yahoo_1999/fk-wazuh
1
0
Fork 0
forked from wazuh/wazuh-docker
Code Pull Requests Activity

Merge pull request #2220 from wazuh/enhancement/2206-adapt-image-build

Browse Source 
Separate Agent/Manager - Docker - Adapt image build process
This commit is contained in:
Victor Ereñú
2026-02-19 10:44:48 -03:00
committed by GitHub
parent 40c88305bc
commit 175faaed8d
26 changed files with 367 additions and 415 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
+26 -27
View File
@@ -4,7 +4,7 @@
# Variables
source /permanent_data.env
WAZUH_INSTALL_PATH=/var/ossec
WAZUH_INSTALL_PATH=/var/wazuh-manager
WAZUH_CONFIG_MOUNT=/wazuh-config-mount
##############################################################################
@@ -119,7 +119,7 @@ remove_data_files() {
# Create certificates: Manager
##############################################################################
create_ossec_key_cert() {
create_wazuh_key_cert() {
print "Creating wazuh-authd key and cert"
exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.key 4096"
exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/etc/sslmanager.key -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/"
@@ -129,9 +129,9 @@ create_ossec_key_cert() {
# Copy all files from $WAZUH_CONFIG_MOUNT to $WAZUH_INSTALL_PATH and respect
# destination files permissions
#
# For example, to mount the file /var/ossec/data/etc/ossec.conf, mount it at
# $WAZUH_CONFIG_MOUNT/etc/ossec.conf in your container and this code will
# replace the ossec.conf file in /var/ossec/data/etc with yours.
# For example, to mount the file /var/wazuh-manager/data/etc/wazuh-manager.conf, mount it at
# $WAZUH_CONFIG_MOUNT/etc/wazuh-manager.conf in your container and this code will
# replace the wazuh-manager.conf file in /var/wazuh-manager/data/etc with yours.
##############################################################################
mount_files() {
@@ -150,23 +150,23 @@ mount_files() {
# container start.
#
# To use this:
# 1. Create your own ossec.conf file
# 2. In your ossec.conf file, set to_be_replaced_by_hostname as your node_name
# 3. Mount your custom ossec.conf file at $WAZUH_CONFIG_MOUNT/etc/ossec.conf
# 1. Create your own wazuh-manager.conf file
# 2. In your wazuh-manager.conf file, set to_be_replaced_by_hostname as your node_name
# 3. Mount your custom wazuh-manager.conf file at $WAZUH_CONFIG_MOUNT/etc/wazuh-manager.conf
##############################################################################
set_custom_hostname() {
sed -i 's/<node_name>to_be_replaced_by_hostname<\/node_name>/<node_name>'"${HOSTNAME}"'<\/node_name>/g' ${WAZUH_INSTALL_PATH}/etc/ossec.conf
sed -i 's/<node_name>to_be_replaced_by_hostname<\/node_name>/<node_name>'"${HOSTNAME}"'<\/node_name>/g' ${WAZUH_INSTALL_PATH}/etc/wazuh-manager.conf
}
function_configure_ossec_conf() {
OSSEC_CONF="${WAZUH_INSTALL_PATH}/etc/ossec.conf"
function_configure_wazuh_manager_conf() {
WAZUH_MANAGER_CONF="${WAZUH_INSTALL_PATH}/etc/wazuh-manager.conf"
# --------------------------
# Defaults based on OSSEC_CONF
# Defaults based on WAZUH_MANAGER_CONF
# --------------------------
if [[ -z "$WAZUH_CLUSTER_KEY" ]]; then
WAZUH_CLUSTER_KEY=$(sed -n '/<cluster>/,/<\/cluster>/s/.*<key>\(.*\)<\/key>.*/\1/p' "$OSSEC_CONF" | head -n1)
WAZUH_CLUSTER_KEY=$(sed -n '/<cluster>/,/<\/cluster>/s/.*<key>\(.*\)<\/key>.*/\1/p' "$WAZUH_MANAGER_CONF" | head -n1)
fi
# Node type logic
@@ -193,7 +193,7 @@ if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then
echo " </hosts>"
} > "$TMP_HOSTS";
sed -i -e '/<indexer>/,/<\/indexer>/{ /<hosts>/,/<\/hosts>/{ /<hosts>/r '"$TMP_HOSTS" \
-e 'd }}' "$OSSEC_CONF";
-e 'd }}' "$WAZUH_MANAGER_CONF";
rm -f "$TMP_HOSTS";
fi
@@ -201,22 +201,22 @@ fi
# --------------------------
# Cluster: node_name
# --------------------------
sed -i "/<cluster>/,/<\/cluster>/ s|<node_name>.*</node_name>|<node_name>$WAZUH_NODE_NAME</node_name>|" "$OSSEC_CONF"
sed -i "/<cluster>/,/<\/cluster>/ s|<node_name>.*</node_name>|<node_name>$WAZUH_NODE_NAME</node_name>|" "$WAZUH_MANAGER_CONF"
