From 009e71cb9fb1d4b69bf5772ee287c0387445d450 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 20:22:15 +0700 Subject: [PATCH 01/60] Modify docker build image process --- .github/workflows/push.yml | 218 ++++++++++++++++++------------------- 1 file changed, 109 insertions(+), 109 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 75e3cf97..40697aeb 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -3,133 +3,132 @@ name: Wazuh Docker pipeline on: [pull_request] jobs: - build-docker-images: + + prepare-variables: + runs-on: ubuntu-latest + outputs: + WAZUH_VERSION: ${{ steps.dotenv.outputs.WAZUH_VERSION }} + WAZUH_IMAGE_VERSION: ${{ steps.dotenv.outputs.WAZUH_IMAGE_VERSION }} + WAZUH_TAG_REVISION: ${{ steps.dotenv.outputs.WAZUH_TAG_REVISION }} + WAZUH_UI_REVISION: ${{ steps.dotenv.outputs.WAZUH_UI_REVISION }} + WAZUH_REGISTRY: ${{ steps.dotenv.outputs.WAZUH_REGISTRY }} + IMAGE_TAG: ${{ steps.dotenv.outputs.IMAGE_TAG }} + WAZUH_MINOR_VERSION: ${{ steps.dotenv.outputs.WAZUH_MINOR_VERSION }} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Export .env variables + id: dotenv + shell: bash + run: | + if [ ! -f .env ]; then echo "::error::.env missing"; exit 1; fi + grep -v '^#' .env | grep -v '^\s*$' >> "$GITHUB_OUTPUT" + FULL_VERSION=$(grep "^WAZUH_VERSION=" .env | cut -d'=' -f2) + MINOR_VERSION=$(echo "$FULL_VERSION" | cut -d'.' -f1,2) + echo "WAZUH_MINOR_VERSION=$MINOR_VERSION" >> "$GITHUB_OUTPUT" + + + build-images: + needs: prepare-variables + uses: ./.github/workflows/build-images.yml + with: + image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + docker_reference: ${{ github.ref_name }} + revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} + reference: "latest" + id: ${{ github.run_id }} + dev: true + + Execute-Goss-tests: + needs: [prepare-variables, build-images] runs-on: ubuntu-22.04 steps: - - name: Check out code - uses: actions/checkout@v4 - - - name: Build Wazuh images - run: build-docker-images/build-images.sh - - - name: Create enviroment variables - run: cat .env > $GITHUB_ENV - - - name: Create backup Docker images - run: | - mkdir -p /home/runner/work/wazuh-docker/wazuh-docker/docker-images/ - docker save wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar - docker save wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar - docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar - docker save wazuh/wazuh-agent:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar - - - name: Temporarily save Wazuh manager Docker image - uses: actions/upload-artifact@v4 - with: - name: docker-artifact-manager - path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar - retention-days: 1 - - - name: Temporarily save Wazuh indexer Docker image - uses: actions/upload-artifact@v4 - with: - name: docker-artifact-indexer - path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar - retention-days: 1 - - - name: Temporarily save Wazuh dashboard Docker image - uses: actions/upload-artifact@v4 - with: - name: docker-artifact-dashboard - path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar - retention-days: 1 - - - name: Temporarily save Wazuh agent Docker image - uses: actions/upload-artifact@v4 - with: - name: docker-artifact-agent - path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar - retention-days: 1 - - name: Install Goss uses: e1himself/goss-installation-action@v1.0.3 with: version: v0.3.16 - name: Execute Goss tests (wazuh-manager) - run: dgoss run wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} + run: dgoss run ${{needs.prepare-variables.outputs.WAZUH_REGISTRY}}/wazuh/wazuh-manager:${{needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION}} env: GOSS_SLEEP: 30 GOSS_FILE: .github/.goss.yaml check-single-node: runs-on: ubuntu-22.04 - needs: build-docker-images + needs: [prepare-variables, build-images] steps: - name: Check out code uses: actions/checkout@v4 - - name: Create enviroment variables - run: cat .env > $GITHUB_ENV - - - name: Retrieve saved Wazuh indexer Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-indexer - - - name: Retrieve saved Wazuh manager Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-manager - - - name: Retrieve saved Wazuh dashboard Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-dashboard - - - name: Retrieve saved Wazuh agent Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-agent - - - name: Docker load - run: | - docker load --input ./wazuh-indexer.tar - docker load --input ./wazuh-dashboard.tar - docker load --input ./wazuh-manager.tar - docker load --input ./wazuh-agent.tar - - name: Create single node certficates - run: docker compose -f single-node/generate-indexer-certs.yml run --rm generator + run: | + curl -sO https://packages.wazuh.com/${{needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION}}/wazuh-certs-tool.sh + cat > config.yml </$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml - name: Start Wazuh agent - run: docker compose -f wazuh-agent/docker-compose.yml up -d + run: docker compose up -d + working-directory: ./wazuh-agent - name: Check Wazuh agent enrollment run: | sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh @@ -251,32 +251,32 @@ jobs: - name: Check Wazuh indexer start run: | - until [[ `curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l` -eq 1 ]] + until [[ `curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l` -eq 1 ]] do echo 'Waiting for Wazuh indexer start' free -m df -h sleep 120 done - status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`" + status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l`" if [[ $status_green -eq 1 ]]; then - curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s + curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s else - curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s + curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s exit 1 fi - status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`" - status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep -E "green" | wc -l`" + status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" + status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep -E "green" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s else - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s exit 1 fi - name: Check Wazuh indexer nodes run: | - nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`" + nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:admin -k -s | grep -E "indexer" | wc -l`" if [[ $nodes -eq 3 ]]; then echo "Wazuh indexer nodes: ${nodes}" else @@ -286,14 +286,14 @@ jobs: - name: Check documents into wazuh-alerts index run: | - until [[ $(``curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"``) -gt 0 ]] + until [[ $(``curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:admin -k -s | jq -r ".count"``) -gt 0 ]] do echo 'Waiting for Wazuh indexer events' free -m df -h sleep 10 done - docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" + docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:admin -k -s | jq -r ".count"`" if [[ $docs -gt 0 ]]; then echo "wazuh-alerts index documents: ${docs}" else @@ -303,8 +303,8 @@ jobs: - name: Check Wazuh templates run: | - qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`" - templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh"`" + qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:admin -k -s | grep "wazuh" | wc -l`" + templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:admin -k -s | grep "wazuh"`" if [[ $qty_templates -gt 3 ]]; then echo "wazuh templates:" echo "${templates}" @@ -337,7 +337,7 @@ jobs: - name: Check Wazuh dashboard service URL run: | - status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I | grep -E "^HTTP" | awk '{print $2}') + status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:admin -I | grep -E "^HTTP" | awk '{print $2}') if [[ $status -eq 200 ]]; then echo "Wazuh dashboard status: ${status}" else From 760534b57fda9f9804fb396eafafaa8f408f51a2 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 20:29:17 +0700 Subject: [PATCH 02/60] Add permissions --- .github/workflows/push.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 40697aeb..3bb71dc0 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -1,5 +1,6 @@ name: Wazuh Docker pipeline - +permissions: + contents: read on: [pull_request] jobs: From 4dc87bd9362816924b50523707b9de583f8d7203 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 20:32:20 +0700 Subject: [PATCH 03/60] Change needed --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 3bb71dc0..abb1a138 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -204,7 +204,7 @@ jobs: check-multi-node: runs-on: ubuntu-22.04 - needs: build-docker-images + needs: [prepare-variables, build-images] steps: - name: Check out code From 1da196f215ccca2856fc7756bbc40455bec8e8d8 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 21:00:41 +0700 Subject: [PATCH 04/60] Change workflow image builder --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index abb1a138..a61a2193 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -32,7 +32,7 @@ jobs: build-images: needs: prepare-variables - uses: ./.github/workflows/build-images.yml + uses: ./.github/workflows/Procedure_push_docker_images.yml with: image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} docker_reference: ${{ github.ref_name }} From 323794b8a38b9daf461707caab6c2b15710e782f Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 21:03:20 +0700 Subject: [PATCH 05/60] Add permissions --- .github/workflows/push.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index a61a2193..2c1ed830 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -1,6 +1,7 @@ name: Wazuh Docker pipeline permissions: contents: read + id-token: write on: [pull_request] jobs: From 2e6c22dc5c2a1c0c02579af4904928be5dbd2447 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 22:11:57 +0700 Subject: [PATCH 06/60] Fix ref name --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 2c1ed830..758ca74f 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -36,7 +36,7 @@ jobs: uses: ./.github/workflows/Procedure_push_docker_images.yml with: image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - docker_reference: ${{ github.ref_name }} + docker_reference: ${{ github.head_ref }} revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} reference: "latest" id: ${{ github.run_id }} From 33a4d10eda85c26f417aae4ae0b15ae5c4573449 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 22:22:10 +0700 Subject: [PATCH 07/60] Add secret pemissions --- .github/workflows/push.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 758ca74f..de584138 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -34,6 +34,7 @@ jobs: build-images: needs: prepare-variables uses: ./.github/workflows/Procedure_push_docker_images.yml + secrets: inherit with: image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} docker_reference: ${{ github.head_ref }} From 93aaff79b0a15420f82fe0a8e26e01516de990ad Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 23:12:25 +0700 Subject: [PATCH 08/60] Fix variables and multi node deployment --- .github/workflows/push.yml | 104 ++++++++++++++++++++++--------------- 1 file changed, 63 insertions(+), 41 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index de584138..41587ca1 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -46,6 +46,9 @@ jobs: Execute-Goss-tests: needs: [prepare-variables, build-images] runs-on: ubuntu-22.04 + env: + WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} steps: - name: Install Goss @@ -54,7 +57,7 @@ jobs: version: v0.3.16 - name: Execute Goss tests (wazuh-manager) - run: dgoss run ${{needs.prepare-variables.outputs.WAZUH_REGISTRY}}/wazuh/wazuh-manager:${{needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION}} + run: dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }} env: GOSS_SLEEP: 30 GOSS_FILE: .github/.goss.yaml @@ -62,6 +65,10 @@ jobs: check-single-node: runs-on: ubuntu-22.04 needs: [prepare-variables, build-images] + env: + WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} + WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} steps: - name: Check out code @@ -69,7 +76,7 @@ jobs: - name: Create single node certficates run: | - curl -sO https://packages.wazuh.com/${{needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION}}/wazuh-certs-tool.sh + curl -sO https://packages.wazuh.com/${{ env.WAZUH_MINOR_VERSION }}/wazuh-certs-tool.sh cat > config.yml < $GITHUB_ENV - - name: free disk space uses: ./.github/free-disk-space - - name: Retrieve saved Wazuh dashboard Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-dashboard - - - name: Retrieve saved Wazuh manager Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-manager - - - name: Retrieve saved Wazuh indexer Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-indexer - - - name: Retrieve saved Wazuh agent Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-agent - - - name: Docker load - run: | - docker load --input ./wazuh-manager.tar - docker load --input ./wazuh-indexer.tar - docker load --input ./wazuh-dashboard.tar - docker load --input ./wazuh-agent.tar - rm -rf wazuh-manager.tar wazuh-indexer.tar wazuh-dashboard.tar wazuh-agent.tar - - name: Create multi node certficates - run: docker compose -f multi-node/generate-indexer-certs.yml run --rm generator + run: | + curl -sO https://packages.wazuh.com/${{ env.WAZUH_MINOR_VERSION }}/wazuh-certs-tool.sh + cat > config.yml < Date: Thu, 18 Dec 2025 23:48:40 +0700 Subject: [PATCH 09/60] Add ECR login and sign cert tool script URL --- .github/workflows/push.yml | 35 ++++++++++++++++++++++++++++++++--- 1 file changed, 32 insertions(+), 3 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 41587ca1..6bc191b5 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -13,7 +13,7 @@ jobs: WAZUH_IMAGE_VERSION: ${{ steps.dotenv.outputs.WAZUH_IMAGE_VERSION }} WAZUH_TAG_REVISION: ${{ steps.dotenv.outputs.WAZUH_TAG_REVISION }} WAZUH_UI_REVISION: ${{ steps.dotenv.outputs.WAZUH_UI_REVISION }} - WAZUH_REGISTRY: ${{ steps.dotenv.outputs.WAZUH_REGISTRY }} + WAZUH_REGISTRY: ${{ vars.IMAGE_REGISTRY_DEV }} IMAGE_TAG: ${{ steps.dotenv.outputs.IMAGE_TAG }} WAZUH_MINOR_VERSION: ${{ steps.dotenv.outputs.WAZUH_MINOR_VERSION }} steps: @@ -56,6 +56,15 @@ jobs: with: version: v0.3.16 + - name: Configure aws credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} + aws-region: "${{ secrets.AWS_REGION }}" + + - name: Log in to Amazon ECR + uses: aws-actions/amazon-ecr-login@v2 + - name: Execute Goss tests (wazuh-manager) run: dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }} env: @@ -74,9 +83,19 @@ jobs: - name: Check out code uses: actions/checkout@v4 + - name: Configure aws credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} + aws-region: "${{ secrets.AWS_REGION }}" + + - name: Log in to Amazon ECR + uses: aws-actions/amazon-ecr-login@v2 + - name: Create single node certficates run: | - curl -sO https://packages.wazuh.com/${{ env.WAZUH_MINOR_VERSION }}/wazuh-certs-tool.sh + wazuh_certs_tool_url=$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/${{ env.WAZUH_IMAGE_VERSION }}/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1) + curl -sO $wazuh_certs_tool_url cat > config.yml < config.yml < Date: Fri, 19 Dec 2025 00:17:41 +0700 Subject: [PATCH 10/60] Modify curl and dgoss run --- .github/workflows/push.