에러 수정

Author: saranf

.env.example

@@ -4,7 +4,7 @@ PUBLIC_URL=http://mori.rmstudio.co.kr:37854
 TIMEZONE=Asia/Seoul
 
 GRAFANA_ADMIN_USER=admin
-GRAFANA_ADMIN_PASSWORD=change_this_grafana_password
+GRAFANA_ADMIN_PASSWORD=1234
 
 ZABBIX_DB_NAME=zabbix
 ZABBIX_DB_USER=zabbix

README.md

@@ -68,7 +68,7 @@ GitHub Actions가 아래 순서로 동작하도록 구성했습니다.
 2. 서버 경로 `/backup/rmstudio/mori` 생성 확인
 3. `rsync`로 코드 동기화
 4. GitHub Secret의 `.env` 내용을 서버에 업로드
-5. Wazuh 인증서가 없으면 최초 1회 생성
+5. Wazuh 인증서 디렉터리 준비 후 최초 1회 인증서 생성
 6. `docker compose pull`
 7. `docker compose up -d --remove-orphans`
 
@@ -119,6 +119,7 @@ GitHub Actions가 아래 순서로 동작하도록 구성했습니다.
 - `docker compose -f generate-indexer-certs.yml config` 통과
 
 또한 Wazuh Dashboard의 설정 마운트 충돌 가능성을 제거하도록 compose를 보정했습니다.
+Wazuh 인증서 마운트도 디렉터리 방식으로 보정해 파일/디렉터리 마운트 꼬임 가능성을 낮췄습니다.
 
 ## 10. 운영 메모
 

config/wazuh_cluster/wazuh_manager.conf

@@ -57,10 +57,10 @@
     </hosts>
     <ssl>
       <certificate_authorities>
-        <ca>/etc/ssl/root-ca.pem</ca>
+        <ca>/etc/ssl/wazuh/root-ca-manager.pem</ca>
       </certificate_authorities>
-      <certificate>/etc/ssl/filebeat.pem</certificate>
-      <key>/etc/ssl/filebeat.key</key>
+      <certificate>/etc/ssl/wazuh/wazuh.manager.pem</certificate>
+      <key>/etc/ssl/wazuh/wazuh.manager-key.pem</key>
     </ssl>
   </indexer>
 

docker-compose.yml

@@ -8,7 +8,7 @@ services:
       GF_SERVER_DOMAIN: ${PUBLIC_DOMAIN:-mori.rmstudio.co.kr}
       GF_SERVER_ROOT_URL: ${PUBLIC_URL:-http://mori.rmstudio.co.kr:37854}
       GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
-      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-change_me}
+      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-1234}
       GF_USERS_ALLOW_SIGN_UP: "false"
     ports:
       - "${PUBLIC_PORT:-37854}:3000"
@@ -186,9 +186,9 @@ services:
       INDEXER_USERNAME: admin
       INDEXER_PASSWORD: SecretPassword
       FILEBEAT_SSL_VERIFICATION_MODE: full
-      SSL_CERTIFICATE_AUTHORITIES: /etc/ssl/root-ca.pem
-      SSL_CERTIFICATE: /etc/ssl/filebeat.pem
-      SSL_KEY: /etc/ssl/filebeat.key
+      SSL_CERTIFICATE_AUTHORITIES: /etc/ssl/wazuh/root-ca-manager.pem
+      SSL_CERTIFICATE: /etc/ssl/wazuh/wazuh.manager.pem
+      SSL_KEY: /etc/ssl/wazuh/wazuh.manager-key.pem
       API_USERNAME: wazuh-wui
       API_PASSWORD: MyS3cr37P450r.*-
     volumes:
@@ -203,9 +203,7 @@ services:
       - wazuh-wodles:/var/ossec/wodles
       - filebeat-etc:/etc/filebeat
       - filebeat-var:/var/lib/filebeat
-      - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem:ro
-      - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem:ro
-      - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key:ro
+      - ./config/wazuh_indexer_ssl_certs:/etc/ssl/wazuh:ro
       - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf:ro
     networks: [soc]
 
@@ -220,11 +218,7 @@ services:
       nofile: { soft: 65536, hard: 65536 }
     volumes:
       - wazuh-indexer-data:/var/lib/wazuh-indexer
-      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem:ro
-      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key:ro
-      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem:ro
-      - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem:ro
-      - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem:ro
+      - ./config/wazuh_indexer_ssl_certs:/usr/share/wazuh-indexer/config/certs:ro
       - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml:ro
       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml:ro
     networks: [soc]
@@ -246,9 +240,7 @@ services:
     ports:
       - "127.0.0.1:${WAZUH_DASHBOARD_PORT:-8443}:5601"
     volumes:
-      - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem:ro
-      - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem:ro
-      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem:ro
+      - ./config/wazuh_indexer_ssl_certs:/usr/share/wazuh-dashboard/certs:ro
       - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml:ro
       - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml:ro
       - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom

docs/DEPLOYMENT.md

@@ -43,11 +43,16 @@ openssl rand -base64 32
 ### 4. 최초 실행
 
 ```bash
+rm -rf config/wazuh_indexer_ssl_certs
+mkdir -p config/wazuh_indexer_ssl_certs
 docker compose -f generate-indexer-certs.yml run --rm generator
 docker compose up -d
 docker compose ps
 ```
 
+기존에 인증서 생성 전에 `docker compose up`을 먼저 실행했다면,
+`config/wazuh_indexer_ssl_certs` 내부 경로가 디렉터리로 잘못 생성될 수 있으므로 위처럼 초기화 후 다시 생성하는 것을 권장합니다.
+
 ### 5. GitHub Actions 시크릿
 
 다음 시크릿을 저장소에 추가하세요.