# --------------------------
# Cluster: node_type
# --------------------------
sed -i "/<cluster>/,/<\/cluster>/ s|<node_type>.*</node_type>|<node_type>$WAZUH_NODE_TYPE</node_type>|" "$OSSEC_CONF"
sed -i "/<cluster>/,/<\/cluster>/ s|<node_type>.*</node_type>|<node_type>$WAZUH_NODE_TYPE</node_type>|" "$WAZUH_MANAGER_CONF"
# --------------------------
# Cluster: key
# --------------------------
sed -i "/<cluster>/,/<\/cluster>/ s|<key>.*</key>|<key>$WAZUH_CLUSTER_KEY</key>|" "$OSSEC_CONF"
sed -i "/<cluster>/,/<\/cluster>/ s|<key>.*</key>|<key>$WAZUH_CLUSTER_KEY</key>|" "$WAZUH_MANAGER_CONF"
# --------------------------
# Cluster: bind_addr
# --------------------------
sed -i "/<cluster>/,/<\/cluster>/ s|<bind_addr>.*</bind_addr>|<bind_addr>$WAZUH_CLUSTER_BIND_ADDR</bind_addr>|" "$OSSEC_CONF"
sed -i "/<cluster>/,/<\/cluster>/ s|<bind_addr>.*</bind_addr>|<bind_addr>$WAZUH_CLUSTER_BIND_ADDR</bind_addr>|" "$WAZUH_MANAGER_CONF"
# --------------------------
# Cluster: nodes list
@@ -231,7 +231,7 @@ if [[ -n "$WAZUH_CLUSTER_NODES" ]]; then
echo " </nodes>"
} > "$TMP_NODES";
sed -i -e '/<cluster>/,/<\/cluster>/{ /<nodes>/,/<\/nodes>/{ /<nodes>/r '"$TMP_NODES" \
-e 'd }}' "$OSSEC_CONF";
-e 'd }}' "$WAZUH_MANAGER_CONF";
rm -f "$TMP_NODES";
fi
@@ -244,11 +244,11 @@ echo "Wazuh manager config modified successfully."
##############################################################################
configure_permissions() {
chown -R wazuh:wazuh /var/ossec/queue/rids
chown -R wazuh-manager:wazuh-manager /var/wazuh-manager/queue/rids
}
##############################################################################
# Change any ossec user/group to wazuh user/group
# Change any legacy user/group to wazuh-manager user/group
##############################################################################
set_correct_permOwner() {
@@ -262,7 +262,7 @@ set_correct_permOwner() {
##############################################################################
main() {
# Mount permanent data (i.e. ossec.conf)
# Mount permanent data (i.e. wazuh-manager.conf)
mount_permanent_data
# Restore files stored in permanent data that are not permanent (i.e. internal_options.conf)
@@ -271,7 +271,7 @@ main() {
# Apply correct permission and ownership
set_correct_permOwner
# Rename files stored in permanent data (i.e. queue/ossec)
# Rename files stored in permanent data (i.e. queue/wazuh-manager)
move_data_files
# Remove some files in permanent_data (i.e. .template.db)
@@ -280,7 +280,7 @@ main() {
# Create wazuh-authd key and cert if not present
if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ]
then
create_ossec_key_cert
create_wazuh_key_cert
fi
# Mount selected files (WAZUH_CONFIG_MOUNT) to container
@@ -289,9 +289,8 @@ main() {
# Allow setting custom hostname
set_custom_hostname
# Configure ossec.conf based on environment variables
function_configure_ossec_conf
# Configure wazuh-manager.conf based on environment variables
function_configure_wazuh_manager_conf
# Delete temporary data folder
rm -rf ${WAZUH_INSTALL_PATH}/data_tmp
build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager
+29 -30
View File
@@ -3,7 +3,7 @@
##############################################################################
# Migration sequence
# Detect if there is a mounted volume on /wazuh-migration and copy the data
# to /var/ossec, finally it will create a flag ".migration-completed" inside
# to /var/wazuh-manager, finally it will create a flag ".migration-completed" inside
# the mounted volume
##############################################################################
@@ -35,34 +35,33 @@ function_wazuh_migration(){
return
fi
\cp -f /wazuh-migration/data/etc/ossec.conf /var/ossec/etc/ossec.conf
chown root:wazuh /var/ossec/etc/ossec.conf
chmod 640 /var/ossec/etc/ossec.conf
\cp -f /wazuh-migration/data/etc/wazuh-manager.conf /var/wazuh-manager/etc/wazuh-manager.conf
chown root:wazuh-manager /var/wazuh-manager/etc/wazuh-manager.conf
chmod 640 /var/wazuh-manager/etc/wazuh-manager.conf