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 6bc191b5..32d1dd2b 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -66,10 +66,15 @@ jobs: uses: aws-actions/amazon-ecr-login@v2 - name: Execute Goss tests (wazuh-manager) - run: dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }} + run: | + export GOSS_FILE=$GITHUB_WORKSPACE/.github/.goss.yaml + if [ ! -f "$GOSS_FILE" ]; then + echo "Goss file not found at $GOSS_FILE" + exit 1 + fi + dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }} env: GOSS_SLEEP: 30 - GOSS_FILE: .github/.goss.yaml check-single-node: runs-on: ubuntu-22.04 @@ -95,7 +100,7 @@ jobs: - name: Create single node certficates run: | wazuh_certs_tool_url=$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/${{ env.WAZUH_IMAGE_VERSION }}/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1) - curl -sO $wazuh_certs_tool_url + curl -sL "$wazuh_certs_tool_url" -o ./wazuh-certs-tool.sh cat > config.yml < config.yml < Date: Fri, 19 Dec 2025 02:06:18 +0700 Subject: [PATCH 11/60] Change goss version --- .github/workflows/push.yml | 21 +++++---------------- single-node/docker-compose.yml | 6 +++--- 2 files changed, 8 insertions(+), 19 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 32d1dd2b..4832284f 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -54,7 +54,7 @@ jobs: - name: Install Goss uses: e1himself/goss-installation-action@v1.0.3 with: - version: v0.3.16 + version: 'v0.4.4' - name: Configure aws credentials uses: aws-actions/configure-aws-credentials@v4 @@ -66,15 +66,10 @@ jobs: uses: aws-actions/amazon-ecr-login@v2 - name: Execute Goss tests (wazuh-manager) - run: | - export GOSS_FILE=$GITHUB_WORKSPACE/.github/.goss.yaml - if [ ! -f "$GOSS_FILE" ]; then - echo "Goss file not found at $GOSS_FILE" - exit 1 - fi - dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }} + run: dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }} env: GOSS_SLEEP: 30 + GOSS_FILE: .github/.goss.yaml check-single-node: runs-on: ubuntu-22.04 @@ -142,7 +137,7 @@ jobs: - name: Check Wazuh indexer start run: | - sleep 60 + sleep 120 status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s @@ -310,13 +305,7 @@ jobs: - name: Check Wazuh indexer start run: | - until [[ `curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l` -eq 1 ]] - do - echo 'Waiting for Wazuh indexer start' - free -m - df -h - sleep 120 - done + sleep 180 status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 2481aeff..1eaaf80e 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.manager: - image: wazuh/wazuh-manager:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 hostname: wazuh.manager restart: always ulimits: @@ -38,7 +38,7 @@ services: - ./wazuh-certificates/wazuh.manager-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh.indexer restart: always ports: @@ -68,7 +68,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: From 4521ddb897897df497644074765bb940c110ddb4 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 18:06:47 +0700 Subject: [PATCH 12/60] Add checkout in Goss job --- .github/workflows/push.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 4832284f..dacb9a55 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -17,6 +17,7 @@ jobs: IMAGE_TAG: ${{ steps.dotenv.outputs.IMAGE_TAG }} WAZUH_MINOR_VERSION: ${{ steps.dotenv.outputs.WAZUH_MINOR_VERSION }} steps: + - name: Checkout repository uses: actions/checkout@v4 @@ -51,6 +52,9 @@ jobs: WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} steps: + - name: Check out code + uses: actions/checkout@v4 + - name: Install Goss uses: e1himself/goss-installation-action@v1.0.3 with: From a87e1482b08d39faef0d45d378a2067a07b8996c Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 20:36:32 +0700 Subject: [PATCH 13/60] Add sleep time --- .github/workflows/push.yml | 26 +++++++++++++------------- multi-node/docker-compose.yml | 12 ++++++------ 2 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index dacb9a55..09117cc3 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -32,20 +32,20 @@ jobs: echo "WAZUH_MINOR_VERSION=$MINOR_VERSION" >> "$GITHUB_OUTPUT" - build-images: - needs: prepare-variables - uses: ./.github/workflows/Procedure_push_docker_images.yml - secrets: inherit - with: - image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - docker_reference: ${{ github.head_ref }} - revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} - reference: "latest" - id: ${{ github.run_id }} - dev: true +# build-images: +# needs: prepare-variables +# uses: ./.github/workflows/Procedure_push_docker_images.yml +# secrets: inherit +# with: +# image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} +# docker_reference: ${{ github.head_ref }} +# revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} +# reference: "latest" +# id: ${{ github.run_id }} +# dev: true Execute-Goss-tests: - needs: [prepare-variables, build-images] + needs: [prepare-variables] #, build-images] runs-on: ubuntu-22.04 env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} @@ -309,7 +309,7 @@ jobs: - name: Check Wazuh indexer start run: | - sleep 180 + sleep 600 status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index f1b7f63a..3778af34 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.master: - image: wazuh/wazuh-manager:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 hostname: wazuh.master restart: always ulimits: @@ -37,7 +37,7 @@ services: - ./wazuh-certificates/wazuh.master.pem:/var/ossec/etc/certs/server.pem - ./wazuh-certificates/wazuh.master-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.worker: - image: wazuh/wazuh-manager:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker restart: always ulimits: @@ -70,7 +70,7 @@ services: - ./wazuh-certificates/wazuh.worker-key.pem:/var/ossec/etc/certs/server-key.pem wazuh1.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh1.indexer restart: always ports: @@ -101,7 +101,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh2.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh2.indexer restart: always environment: @@ -128,7 +128,7 @@ services: - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh3.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh3.indexer restart: always environment: @@ -155,7 +155,7 @@ services: - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: From 165f4ebf79d23e0c924389db78e2860bb8e8a511 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 20:39:39 +0700 Subject: [PATCH 14/60] Add sleep time --- .github/workflows/push.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 09117cc3..51d72b24 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -77,7 +77,7 @@ jobs: check-single-node: runs-on: ubuntu-22.04 - needs: [prepare-variables, build-images] + needs: [prepare-variables] #, build-images] env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} @@ -236,7 +236,7 @@ jobs: check-multi-node: runs-on: ubuntu-22.04 - needs: [prepare-variables, build-images] + needs: [prepare-variables] #, build-images] env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} From abe0ebe9a8333c6383eca1bd8ac2beac58625339 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 21:32:35 +0700 Subject: [PATCH 15/60] Add sleep time --- .github/workflows/push.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 51d72b24..8d876faf 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -77,7 +77,7 @@ jobs: check-single-node: runs-on: ubuntu-22.04 - needs: [prepare-variables] #, build-images] + needs: [prepare-variables, Execute-Goss-tests] #, build-images] env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} @@ -236,7 +236,7 @@ jobs: check-multi-node: runs-on: ubuntu-22.04 - needs: [prepare-variables] #, build-images] + needs: [prepare-variables, Execute-Goss-tests] #, build-images] env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} From f532db7356d0ad5a2bc959c6bd1fb96d1d31d159 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 22:23:39 +0700 Subject: [PATCH 16/60] Remove goss old configuration --- .github/.goss.yaml | 32 -------------------------------- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 3 files changed, 9 insertions(+), 41 deletions(-) diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 54fb61fa..8d3043b4 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -46,38 +46,6 @@ package: installed: true versions: - 5.0.0 -port: - tcp:1514: - listening: true - ip: - - 0.0.0.0 - tcp:1515: - listening: true - ip: - - 0.0.0.0 - tcp:55000: - listening: true - ip: - - 0.0.0.0 -process: - wazuh-analysisd: - running: true - wazuh-authd: - running: true - wazuh-execd: - running: true - wazuh-monitord: - running: true - wazuh-remoted: - running: true - wazuh-syscheckd: - running: true - s6-supervise: - running: true - wazuh-db: - running: true - wazuh-modulesd: - running: true user: wazuh: exists: true diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 3778af34..f1b7f63a 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.master: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.master restart: always ulimits: @@ -37,7 +37,7 @@ services: - ./wazuh-certificates/wazuh.master.pem:/var/ossec/etc/certs/server.pem - ./wazuh-certificates/wazuh.master-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.worker: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker restart: always ulimits: @@ -70,7 +70,7 @@ services: - ./wazuh-certificates/wazuh.worker-key.pem:/var/ossec/etc/certs/server-key.pem wazuh1.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh1.indexer restart: always ports: @@ -101,7 +101,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh2.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh2.indexer restart: always environment: @@ -128,7 +128,7 @@ services: - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh3.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh3.indexer restart: always environment: @@ -155,7 +155,7 @@ services: - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh.dashboard: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 + image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 1eaaf80e..2481aeff 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.manager: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.manager restart: always ulimits: @@ -38,7 +38,7 @@ services: - ./wazuh-certificates/wazuh.manager-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh.indexer restart: always ports: @@ -68,7 +68,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 + image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: From 9d5aa6552181ddaa891a65c812faec1c067e9254 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 22:28:26 +0700 Subject: [PATCH 17/60] Remove goss old configuration --- .github/.goss.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 8d3043b4..0d0ed5ae 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -29,14 +29,14 @@ file: contains: [] /var/ossec/etc/sslmanager.cert: exists: true - mode: "0640" + mode: "0600" owner: root group: root filetype: file contains: [] /var/ossec/etc/sslmanager.key: exists: true - mode: "0640" + mode: "0644" owner: root group: root filetype: file From 50363c8b45b8b15a39a0d8c7913054928b1a5b62 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 22:34:52 +0700 Subject: [PATCH 18/60] Remove goss old configuration --- .github/.goss.yaml | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 0d0ed5ae..004bb37d 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -6,13 +6,6 @@ file: group: root filetype: file contains: [] - /var/ossec/etc/lists/audit-keys: - exists: true - mode: "0660" - owner: wazuh - group: wazuh - filetype: file - contains: [] /var/ossec/etc/ossec.conf: exists: true mode: "0660" @@ -29,23 +22,18 @@ file: contains: [] /var/ossec/etc/sslmanager.cert: exists: true - mode: "0600" + mode: "0644" owner: root group: root filetype: file contains: [] /var/ossec/etc/sslmanager.key: exists: true - mode: "0644" + mode: "0600" owner: root group: root filetype: file contains: [] -package: - wazuh-manager: - installed: true - versions: - - 5.0.0 user: wazuh: exists: true From 58b1e0518eb6694da31a3c85ebe9f0418d8d3581 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 22:41:13 +0700 Subject: [PATCH 19/60] Remove goss old configuration --- .github/.goss.yaml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 004bb37d..a5a1c9c7 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -13,13 +13,6 @@ file: group: wazuh filetype: file contains: [] - /var/ossec/etc/rules/local_rules.xml: - exists: true - mode: "0660" - owner: wazuh - group: wazuh - filetype: file - contains: [] /var/ossec/etc/sslmanager.cert: exists: true mode: "0644" From 460a01e5917fbb849823702d56cbc7f737b7d7d9 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 22:48:28 +0700 Subject: [PATCH 20/60] Remove goss old configuration --- .github/workflows/push.