Standarize certificates configuration script

.github/workflows/5_pr_check.yml

@@ -149,7 +149,7 @@ jobs:
               dns: "wazuh.dashboard"
         EOF
         cat config.yml
-        sudo bash certificates-conf.sh --cert --copy --priv
+        sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv
         sudo sysctl -w vm.max_map_count=262144
       working-directory: ./single-node
 
@@ -430,7 +430,7 @@ jobs:
               dns: "wazuh.dashboard"
         EOF
         cat config.yml
-        sudo bash certificates-conf.sh --cert --copy --priv
+        sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv
         sudo sysctl -w vm.max_map_count=262144
       working-directory: ./multi-node
 

.gitignore

@@ -6,13 +6,13 @@ single-node/wazuh-certificates/*
 single-node/wazuh-certificates-tool.log
 single-node/wazuh-certs-tool*.sh
 single-node/config*.yml
-single-node/config/*/certs/*
+single-node/config
 multi-node/wazuh-certificates
 multi-node/wazuh-certificates/*
 multi-node/wazuh-certificates-tool.log
 multi-node/wazuh-certs-tool*.sh
 multi-node/config*.yml
-multi-node/config/*/certs/*
+multi-node/config/wazuh*
 
 # Documentation
 docs/book/

docs/ref/getting-started/deployment/multi-node.md

@@ -57,7 +57,7 @@ This deployment utilizes the `multi-node/docker-compose.yml` file, which defines
 5.  Run the certificate creation script:
 
     ```bash
-    sudo bash certificates-conf.sh --cert --copy --priv
+    sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv
     ```
 
 6.  Start the Wazuh environment using `docker compose`:

docs/ref/getting-started/deployment/single-node.md

@@ -49,7 +49,7 @@ This deployment uses the `single-node/docker-compose.yml` file, which defines a
 5.  Run the certificate creation script:
 
     ```bash
-    sudo bash certificates-conf.sh --cert --copy --priv
+    sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv
     ```
 
