -6,11 +6,13 @@ single-node/wazuh-certificates/* single-node/wazuh-certificates-tool.log single-node/wazuh-certs-tool*.sh single-node/config*.yml +single-node/config/*/certs/* multi-node/wazuh-certificates multi-node/wazuh-certificates/* multi-node/wazuh-certificates-tool.log multi-node/wazuh-certs-tool*.sh multi-node/config*.yml +multi-node/config/*/certs/* # Documentation docs/book/ diff --git a/docs/ref/getting-started/deployment/multi-node.md b/docs/ref/getting-started/deployment/multi-node.md index 9dc06f8b..19b9d525 100644 --- a/docs/ref/getting-started/deployment/multi-node.md +++ b/docs/ref/getting-started/deployment/multi-node.md @@ -57,7 +57,7 @@ This deployment utilizes the `multi-node/docker-compose.yml` file, which defines 5. Run the certificate creation script: ```bash - bash ./wazuh-certs-tool.sh -A + sudo bash certificates-conf.sh --cert --copy --priv ``` 6. Start the Wazuh environment using `docker compose`: diff --git a/docs/ref/getting-started/deployment/single-node.md b/docs/ref/getting-started/deployment/single-node.md index d55a9ebc..43a62d23 100644 --- a/docs/ref/getting-started/deployment/single-node.md +++ b/docs/ref/getting-started/deployment/single-node.md @@ -29,30 +29,30 @@ This deployment uses the `single-node/docker-compose.yml` file, which defines a ```yaml nodes: - # Wazuh indexer server nodes - indexer: + # Wazuh indexer server nodes + indexer: - name: wazuh.indexer - dns: "wazuh.indexer" + dns: "wazuh.indexer" - # Wazuh manager nodes - # Use node_type only with more than one Wazuh manager - manager: + # Wazuh manager nodes + # Use node_type only with more than one Wazuh manager + manager: - name: wazuh.manager - dns: "wazuh.manager" + dns: "wazuh.manager" - # Wazuh dashboard node - dashboard: + # Wazuh dashboard node + dashboard: - name: wazuh.dashboard - dns: "wazuh.dashboard" + dns: "wazuh.dashboard" ``` 5. Run the certificate creation script: ```bash - bash ./wazuh-certs-tool.sh -A + sudo bash certificates-conf.sh --cert --copy --priv ``` -5. Start the Wazuh environment using `docker compose`: +6. Start the Wazuh environment using `docker compose`: * To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop): diff --git a/multi-node/certificates-conf.sh b/multi-node/certificates-conf.sh new file mode 100644 index 00000000..5703dbb3 --- /dev/null +++ b/multi-node/certificates-conf.sh @@ -0,0 +1,104 @@ +#!/bin/bash + +# Path configuration (adjust according to your folder structure) +CERT_TOOL="./wazuh-certs-tool.sh" +CONFIG_FILE="./config.yml" +OUTPUT_DIR="./wazuh-certificates" # Folder created by the script by default + +# Parse arguments +DO_CERT=false +DO_COPY=false +DO_PRIV=false + +for arg in "$@"; do + case $arg in + --cert) DO_CERT=true ;; + --copy) DO_COPY=true ;; + --priv) DO_PRIV=true ;; + *) + echo "Unknown option: $arg" + echo "Usage: $0 [--cert] [--copy] [--priv]" + exit 1 + ;; + esac +done + +# If no flags provided, show usage +if ! $DO_CERT && ! $DO_COPY && ! $DO_PRIV; then + echo "Usage: $0 [--cert] [--copy] [--priv]" + echo " --cert Generate certificates using wazuh-certs-tool.sh" + echo " --copy Copy certificates to the corresponding config directories" + echo " --priv Set ownership and permissions on the certificate files" + exit 1 +fi + +# 1. Generate certificates +if $DO_CERT; then + echo "Generating certificates" + bash $CERT_TOOL -A +fi + +# 2. Copy certificates to config directories +if $DO_COPY; then + echo "Setting up directories for certificates" + mkdir -p ./config/wazuh_indexer_1/certs + mkdir -p ./config/wazuh_indexer_2/certs + mkdir -p ./config/wazuh_indexer_3/certs + mkdir -p ./config/wazuh_dashboard/certs + mkdir -p ./config/wazuh_cluster_master/certs + mkdir -p ./config/wazuh_cluster_worker/certs + + echo "Copying certificates for Indexer 1" + cp $OUTPUT_DIR/wazuh1.indexer* ./config/wazuh_indexer_1/certs/ + cp $OUTPUT_DIR/root-ca* ./config/wazuh_indexer_1/certs/ + cp $OUTPUT_DIR/admin* ./config/wazuh_indexer_1/certs/ + + echo "Copying certificates for Indexer 2" + cp $OUTPUT_DIR/wazuh2.indexer* ./config/wazuh_indexer_2/certs/ + cp $OUTPUT_DIR/root-ca* ./config/wazuh_indexer_2/certs/ + + echo "Copying certificates for Indexer 3" + cp $OUTPUT_DIR/wazuh3.indexer* ./config/wazuh_indexer_3/certs/ + cp $OUTPUT_DIR/root-ca* ./config/wazuh_indexer_3/certs/ + + echo "Copying certificates for Dashboard" + cp $OUTPUT_DIR/wazuh.dashboard* ./config/wazuh_dashboard/certs/ + cp $OUTPUT_DIR/root-ca* ./config/wazuh_dashboard/certs/ + + echo "Copying certificates for Master Manager" + cp $OUTPUT_DIR/wazuh.master* ./config/wazuh_cluster_master/certs/ + cp $OUTPUT_DIR/root-ca* ./config/wazuh_cluster_master/certs/ + + echo "Copying certificates for Worker Manager" + cp $OUTPUT_DIR/wazuh.worker* ./config/wazuh_cluster_worker/certs/ + cp $OUTPUT_DIR/root-ca* ./config/wazuh_cluster_worker/certs/ +fi + +# 3. Set ownership and permissions +if $DO_PRIV; then + echo "Configuring permissions for Indexer 1 (1000:1000)" + chown -R 1000:1000 ./config/wazuh_indexer_1/certs + chmod 400 ./config/wazuh_indexer_1/certs/* + + echo "Configuring permissions for Indexer 2 (1000:1000)" + chown -R 1000:1000 ./config/wazuh_indexer_2/certs + chmod 400 ./config/wazuh_indexer_2/certs/* + + echo "Configuring permissions for Indexer 3 (1000:1000)" + chown -R 1000:1000 ./config/wazuh_indexer_3/certs + chmod 400 ./config/wazuh_indexer_3/certs/* + + echo "Setting permissions for Dashboard (1000:1000)" + chown -R 1000:1000 ./config/wazuh_dashboard/certs + chmod 400 ./config/wazuh_dashboard/certs/* + + echo "Configuring permissions for Master Manager (999:999)" + chown -R 999:999 ./config/wazuh_cluster_master/certs + chmod 400 ./config/wazuh_cluster_master/certs/* + + echo "Configuring permissions for Worker Manager (999:999)" + chown -R 999:999 ./config/wazuh_cluster_worker/certs + chmod 400 ./config/wazuh_cluster_worker/certs/* +fi + +echo "Process completed." diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 65dec154..6146dde8 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -40,9 +40,9 @@ services: - master-wazuh-logs:/var/wazuh-manager/logs - master-wazuh-queue:/var/wazuh-manager/queue - master-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups - - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem - - ./wazuh-certificates/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem - - ./wazuh-certificates/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem + - ./config/wazuh_cluster_master/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem + - ./config/wazuh_cluster_master/certs/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem + - ./config/wazuh_cluster_master/certs/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem wazuh.worker: image: wazuh/wazuh-manager:5.0.0 @@ -81,9 +81,9 @@ services: - worker-wazuh-logs:/var/wazuh-manager/logs - worker-wazuh-queue:/var/wazuh-manager/queue - worker-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups - - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem - - ./wazuh-certificates/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem - - ./wazuh-certificates/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem + - ./config/wazuh_cluster_worker/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem + - ./config/wazuh_cluster_worker/certs/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem + - ./config/wazuh_cluster_worker/certs/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem wazuh1.indexer: image: wazuh/wazuh-indexer:5.0.0 @@ -117,11 +117,11 @@ services: start_period: 60s volumes: - wazuh-indexer-data-1:/var/lib/wazuh-indexer - - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./wazuh-certificates/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem - - ./wazuh-certificates/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem - - ./wazuh-certificates/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem - - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem + - ./config/wazuh_indexer_1/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./config/wazuh_indexer_1/certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem + - ./config/wazuh_indexer_1/certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem + - ./config/wazuh_indexer_1/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem + - ./config/wazuh_indexer_1/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh2.indexer: image: wazuh/wazuh-indexer:5.0.0 @@ -157,9 +157,9 @@ services: start_period: 60s volumes: - wazuh-indexer-data-2:/var/lib/wazuh-indexer - - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./wazuh-certificates/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem - - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem + - ./config/wazuh_indexer_2/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./config/wazuh_indexer_2/certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem + - ./config/wazuh_indexer_2/certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh3.indexer: image: wazuh/wazuh-indexer:5.0.0 @@ -195,9 +195,9 @@ services: start_period: 60s volumes: - wazuh-indexer-data-3:/var/lib/wazuh-indexer - - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./wazuh-certificates/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem - - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem + - ./config/wazuh_indexer_3/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./config/wazuh_indexer_3/certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem + - ./config/wazuh_indexer_3/certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh.dashboard: image: wazuh/wazuh-dashboard:5.0.0 @@ -227,9 +227,9 @@ services: - SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem - OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem volumes: - - ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem - - ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem - - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem + - ./config/wazuh_dashboard/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem + - ./config/wazuh_dashboard/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem + - ./config/wazuh_dashboard/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom depends_on: diff --git a/single-node/certificates-conf.sh b/single-node/certificates-conf.sh new file mode 100644 index 00000000..4719ed61 --- /dev/null +++ b/single-node/certificates-conf.sh @@ -0,0 +1,77 @@ +#!/bin/bash + +# Path configuration (adjust according to your folder structure) +CERT_TOOL="./wazuh-certs-tool.sh" +CONFIG_FILE="./config.yml" +OUTPUT_DIR="./wazuh-certificates" # Folder created by the script by default + +# Parse arguments +DO_CERT=false +DO_COPY=false +DO_PRIV=false + +for arg in "$@"; do + case $arg in + --cert) DO_CERT=true ;; + --copy) DO_COPY=true ;; + --priv) DO_PRIV=true ;; + *) + echo "Unknown option: $arg" + echo "Usage: $0 [--cert] [--copy] [--priv]" + exit 1 + ;; + esac +done + +# If no flags provided, show usage +if ! $DO_CERT && ! $DO_COPY && ! $DO_PRIV; then + echo "Usage: $0 [--cert] [--copy] [--priv]" + echo " --cert Generate certificates using wazuh-certs-tool.sh" + echo " --copy Copy certificates to the corresponding config directories" + echo " --priv Set ownership and permissions on the certificate files" + exit 1 +fi + +# 1. Generate certificates +if $DO_CERT; then + echo "Generating certificates" + bash $CERT_TOOL -A +fi + +# 2. Copy certificates to config directories +if $DO_COPY; then + echo "Setting up directories for certificates" + mkdir -p ./config/wazuh_indexer/certs + mkdir -p ./config/wazuh_dashboard/certs + mkdir -p ./config/wazuh_cluster/certs + + echo "Copying certificates for Indexer" + cp $OUTPUT_DIR/wazuh.indexer* ./config/wazuh_indexer/certs/ + cp $OUTPUT_DIR/root-ca* ./config/wazuh_indexer/certs/ + cp $OUTPUT_DIR/admin* ./config/wazuh_indexer/certs/ + + echo "Copying certificates for Dashboard" + cp $OUTPUT_DIR/wazuh.dashboard* ./config/wazuh_dashboard/certs/ + cp $OUTPUT_DIR/root-ca* ./config/wazuh_dashboard/certs/ + + echo "Copying certificates for Manager" + cp $OUTPUT_DIR/wazuh.manager* ./config/wazuh_cluster/certs/ + cp $OUTPUT_DIR/root-ca* ./config/wazuh_cluster/certs/ +fi + +# 3. Set ownership and permissions +if $DO_PRIV; then + echo "Configuring permissions for Indexer (1000:1000)" + chown -R 1000:1000 ./config/wazuh_indexer/certs + chmod 400 ./config/wazuh_indexer/certs/* + + echo "Setting permissions for Dashboard (1000:1000)" + chown -R 1000:1000 ./config/wazuh_dashboard/certs + chmod 400 ./config/wazuh_dashboard/certs/* + + echo "Configuring permissions for Manager (999:999)" + chown -R 999:999 ./config/wazuh_cluster/certs + chmod 400 ./config/wazuh_cluster/certs/* +fi + +echo "Process completed." diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 52e400f8..6767b281 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -40,9 +40,9 @@ services: - wazuh_logs:/var/wazuh-manager/logs - wazuh_queue:/var/wazuh-manager/queue - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups - - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem - - ./wazuh-certificates/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem - - ./wazuh-certificates/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem + - ./config/wazuh_cluster/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem + - ./config/wazuh_cluster/certs/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem + - ./config/wazuh_cluster/certs/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem wazuh.indexer: image: wazuh/wazuh-indexer:5.0.0 @@ -75,11 +75,11 @@ services: start_period: 60s volumes: - wazuh-indexer-data:/var/lib/wazuh-indexer - - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./wazuh-certificates/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem - - ./wazuh-certificates/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem - - ./wazuh-certificates/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem - - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem + - ./config/wazuh_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./config/wazuh_indexer/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem + - ./config/wazuh_indexer/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem + - ./config/wazuh_indexer/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem + - ./config/wazuh_indexer/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: image: wazuh/wazuh-dashboard:5.0.0 @@ -109,9 +109,9 @@ services: - SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem - OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem volumes: - - ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem - - ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem - - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem + - ./config/wazuh_dashboard/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem + - ./config/wazuh_dashboard/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem + - ./config/wazuh_dashboard/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom depends_on: From cf5d4fa36ec962f72df1cba05dfdb9d92bf61630 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 1 Apr 2026 01:54:42 +0700 Subject: [PATCH 2/5] Modify PR checks --- .github/workflows/5_pr_check.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/5_pr_check.yml b/.github/workflows/5_pr_check.yml index 26002d0a..f3a11965 100644 --- a/.github/workflows/5_pr_check.yml +++ b/.github/workflows/5_pr_check.yml @@ -149,7 +149,7 @@ jobs: dns: "wazuh.dashboard" EOF cat config.yml - bash ./wazuh-certs-tool.sh -A + sudo bash certificates-conf.sh --cert --copy --priv sudo sysctl -w vm.max_map_count=262144 working-directory: ./single-node @@ -430,7 +430,7 @@ jobs: dns: "wazuh.dashboard" EOF cat config.yml - bash ./wazuh-certs-tool.sh -A + sudo bash certificates-conf.sh --cert --copy --priv sudo sysctl -w vm.max_map_count=262144 working-directory: ./multi-node From 0f142766cc4e9af94f98e1cb3eed4a55bdd750e8 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 1 Apr 2026 01:59:31 +0700 Subject: [PATCH 3/5] Add changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 238edaf7..30fb6709 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Certificates configuration script. ([#2285](https://github.com/wazuh/wazuh-docker/pull/2285)) - Modify artifact URLs file name. ([#2266](https://github.com/wazuh/wazuh-docker/pull/2266)) - Use URL signing script to generate presigned internal package URLs. ([#2259](https://github.com/wazuh/wazuh-docker/pull/2259)) - Updated wazuh-docker documentation config and tooling versions to meet new standards. ([#2264](https://github.com/wazuh/wazuh-docker/pull/2264)) From 1ac37f1ee82b7c6b3976a490f15acb0a5b1c268e Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 1 Apr 2026 02:28:42 +0700 Subject: [PATCH 4/5] Add unninstal steps --- docs/ref/uninstall.md | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/docs/ref/uninstall.md b/docs/ref/uninstall.md index d2fafc1e..1e2a39cf 100644 --- a/docs/ref/uninstall.md +++ b/docs/ref/uninstall.md @@ -10,25 +10,19 @@ This section describes how to uninstall a Wazuh Docker deployment by stopping an cd ``` -2. Stop and remove the containers: +2. Stop and remove the containers, persistent volumes and all stored data: ```bash - docker compose down --remove-orphans + docker compose down -v ``` -3. Remove persistent volumes and all stored data: +3. Remove generated or downloaded files: ```bash - docker compose down --volumes --remove-orphans + rm -rf wazuh-certificates/ config.yml wazuh-certs-tool.sh config/*/certs ``` -4. Remove generated or downloaded files: - - ```bash - rm -rf wazuh-certificates/ config.yml wazuh-certs-tool.sh - ``` - -5. Verify that the deployment is removed: +4. Verify that the deployment is removed: ```bash docker ps @@ -45,7 +39,7 @@ This section describes how to uninstall a Wazuh Docker deployment by stopping an 2. Stop and remove the container: ```bash - docker compose down --remove-orphans + docker compose down ``` 3. Verify that the deployment is removed: From 5745995e5c4814f4bc0e5fe3d77bd7b6819487de Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 1 Apr 2026 21:30:52 +0700 Subject: [PATCH 5/5] Standarize certificates configuration script --- .github/workflows/5_pr_check.yml | 4 +- .gitignore | 4 +- .../getting-started/deployment/multi-node.md | 2 +- .../getting-started/deployment/single-node.md | 2 +- multi-node/certificates-conf.sh | 104 ------------ multi-node/docker-compose.yml | 34 ++-- single-node/certificates-conf.sh | 77 --------- single-node/docker-compose.yml | 6 +- tools/utils/deployment/certificates-conf.sh | 153 ++++++++++++++++++ 9 files changed, 179 insertions(+), 207 deletions(-) delete mode 100644 multi-node/certificates-conf.sh delete mode 100644 single-node/certificates-conf.sh create mode 100644 tools/utils/deployment/certificates-conf.sh diff --git a/.github/workflows/5_pr_check.yml b/.github/workflows/5_pr_check.yml index f3a11965..287c46e4 100644 --- a/.github/workflows/5_pr_check.yml +++ b/.github/workflows/5_pr_check.yml @@ -149,7 +149,7 @@ jobs: dns: "wazuh.dashboard" EOF cat config.yml - sudo bash certificates-conf.sh --cert --copy --priv + sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv sudo sysctl -w vm.max_map_count=262144 working-directory: ./single-node @@ -430,7 +430,7 @@ jobs: dns: "wazuh.dashboard" EOF cat config.yml - sudo bash certificates-conf.sh --cert --copy --priv + sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv sudo sysctl -w vm.max_map_count=262144 working-directory: ./multi-node diff --git a/.gitignore b/.gitignore index 59dd4cb2..36cabbb5 100644 --- a/.gitignore +++ b/.gitignore @@ -6,13 +6,13 @@ single-node/wazuh-certificates/* single-node/wazuh-certificates-tool.log single-node/wazuh-certs-tool*.sh single-node/config*.yml -single-node/config/*/certs/* +single-node/config multi-node/wazuh-certificates multi-node/wazuh-certificates/* multi-node/wazuh-certificates-tool.log multi-node/wazuh-certs-tool*.sh multi-node/config*.yml -multi-node/config/*/certs/* +multi-node/config/wazuh* # Documentation docs/book/ diff --git a/docs/ref/getting-started/deployment/multi-node.md b/docs/ref/getting-started/deployment/multi-node.md index 19b9d525..d2f46887 100644 --- a/docs/ref/getting-started/deployment/multi-node.md +++ b/docs/ref/getting-started/deployment/multi-node.md @@ -57,7 +57,7 @@ This deployment utilizes the `multi-node/docker-compose.yml` file, which defines 5. Run the certificate creation script: ```bash - sudo bash certificates-conf.sh --cert --copy --priv + sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv ``` 6. Start the Wazuh environment using `docker compose`: diff --git a/docs/ref/getting-started/deployment/single-node.md b/docs/ref/getting-started/deployment/single-node.md index 43a62d23..a2912e28 100644 --- a/docs/ref/getting-started/deployment/single-node.md +++ b/docs/ref/getting-started/deployment/single-node.md @@ -49,7 +49,7 @@ This deployment uses the `single-node/docker-compose.yml` file, which defines a 5. Run the certificate creation script: ```bash - sudo bash certificates-conf.sh --cert --copy --priv + sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv ``` 6. Start the Wazuh environment using `docker compose`: diff --git a/multi-node/certificates-conf.sh b/multi-node/certificates-conf.sh deleted file mode 100644 index 5703dbb3..00000000 --- a/multi-node/certificates-conf.sh +++ /dev/null @@ -1,104 +0,0 @@ -#!/bin/bash - -# Path configuration (adjust according to your folder structure) -CERT_TOOL="./wazuh-certs-tool.sh" -CONFIG_FILE="./config.yml" -OUTPUT_DIR="./wazuh-certificates" # Folder created by the script by default - -# Parse arguments -DO_CERT=false -DO_COPY=false -DO_PRIV=false - -for arg in "$@"; do - case $arg in - --cert) DO_CERT=true ;; - --copy) DO_COPY=true ;; - --priv) DO_PRIV=true ;; - *) - echo "Unknown option: $arg" - echo "Usage: $0 [--cert] [--copy] [--priv]" - exit 1 - ;; - esac -done - -# If no flags provided, show usage -if ! $DO_CERT && ! $DO_COPY && ! $DO_PRIV; then - echo "Usage: $0 [--cert] [--copy] [--priv]" - echo " --cert Generate certificates using wazuh-certs-tool.sh" - echo " --copy Copy certificates to the corresponding config directories" - echo " --priv Set ownership and permissions on the certificate files" - exit 1 -fi - -# 1. Generate certificates -if $DO_CERT; then - echo "Generating certificates" - bash $CERT_TOOL -A -fi - -# 2. Copy certificates to config directories -if $DO_COPY; then - echo "Setting up directories for certificates" - mkdir -p ./config/wazuh_indexer_1/certs - mkdir -p ./config/wazuh_indexer_2/certs - mkdir -p ./config/wazuh_indexer_3/certs - mkdir -p ./config/wazuh_dashboard/certs - mkdir -p ./config/wazuh_cluster_master/certs - mkdir -p ./config/wazuh_cluster_worker/certs - - echo "Copying certificates for Indexer 1" - cp $OUTPUT_DIR/wazuh1.indexer* ./config/wazuh_indexer_1/certs/ - cp $OUTPUT_DIR/root-ca* ./config/wazuh_indexer_1/certs/ - cp $OUTPUT_DIR/admin* ./config/wazuh_indexer_1/certs/ - - echo "Copying certificates for Indexer 2" - cp $OUTPUT_DIR/wazuh2.indexer* ./config/wazuh_indexer_2/certs/ - cp $OUTPUT_DIR/root-ca* ./config/wazuh_indexer_2/certs/ - - echo "Copying certificates for Indexer 3" - cp $OUTPUT_DIR/wazuh3.indexer* ./config/wazuh_indexer_3/certs/ - cp $OUTPUT_DIR/root-ca* ./config/wazuh_indexer_3/certs/ - - echo "Copying certificates for Dashboard" - cp $OUTPUT_DIR/wazuh.dashboard* ./config/wazuh_dashboard/certs/ - cp $OUTPUT_DIR/root-ca* ./config/wazuh_dashboard/certs/ - - echo "Copying certificates for Master Manager" - cp $OUTPUT_DIR/wazuh.master* ./config/wazuh_cluster_master/certs/ - cp $OUTPUT_DIR/root-ca* ./config/wazuh_cluster_master/certs/ - - echo "Copying certificates for Worker Manager" - cp $OUTPUT_DIR/wazuh.worker* ./config/wazuh_cluster_worker/certs/ - cp $OUTPUT_DIR/root-ca* ./config/wazuh_cluster_worker/certs/ -fi - -# 3. Set ownership and permissions -if $DO_PRIV; then - echo "Configuring permissions for Indexer 1 (1000:1000)" - chown -R 1000:1000 ./config/wazuh_indexer_1/certs - chmod 400 ./config/wazuh_indexer_1/certs/* - - echo "Configuring permissions for Indexer 2 (1000:1000)" - chown -R 1000:1000 ./config/wazuh_indexer_2/certs - chmod 400 ./config/wazuh_indexer_2/certs/* - - echo "Configuring permissions for Indexer 3 (1000:1000)" - chown -R 1000:1000 ./config/wazuh_indexer_3/certs - chmod 400 ./config/wazuh_indexer_3/certs/* - - echo "Setting permissions for Dashboard (1000:1000)" - chown -R 1000:1000 ./config/wazuh_dashboard/certs - chmod 400 ./config/wazuh_dashboard/certs/* - - echo "Configuring permissions for Master Manager (999:999)" - chown -R 999:999 ./config/wazuh_cluster_master/certs - chmod 400 ./config/wazuh_cluster_master/certs/* - - echo "Configuring permissions for Worker Manager (999:999)" - chown -R 999:999 ./config/wazuh_cluster_worker/certs - chmod 400 ./config/wazuh_cluster_worker/certs/* -fi - -echo "Process completed." diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 6146dde8..b3e76e5a 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -40,9 +40,9 @@ services: - master-wazuh-logs:/var/wazuh-manager/logs - master-wazuh-queue:/var/wazuh-manager/queue - master-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups - - ./config/wazuh_cluster_master/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem - - ./config/wazuh_cluster_master/certs/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem - - ./config/wazuh_cluster_master/certs/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem + - ./config/wazuh_master/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem + - ./config/wazuh_master/certs/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem + - ./config/wazuh_master/certs/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem wazuh.worker: image: wazuh/wazuh-manager:5.0.0 @@ -81,9 +81,9 @@ services: - worker-wazuh-logs:/var/wazuh-manager/logs - worker-wazuh-queue:/var/wazuh-manager/queue - worker-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups - - ./config/wazuh_cluster_worker/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem - - ./config/wazuh_cluster_worker/certs/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem - - ./config/wazuh_cluster_worker/certs/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem + - ./config/wazuh_worker/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem + - ./config/wazuh_worker/certs/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem + - ./config/wazuh_worker/certs/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem wazuh1.indexer: image: wazuh/wazuh-indexer:5.0.0 @@ -117,11 +117,11 @@ services: start_period: 60s volumes: - wazuh-indexer-data-1:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_1/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_1/certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem - - ./config/wazuh_indexer_1/certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem - - ./config/wazuh_indexer_1/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem - - ./config/wazuh_indexer_1/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem + - ./config/wazuh1_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./config/wazuh1_indexer/certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem + - ./config/wazuh1_indexer/certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem + - ./config/wazuh1_indexer/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem + - ./config/wazuh1_indexer/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh2.indexer: image: wazuh/wazuh-indexer:5.0.0 @@ -157,9 +157,9 @@ services: start_period: 60s volumes: - wazuh-indexer-data-2:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_2/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_2/certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem - - ./config/wazuh_indexer_2/certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem + - ./config/wazuh2_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./config/wazuh2_indexer/certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem + - ./config/wazuh2_indexer/certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh3.indexer: image: wazuh/wazuh-indexer:5.0.0 @@ -195,9 +195,9 @@ services: start_period: 60s volumes: - wazuh-indexer-data-3:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_3/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_3/certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem - - ./config/wazuh_indexer_3/certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem + - ./config/wazuh3_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./config/wazuh3_indexer/certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem + - ./config/wazuh3_indexer/certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh.dashboard: image: wazuh/wazuh-dashboard:5.0.0 diff --git a/single-node/certificates-conf.sh b/single-node/certificates-conf.sh deleted file mode 100644 index 4719ed61..00000000 --- a/single-node/certificates-conf.sh +++ /dev/null @@ -1,77 +0,0 @@ -#!/bin/bash - -# Path configuration (adjust according to your folder structure) -CERT_TOOL="./wazuh-certs-tool.sh" -CONFIG_FILE="./config.yml" -OUTPUT_DIR="./wazuh-certificates" # Folder created by the script by default - -# Parse arguments -DO_CERT=false -DO_COPY=false -DO_PRIV=false - -for arg in "$@"; do - case $arg in - --cert) DO_CERT=true ;; - --copy) DO_COPY=true ;; - --priv) DO_PRIV=true ;; - *) - echo "Unknown option: $arg" - echo "Usage: $0 [--cert] [--copy] [--priv]" - exit 1 - ;; - esac -done - -# If no flags provided, show usage -if ! $DO_CERT && ! $DO_COPY && ! $DO_PRIV; then - echo "Usage: $0 [--cert] [--copy] [--priv]" - echo " --cert Generate certificates using wazuh-certs-tool.sh" - echo " --copy Copy certificates to the corresponding config directories" - echo " --priv Set ownership and permissions on the certificate files" - exit 1 -fi - -# 1. Generate certificates -if $DO_CERT; then - echo "Generating certificates" - bash $CERT_TOOL -A -fi - -# 2. Copy certificates to config directories -if $DO_COPY; then - echo "Setting up directories for certificates" - mkdir -p ./config/wazuh_indexer/certs - mkdir -p ./config/wazuh_dashboard/certs - mkdir -p ./config/wazuh_cluster/certs - - echo "Copying certificates for Indexer" - cp $OUTPUT_DIR/wazuh.indexer* ./config/wazuh_indexer/certs/ - cp $OUTPUT_DIR/root-ca* ./config/wazuh_indexer/certs/ - cp $OUTPUT_DIR/admin* ./config/wazuh_indexer/certs/ - - echo "Copying certificates for Dashboard" - cp $OUTPUT_DIR/wazuh.dashboard* ./config/wazuh_dashboard/certs/ - cp $OUTPUT_DIR/root-ca* ./config/wazuh_dashboard/certs/ - - echo "Copying certificates for Manager" - cp $OUTPUT_DIR/wazuh.manager* ./config/wazuh_cluster/certs/ - cp $OUTPUT_DIR/root-ca* ./config/wazuh_cluster/certs/ -fi - -# 3. Set ownership and permissions -if $DO_PRIV; then - echo "Configuring permissions for Indexer (1000:1000)" - chown -R 1000:1000 ./config/wazuh_indexer/certs - chmod 400 ./config/wazuh_indexer/certs/* - - echo "Setting permissions for Dashboard (1000:1000)" - chown -R 1000:1000 ./config/wazuh_dashboard/certs - chmod 400 ./config/wazuh_dashboard/certs/* - - echo "Configuring permissions for Manager (999:999)" - chown -R 999:999 ./config/wazuh_cluster/certs - chmod 400 ./config/wazuh_cluster/certs/* -fi - -echo "Process completed." diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 6767b281..bf8ca96f 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -40,9 +40,9 @@ services: - wazuh_logs:/var/wazuh-manager/logs - wazuh_queue:/var/wazuh-manager/queue - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups - - ./config/wazuh_cluster/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem - - ./config/wazuh_cluster/certs/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem - - ./config/wazuh_cluster/certs/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem + - ./config/wazuh_manager/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem + - ./config/wazuh_manager/certs/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem + - ./config/wazuh_manager/certs/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem wazuh.indexer: image: wazuh/wazuh-indexer:5.0.0 diff --git a/tools/utils/deployment/certificates-conf.sh b/tools/utils/deployment/certificates-conf.sh new file mode 100644 index 00000000..a058eac4 --- /dev/null +++ b/tools/utils/deployment/certificates-conf.sh @@ -0,0 +1,153 @@ +#!