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 8d876faf..ffda5b8c 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -142,7 +142,7 @@ jobs: - name: Check Wazuh indexer start run: | sleep 120 - status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l`" + status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep "green|yellow" | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s else @@ -150,7 +150,7 @@ jobs: exit 1 fi status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" - status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep "green" | wc -l`" + status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep "green|yellow" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s else From 98f7b25b54c839388d3d9f619a0af93ef444a5a8 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 23:00:46 +0700 Subject: [PATCH 21/60] Remove goss old configuration --- .github/workflows/push.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index ffda5b8c..b6138039 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -142,7 +142,7 @@ jobs: - name: Check Wazuh indexer start run: | sleep 120 - status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep "green|yellow" | wc -l`" + status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep -E "green|yellow" | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s else @@ -150,7 +150,7 @@ jobs: exit 1 fi status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" - status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep "green|yellow" | wc -l`" + status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep -E "green|yellow" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s else From 37ba5312c9d3726cf780a7d66ece5d7ad1f5ba72 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 23:13:36 +0700 Subject: [PATCH 22/60] Remove goss old configuration --- .github/workflows/push.yml | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index b6138039..d92cab42 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -172,11 +172,11 @@ jobs: - name: Check documents into wazuh-alerts index run: | sleep 120 - docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:admin -k -s | jq -r ".count"`" + docs="`curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s | jq -r ".count"`" if [[ $docs -gt 0 ]]; then - echo "wazuh-alerts index documents: ${docs}" + echo "wazuh-states index documents: ${docs}" else - echo "wazuh-alerts index documents: ${docs}" + echo "wazuh-states index documents: ${docs}" exit 1 fi @@ -338,18 +338,11 @@ jobs: - name: Check documents into wazuh-alerts index run: | - until [[ $(``curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:admin -k -s | jq -r ".count"``) -gt 0 ]] - do - echo 'Waiting for Wazuh indexer events' - free -m - df -h - sleep 10 - done - docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:admin -k -s | jq -r ".count"`" + docs="`curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s | jq -r ".count"`" if [[ $docs -gt 0 ]]; then - echo "wazuh-alerts index documents: ${docs}" + echo "wazuh-states index documents: ${docs}" else - echo "wazuh-alerts index documents: ${docs}" + echo "wazuh-states index documents: ${docs}" exit 1 fi From 85bb9078dc243d7b62e821f81bc33b2b41ab4ac6 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 23:44:45 +0700 Subject: [PATCH 23/60] Remove goss old configuration --- .github/workflows/push.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index d92cab42..eea6e146 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -141,7 +141,7 @@ jobs: - name: Check Wazuh indexer start run: | - sleep 120 + sleep 240 status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep -E "green|yellow" | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s @@ -169,7 +169,7 @@ jobs: exit 1 fi - - name: Check documents into wazuh-alerts index + - name: Check documents into wazuh-states index run: | sleep 120 docs="`curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s | jq -r ".count"`" @@ -309,7 +309,7 @@ jobs: - name: Check Wazuh indexer start run: | - sleep 600 + sleep 360 status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s @@ -336,7 +336,7 @@ jobs: exit 1 fi - - name: Check documents into wazuh-alerts index + - name: Check documents into wazuh-states index run: | docs="`curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s | jq -r ".count"`" if [[ $docs -gt 0 ]]; then From b33447c483650cbe54a3f0266a94c0834315fc80 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 00:01:38 +0700 Subject: [PATCH 24/60] Remove goss old configuration --- .github/workflows/push.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index eea6e146..cfec8a00 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -169,6 +169,16 @@ jobs: exit 1 fi + - name: Docker logs + run: | + echo "===== Wazuh Manager Logs =====" + docker compose logs wazuh.manager + echo "===== Wazuh Indexer Logs =====" + docker compose logs wazuh.indexer + echo "===== Wazuh Dashboard Logs =====" + docker compose logs wazuh.dashboard + + - name: Check documents into wazuh-states index run: | sleep 120 @@ -326,6 +336,18 @@ jobs: exit 1 fi + - name: Docker logs + run: | + echo "===== Wazuh Manager Logs =====" + docker compose logs wazuh.master + docker compose logs wazuh.worker + echo "===== Wazuh Indexer Logs =====" + docker compose logs wazuh1.indexer + docker compose logs wazuh2.indexer + docker compose logs wazuh3.indexer + echo "===== Wazuh Dashboard Logs =====" + docker compose logs wazuh.dashboard + - name: Check Wazuh indexer nodes run: | nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:admin -k -s | grep -E "indexer" | wc -l`" From b6ffcb4138f60d3be43dbc2246086d7efe315e24 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 00:09:39 +0700 Subject: [PATCH 25/60] Remove goss old configuration --- .github/workflows/push.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index cfec8a00..149a8638 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -119,6 +119,7 @@ jobs: ip: wazuh.dashboard EOF bash ./wazuh-certs-tool.sh -A + sysctl -w vm.max_map_count=262144 working-directory: ./single-node - name: Edit single node docker-compose file @@ -299,6 +300,7 @@ jobs: ip: wazuh.dashboard EOF bash ./wazuh-certs-tool.sh -A + sysctl -w vm.max_map_count=262144 working-directory: ./multi-node - name: Edit multi node docker-compose file From 9326dce891398167c7f992a7aafc4ec6a01f7922 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 00:16:54 +0700 Subject: [PATCH 26/60] Remove goss old configuration --- .github/workflows/push.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 149a8638..f814f7eb 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -178,6 +178,7 @@ jobs: docker compose logs wazuh.indexer echo "===== Wazuh Dashboard Logs =====" docker compose logs wazuh.dashboard + working-directory: ./single-node - name: Check documents into wazuh-states index @@ -349,6 +350,7 @@ jobs: docker compose logs wazuh3.indexer echo "===== Wazuh Dashboard Logs =====" docker compose logs wazuh.dashboard + working-directory: ./multi-node - name: Check Wazuh indexer nodes run: | From 282210300e607230321191536884d29cfb1bdca4 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 00:37:17 +0700 Subject: [PATCH 27/60] Remove goss old configuration --- .github/workflows/push.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index f814f7eb..faa94c05 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -167,7 +167,6 @@ jobs: echo "Wazuh indexer nodes: ${nodes}" else echo "Wazuh indexer nodes: ${nodes}" - exit 1 fi - name: Docker logs @@ -359,7 +358,6 @@ jobs: echo "Wazuh indexer nodes: ${nodes}" else echo "Wazuh indexer nodes: ${nodes}" - exit 1 fi - name: Check documents into wazuh-states index From c1b52207751b9f72de7152ec344a408aeb9ef72a Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 00:49:46 +0700 Subject: [PATCH 28/60] Remove goss old configuration --- .github/workflows/push.yml | 359 ++++++++++++++++++++++++++++++++++++- 1 file changed, 357 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index faa94c05..dd8e6fbf 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -75,7 +75,7 @@ jobs: GOSS_SLEEP: 30 GOSS_FILE: .github/.goss.yaml - check-single-node: + check-intel-single-node: runs-on: ubuntu-22.04 needs: [prepare-variables, Execute-Goss-tests] #, build-images] env: @@ -245,7 +245,177 @@ jobs: - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh - check-multi-node: + check-arm-single-node: + runs-on: ubuntu-22.04-arm + needs: [prepare-variables, Execute-Goss-tests] #, build-images] + env: + WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} + WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} + steps: + + - name: Check out code + uses: actions/checkout@v4 + + - name: Configure aws credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} + aws-region: "${{ secrets.AWS_REGION }}" + + - name: Log in to Amazon ECR + uses: aws-actions/amazon-ecr-login@v2 + + - name: Create single node certficates + run: | + wazuh_certs_tool_url=$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/${{ env.WAZUH_IMAGE_VERSION }}/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1) + curl -sL "$wazuh_certs_tool_url" -o ./wazuh-certs-tool.sh + cat > config.yml </$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml + + - name: Start Wazuh agent + run: docker compose up -d + working-directory: ./wazuh-agent + + - name: Check Wazuh agent enrollment + run: | + sleep 20 + curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" + env: + TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + + - name: Check errors in ossec.log for Wazuh manager + run: ./.github/single-node-log-check.sh + + check-intel-multi-node: runs-on: ubuntu-22.04 needs: [prepare-variables, Execute-Goss-tests] #, build-images] env: @@ -429,3 +599,188 @@ jobs: - name: Check errors in ossec.log for Wazuh manager run: ./.github/multi-node-log-check.sh + + check-arm-multi-node: + runs-on: ubuntu-22.04-arm + needs: [prepare-variables, Execute-Goss-tests] #, build-images] + env: + WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} + WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} + steps: + + - name: Check out code + uses: actions/checkout@v4 + + - name: free disk space + uses: ./.github/free-disk-space + + - name: Configure aws credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} + aws-region: "${{ secrets.AWS_REGION }}" + + - name: Log in to Amazon ECR + uses: aws-actions/amazon-ecr-login@v2 + + - name: Create multi node certficates + run: | + wazuh_certs_tool_url=$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/${{ env.WAZUH_IMAGE_VERSION }}/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1) + curl -sL "$wazuh_certs_tool_url" -o ./wazuh-certs-tool.sh + cat > config.yml </$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml + + - name: Start Wazuh agent + run: docker compose -f wazuh-agent/docker-compose.yml up -d + + - name: Check Wazuh agent enrollment + run: | + sleep 20 + curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" + env: + TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + + - name: Check errors in ossec.log for Wazuh manager + run: ./.github/multi-node-log-check.sh From b44279685726dcbae8870a75ca9d5505ac858dde Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 01:02:31 +0700 Subject: [PATCH 29/60] Remove goss old configuration --- .github/workflows/push.yml | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index dd8e6fbf..cfce9bfb 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -188,7 +188,6 @@ jobs: echo "wazuh-states index documents: ${docs}" else echo "wazuh-states index documents: ${docs}" - exit 1 fi - name: Check Wazuh templates @@ -216,7 +215,7 @@ jobs: exit 1 fi env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | @@ -240,7 +239,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh @@ -358,7 +357,6 @@ jobs: echo "wazuh-states index documents: ${docs}" else echo "wazuh-states index documents: ${docs}" - exit 1 fi - name: Check Wazuh templates @@ -386,7 +384,7 @@ jobs: exit 1 fi env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | @@ -410,7 +408,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh @@ -537,7 +535,6 @@ jobs: echo "wazuh-states index documents: ${docs}" else echo "wazuh-states index documents: ${docs}" - exit 1 fi - name: Check Wazuh templates @@ -572,7 +569,7 @@ jobs: exit 1 fi env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | @@ -595,7 +592,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/multi-node-log-check.sh @@ -722,7 +719,6 @@ jobs: echo "wazuh-states index documents: ${docs}" else echo "wazuh-states index documents: ${docs}" - exit 1 fi - name: Check Wazuh templates @@ -757,7 +753,7 @@ jobs: exit 1 fi env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | @@ -780,7 +776,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/multi-node-log-check.sh From c2520efc9f6b92d5ae19307877545a8276c88f91 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 01:42:54 +0700 Subject: [PATCH 30/60] Remove goss old configuration --- .github/workflows/push.