 6.  Start the Wazuh environment using `docker compose`:

multi-node/certificates-conf.sh

@@ -1,104 +0,0 @@
-#!/bin/bash
-
-# Path configuration (adjust according to your folder structure)
-CERT_TOOL="./wazuh-certs-tool.sh"
-CONFIG_FILE="./config.yml"
-OUTPUT_DIR="./wazuh-certificates" # Folder created by the script by default
-
-# Parse arguments
-DO_CERT=false
-DO_COPY=false
-DO_PRIV=false
-
-for arg in "$@"; do
-  case $arg in
-    --cert) DO_CERT=true ;;
-    --copy) DO_COPY=true ;;
-    --priv) DO_PRIV=true ;;
-    *)
-      echo "Unknown option: $arg"
-      echo "Usage: $0 [--cert] [--copy] [--priv]"
-      exit 1
-      ;;
-  esac
-done
-
-# If no flags provided, show usage
-if ! $DO_CERT && ! $DO_COPY && ! $DO_PRIV; then
-  echo "Usage: $0 [--cert] [--copy] [--priv]"
-  echo "  --cert  Generate certificates using wazuh-certs-tool.sh"
-  echo "  --copy  Copy certificates to the corresponding config directories"
-  echo "  --priv  Set ownership and permissions on the certificate files"
-  exit 1
-fi
-
-# 1. Generate certificates
-if $DO_CERT; then
-  echo "Generating certificates"
-  bash $CERT_TOOL -A
-fi
-
-# 2. Copy certificates to config directories
-if $DO_COPY; then
-  echo "Setting up directories for certificates"
-  mkdir -p ./config/wazuh_indexer_1/certs
-  mkdir -p ./config/wazuh_indexer_2/certs
-  mkdir -p ./config/wazuh_indexer_3/certs
-  mkdir -p ./config/wazuh_dashboard/certs
-  mkdir -p ./config/wazuh_cluster_master/certs
-  mkdir -p ./config/wazuh_cluster_worker/certs
-
-  echo "Copying certificates for Indexer 1"
-  cp $OUTPUT_DIR/wazuh1.indexer* ./config/wazuh_indexer_1/certs/
-  cp $OUTPUT_DIR/root-ca* ./config/wazuh_indexer_1/certs/
-  cp $OUTPUT_DIR/admin* ./config/wazuh_indexer_1/certs/
-
-  echo "Copying certificates for Indexer 2"
-  cp $OUTPUT_DIR/wazuh2.indexer* ./config/wazuh_indexer_2/certs/
-  cp $OUTPUT_DIR/root-ca* ./config/wazuh_indexer_2/certs/
-
-  echo "Copying certificates for Indexer 3"
-  cp $OUTPUT_DIR/wazuh3.indexer* ./config/wazuh_indexer_3/certs/
-  cp $OUTPUT_DIR/root-ca* ./config/wazuh_indexer_3/certs/
-
-  echo "Copying certificates for Dashboard"
-  cp $OUTPUT_DIR/wazuh.dashboard* ./config/wazuh_dashboard/certs/
-  cp $OUTPUT_DIR/root-ca* ./config/wazuh_dashboard/certs/
-
-  echo "Copying certificates for Master Manager"
-  cp $OUTPUT_DIR/wazuh.master* ./config/wazuh_cluster_master/certs/
-  cp $OUTPUT_DIR/root-ca* ./config/wazuh_cluster_master/certs/
-
-  echo "Copying certificates for Worker Manager"
-  cp $OUTPUT_DIR/wazuh.worker* ./config/wazuh_cluster_worker/certs/
-  cp $OUTPUT_DIR/root-ca* ./config/wazuh_cluster_worker/certs/
-fi
-
-# 3. Set ownership and permissions
-if $DO_PRIV; then
-  echo "Configuring permissions for Indexer 1 (1000:1000)"
-  chown -R 1000:1000 ./config/wazuh_indexer_1/certs
-  chmod 400 ./config/wazuh_indexer_1/certs/*
-
-  echo "Configuring permissions for Indexer 2 (1000:1000)"
-  chown -R 1000:1000 ./config/wazuh_indexer_2/certs
-  chmod 400 ./config/wazuh_indexer_2/certs/*
-
-  echo "Configuring permissions for Indexer 3 (1000:1000)"
-  chown -R 1000:1000 ./config/wazuh_indexer_3/certs
-  chmod 400 ./config/wazuh_indexer_3/certs/*
-
-  echo "Setting permissions for Dashboard (1000:1000)"
-  chown -R 1000:1000 ./config/wazuh_dashboard/certs
-  chmod 400 ./config/wazuh_dashboard/certs/*
-
-  echo "Configuring permissions for Master Manager (999:999)"
-  chown -R 999:999 ./config/wazuh_cluster_master/certs
-  chmod 400 ./config/wazuh_cluster_master/certs/*
-
-  echo "Configuring permissions for Worker Manager (999:999)"
-  chown -R 999:999 ./config/wazuh_cluster_worker/certs
-  chmod 400 ./config/wazuh_cluster_worker/certs/*
-fi
-
-echo "Process completed."

multi-node/docker-compose.yml

@@ -40,9 +40,9 @@ services:
       - master-wazuh-logs:/var/wazuh-manager/logs
       - master-wazuh-queue:/var/wazuh-manager/queue
       - master-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
-      - ./config/wazuh_cluster_master/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
+      - ./config/wazuh_master/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
-      - ./config/wazuh_cluster_master/certs/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem
+      - ./config/wazuh_master/certs/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem
-      - ./config/wazuh_cluster_master/certs/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
+      - ./config/wazuh_master/certs/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
 
   wazuh.worker:
     image: wazuh/wazuh-manager:5.0.0
@@ -81,9 +81,9 @@ services:
       - worker-wazuh-logs:/var/wazuh-manager/logs
       - worker-wazuh-queue:/var/wazuh-manager/queue
       - worker-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
-      - ./config/wazuh_cluster_worker/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
+      - ./config/wazuh_worker/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
-      - ./config/wazuh_cluster_worker/certs/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem
+      - ./config/wazuh_worker/certs/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem
-      - ./config/wazuh_cluster_worker/certs/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
+      - ./config/wazuh_worker/certs/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
 
