mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
Prageeth Panicker
5864cd4750
The indexer entrypoint is now only our CA-import block followed by exec of the image's own /entrypoint.sh, mounted at /infinito-entrypoint.sh with an explicit command. The certs entrypoint is our own script: it downloads the cert tool only from packages.wazuh.com and fails if that download fails, so there is no silent fallback to the dev bucket. The manager node name is passed in as WAZUH_MANAGER_NODE for both compose and swarm.
40 lines
1.3 KiB
Bash
Executable File
40 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
unset CURL_CA_BUNDLE SSL_CERT_FILE REQUESTS_CA_BUNDLE NODE_EXTRA_CA_CERTS
|
|
|
|
: "${CERT_TOOL_VERSION:?CERT_TOOL_VERSION must name the wazuh-certs-tool release}"
|
|
: "${WAZUH_MANAGER_NODE:?WAZUH_MANAGER_NODE must name the manager node in /config/certs.yml}"
|
|
|
|
config_src="/config/certs.yml"
|
|
out_dir="/certificates"
|
|
tool_url="https://packages.wazuh.com/${CERT_TOOL_VERSION}/wazuh-certs-tool.sh"
|
|
|
|
work_dir="$(mktemp -d)"
|
|
trap 'rm -rf "${work_dir}"' EXIT
|
|
|
|
if ! curl --connect-timeout 10 --max-time 120 --fail --silent --show-error --location \
|
|
--retry 5 --retry-delay 5 --retry-all-errors \
|
|
--output "${work_dir}/wazuh-certs-tool.sh" "${tool_url}"; then
|
|
echo "ERROR: downloading ${tool_url} failed; no certificates were generated" >&2
|
|
exit 1
|
|
fi
|
|
|
|
cp "${config_src}" "${work_dir}/config.yml"
|
|
bash "${work_dir}/wazuh-certs-tool.sh" --all
|
|
|
|
cp "${work_dir}"/wazuh-certificates/* "${out_dir}/"
|
|
cp "${out_dir}/root-ca.pem" "${out_dir}/root-ca-manager.pem"
|
|
cp "${out_dir}/root-ca.key" "${out_dir}/root-ca-manager.key"
|
|
|
|
chmod 0400 "${out_dir}"/*
|
|
chown 1000:1000 "${out_dir}"/*
|
|
chown 999:999 \
|
|
"${out_dir}/root-ca-manager.pem" \
|
|
"${out_dir}/root-ca-manager.key" \
|
|
"${out_dir}/${WAZUH_MANAGER_NODE}.pem" \
|
|
"${out_dir}/${WAZUH_MANAGER_NODE}-key.pem"
|
|
chmod 0500 "${out_dir}"
|
|
|
|
echo "Wazuh certificates written to ${out_dir}"
|