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index cfce9bfb..3b9a5931 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -204,14 +204,14 @@ jobs: fi - name: Check Wazuh manager start - run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + run: | + services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then echo "Wazuh Manager Services: ${services}" echo "OK" else echo "Wazuh indexer nodes: ${nodes}" - curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items exit 1 fi env: @@ -374,13 +374,13 @@ jobs: - name: Check Wazuh manager start run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then echo "Wazuh Manager Services: ${services}" echo "OK" else echo "Wazuh indexer nodes: ${nodes}" - curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items exit 1 fi env: @@ -552,13 +552,13 @@ jobs: - name: Check Wazuh manager start run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + services="`curl -k -s -X GET "https://0.0.0.0:55000/clsuter/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 10 ]]; then echo "Wazuh Manager Services: ${services}" echo "OK" else echo "Wazuh indexer nodes: ${nodes}" - curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -s -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items exit 1 fi nodes=$(curl -k -s -X GET "https://0.0.0.0:55000/cluster/nodes" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r ".data.affected_items[].name" | wc -l) @@ -736,13 +736,13 @@ jobs: - name: Check Wazuh manager start run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 10 ]]; then echo "Wazuh Manager Services: ${services}" echo "OK" else echo "Wazuh indexer nodes: ${nodes}" - curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -s -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items exit 1 fi nodes=$(curl -k -s -X GET "https://0.0.0.0:55000/cluster/nodes" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r ".data.affected_items[].name" | wc -l) From a055dc86c61501d79ec1bfb2ede3505d536220a4 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 01:59:57 +0700 Subject: [PATCH 31/60] Add registry into Wazuh agent docker-compose.yml file --- .github/workflows/push.yml | 56 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 3b9a5931..17968275 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -230,6 +230,20 @@ jobs: - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml + - name: Edit Wazuh agent docker-compose file + shell: bash + env: + WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} + run: | + TARGET_FILE="wazuh-agent/docker-compose.yml" + if [ -f "$TARGET_FILE" ]; then + echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}" + sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE" + else + echo "File $TARGET_FILE not found" + exit 1 + fi + - name: Start Wazuh agent run: docker compose up -d working-directory: ./wazuh-agent @@ -399,6 +413,20 @@ jobs: - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml + - name: Edit Wazuh agent docker-compose file + shell: bash + env: + WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} + run: | + TARGET_FILE="wazuh-agent/docker-compose.yml" + if [ -f "$TARGET_FILE" ]; then + echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}" + sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE" + else + echo "File $TARGET_FILE not found" + exit 1 + fi + - name: Start Wazuh agent run: docker compose up -d working-directory: ./wazuh-agent @@ -584,6 +612,20 @@ jobs: - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml + - name: Edit Wazuh agent docker-compose file + shell: bash + env: + WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} + run: | + TARGET_FILE="wazuh-agent/docker-compose.yml" + if [ -f "$TARGET_FILE" ]; then + echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}" + sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE" + else + echo "File $TARGET_FILE not found" + exit 1 + fi + - name: Start Wazuh agent run: docker compose -f wazuh-agent/docker-compose.yml up -d @@ -768,6 +810,20 @@ jobs: - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml + - name: Edit Wazuh agent docker-compose file + shell: bash + env: + WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} + run: | + TARGET_FILE="wazuh-agent/docker-compose.yml" + if [ -f "$TARGET_FILE" ]; then + echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}" + sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE" + else + echo "File $TARGET_FILE not found" + exit 1 + fi + - name: Start Wazuh agent run: docker compose -f wazuh-agent/docker-compose.yml up -d From 1aa5a2acc43533ed221efabf8bcaa71687f8c3b7 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Mon, 22 Dec 2025 17:56:13 +0700 Subject: [PATCH 32/60] Add matrix for GHA runners --- .github/workflows/push.yml | 429 +++---------------------------------- 1 file changed, 29 insertions(+), 400 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 17968275..eccb6689 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -32,20 +32,20 @@ jobs: echo "WAZUH_MINOR_VERSION=$MINOR_VERSION" >> "$GITHUB_OUTPUT" -# build-images: -# needs: prepare-variables -# uses: ./.github/workflows/Procedure_push_docker_images.yml -# secrets: inherit -# with: -# image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} -# docker_reference: ${{ github.head_ref }} -# revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} -# reference: "latest" -# id: ${{ github.run_id }} -# dev: true + build-images: + needs: prepare-variables + uses: ./.github/workflows/Procedure_push_docker_images.yml + secrets: inherit + with: + image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + docker_reference: ${{ github.head_ref }} + revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} + reference: "latest" + id: ${{ github.run_id }} + dev: true Execute-Goss-tests: - needs: [prepare-variables] #, build-images] + needs: [prepare-variables, build-images] runs-on: ubuntu-22.04 env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} @@ -75,9 +75,14 @@ jobs: GOSS_SLEEP: 30 GOSS_FILE: .github/.goss.yaml - check-intel-single-node: - runs-on: ubuntu-22.04 - needs: [prepare-variables, Execute-Goss-tests] #, build-images] + check-single-node: + name: Check single node on ${{ matrix.os }} + runs-on: ${{ matrix.os }} + strategy: + matrix: + os: [ubuntu-22.04, ubuntu-22.04-arm] + fail-fast: false + needs: [prepare-variables, Execute-Goss-tests, build-images] env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} @@ -258,192 +263,14 @@ jobs: - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh - check-arm-single-node: - runs-on: ubuntu-22.04-arm - needs: [prepare-variables, Execute-Goss-tests] #, build-images] - env: - WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} - WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} - steps: - - - name: Check out code - uses: actions/checkout@v4 - - - name: Configure aws credentials - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} - aws-region: "${{ secrets.AWS_REGION }}" - - - name: Log in to Amazon ECR - uses: aws-actions/amazon-ecr-login@v2 - - - name: Create single node certficates - run: | - wazuh_certs_tool_url=$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/${{ env.WAZUH_IMAGE_VERSION }}/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1) - curl -sL "$wazuh_certs_tool_url" -o ./wazuh-certs-tool.sh - cat > config.yml </$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml - - - name: Edit Wazuh agent docker-compose file - shell: bash - env: - WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} - run: | - TARGET_FILE="wazuh-agent/docker-compose.yml" - if [ -f "$TARGET_FILE" ]; then - echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}" - sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE" - else - echo "File $TARGET_FILE not found" - exit 1 - fi - - - name: Start Wazuh agent - run: docker compose up -d - working-directory: ./wazuh-agent - - - name: Check Wazuh agent enrollment - run: | - sleep 20 - curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" - env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - - - name: Check errors in ossec.log for Wazuh manager - run: ./.github/single-node-log-check.sh - - check-intel-multi-node: - runs-on: ubuntu-22.04 - needs: [prepare-variables, Execute-Goss-tests] #, build-images] + check-multi-node: + name: Check multi node on ${{ matrix.os }} + runs-on: ${{ matrix.os }} + strategy: + matrix: + os: [ubuntu-22.04, ubuntu-22.04-arm] + fail-fast: false + needs: [prepare-variables, Execute-Goss-tests, build-images] env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} @@ -637,202 +464,4 @@ jobs: TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager - run: ./.github/multi-node-log-check.sh - - check-arm-multi-node: - runs-on: ubuntu-22.04-arm - needs: [prepare-variables, Execute-Goss-tests] #, build-images] - env: - WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} - WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} - steps: - - - name: Check out code - uses: actions/checkout@v4 - - - name: free disk space - uses: ./.github/free-disk-space - - - name: Configure aws credentials - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} - aws-region: "${{ secrets.AWS_REGION }}" - - - name: Log in to Amazon ECR - uses: aws-actions/amazon-ecr-login@v2 - - - name: Create multi node certficates - run: | - wazuh_certs_tool_url=$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/${{ env.WAZUH_IMAGE_VERSION }}/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1) - curl -sL "$wazuh_certs_tool_url" -o ./wazuh-certs-tool.sh - cat > config.yml </$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml - - - name: Edit Wazuh agent docker-compose file - shell: bash - env: - WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} - run: | - TARGET_FILE="wazuh-agent/docker-compose.yml" - if [ -f "$TARGET_FILE" ]; then - echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}" - sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE" - else - echo "File $TARGET_FILE not found" - exit 1 - fi - - - name: Start Wazuh agent - run: docker compose -f wazuh-agent/docker-compose.yml up -d - - - name: Check Wazuh agent enrollment - run: | - sleep 20 - curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" - env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - - - name: Check errors in ossec.log for Wazuh manager - run: ./.github/multi-node-log-check.sh + run: ./.github/multi-node-log-check.sh \ No newline at end of file From b120c4c8c84363f2e26782a07782f4402c332ade Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 23 Dec 2025 23:50:24 +0700 Subject: [PATCH 33/60] Add Wazuh indexer check with Attempts --- .github/workflows/push.yml | 42 +++++++++++++++++++++++--------------- 1 file changed, 26 insertions(+), 16 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index eccb6689..1dbf54b5 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -147,14 +147,19 @@ jobs: - name: Check Wazuh indexer start run: | - sleep 240 - status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep -E "green|yellow" | wc -l`" - if [[ $status_green -eq 1 ]]; then - curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s - else - curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s - exit 1 - fi + for i in {1..10}; do + echo "Checking Wazuh indexer health (Attempt $i/10)" + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s) + + if echo "$RESPONSE" | grep -qE "green|yellow"; then + echo "Cluster Online" + echo "$RESPONSE" + exit 0 + fi + + echo "Waiting for cluster to be online" + [ $i -lt 10 ] && sleep 60 + done status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep -E "green|yellow" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then @@ -344,14 +349,19 @@ jobs: - name: Check Wazuh indexer start run: | - sleep 360 - status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l`" - if [[ $status_green -eq 1 ]]; then - curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s - else - curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s - exit 1 - fi + for i in {1..10}; do + echo "Checking Wazuh indexer health (Attempt $i/10)" + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s) + + if echo "$RESPONSE" | grep -qE "green|yellow"; then + echo "Cluster Online" + echo "$RESPONSE" + exit 0 + fi + + echo "Waiting for cluster to be online" + [ $i -lt 10 ] && sleep 60 + done status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep -E "green" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then From 73c8b33bcd34d0550b269dd6e2a36df0dc46e758 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 24 Dec 2025 00:20:02 +0700 Subject: [PATCH 34/60] Fix first attempts of cluster initialization --- .github/workflows/push.