\cp -f /wazuh-migration/data/etc/client.keys /var/ossec/etc/client.keys
chown wazuh:wazuh /var/ossec/etc/client.keys
chmod 640 /var/ossec/etc/client.keys
\cp -f /wazuh-migration/data/etc/client.keys /var/wazuh-manager/etc/client.keys
chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/client.keys
chmod 640 /var/wazuh-manager/etc/client.keys
\cp -f /wazuh-migration/data/etc/sslmanager.cert /var/ossec/etc/sslmanager.cert
\cp -f /wazuh-migration/data/etc/sslmanager.key /var/ossec/etc/sslmanager.key
chown root:root /var/ossec/etc/sslmanager.cert /var/ossec/etc/sslmanager.key
chmod 640 /var/ossec/etc/sslmanager.cert /var/ossec/etc/sslmanager.key
\cp -f /wazuh-migration/data/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.cert
\cp -f /wazuh-migration/data/etc/sslmanager.key /var/wazuh-manager/etc/sslmanager.key
chown root:root /var/wazuh-manager/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.key
chmod 640 /var/wazuh-manager/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.key
\cp -f /wazuh-migration/data/etc/shared/default/agent.conf /var/ossec/etc/shared/default/agent.conf
chown wazuh:wazuh /var/ossec/etc/shared/default/agent.conf
chmod 660 /var/ossec/etc/shared/default/agent.conf
\cp -f /wazuh-migration/data/etc/shared/default/agent.conf /var/wazuh-manager/etc/shared/default/agent.conf
chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/shared/default/agent.conf
chmod 660 /var/wazuh-manager/etc/shared/default/agent.conf
\cp -f /wazuh-migration/data/etc/decoders/* /var/ossec/etc/decoders/
chown wazuh:wazuh /var/ossec/etc/decoders/*
chmod 660 /var/ossec/etc/decoders/*
\cp -f /wazuh-migration/data/etc/decoders/* /var/wazuh-manager/etc/decoders/
chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/decoders/*
chmod 660 /var/wazuh-manager/etc/decoders/*
\cp -f /wazuh-migration/data/etc/rules/* /var/wazuh-manager/etc/rules/
chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/rules/*
chmod 660 /var/wazuh-manager/etc/rules/*
\cp -f /wazuh-migration/data/etc/rules/* /var/ossec/etc/rules/
chown wazuh:wazuh /var/ossec/etc/rules/*
chmod 660 /var/ossec/etc/rules/*
\cp -f /wazuh-migration/global.db /var/ossec/queue/db/global.db
chown wazuh:wazuh /var/ossec/queue/db/global.db
chmod 640 /var/ossec/queue/db/global.db
\cp -f /wazuh-migration/global.db /var/wazuh-manager/queue/db/global.db
chown wazuh-manager:wazuh-manager /var/wazuh-manager/queue/db/global.db
chmod 640 /var/wazuh-manager/queue/db/global.db
# mark volume as migrated
touch /wazuh-migration/.migration-completed
@@ -76,7 +75,7 @@ function_wazuh_migration(){
function_create_custom_user() {
if [[ ! -z $API_USERNAME ]] && [[ ! -z $API_PASSWORD ]]; then
cat << EOF > /var/ossec/api/configuration/admin.json
cat << EOF > /var/wazuh-manager/api/configuration/admin.json
{
"username": "$API_USERNAME",
"password": "$API_PASSWORD"
@@ -84,9 +83,9 @@ function_create_custom_user() {
EOF
# create or customize API user
if /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/create_user.py; then
if /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/framework/scripts/create_user.py; then
# remove json if exit code is 0
rm /var/ossec/api/configuration/admin.json
rm /var/wazuh-manager/api/configuration/admin.json
else
echored "There was an error configuring the API user"
# terminate container to avoid unpredictable behavior
@@ -109,8 +108,8 @@ function_entrypoint_scripts() {
function_configure_vulnerability_detection() {
if [ "$INDEXER_PASSWORD" != "" ]; then
>&2 echo "Configuring password."
echo "$INDEXER_USERNAME" | /var/ossec/bin/wazuh-keystore -f indexer -k username
echo "$INDEXER_PASSWORD" | /var/ossec/bin/wazuh-keystore -f indexer -k password
echo "$INDEXER_USERNAME" | /var/wazuh-manager/bin/wazuh-keystore -f indexer -k username
echo "$INDEXER_PASSWORD" | /var/wazuh-manager/bin/wazuh-keystore -f indexer -k password
fi
}
@@ -127,4 +126,4 @@ function_configure_vulnerability_detection
function_entrypoint_scripts
# Start Wazuh
/var/ossec/bin/wazuh-control start
/var/wazuh-manager/bin/wazuh-control start