mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-11 13:17:07 +00:00
Prageeth Panicker
bf37d5e7b3
Tor: use the shared tor block (bond 0.5, enabled when svc-net-tor is in the node's groups, tor pinned on in both variants) so a node serves one network, onion on a Tor node and clearnet otherwise. SPOT and sizing: WAZUH_INDEXER_URL replaces four hand-built copies of the indexer URL, and the indexer heap is half of mem_limit instead of a hardcoded 1g (unchanged for the current 2g limit). Fixes: bcrypt_hash rejects secrets over 72 bytes; the Keycloak group-removal helper uses the same resolver as the add helper and checks every response (the realm is no longer URL-encoded, matching the add helper), and a failed cleanup fails an otherwise passing test; the swarm certs generator removes a stale container before each attempt; vm.max_map_count is set before the early handler flush; securityadmin failed_when now needs rc 0 and the success marker. The regenerated role README also picks up generator drift (mailu to stalwart).
23 lines
1.1 KiB
Django/Jinja
23 lines
1.1 KiB
Django/Jinja
server.host: 0.0.0.0
|
|
server.port: {{ WAZUH_DASHBOARD_INTERNAL_PORT }}
|
|
server.ssl.enabled: false
|
|
opensearch.hosts: {{ WAZUH_INDEXER_URL }}
|
|
opensearch.ssl.verificationMode: certificate
|
|
opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"]
|
|
opensearch.requestHeadersWhitelist: ["securitytenant", "Authorization"]
|
|
opensearch_security.multitenancy.enabled: false
|
|
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
|
|
uiSettings.overrides.defaultRoute: /app/home
|
|
opensearch_security.cookie.ttl: 900000
|
|
opensearch_security.session.ttl: 900000
|
|
opensearch_security.session.keepalive: true
|
|
{% if WAZUH_OIDC_ENABLED %}
|
|
opensearch_security.auth.type: "openid"
|
|
opensearch_security.openid.connect_url: "{{ OIDC.CLIENT.DISCOVERY_DOCUMENT }}"
|
|
opensearch_security.openid.client_id: "{{ OIDC.CLIENT.ID }}"
|
|
opensearch_security.openid.client_secret: "{{ OIDC.CLIENT.SECRET }}"
|
|
opensearch_security.openid.base_redirect_url: "{{ lookup('tls', application_id, 'url.base') }}"
|
|
opensearch_security.openid.scope: "openid profile email groups"
|
|
opensearch_security.openid.logout_url: "{{ OIDC.CLIENT.LOGOUT_URL }}"
|
|
{% endif %}
|