   wazuh1.indexer:
     image: wazuh/wazuh-indexer:5.0.0
@@ -117,11 +117,11 @@ services:
       start_period: 60s
     volumes:
       - wazuh-indexer-data-1:/var/lib/wazuh-indexer
-      - ./config/wazuh_indexer_1/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
+      - ./config/wazuh1_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
-      - ./config/wazuh_indexer_1/certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
+      - ./config/wazuh1_indexer/certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
-      - ./config/wazuh_indexer_1/certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
+      - ./config/wazuh1_indexer/certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
-      - ./config/wazuh_indexer_1/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
+      - ./config/wazuh1_indexer/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
-      - ./config/wazuh_indexer_1/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
+      - ./config/wazuh1_indexer/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 
   wazuh2.indexer:
     image: wazuh/wazuh-indexer:5.0.0
@@ -157,9 +157,9 @@ services:
       start_period: 60s
     volumes:
       - wazuh-indexer-data-2:/var/lib/wazuh-indexer
-      - ./config/wazuh_indexer_2/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
+      - ./config/wazuh2_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
-      - ./config/wazuh_indexer_2/certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
+      - ./config/wazuh2_indexer/certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
-      - ./config/wazuh_indexer_2/certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
+      - ./config/wazuh2_indexer/certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
   wazuh3.indexer:
     image: wazuh/wazuh-indexer:5.0.0
@@ -195,9 +195,9 @@ services:
       start_period: 60s
     volumes:
       - wazuh-indexer-data-3:/var/lib/wazuh-indexer
-      - ./config/wazuh_indexer_3/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
+      - ./config/wazuh3_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
-      - ./config/wazuh_indexer_3/certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
+      - ./config/wazuh3_indexer/certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
-      - ./config/wazuh_indexer_3/certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
+      - ./config/wazuh3_indexer/certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
   wazuh.dashboard:
     image: wazuh/wazuh-dashboard:5.0.0

single-node/certificates-conf.sh

@@ -1,77 +0,0 @@
-#!/bin/bash
-
-# Path configuration (adjust according to your folder structure)
-CERT_TOOL="./wazuh-certs-tool.sh"
-CONFIG_FILE="./config.yml"
-OUTPUT_DIR="./wazuh-certificates" # Folder created by the script by default
-
-# Parse arguments
-DO_CERT=false
-DO_COPY=false
-DO_PRIV=false
-
-for arg in "$@"; do
-  case $arg in
-    --cert) DO_CERT=true ;;
-    --copy) DO_COPY=true ;;
-    --priv) DO_PRIV=true ;;
-    *)
-      echo "Unknown option: $arg"
-      echo "Usage: $0 [--cert] [--copy] [--priv]"
-      exit 1
-      ;;
-  esac
-done
-
-# If no flags provided, show usage
-if ! $DO_CERT && ! $DO_COPY && ! $DO_PRIV; then
-  echo "Usage: $0 [--cert] [--copy] [--priv]"
-  echo "  --cert  Generate certificates using wazuh-certs-tool.sh"
-  echo "  --copy  Copy certificates to the corresponding config directories"
-  echo "  --priv  Set ownership and permissions on the certificate files"
-  exit 1
-fi
-
-# 1. Generate certificates
-if $DO_CERT; then
-  echo "Generating certificates"
-  bash $CERT_TOOL -A
-fi
-
-# 2. Copy certificates to config directories
-if $DO_COPY; then
-  echo "Setting up directories for certificates"
-  mkdir -p ./config/wazuh_indexer/certs
-  mkdir -p ./config/wazuh_dashboard/certs
-  mkdir -p ./config/wazuh_cluster/certs
-
-  echo "Copying certificates for Indexer"
-  cp $OUTPUT_DIR/wazuh.indexer* ./config/wazuh_indexer/certs/
-  cp $OUTPUT_DIR/root-ca* ./config/wazuh_indexer/certs/
-  cp $OUTPUT_DIR/admin* ./config/wazuh_indexer/certs/
-
-  echo "Copying certificates for Dashboard"
-  cp $OUTPUT_DIR/wazuh.dashboard* ./config/wazuh_dashboard/certs/
-  cp $OUTPUT_DIR/root-ca* ./config/wazuh_dashboard/certs/
-
-  echo "Copying certificates for Manager"
-  cp $OUTPUT_DIR/wazuh.manager* ./config/wazuh_cluster/certs/
-  cp $OUTPUT_DIR/root-ca* ./config/wazuh_cluster/certs/
-fi
-
-# 3. Set ownership and permissions
-if $DO_PRIV; then
-  echo "Configuring permissions for Indexer (1000:1000)"
-  chown -R 1000:1000 ./config/wazuh_indexer/certs
-  chmod 400 ./config/wazuh_indexer/certs/*
-
-  echo "Setting permissions for Dashboard (1000:1000)"
-  chown -R 1000:1000 ./config/wazuh_dashboard/certs
-  chmod 400 ./config/wazuh_dashboard/certs/*
-
-  echo "Configuring permissions for Manager (999:999)"
-  chown -R 999:999 ./config/wazuh_cluster/certs
-  chmod 400 ./config/wazuh_cluster/certs/*
-fi
-
-echo "Process completed."