/bin/bash + +# Path configuration (adjust according to your folder structure) +CERT_TOOL="./wazuh-certs-tool.sh" +CONFIG_FILE="./config.yml" +OUTPUT_DIR="./wazuh-certificates" # Folder created by the script by default + +# Parse arguments +DO_CERT=false +DO_COPY=false +DO_PRIV=false + +for arg in "$@"; do + case $arg in + --cert) DO_CERT=true ;; + --copy) DO_COPY=true ;; + --priv) DO_PRIV=true ;; + *) + echo "Unknown option: $arg" + echo "Usage: $0 [--cert] [--copy] [--priv]" + exit 1 + ;; + esac +done + +# If no flags provided, show usage +if ! $DO_CERT && ! $DO_COPY && ! $DO_PRIV; then + echo "Usage: $0 [--cert] [--copy] [--priv]" + echo " --cert Generate certificates using wazuh-certs-tool.sh" + echo " --copy Copy certificates to the corresponding config directories" + echo " --priv Set ownership and permissions on the certificate files" + exit 1 +fi + +# --------------------------------------------------------------------------- +# Parse config.yml to extract node names per section (indexer, manager, dashboard) +# --------------------------------------------------------------------------- +parse_config() { + local section="" + INDEXER_NODES=() + MANAGER_NODES=() + DASHBOARD_NODES=() + + while IFS= read -r line; do + # Detect section headers (e.g., " indexer:", " manager:", " dashboard:") + if echo "$line" | grep -qE '^\s+indexer:\s*$'; then + section="indexer" + continue + elif echo "$line" | grep -qE '^\s+manager:\s*$'; then + section="manager" + continue + elif echo "$line" | grep -qE '^\s+dashboard:\s*$'; then + section="dashboard" + continue + fi + + # Extract node name from "- name: " lines + if echo "$line" | grep -qE '^\s+-\s+name:'; then + local name + name=$(echo "$line" | sed 's/.*name:\s*//' | tr -d ' "'\''') + case $section in + indexer) INDEXER_NODES+=("$name") ;; + manager) MANAGER_NODES+=("$name") ;; + dashboard) DASHBOARD_NODES+=("$name") ;; + esac + fi + done < "$CONFIG_FILE" +} + +# Convert node name to directory name (replace . with _) +node_to_dir() { + echo "$1" | tr '.' '_' +} + +# --------------------------------------------------------------------------- +# Main logic +# --------------------------------------------------------------------------- + +# Parse config.yml +if $DO_COPY || $DO_PRIV; then + if [ ! -f "$CONFIG_FILE" ]; then + echo "Error: Configuration file $CONFIG_FILE not found." + exit 1 + fi + parse_config + echo "Detected indexer nodes: ${INDEXER_NODES[*]}" + echo "Detected manager nodes: ${MANAGER_NODES[*]}" + echo "Detected dashboard nodes: ${DASHBOARD_NODES[*]}" +fi + +# 1. Generate certificates +if $DO_CERT; then + echo "Generating certificates" + bash $CERT_TOOL -A +fi + +# 2. Copy certificates to config directories +if $DO_COPY; then + FIRST_INDEXER=true + for node in "${INDEXER_NODES[@]}"; do + dir_name=$(node_to_dir "$node") + echo "Copying certificates for indexer: $node -> config/$dir_name/certs/" + mkdir -p "./config/$dir_name/certs" + cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/" + cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/" + if $FIRST_INDEXER; then + cp "$OUTPUT_DIR"/admin* "./config/$dir_name/certs/" + FIRST_INDEXER=false + fi + done + + for node in "${MANAGER_NODES[@]}"; do + dir_name=$(node_to_dir "$node") + echo "Copying certificates for manager: $node -> config/$dir_name/certs/" + mkdir -p "./config/$dir_name/certs" + cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/" + cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/" + done + + for node in "${DASHBOARD_NODES[@]}"; do + dir_name=$(node_to_dir "$node") + echo "Copying certificates for dashboard: $node -> config/$dir_name/certs/" + mkdir -p "./config/$dir_name/certs" + cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/" + cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/" + done +fi + +# 3. Set ownership and permissions +if $DO_PRIV; then + for node in "${INDEXER_NODES[@]}"; do + dir_name=$(node_to_dir "$node") + echo "Setting permissions for indexer $node (1000:1000)" + chown -R 1000:1000 "./config/$dir_name/certs" + chmod 400 "./config/$dir_name/certs/"* + done + + for node in "${MANAGER_NODES[@]}"; do + dir_name=$(node_to_dir "$node") + echo "Setting permissions for manager $node (999:999)" + chown -R 999:999 "./config/$dir_name/certs" + chmod 400 "./config/$dir_name/certs/"* + done + + for node in "${DASHBOARD_NODES[@]}"; do + dir_name=$(node_to_dir "$node") + echo "Setting permissions for dashboard $node (1000:1000)" + chown -R 1000:1000 "./config/$dir_name/certs" + chmod 400 "./config/$dir_name/certs/"* + done +fi + +echo "Process completed."