From 2f03248612bc7e881733d1eec9201d8e70f3fd7c Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Wed, 31 Jan 2024 16:22:44 -0500
Subject: [PATCH 1/2] use different nginx defaults for so-fleet node hosting
 artifacts

---
 salt/docker/defaults.yaml          |  7 +++++++
 salt/firewall/containers.map.jinja |  2 +-
 salt/nginx/enabled.sls             | 23 +++++++++++++++--------
 3 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/salt/docker/defaults.yaml b/salt/docker/defaults.yaml
index 9a27843ae..4bc212fbe 100644
--- a/salt/docker/defaults.yaml
+++ b/salt/docker/defaults.yaml
@@ -84,6 +84,13 @@ docker:
       custom_bind_mounts: []
       extra_hosts: []
       extra_env: []
+    'so-nginx-fleet-node':
+      final_octet: 31
+      port_bindings:
+        - 8443:8443
+      custom_bind_mounts: []
+      extra_hosts: []
+      extra_env: []
     'so-playbook':
       final_octet: 32
       port_bindings:
diff --git a/salt/firewall/containers.map.jinja b/salt/firewall/containers.map.jinja
index 99a3bd5d0..b3ead0f4c 100644
--- a/salt/firewall/containers.map.jinja
+++ b/salt/firewall/containers.map.jinja
@@ -95,7 +95,7 @@
 {% set NODE_CONTAINERS = [
      'so-elastic-fleet',
      'so-logstash',
-     'so-nginx'
+     'so-nginx-fleet-node'
 ] %}
 
 {% elif GLOBALS.role == 'so-sensor' %}
diff --git a/salt/nginx/enabled.sls b/salt/nginx/enabled.sls
index eca9c237a..273fb65be 100644
--- a/salt/nginx/enabled.sls
+++ b/salt/nginx/enabled.sls
@@ -94,17 +94,24 @@ make-rule-dir-nginx:
       
 {%   endif %}
 
+{# if this is an so-fleet node then we want to use the port bindings, custom bind mounts defined for fleet #}
+{% if GLOBALS.role == 'so-fleet' %}
+{%   set container_config = 'so-nginx-fleet-node' %}
+{% else %}
+{%   set container_config = 'so-nginx' %}
+{% endif %}
+
 so-nginx:
   docker_container.running:
     - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-nginx:{{ GLOBALS.so_version }}
     - hostname: so-nginx
     - networks:
       - sobridge:
-        - ipv4_address: {{ DOCKER.containers['so-nginx'].ip }}
+        - ipv4_address: {{ DOCKER.containers[container_config].ip }}
     - extra_hosts:
       - {{ GLOBALS.manager }}:{{ GLOBALS.manager_ip }}
-    {% if DOCKER.containers['so-nginx'].extra_hosts %}
-      {% for XTRAHOST in DOCKER.containers['so-nginx'].extra_hosts %}
+    {% if DOCKER.containers[container_config].extra_hosts %}
+      {% for XTRAHOST in DOCKER.containers[container_config].extra_hosts %}
       - {{ XTRAHOST }}
       {% endfor %}
     {% endif %}
@@ -124,20 +131,20 @@ so-nginx:
       - /nsm/repo:/opt/socore/html/repo:ro
       - /nsm/rules:/nsm/rules:ro
       {% endif %}
-      {% if DOCKER.containers['so-nginx'].custom_bind_mounts %}
-        {% for BIND in DOCKER.containers['so-nginx'].custom_bind_mounts %}
+      {% if DOCKER.containers[container_config].custom_bind_mounts %}
+        {% for BIND in DOCKER.containers[container_config].custom_bind_mounts %}
       - {{ BIND }}
         {% endfor %}
       {% endif %}
-    {% if DOCKER.containers['so-nginx'].extra_env %}
+    {% if DOCKER.containers[container_config].extra_env %}
     - environment:
-      {% for XTRAENV in DOCKER.containers['so-nginx'].extra_env %}
+      {% for XTRAENV in DOCKER.containers[container_config].extra_env %}
       - {{ XTRAENV }}
       {% endfor %}
     {% endif %}
     - cap_add: NET_BIND_SERVICE
     - port_bindings:
-      {% for BINDING in DOCKER.containers['so-nginx'].port_bindings %}
+      {% for BINDING in DOCKER.containers[container_config].port_bindings %}
       - {{ BINDING }}
       {% endfor %}
     - watch:

From ae32ac40c2dde62a0c26319c78a667700406f94e Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Wed, 31 Jan 2024 16:28:45 -0500
Subject: [PATCH 2/2] add fleet node nginx to docker annotations

---
 salt/docker/soc_docker.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/salt/docker/soc_docker.yaml b/salt/docker/soc_docker.yaml
index 850324a9e..6e0efeb20 100644
--- a/salt/docker/soc_docker.yaml
+++ b/salt/docker/soc_docker.yaml
@@ -48,6 +48,7 @@ docker:
     so-logstash: *dockerOptions
     so-mysql: *dockerOptions
     so-nginx: *dockerOptions
+    so-nginx-fleet-node: *dockerOptions
     so-playbook: *dockerOptions
     so-redis: *dockerOptions
     so-sensoroni: *dockerOptions