single-node/docker-compose.yml

@@ -40,9 +40,9 @@ services:
       - wazuh_logs:/var/wazuh-manager/logs
       - wazuh_queue:/var/wazuh-manager/queue
       - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups
-      - ./config/wazuh_cluster/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
+      - ./config/wazuh_manager/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
-      - ./config/wazuh_cluster/certs/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem
+      - ./config/wazuh_manager/certs/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem
-      - ./config/wazuh_cluster/certs/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
+      - ./config/wazuh_manager/certs/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
 
   wazuh.indexer:
     image: wazuh/wazuh-indexer:5.0.0

tools/utils/deployment/certificates-conf.sh

@@ -0,0 +1,153 @@
+#!/bin/bash
+
+# Path configuration (adjust according to your folder structure)
+CERT_TOOL="./wazuh-certs-tool.sh"
+CONFIG_FILE="./config.yml"
+OUTPUT_DIR="./wazuh-certificates" # Folder created by the script by default
+
+# Parse arguments
+DO_CERT=false
+DO_COPY=false
+DO_PRIV=false
+
+for arg in "$@"; do
+  case $arg in
+    --cert) DO_CERT=true ;;
+    --copy) DO_COPY=true ;;
+    --priv) DO_PRIV=true ;;
+    *)
+      echo "Unknown option: $arg"
+      echo "Usage: $0 [--cert] [--copy] [--priv]"
+      exit 1
+      ;;
+  esac
+done
+
+# If no flags provided, show usage
+if ! $DO_CERT && ! $DO_COPY && ! $DO_PRIV; then
+  echo "Usage: $0 [--cert] [--copy] [--priv]"
+  echo "  --cert  Generate certificates using wazuh-certs-tool.sh"
+  echo "  --copy  Copy certificates to the corresponding config directories"
+  echo "  --priv  Set ownership and permissions on the certificate files"
+  exit 1
+fi
+
+# ---------------------------------------------------------------------------
+# Parse config.yml to extract node names per section (indexer, manager, dashboard)
+# ---------------------------------------------------------------------------
+parse_config() {
+  local section=""
+  INDEXER_NODES=()
+  MANAGER_NODES=()
+  DASHBOARD_NODES=()
+
+  while IFS= read -r line; do
+    # Detect section headers (e.g., "  indexer:", "  manager:", "  dashboard:")
+    if echo "$line" | grep -qE '^\s+indexer:\s*$'; then
+      section="indexer"
+      continue
+    elif echo "$line" | grep -qE '^\s+manager:\s*$'; then
+      section="manager"
+      continue
+    elif echo "$line" | grep -qE '^\s+dashboard:\s*$'; then
+      section="dashboard"
+      continue
+    fi
+
+    # Extract node name from "- name: <value>" lines
+    if echo "$line" | grep -qE '^\s+-\s+name:'; then
+      local name
+      name=$(echo "$line" | sed 's/.*name:\s*//' | tr -d ' "'\''')
+      case $section in
+        indexer)   INDEXER_NODES+=("$name") ;;
+        manager)   MANAGER_NODES+=("$name") ;;
