From 9bc3ae6b26bfbc6d0ea89b9ab6e9f00d96c667f5 Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Thu, 12 Nov 2026 15:49:34 -0600
Subject: [PATCH] further tighten elastic artifact registry

---
 salt/nginx/enabled.sls    | 9 ++++++++-
 salt/nginx/etc/nginx.conf | 2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/salt/nginx/enabled.sls b/salt/nginx/enabled.sls
index f1a71238a..c6b20f7f5 100644
--- a/salt/nginx/enabled.sls
+++ b/salt/nginx/enabled.sls
@@ -16,6 +16,12 @@ include:
   - nginx.config
   - nginx.sostatus
 
+fleet_beats_dir_nginx:
+  file.directory:
+    - name: /nsm/elastic-fleet/artifacts/beats
+    - makedirs: True
+    - show_changes: False
+
 {%   if GLOBALS.role != 'so-fleet' %}
 {%     set container_config = 'so-nginx' %}
 make-rule-dir-nginx:
@@ -54,7 +60,7 @@ so-nginx:
       - /opt/so/log/nginx/:/var/log/nginx:rw
       - /opt/so/tmp/nginx/:/var/lib/nginx:rw
       - /opt/so/tmp/nginx/:/run:rw
-      - /nsm/elastic-fleet/artifacts/:/opt/socore/elastic-artifacts/artifacts:ro
+      - /nsm/elastic-fleet/artifacts/beats/:/opt/socore/elastic-artifacts/artifacts/beats:ro
       {% if GLOBALS.is_manager %}
       - /nsm/elastic-fleet/so_agent-installers/:/opt/socore/html/packages
       - /etc/pki/managerssl.crt:/etc/pki/nginx/server.crt:ro
@@ -106,6 +112,7 @@ so-nginx:
       {% endif %}
     - require:
       - file: nginxconf
+      - file: fleet_beats_dir_nginx
       {% if GLOBALS.is_manager %}
       {%   if NGINXMERGED.ssl.replace_cert %}
       - file: managerssl_key
diff --git a/salt/nginx/etc/nginx.conf b/salt/nginx/etc/nginx.conf
index 5f9f9858d..6a128d56b 100644
--- a/salt/nginx/etc/nginx.conf
+++ b/salt/nginx/etc/nginx.conf
@@ -57,7 +57,7 @@ http {
     server_name {{ GLOBALS.hostname }};
     {%- endif %}
 		root /opt/socore/elastic-artifacts;
-		location /artifacts/ {
+		location /artifacts/beats/ {
 			try_files $uri =404;
 		}
 		location / {