From 160bf4bbe9f90e7eecfd4d4a635d6842eb226bed Mon Sep 17 00:00:00 2001
From: Miguelangel Freitas <miguelangel@wazuh.com>
Date: Sat, 16 Sep 2017 22:01:17 -0400
Subject: [PATCH] Adding Nginx container

* Setting Nginx with SSL and basic auth, closes #20
* Set Content-Type on Kibana API config.
---
 docker-compose.yml           | 22 ++++++++++++++--
 kibana/config/wait-for-it.sh |  2 +-
 nginx/configure.sh           | 49 ++++++++++++++++++++++++++++++++++++
 3 files changed, 70 insertions(+), 3 deletions(-)
 create mode 100644 nginx/configure.sh

diff --git a/docker-compose.yml b/docker-compose.yml
index fe0502e4..883d80ba 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -53,8 +53,8 @@ services:
     image: wazuh/wazuh-kibana
     hostname: kibana
     restart: always
-    ports:
-      - "5601:5601"
+#    ports:
+#      - "5601:5601"
     networks:
         - docker_elk
     depends_on:
@@ -65,6 +65,24 @@ services:
     entrypoint: sh wait-for-it.sh elasticsearch
 #    environment:
 #      - "WAZUH_KIBANA_PLUGIN_URL=http://your.repo/wazuhapp-2.1.0-5.5.1.zip"
+  nginx:
+    image: nginx:latest
+    hostname: nginx
+    restart: always
+    command: bash /configure.sh
+    volumes:
+      - ./nginx/configure.sh:/configure.sh
+    environment:
+      - NGINX_PORT=443
+    ports:
+      - "80:80"
+      - "443:443"
+    networks:
+      - docker_elk
+    depends_on:
+      - kibana
+    links:
+      - kibana
 
 networks:
   docker_elk:
diff --git a/kibana/config/wait-for-it.sh b/kibana/config/wait-for-it.sh
index af6942a3..88cb344f 100644
--- a/kibana/config/wait-for-it.sh
+++ b/kibana/config/wait-for-it.sh
@@ -26,7 +26,7 @@ sleep 30
 
 echo "Configuring defaultIndex to wazuh-alerts-*"
 
-curl -s -XPUT http://$host:9200/.kibana/config/5.5.2 -d '{"defaultIndex" : "wazuh-alerts-*"}' > /dev/null
+curl -s -XPUT http://$host:9200/.kibana/config/5.5.2 -H 'Content-Type: application/json' -d '{"defaultIndex" : "wazuh-alerts-*"}' > /dev/null
 
 sleep 30
 
diff --git a/nginx/configure.sh b/nginx/configure.sh
new file mode 100644
index 00000000..2877a2ee
--- /dev/null
+++ b/nginx/configure.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+
+set -e
+
+if [ ! -d /etc/pki/tls/certs ]; then
+  echo "Generating SSL certificates"
+  if [ ! -x /usr/bin/openssl ]; then
+    apt-get update >/dev/null
+    apt-get -y install openssl >/dev/null
+  fi
+  mkdir -p /etc/pki/tls/certs /etc/pki/tls/private
+  openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout /etc/pki/tls/private/kibana-access.key -out /etc/pki/tls/certs/kibana-access.pem >/dev/null
+fi
+
+if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then
+  echo "Setting kibana credentials"
+  if [ ! -x /usr/bin/htpasswd ]; then
+    apt-get update >/dev/null
+    apt-get -y install apache2-utils >/dev/null
+  fi
+  echo bar|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd foo >/dev/null
+else
+  echo "Kibana credentials already configured"
+fi
+
+echo "Configuring NGINX"
+cat > /etc/nginx/conf.d/default.conf <<EOF
+server {
+    listen 80;
+    listen [::]:80;
+    return 301 https://\$host:$NGINX_PORT\$request_uri;
+}
+
+server {
+    listen $NGINX_PORT default_server;
+    listen [::]:$NGINX_PORT;
+    ssl on;
+    ssl_certificate /etc/pki/tls/certs/kibana-access.pem;
+    ssl_certificate_key /etc/pki/tls/private/kibana-access.key;
+    location / {
+        auth_basic "Restricted";
+        auth_basic_user_file /etc/nginx/conf.d/kibana.htpasswd;
+        proxy_pass http://kibana:5601/;
+    }
+}
+EOF
+
+echo "Starting Nginx"
+nginx -g 'daemon off; error_log /dev/stdout info;'