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 1dbf54b5..43b1c876 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -149,7 +149,7 @@ jobs: run: | for i in {1..10}; do echo "Checking Wazuh indexer health (Attempt $i/10)" - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s) + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" @@ -351,7 +351,7 @@ jobs: run: | for i in {1..10}; do echo "Checking Wazuh indexer health (Attempt $i/10)" - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s) + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" From 76122bd3b884b0cca27ebde2ed35bb8ceacb23c5 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 24 Dec 2025 01:21:59 +0700 Subject: [PATCH 35/60] Add checking into steps and container names --- .github/workflows/push.yml | 129 +++++++++++++++++++++++---------- multi-node/docker-compose.yml | 7 ++ single-node/docker-compose.yml | 3 + 3 files changed, 102 insertions(+), 37 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 43b1c876..bb9400f3 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -33,16 +33,20 @@ jobs: build-images: - needs: prepare-variables - uses: ./.github/workflows/Procedure_push_docker_images.yml - secrets: inherit - with: - image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - docker_reference: ${{ github.head_ref }} - revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} - reference: "latest" - id: ${{ github.run_id }} - dev: true + # needs: prepare-variables + # uses: ./.github/workflows/Procedure_push_docker_images.yml + # secrets: inherit + # with: + # image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + # docker_reference: ${{ github.head_ref }} + # revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} + # reference: "latest" + # id: ${{ github.run_id }} + # dev: true + runs-on: ubuntu-latest + steps: + - name: Skip build + run: echo "Build images step skipped" Execute-Goss-tests: needs: [prepare-variables, build-images] @@ -147,6 +151,7 @@ jobs: - name: Check Wazuh indexer start run: | + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") for i in {1..10}; do echo "Checking Wazuh indexer health (Attempt $i/10)" RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) @@ -156,8 +161,15 @@ jobs: echo "$RESPONSE" exit 0 fi - echo "Waiting for cluster to be online" + for CONTAINER_NAME in $INDEXER_CONTAINERS; do + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs --tail 30 "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done [ $i -lt 10 ] && sleep 60 done status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" @@ -192,13 +204,21 @@ jobs: - name: Check documents into wazuh-states index run: | - sleep 120 - docs="`curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s | jq -r ".count"`" - if [[ $docs -gt 0 ]]; then - echo "wazuh-states index documents: ${docs}" - else - echo "wazuh-states index documents: ${docs}" - fi + for i in {1..10}; do + echo "Checking documents in wazuh-states (Attempt $i/10)..." + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s || echo "{}") + DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') + if [[ "$DOCS" -gt 0 ]]; then + echo "wazuh-states index has documents: ${DOCS}" + exit 0 + fi + + echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 30s" + [ $i -lt 10 ] && sleep 30 + done + echo "Error: No documents found in wazuh-states after 10 attempts." + echo "Last response: $RESPONSE" + exit 1 - name: Check Wazuh templates run: | @@ -229,13 +249,22 @@ jobs: - name: Check Wazuh dashboard service URL run: | - status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:admin -I -s | grep -E "^HTTP" | awk '{print $2}') - if [[ $status -eq 200 ]]; then - echo "Wazuh dashboard status: ${status}" - else - echo "Wazuh dashboard status: ${status}" + for i in {1..10}; do + echo "Checking Wazuh dashboard (Attempt $i/10)" + STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u admin:admin "https://0.0.0.0:443/app/status") + echo "Current status: $STATUS" + if [[ "$STATUS" == "200" ]]; then + echo "Wazuh dashboard is UP" + exit 0 + elif [[ "$STATUS" == "429" || "$STATUS" == "503" ]]; then + echo "Dashboard is busy or initializing (Status $STATUS). Retrying in 30s" + else + echo "Unexpected status $STATUS. Retrying in 30s" + fi + sleep 30 + done + echo "Error: Dashboard did not reach 200 status in time." exit 1 - fi - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml @@ -349,7 +378,7 @@ jobs: - name: Check Wazuh indexer start run: | - for i in {1..10}; do + for i in {1..20}; do echo "Checking Wazuh indexer health (Attempt $i/10)" RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) @@ -360,6 +389,14 @@ jobs: fi echo "Waiting for cluster to be online" + for CONTAINER_NAME in $INDEXER_CONTAINERS; do + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs --tail 30 "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done [ $i -lt 10 ] && sleep 60 done status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" @@ -395,12 +432,21 @@ jobs: - name: Check documents into wazuh-states index run: | - docs="`curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s | jq -r ".count"`" - if [[ $docs -gt 0 ]]; then - echo "wazuh-states index documents: ${docs}" - else - echo "wazuh-states index documents: ${docs}" - fi + for i in {1..10}; do + echo "Checking documents in wazuh-states (Attempt $i/10)..." + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s || echo "{}") + DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') + if [[ "$DOCS" -gt 0 ]]; then + echo "wazuh-states index has documents: ${DOCS}" + exit 0 + fi + + echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 30s" + [ $i -lt 10 ] && sleep 30 + done + echo "Error: No documents found in wazuh-states after 10 attempts." + echo "Last response: $RESPONSE" + exit 1 - name: Check Wazuh templates run: | @@ -438,13 +484,22 @@ jobs: - name: Check Wazuh dashboard service URL run: | - status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:admin -I | grep -E "^HTTP" | awk '{print $2}') - if [[ $status -eq 200 ]]; then - echo "Wazuh dashboard status: ${status}" - else - echo "Wazuh dashboard status: ${status}" + for i in {1..10}; do + echo "Checking Wazuh dashboard (Attempt $i/10)" + STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u admin:admin "https://0.0.0.0:443/app/status") + echo "Current status: $STATUS" + if [[ "$STATUS" == "200" ]]; then + echo "Wazuh dashboard is UP" + exit 0 + elif [[ "$STATUS" == "429" || "$STATUS" == "503" ]]; then + echo "Dashboard is busy or initializing (Status $STATUS). Retrying in 30s" + else + echo "Unexpected status $STATUS. Retrying in 30s" + fi + sleep 30 + done + echo "Error: Dashboard did not reach 200 status in time." exit 1 - fi - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index f1b7f63a..2e69f4d0 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,6 +3,7 @@ services: wazuh.master: image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.master + container_name: multi-node-wazuh.master restart: always ulimits: memlock: @@ -39,6 +40,7 @@ services: wazuh.worker: image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker + container_name: multi-node-wazuh.worker restart: always ulimits: memlock: @@ -72,6 +74,7 @@ services: wazuh1.indexer: image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh1.indexer + container_name: multi-node-wazuh1.indexer restart: always ports: - "9200:9200" @@ -103,6 +106,7 @@ services: wazuh2.indexer: image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh2.indexer + container_name: multi-node-wazuh2.indexer restart: always environment: - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g @@ -130,6 +134,7 @@ services: wazuh3.indexer: image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh3.indexer + container_name: multi-node-wazuh3.indexer restart: always environment: - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g @@ -157,6 +162,7 @@ services: wazuh.dashboard: image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard + container_name: multi-node-wazuh.dashboard restart: always ports: - 443:5601 @@ -190,6 +196,7 @@ services: nginx: image: nginx:stable hostname: nginx + container_name: multi-node-nginx restart: always ports: - "1514:1514" diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 2481aeff..1bfcee5e 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,6 +3,7 @@ services: wazuh.manager: image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.manager + container_name: single-node-wazuh.manager restart: always ulimits: memlock: @@ -40,6 +41,7 @@ services: wazuh.indexer: image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh.indexer + container_name: single-node-wazuh.indexer restart: always ports: - "9200:9200" @@ -70,6 +72,7 @@ services: wazuh.dashboard: image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard + container_name: single-node-wazuh.dashboard restart: always ports: - 443:443 From d0ca1e6163e798057951421b978ae8a44475f888 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 24 Dec 2025 01:31:35 +0700 Subject: [PATCH 36/60] Add checking into steps and container names --- .github/workflows/push.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index bb9400f3..44b0fad3 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -155,7 +155,7 @@ jobs: for i in {1..10}; do echo "Checking Wazuh indexer health (Attempt $i/10)" RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) - + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" echo "$RESPONSE" @@ -381,13 +381,12 @@ jobs: for i in {1..20}; do echo "Checking Wazuh indexer health (Attempt $i/10)" RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) - + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" echo "$RESPONSE" exit 0 fi - echo "Waiting for cluster to be online" for CONTAINER_NAME in $INDEXER_CONTAINERS; do echo "" From bf56fab8c8eadfeec6a2656b624810345c2883c9 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 24 Dec 2025 01:42:08 +0700 Subject: [PATCH 37/60] Add config.yml check --- .github/workflows/push.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 44b0fad3..273a3091 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -127,8 +127,9 @@ jobs: - name: wazuh.dashboard ip: wazuh.dashboard EOF + cat config.yml bash ./wazuh-certs-tool.sh -A - sysctl -w vm.max_map_count=262144 + sudo sysctl -w vm.max_map_count=262144 working-directory: ./single-node - name: Edit single node docker-compose file @@ -340,7 +341,6 @@ jobs: ip: wazuh2.indexer - name: wazuh3.indexer ip: wazuh3.indexer - # Wazuh server nodes # Use node_type only with more than one Wazuh manager server: @@ -350,14 +350,14 @@ jobs: - name: wazuh.worker ip: wazuh.worker node_type: worker - # Wazuh dashboard node dashboard: - name: wazuh.dashboard ip: wazuh.dashboard EOF + cat config.yml bash ./wazuh-certs-tool.sh -A - sysctl -w vm.max_map_count=262144 + sudo sysctl -w vm.max_map_count=262144 working-directory: ./multi-node - name: Edit multi node docker-compose file From 5df15e85687dc2633e3d3cad4db130c5e7e0c459 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 24 Dec 2025 01:50:49 +0700 Subject: [PATCH 38/60] Fix multi node config.yml --- .github/workflows/push.yml | 44 ++++++++++++++++++++------------------ 1 file changed, 23 insertions(+), 21 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 273a3091..74f11be5 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -333,27 +333,29 @@ jobs: curl -sL "$wazuh_certs_tool_url" -o ./wazuh-certs-tool.sh cat > config.yml < Date: Thu, 25 Dec 2025 17:38:03 +0700 Subject: [PATCH 39/60] Add env variables --- .github/workflows/push.yml | 85 ++++++++++++++++++++------------------ 1 file changed, 44 insertions(+), 41 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 74f11be5..9eef790d 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -33,20 +33,16 @@ jobs: build-images: - # needs: prepare-variables - # uses: ./.github/workflows/Procedure_push_docker_images.yml - # secrets: inherit - # with: - # image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - # docker_reference: ${{ github.head_ref }} - # revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} - # reference: "latest" - # id: ${{ github.run_id }} - # dev: true - runs-on: ubuntu-latest - steps: - - name: Skip build - run: echo "Build images step skipped" + needs: prepare-variables + uses: ./.github/workflows/Procedure_push_docker_images.yml + secrets: inherit + with: + image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + docker_reference: ${{ github.head_ref }} + revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} + reference: "latest" + id: ${{ github.run_id }} + dev: true Execute-Goss-tests: needs: [prepare-variables, build-images] @@ -91,6 +87,10 @@ jobs: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} + INDEXER_USERNAME: admin + INDEXER_PASSWORD: admin + API_USERNAME: wazuh-wui + API_PASSWORD: MyS3cr37P450r.*- steps: - name: Check out code @@ -155,7 +155,7 @@ jobs: INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") for i in {1..10}; do echo "Checking Wazuh indexer health (Attempt $i/10)" - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" @@ -173,19 +173,19 @@ jobs: done [ $i -lt 10 ] && sleep 60 done - status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" - status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep -E "green|yellow" | wc -l`" + status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" + status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s else - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s exit 1 fi - name: Check Wazuh indexer nodes run: | - nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:admin -k -s | grep -E "indexer" | wc -l`" + nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" if [[ $nodes -eq 1 ]]; then echo "Wazuh indexer nodes: ${nodes}" else @@ -207,7 +207,7 @@ jobs: run: | for i in {1..10}; do echo "Checking documents in wazuh-states (Attempt $i/10)..." - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s || echo "{}") + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') if [[ "$DOCS" -gt 0 ]]; then echo "wazuh-states index has documents: ${DOCS}" @@ -223,8 +223,8 @@ jobs: - name: Check Wazuh templates run: | - qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:admin -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" - templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:admin -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" + qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" + templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" if [[ $qty_templates -gt 3 ]]; then echo "wazuh templates:" echo "${templates}" @@ -246,13 +246,12 @@ jobs: exit 1 fi env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - + TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | for i in {1..10}; do echo "Checking Wazuh dashboard (Attempt $i/10)" - STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u admin:admin "https://0.0.0.0:443/app/status") + STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://0.0.0.0:443/app/status") echo "Current status: $STATUS" if [[ "$STATUS" == "200" ]]; then echo "Wazuh dashboard is UP" @@ -293,7 +292,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh @@ -310,6 +309,10 @@ jobs: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} + INDEXER_USERNAME: admin + INDEXER_PASSWORD: admin + API_USERNAME: wazuh-wui + API_PASSWORD: MyS3cr37P450r.