+        dashboard) DASHBOARD_NODES+=("$name") ;;
+      esac
+    fi
+  done < "$CONFIG_FILE"
+}
+
+# Convert node name to directory name (replace . with _)
+node_to_dir() {
+  echo "$1" | tr '.' '_'
+}
+
+# ---------------------------------------------------------------------------
+# Main logic
+# ---------------------------------------------------------------------------
+
+# Parse config.yml
+if $DO_COPY || $DO_PRIV; then
+  if [ ! -f "$CONFIG_FILE" ]; then
+    echo "Error: Configuration file $CONFIG_FILE not found."
+    exit 1
+  fi
+  parse_config
+  echo "Detected indexer nodes:   ${INDEXER_NODES[*]}"
+  echo "Detected manager nodes:   ${MANAGER_NODES[*]}"
+  echo "Detected dashboard nodes: ${DASHBOARD_NODES[*]}"
+fi
+
+# 1. Generate certificates
+if $DO_CERT; then
+  echo "Generating certificates"
+  bash $CERT_TOOL -A
+fi
+
+# 2. Copy certificates to config directories
+if $DO_COPY; then
+  FIRST_INDEXER=true
+  for node in "${INDEXER_NODES[@]}"; do
+    dir_name=$(node_to_dir "$node")
+    echo "Copying certificates for indexer: $node -> config/$dir_name/certs/"
+    mkdir -p "./config/$dir_name/certs"
+    cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
+    cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
+    if $FIRST_INDEXER; then
+      cp "$OUTPUT_DIR"/admin* "./config/$dir_name/certs/"
+      FIRST_INDEXER=false
+    fi
+  done
+
+  for node in "${MANAGER_NODES[@]}"; do
+    dir_name=$(node_to_dir "$node")
+    echo "Copying certificates for manager: $node -> config/$dir_name/certs/"
+    mkdir -p "./config/$dir_name/certs"
+    cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
+    cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
+  done
+
+  for node in "${DASHBOARD_NODES[@]}"; do
+    dir_name=$(node_to_dir "$node")
+    echo "Copying certificates for dashboard: $node -> config/$dir_name/certs/"
+    mkdir -p "./config/$dir_name/certs"
+    cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
+    cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
+  done
+fi
+
+# 3. Set ownership and permissions
+if $DO_PRIV; then
+  for node in "${INDEXER_NODES[@]}"; do
+    dir_name=$(node_to_dir "$node")
+    echo "Setting permissions for indexer $node (1000:1000)"
+    chown -R 1000:1000 "./config/$dir_name/certs"
+    chmod 400 "./config/$dir_name/certs/"*
+  done
+
+  for node in "${MANAGER_NODES[@]}"; do
+    dir_name=$(node_to_dir "$node")
+    echo "Setting permissions for manager $node (999:999)"
+    chown -R 999:999 "./config/$dir_name/certs"
+    chmod 400 "./config/$dir_name/certs/"*
+  done
+
+  for node in "${DASHBOARD_NODES[@]}"; do
+    dir_name=$(node_to_dir "$node")
+    echo "Setting permissions for dashboard $node (1000:1000)"
+    chown -R 1000:1000 "./config/$dir_name/certs"
+    chmod 400 "./config/$dir_name/certs/"*
+  done
+fi
+
+echo "Process completed."