*- steps: - name: Check out code @@ -351,7 +354,7 @@ jobs: - name: wazuh.worker ip: wazuh.worker node_type: worker - + # Wazuh dashboard node dashboard: - name: wazuh.dashboard @@ -382,7 +385,7 @@ jobs: run: | for i in {1..20}; do echo "Checking Wazuh indexer health (Attempt $i/10)" - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" @@ -400,12 +403,12 @@ jobs: done [ $i -lt 10 ] && sleep 60 done - status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" - status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep -E "green" | wc -l`" + status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" + status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s else - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s exit 1 fi @@ -424,7 +427,7 @@ jobs: - name: Check Wazuh indexer nodes run: | - nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:admin -k -s | grep -E "indexer" | wc -l`" + nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" if [[ $nodes -eq 3 ]]; then echo "Wazuh indexer nodes: ${nodes}" else @@ -435,7 +438,7 @@ jobs: run: | for i in {1..10}; do echo "Checking documents in wazuh-states (Attempt $i/10)..." - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s || echo "{}") + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') if [[ "$DOCS" -gt 0 ]]; then echo "wazuh-states index has documents: ${DOCS}" @@ -451,8 +454,8 @@ jobs: - name: Check Wazuh templates run: | - qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:admin -k -s | grep "wazuh" | wc -l`" - templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:admin -k -s | grep "wazuh"`" + qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh" | wc -l`" + templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh"`" if [[ $qty_templates -gt 3 ]]; then echo "wazuh templates:" echo "${templates}" @@ -464,7 +467,7 @@ jobs: - name: Check Wazuh manager start run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/clsuter/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + services="`curl -k -s -X GET "https://0.0.0.0:55000/clsuter/manager/status?pretty=true" -H "Authorization: Bearer ${{ env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 10 ]]; then echo "Wazuh Manager Services: ${services}" echo "OK" @@ -481,13 +484,13 @@ jobs: exit 1 fi env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | for i in {1..10}; do echo "Checking Wazuh dashboard (Attempt $i/10)" - STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u admin:admin "https://0.0.0.0:443/app/status") + STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://0.0.0.0:443/app/status") echo "Current status: $STATUS" if [[ "$STATUS" == "200" ]]; then echo "Wazuh dashboard is UP" @@ -527,7 +530,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/multi-node-log-check.sh \ No newline at end of file From 1f656b7b36b24304dce21c5b7ae62a23ca6c84ff Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 25 Dec 2025 18:24:08 +0700 Subject: [PATCH 40/60] Modify sleep time for count documents --- .github/workflows/push.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 9eef790d..7ba05f0c 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -214,8 +214,8 @@ jobs: exit 0 fi - echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 30s" - [ $i -lt 10 ] && sleep 30 + echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" + [ $i -lt 10 ] && sleep 60 done echo "Error: No documents found in wazuh-states after 10 attempts." echo "Last response: $RESPONSE" @@ -445,8 +445,8 @@ jobs: exit 0 fi - echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 30s" - [ $i -lt 10 ] && sleep 30 + echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" + [ $i -lt 10 ] && sleep 60 done echo "Error: No documents found in wazuh-states after 10 attempts." echo "Last response: $RESPONSE" From ea05bb5207490fa0336fbbcbec9c2fe950fcc2ba Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 25 Dec 2025 19:37:13 +0700 Subject: [PATCH 41/60] Modify Wazuh manager test --- .github/workflows/push.yml | 72 ++++++++++++++++++++------------------ 1 file changed, 37 insertions(+), 35 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 7ba05f0c..1c2ddf9c 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -33,16 +33,21 @@ jobs: build-images: + runs-on: ubuntu-latest needs: prepare-variables - uses: ./.github/workflows/Procedure_push_docker_images.yml - secrets: inherit - with: - image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - docker_reference: ${{ github.head_ref }} - revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} - reference: "latest" - id: ${{ github.run_id }} - dev: true + steps: + + - name: Build step + run: echo "Build Docker images here" +# uses: ./.github/workflows/Procedure_push_docker_images.yml +# secrets: inherit +# with: +# image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} +# docker_reference: ${{ github.head_ref }} +# revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} +# reference: "latest" +# id: ${{ github.run_id }} +# dev: true Execute-Goss-tests: needs: [prepare-variables, build-images] @@ -91,6 +96,7 @@ jobs: INDEXER_PASSWORD: admin API_USERNAME: wazuh-wui API_PASSWORD: MyS3cr37P450r.*- + MANAGER_NODES: "manager" steps: - name: Check out code @@ -236,15 +242,16 @@ jobs: - name: Check Wazuh manager start run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" - if [[ $services -gt 9 ]]; then - echo "Wazuh Manager Services: ${services}" - echo "OK" - else - echo "Wazuh indexer nodes: ${nodes}" - curl -k -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items - exit 1 - fi + for NODE in "${{ env.MANAGER_NODES }}"; do + services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + if [[ $services -gt 9 ]]; then + echo "Wazuh Manager $NODE Services: ${services}" + echo "OK" + else + curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + exit 1 + fi + done env: TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL @@ -313,6 +320,7 @@ jobs: INDEXER_PASSWORD: admin API_USERNAME: wazuh-wui API_PASSWORD: MyS3cr37P450r.*- + MANAGER_NODES: "master worker" steps: - name: Check out code @@ -466,23 +474,17 @@ jobs: fi - name: Check Wazuh manager start - run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/clsuter/manager/status?pretty=true" -H "Authorization: Bearer ${{ env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" - if [[ $services -gt 10 ]]; then - echo "Wazuh Manager Services: ${services}" - echo "OK" - else - echo "Wazuh indexer nodes: ${nodes}" - curl -k -s -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items - exit 1 - fi - nodes=$(curl -k -s -X GET "https://0.0.0.0:55000/cluster/nodes" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r ".data.affected_items[].name" | wc -l) - if [[ $nodes -eq 2 ]]; then - echo "Wazuh manager nodes: ${nodes}" - else - echo "Wazuh manager nodes: ${nodes}" - exit 1 - fi + run: | + for NODE in "${{ env.MANAGER_NODES }}"; do + services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + if [[ $services -gt 9 ]]; then + echo "Wazuh Manager $NODE Services: ${services}" + echo "OK" + else + curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + exit 1 + fi + done env: TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") From 7c5b3f3b54e07110435a78124b138e64d5a97068 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 25 Dec 2025 20:01:39 +0700 Subject: [PATCH 42/60] Modify list separator and amount of replies --- .github/workflows/push.yml | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 1c2ddf9c..0a885c91 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -159,8 +159,8 @@ jobs: - name: Check Wazuh indexer start run: | INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") - for i in {1..10}; do - echo "Checking Wazuh indexer health (Attempt $i/10)" + for i in {1..20}; do + echo "Checking Wazuh indexer health (Attempt $i/20)" RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then @@ -177,7 +177,7 @@ jobs: docker logs --tail 30 "$CONTAINER_NAME" echo "---------------------------------------------------------" done - [ $i -lt 10 ] && sleep 60 + [ $i -lt 20 ] && sleep 60 done status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`" @@ -211,8 +211,8 @@ jobs: - name: Check documents into wazuh-states index run: | - for i in {1..10}; do - echo "Checking documents in wazuh-states (Attempt $i/10)..." + for i in {1..20}; do + echo "Checking documents in wazuh-states (Attempt $i/20)..." RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') if [[ "$DOCS" -gt 0 ]]; then @@ -221,9 +221,9 @@ jobs: fi echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" - [ $i -lt 10 ] && sleep 60 + [ $i -lt 20 ] && sleep 60 done - echo "Error: No documents found in wazuh-states after 10 attempts." + echo "Error: No documents found in wazuh-states after 20 attempts." echo "Last response: $RESPONSE" exit 1 @@ -254,10 +254,11 @@ jobs: done env: TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + - name: Check Wazuh dashboard service URL run: | - for i in {1..10}; do - echo "Checking Wazuh dashboard (Attempt $i/10)" + for i in {1..20}; do + echo "Checking Wazuh dashboard (Attempt $i/20)" STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://0.0.0.0:443/app/status") echo "Current status: $STATUS" if [[ "$STATUS" == "200" ]]; then @@ -320,7 +321,7 @@ jobs: INDEXER_PASSWORD: admin API_USERNAME: wazuh-wui API_PASSWORD: MyS3cr37P450r.*- - MANAGER_NODES: "master worker" + MANAGER_NODES: "master,worker" steps: - name: Check out code @@ -392,7 +393,7 @@ jobs: - name: Check Wazuh indexer start run: | for i in {1..20}; do - echo "Checking Wazuh indexer health (Attempt $i/10)" + echo "Checking Wazuh indexer health (Attempt $i/20)" RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then @@ -409,7 +410,7 @@ jobs: docker logs --tail 30 "$CONTAINER_NAME" echo "---------------------------------------------------------" done - [ $i -lt 10 ] && sleep 60 + [ $i -lt 20 ] && sleep 60 done status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`" @@ -444,8 +445,9 @@ jobs: - name: Check documents into wazuh-states index run: | - for i in {1..10}; do - echo "Checking documents in wazuh-states (Attempt $i/10)..." + IFS=',' + for i in {1..20}; do + echo "Checking documents in wazuh-states (Attempt $i/20)..." RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') if [[ "$DOCS" -gt 0 ]]; then @@ -454,9 +456,9 @@ jobs: fi echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" - [ $i -lt 10 ] && sleep 60 + [ $i -lt 20 ] && sleep 60 done - echo "Error: No documents found in wazuh-states after 10 attempts." + echo "Error: No documents found in wazuh-states after 20 attempts." echo "Last response: $RESPONSE" exit 1 @@ -490,8 +492,8 @@ jobs: - name: Check Wazuh dashboard service URL run: | - for i in {1..10}; do - echo "Checking Wazuh dashboard (Attempt $i/10)" + for i in {1..20}; do + echo "Checking Wazuh dashboard (Attempt $i/20)" STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://0.0.0.0:443/app/status") echo "Current status: $STATUS" if [[ "$STATUS" == "200" ]]; then From cf8c10d81797d53399203e50a115fe7ad9c60d34 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 25 Dec 2025 20:12:35 +0700 Subject: [PATCH 43/60] Modify list separator --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 0a885c91..5dc1c427 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -445,7 +445,6 @@ jobs: - name: Check documents into wazuh-states index run: | - IFS=',' for i in {1..20}; do echo "Checking documents in wazuh-states (Attempt $i/20)..." RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") @@ -477,6 +476,7 @@ jobs: - name: Check Wazuh manager start run: | + IFS=',' for NODE in "${{ env.MANAGER_NODES }}"; do services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then From 0b894153c036bb773a3a8ef0dbdbc2b5a31a511d Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 25 Dec 2025 23:44:43 +0700 Subject: [PATCH 44/60] Add retry option in Wazuh manager test --- .github/workflows/push.yml | 44 +++++++++++++++++++++----------------- 1 file changed, 24 insertions(+), 20 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 5dc1c427..daa2b3ff 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -243,17 +243,19 @@ jobs: - name: Check Wazuh manager start run: | for NODE in "${{ env.MANAGER_NODES }}"; do - services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" - if [[ $services -gt 9 ]]; then - echo "Wazuh Manager $NODE Services: ${services}" - echo "OK" - else - curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items - exit 1 - fi + for i in {1..20}; do + TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + if [[ $services -gt 9 ]]; then + echo "Wazuh Manager $NODE Services: ${services}" + echo "OK" + else + curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" + [ $i -lt 20 ] && sleep 30 + fi + done done - env: - TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | @@ -478,17 +480,19 @@ jobs: run: | IFS=',' for NODE in "${{ env.MANAGER_NODES }}"; do - services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" - if [[ $services -gt 9 ]]; then - echo "Wazuh Manager $NODE Services: ${services}" - echo "OK" - else - curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items - exit 1 - fi + for i in {1..20}; do + TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + if [[ $services -gt 9 ]]; then + echo "Wazuh Manager $NODE Services: ${services}" + echo "OK" + else + curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" + [ $i -lt 20 ] && sleep 30 + fi + done done - env: - TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | From e91e15bbd900d0b13c492e85140fd97e42709c7f Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 25 Dec 2025 23:58:15 +0700 Subject: [PATCH 45/60] Modify service ip --- .github/workflows/push.yml | 56 +++++++++++++++++++------------------- 1 file changed, 28 insertions(+), 28 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index daa2b3ff..ac4a2c26 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -161,7 +161,7 @@ jobs: INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") for i in {1..20}; do echo "Checking Wazuh indexer health (Attempt $i/20)" - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) + RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" @@ -179,19 +179,19 @@ jobs: done [ $i -lt 20 ] && sleep 60 done - status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" - status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`" + status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" + status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s + curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s else - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s + curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s exit 1 fi - name: Check Wazuh indexer nodes run: | - nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" + nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" if [[ $nodes -eq 1 ]]; then echo "Wazuh indexer nodes: ${nodes}" else @@ -213,7 +213,7 @@ jobs: run: | for i in {1..20}; do echo "Checking documents in wazuh-states (Attempt $i/20)..." - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") + RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') if [[ "$DOCS" -gt 0 ]]; then echo "wazuh-states index has documents: ${DOCS}" @@ -229,8 +229,8 @@ jobs: - name: Check Wazuh templates run: | - qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" - templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" + qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" + templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" if [[ $qty_templates -gt 3 ]]; then echo "wazuh templates:" echo "${templates}" @@ -244,13 +244,13 @@ jobs: run: | for NODE in "${{ env.MANAGER_NODES }}"; do for i in {1..20}; do - TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") + services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then echo "Wazuh Manager $NODE Services: ${services}" echo "OK" else - curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" [ $i -lt 20 ] && sleep 30 fi @@ -261,7 +261,7 @@ jobs: run: | for i in {1..20}; do echo "Checking Wazuh dashboard (Attempt $i/20)" - STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://0.0.0.0:443/app/status") + STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://127.0.0.1:443/app/status") echo "Current status: $STATUS" if [[ "$STATUS" == "200" ]]; then echo "Wazuh dashboard is UP" @@ -302,7 +302,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh @@ -396,7 +396,7 @@ jobs: run: | for i in {1..20}; do echo "Checking Wazuh indexer health (Attempt $i/20)" - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) + RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" @@ -414,12 +414,12 @@ jobs: done [ $i -lt 20 ] && sleep 60 done - status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" - status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`" + status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" + status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s + curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s else - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s + curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s exit 1 fi @@ -438,7 +438,7 @@ jobs: - name: Check Wazuh indexer nodes run: | - nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" + nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" if [[ $nodes -eq 3 ]]; then echo "Wazuh indexer nodes: ${nodes}" else @@ -449,7 +449,7 @@ jobs: run: | for i in {1..20}; do echo "Checking documents in wazuh-states (Attempt $i/20)..." - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") + RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') if [[ "$DOCS" -gt 0 ]]; then echo "wazuh-states index has documents: ${DOCS}" @@ -465,8 +465,8 @@ jobs: - name: Check Wazuh templates run: | - qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh" | wc -l`" - templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh"`" + qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh" | wc -l`" + templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh"`" if [[ $qty_templates -gt 3 ]]; then echo "wazuh templates:" echo "${templates}" @@ -481,13 +481,13 @@ jobs: IFS=',' for NODE in "${{ env.MANAGER_NODES }}"; do for i in {1..20}; do - TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") + services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then echo "Wazuh Manager $NODE Services: ${services}" echo "OK" else - curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" [ $i -lt 20 ] && sleep 30 fi @@ -498,7 +498,7 @@ jobs: run: | for i in {1..20}; do echo "Checking Wazuh dashboard (Attempt $i/20)" - STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://0.0.0.0:443/app/status") + STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://127.0.0.1:443/app/status") echo "Current status: $STATUS" if [[ "$STATUS" == "200" ]]; then echo "Wazuh dashboard is UP" @@ -538,7 +538,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/multi-node-log-check.sh \ No newline at end of file From d264717f64b36139ed78abaf071998a51582b2da Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 26 Dec 2025 00:36:12 +0700 Subject: [PATCH 46/60] Add docker logs review --- .github/workflows/push.yml | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index ac4a2c26..cc2af6a3 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -158,7 +158,6 @@ jobs: - name: Check Wazuh indexer start run: | - INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") for i in {1..20}; do echo "Checking Wazuh indexer health (Attempt $i/20)" RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) @@ -220,6 +219,15 @@ jobs: exit 0 fi + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') + for CONTAINER_NAME in $INDEXER_CONTAINERS; do + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs --tail 30 "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" [ $i -lt 20 ] && sleep 60 done @@ -455,7 +463,15 @@ jobs: echo "wazuh-states index has documents: ${DOCS}" exit 0 fi - + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') + for CONTAINER_NAME in $INDEXER_CONTAINERS; do + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs --tail 30 "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" [ $i -lt 20 ] && sleep 60 done From d586b48d8f74b9a5efdf44660f70ee13be344e23 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 26 Dec 2025 00:51:36 +0700 Subject: [PATCH 47/60] Add double-quote and chenge TOKEN variable --- .github/workflows/push.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index cc2af6a3..48104673 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -253,12 +253,12 @@ jobs: for NODE in "${{ env.MANAGER_NODES }}"; do for i in {1..20}; do TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") - services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then echo "Wazuh Manager $NODE Services: ${services}" echo "OK" else - curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" [ $i -lt 20 ] && sleep 30 fi @@ -498,12 +498,12 @@ jobs: for NODE in "${{ env.MANAGER_NODES }}"; do for i in {1..20}; do TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") - services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then echo "Wazuh Manager $NODE Services: ${services}" echo "OK" else - curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" [ $i -lt 20 ] && sleep 30 fi From 2573671e471d391507624187f3cf77a7a73057d7 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 26 Dec 2025 01:01:46 +0700 Subject: [PATCH 48/60] Add free space step for single node deployment --- .github/workflows/push.yml | 3 +++ single-node/docker-compose.yml | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 48104673..50186466 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -102,6 +102,9 @@ jobs: - name: Check out code uses: actions/checkout@v4 + - name: free disk space + uses: ./.github/free-disk-space + - name: Configure aws credentials uses: aws-actions/configure-aws-credentials@v4 with: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 1bfcee5e..6c74802c 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -75,8 +75,9 @@ services: container_name: single-node-wazuh.dashboard restart: always ports: - - 443:443 + - 443:5601 environment: + - SERVER_PORT=5601 - SERVER_HOST=0.0.0.0 - OPENSEARCH_HOSTS=https://wazuh.indexer:9200 - INDEXER_USERNAME=admin From 07634d7df5b0b18d06ae507e972bd25b2e4ae494 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 26 Dec 2025 01:18:53 +0700 Subject: [PATCH 49/60] Modify manager list work --- .github/workflows/push.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 50186466..0c22b54e 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -497,14 +497,15 @@ jobs: - name: Check Wazuh manager start run: | - IFS=',' - for NODE in "${{ env.MANAGER_NODES }}"; do + IFS=',' read -r -a NODES <<< "${{ env.MANAGER_NODES }}" + for NODE in "${NODES[@]}"; do for i in {1..20}; do TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then echo "Wazuh Manager $NODE Services: ${services}" echo "OK" + break else curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" From c9e0f3f099b9dc811b3b655bb7937b123a502eae Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 26 Dec 2025 01:47:57 +0700 Subject: [PATCH 50/60] Change cluster worker node name --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 0c22b54e..62921714 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -334,7 +334,7 @@ jobs: INDEXER_PASSWORD: admin API_USERNAME: wazuh-wui API_PASSWORD: MyS3cr37P450r.*- - MANAGER_NODES: "master,worker" + MANAGER_NODES: "master,worker01" steps: - name: Check out code From cd99438abc80b00ff26601c4b50c3308f8410c53 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 26 Dec 2025 02:06:37 +0700 Subject: [PATCH 51/60] Add a last step with docker logs check --- .github/workflows/push.yml | 98 +++++++++++++++----------------------- 1 file changed, 38 insertions(+), 60 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 62921714..4f5dacaa 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -33,21 +33,16 @@ jobs: build-images: - runs-on: ubuntu-latest needs: prepare-variables - steps: - - - name: Build step - run: echo "Build Docker images here" -# uses: ./.github/workflows/Procedure_push_docker_images.yml -# secrets: inherit -# with: -# image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} -# docker_reference: ${{ github.head_ref }} -# revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} -# reference: "latest" -# id: ${{ github.run_id }} -# dev: true + uses: ./.github/workflows/Procedure_push_docker_images.yml + secrets: inherit + with: + image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + docker_reference: ${{ github.head_ref }} + revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} + reference: "latest" + id: ${{ github.run_id }} + dev: true Execute-Goss-tests: needs: [prepare-variables, build-images] @@ -200,17 +195,6 @@ jobs: echo "Wazuh indexer nodes: ${nodes}" fi - - name: Docker logs - run: | - echo "===== Wazuh Manager Logs =====" - docker compose logs wazuh.manager - echo "===== Wazuh Indexer Logs =====" - docker compose logs wazuh.indexer - echo "===== Wazuh Dashboard Logs =====" - docker compose logs wazuh.dashboard - working-directory: ./single-node - - - name: Check documents into wazuh-states index run: | for i in {1..20}; do @@ -221,16 +205,6 @@ jobs: echo "wazuh-states index has documents: ${DOCS}" exit 0 fi - - INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') - for CONTAINER_NAME in $INDEXER_CONTAINERS; do - echo "" - echo "=========================================================" - echo "Container logs for $CONTAINER_NAME" - echo "=========================================================" - docker logs --tail 30 "$CONTAINER_NAME" - echo "---------------------------------------------------------" - done echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" [ $i -lt 20 ] && sleep 60 done @@ -311,12 +285,25 @@ jobs: - name: Check Wazuh agent enrollment run: | sleep 20 - curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" + curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh + + - name: Docker logs + run: | + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') + for CONTAINER_NAME in $INDEXER_CONTAINERS; do + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done + working-directory: ./single-node check-multi-node: name: Check multi node on ${{ matrix.os }} @@ -434,19 +421,6 @@ jobs: exit 1 fi - - name: Docker logs - run: | - echo "===== Wazuh Manager Logs =====" - docker compose logs wazuh.master - docker compose logs wazuh.worker - echo "===== Wazuh Indexer Logs =====" - docker compose logs wazuh1.indexer - docker compose logs wazuh2.indexer - docker compose logs wazuh3.indexer - echo "===== Wazuh Dashboard Logs =====" - docker compose logs wazuh.dashboard - working-directory: ./multi-node - - name: Check Wazuh indexer nodes run: | nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" @@ -466,15 +440,6 @@ jobs: echo "wazuh-states index has documents: ${DOCS}" exit 0 fi - INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') - for CONTAINER_NAME in $INDEXER_CONTAINERS; do - echo "" - echo "=========================================================" - echo "Container logs for $CONTAINER_NAME" - echo "=========================================================" - docker logs --tail 30 "$CONTAINER_NAME" - echo "---------------------------------------------------------" - done echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" [ $i -lt 20 ] && sleep 60 done @@ -556,9 +521,22 @@ jobs: - name: Check Wazuh agent enrollment run: | sleep 20 - curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" + curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager - run: ./.github/multi-node-log-check.sh \ No newline at end of file + run: ./.github/multi-node-log-check.sh + + - name: Docker logs + run: | + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') + for CONTAINER_NAME in $INDEXER_CONTAINERS; do + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done + working-directory: ./single-node \ No newline at end of file From 47ee381f48b4f17cc753a70e6a179fb8e5133400 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 27 Dec 2025 02:45:08 +0700 Subject: [PATCH 52/60] Add Changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 96f4a5c8..825717c5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Modify docker build image process ([#2131](https://github.com/wazuh/wazuh-docker/issues/2131)) - Update documentation for Wazuh Docker image builder and workflow usage ([#2136](https://github.com/wazuh/wazuh-docker/issues/2136)) - Configure deployment with environment variables ([#2081](https://github.com/wazuh/wazuh-docker/pull/2081)) - Modify Wazuh components install method ([#2058](https://github.com/wazuh/wazuh-docker/pull/2058)) From e0a4e3f9fc8063db3bcddf85f6ba700edd0d31a8 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 27 Dec 2025 02:49:45 +0700 Subject: [PATCH 53/60] Add newline --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 4f5dacaa..0d731c50 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -539,4 +539,4 @@ jobs: docker logs "$CONTAINER_NAME" echo "---------------------------------------------------------" done - working-directory: ./single-node \ No newline at end of file + working-directory: ./single-node From eb00d13ad34f9bca68f856d051c6f7a0b3041bc7 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Mon, 29 Dec 2025 20:49:11 +0700 Subject: [PATCH 54/60] change workflow name and delete trivy check workflows --- .../workflows/{push.yml => 5_pr_check.yml} | 0 .github/workflows/trivy-dashboard.yml | 76 ------------------- .github/workflows/trivy-indexer.yml | 76 ------------------- .github/workflows/trivy-manager.yml | 76 ------------------- 4 files changed, 228 deletions(-) rename .github/workflows/{push.yml => 5_pr_check.yml} (100%) delete mode 100644 .github/workflows/trivy-dashboard.yml delete mode 100644 .github/workflows/trivy-indexer.yml delete mode 100644 .github/workflows/trivy-manager.yml diff --git a/.github/workflows/push.yml b/.github/workflows/5_pr_check.yml similarity index 100% rename from .github/workflows/push.yml rename to .github/workflows/5_pr_check.yml diff --git a/.github/workflows/trivy-dashboard.yml b/.github/workflows/trivy-dashboard.yml deleted file mode 100644 index 5239d93c..00000000 --- a/.github/workflows/trivy-dashboard.yml +++ /dev/null @@ -1,76 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Trivy scan Wazuh dashboard - -on: - release: - types: - - published - pull_request: - branches: - - main - schedule: - - cron: '34 2 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - - name: Build images and upload Trivy results - runs-on: "ubuntu-22.04" - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Installing dependencies - run: | - sudo apt-get update - sudo apt-get install -y jq - - - name: Checkout latest tag - run: | - latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') - git fetch origin - git checkout $latest - - - name: Build Wazuh images - run: build-docker-images/build-images.sh - - - name: Create enviroment variables - run: | - cat .env > $GITHUB_ENV - echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV - - - name: Run Trivy vulnerability scanner for Wazuh dashboard - uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 - with: - image-ref: 'wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}}' - format: 'template' - template: '@/contrib/sarif.tpl' - output: 'trivy-results-dashboard.sarif' - severity: 'LOW,MEDIUM,CRITICAL,HIGH' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: 'trivy-results-dashboard.sarif' - - - name: Slack notification - uses: rtCamp/action-slack-notify@v2 - env: - SLACK_CHANNEL: cicd-monitoring - SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' - #SLACK_ICON: https://github.com/rtCamp.png?size=48 - SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" - SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. - SLACK_USERNAME: github_actions - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file diff --git a/.github/workflows/trivy-indexer.yml b/.github/workflows/trivy-indexer.yml deleted file mode 100644 index 6f69f206..00000000 --- a/.github/workflows/trivy-indexer.yml +++ /dev/null @@ -1,76 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Trivy scan Wazuh indexer - -on: - release: - types: - - published - pull_request: - branches: - - main - schedule: - - cron: '34 2 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - - name: Build images and upload Trivy results - runs-on: "ubuntu-22.04" - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Installing dependencies - run: | - sudo apt-get update - sudo apt-get install -y jq - - - name: Checkout latest tag - run: | - latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') - git fetch origin - git checkout $latest - - - name: Build Wazuh images - run: build-docker-images/build-images.sh - - - name: Create enviroment variables - run: | - cat .env > $GITHUB_ENV - echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV - - - name: Run Trivy vulnerability scanner for Wazuh indexer - uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 - with: - image-ref: 'wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}}' - format: 'template' - template: '@/contrib/sarif.tpl' - output: 'trivy-results-indexer.sarif' - severity: 'LOW,MEDIUM,CRITICAL,HIGH' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: 'trivy-results-indexer.sarif' - - - name: Slack notification - uses: rtCamp/action-slack-notify@v2 - env: - SLACK_CHANNEL: cicd-monitoring - SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' - #SLACK_ICON: https://github.com/rtCamp.png?size=48 - SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" - SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. - SLACK_USERNAME: github_actions - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file diff --git a/.github/workflows/trivy-manager.yml b/.github/workflows/trivy-manager.yml deleted file mode 100644 index da75bcc7..00000000 --- a/.github/workflows/trivy-manager.yml +++ /dev/null @@ -1,76 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Trivy scan Wazuh manager - -on: - release: - types: - - published - pull_request: - branches: - - main - schedule: - - cron: '34 2 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - - name: Build images and upload Trivy results - runs-on: "ubuntu-22.04" - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Installing dependencies - run: | - sudo apt-get update - sudo apt-get install -y jq - - - name: Checkout latest tag - run: | - latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') - git fetch origin - git checkout $latest - - - name: Build Wazuh images - run: build-docker-images/build-images.sh - - - name: Create enviroment variables - run: | - cat .env > $GITHUB_ENV - echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV - - - name: Run Trivy vulnerability scanner for Wazuh manager - uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 - with: - image-ref: 'wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}}' - format: 'template' - template: '@/contrib/sarif.tpl' - output: 'trivy-results-manager.sarif' - severity: 'LOW,MEDIUM,CRITICAL,HIGH' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: 'trivy-results-manager.sarif' - - - name: Slack notification - uses: rtCamp/action-slack-notify@v2 - env: - SLACK_CHANNEL: cicd-monitoring - SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' - #SLACK_ICON: https://github.com/rtCamp.png?size=48 - SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" - SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. - SLACK_USERNAME: github_actions - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file From 01c72c2c8bb485519a4adb9d775aa4cd526632b1 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Mon, 29 Dec 2025 22:53:50 +0700 Subject: [PATCH 55/60] Change Wazuh agent check --- .github/workflows/5_pr_check.yml | 34 ++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-) diff --git a/.github/workflows/5_pr_check.yml b/.github/workflows/5_pr_check.yml index 0d731c50..172e2965 100644 --- a/.github/workflows/5_pr_check.yml +++ b/.github/workflows/5_pr_check.yml @@ -284,10 +284,19 @@ jobs: - name: Check Wazuh agent enrollment run: | - sleep 20 - curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" - env: - TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") + for i in {1..5}; do + TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") + agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`" + if [[ $agents -gt 1 ]]; then + echo "Wazuh agents: ${agents}" + echo "OK" + break + else + curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" + echo "Wazuh agents: ${agents}. Retrying in 10s" + [ $i -lt 5 ] && sleep 10 + fi + done - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh @@ -520,10 +529,19 @@ jobs: - name: Check Wazuh agent enrollment run: | - sleep 20 - curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" - env: - TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") + for i in {1..5}; do + TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") + agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`" + if [[ $agents -gt 1 ]]; then + echo "Wazuh agents: ${agents}" + echo "OK" + break + else + curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" + echo "Wazuh agents: ${agents}. Retrying in 10s" + [ $i -lt 5 ] && sleep 10 + fi + done - name: Check errors in ossec.log for Wazuh manager run: ./.github/multi-node-log-check.sh From 54b470d89b0579f1a1e62c388134cff50b2db7fc Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Mon, 29 Dec 2025 23:48:04 +0700 Subject: [PATCH 56/60] Change Wazuh agent check --- .github/workflows/5_pr_check.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/5_pr_check.yml b/.github/workflows/5_pr_check.yml index 172e2965..f54a8164 100644 --- a/.github/workflows/5_pr_check.yml +++ b/.github/workflows/5_pr_check.yml @@ -302,6 +302,7 @@ jobs: run: ./.github/single-node-log-check.sh - name: Docker logs + if: always() run: | INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') for CONTAINER_NAME in $INDEXER_CONTAINERS; do @@ -547,6 +548,7 @@ jobs: run: ./.github/multi-node-log-check.sh - name: Docker logs + if: always() run: | INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') for CONTAINER_NAME in $INDEXER_CONTAINERS; do From 84441f9da9f08948d29086abf90b242563e65d0d Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 30 Dec 2025 00:54:13 +0700 Subject: [PATCH 57/60] Fix S6 overlay arch into Wazuh agent image build --- build-docker-images/wazuh-agent/Dockerfile | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index 46bcab1c..98ae1bde 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -23,12 +23,11 @@ RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \ rm -rf /wazuh-agent.rpm && \ dnf clean all && \ sed -i '//d' /var/ossec/etc/ossec.conf && \ - curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ - -o /tmp/s6-overlay-amd64.tar.gz && \ - tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \ - tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && \ - rm /tmp/s6-overlay-amd64.tar.gz - + curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-${S6_ARCH}.tar.gz \ + -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ + tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \ + tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \ + rm /tmp/s6-overlay-${S6_ARCH}.tar.gz COPY config/etc/ /etc/ ENTRYPOINT [ "/init" ] From 6e93c01ab1b0f85d18f59b641ae576053b754ee6 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 30 Dec 2025 01:01:34 +0700 Subject: [PATCH 58/60] Fix S6 overlay arch into Wazuh agent image build --- build-docker-images/wazuh-agent/Dockerfile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index 98ae1bde..fd99ee2a 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -23,11 +23,13 @@ RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \ rm -rf /wazuh-agent.rpm && \ dnf clean all && \ sed -i '//d' /var/ossec/etc/ossec.conf && \ + S6_ARCH="amd64" && \ + if [ "${TARGETARCH}" = "arm64" ]; then S6_ARCH="aarch64"; fi && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-${S6_ARCH}.tar.gz \ -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \ - rm /tmp/s6-overlay-${S6_ARCH}.tar.gz + rm /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ COPY config/etc/ /etc/ ENTRYPOINT [ "/init" ] From 0fedd684b5bbbd9d734368c4b7a1ecac409bede3 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 30 Dec 2025 01:13:51 +0700 Subject: [PATCH 59/60] Fix S6 overlay arch into Wazuh agent image build --- build-docker-images/wazuh-agent/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index fd99ee2a..08253f8f 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -29,7 +29,7 @@ RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \ -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \ - rm /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ + rm /tmp/s6-overlay-${S6_ARCH}.tar.gz && COPY config/etc/ /etc/ ENTRYPOINT [ "/init" ] From dc9da8aacbd1ab102c886ca5c27828dbce3575ca Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 30 Dec 2025 01:23:33 +0700 Subject: [PATCH 60/60] Fix S6 overlay arch into Wazuh agent image build --- build-docker-images/wazuh-agent/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index 08253f8f..c8fc26ca 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -29,7 +29,7 @@ RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \ -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \ - rm /tmp/s6-overlay-${S6_ARCH}.tar.gz && + rm /tmp/s6-overlay-${S6_ARCH}.tar.gz COPY config/etc/ /etc/ ENTRYPOINT [ "/init" ]