CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add conditional for heavynode for redis and elasticsearch

Browse Source
This commit is contained in:
weslambert
2021-07-06 14:21:29 -04:00
committed by GitHub
parent 2f3f04e4ca
commit ce0b064972
1 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
salt/ssl/init.sls
View File

@@ -9,6 +9,9 @@
{% set MAININT = salt['pillar.get']('host:mainint') %} {% set MAININT = salt['pillar.get']('host:mainint') %}
{% set MAINIP = salt['grains.get']('ip_interfaces').get(MAININT)[0] %} {% set MAINIP = salt['grains.get']('ip_interfaces').get(MAININT)[0] %}
{% set CUSTOM_FLEET_HOSTNAME = salt['pillar.get']('global:fleet_custom_hostname', None) %} {% set CUSTOM_FLEET_HOSTNAME = salt['pillar.get']('global:fleet_custom_hostname', None) %}
{% if grains.role in ['so-heavynode'] %}
{% set heavynode = salt['grains.get']('host') %}
{% endif %}
{% if grains.id.split('_')|last in ['manager', 'eval', 'standalone', 'import', 'helixsensor'] %} {% if grains.id.split('_')|last in ['manager', 'eval', 'standalone', 'import', 'helixsensor'] %}
{% set trusttheca_text = salt['cp.get_file_str']('/etc/pki/ca.crt')|replace('\n', '') %} {% set trusttheca_text = salt['cp.get_file_str']('/etc/pki/ca.crt')|replace('\n', '') %}
@@ -103,7 +106,11 @@ influxkeyperms:
# Create a cert for Redis encryption # Create a cert for Redis encryption
/etc/pki/redis.key: /etc/pki/redis.key:
x509.private_key_managed: x509.private_key_managed:
{% if grains.role in ['so-heavynode'] %}
- CN: {{ heavynode }}
{% else %}
- CN: {{ manager }} - CN: {{ manager }}
{% endif %}
- bits: 4096 - bits: 4096
- days_remaining: 0 - days_remaining: 0
- days_valid: 820 - days_valid: 820
@@ -123,7 +130,11 @@ influxkeyperms:
- ca_server: {{ ca_server }} - ca_server: {{ ca_server }}
- signing_policy: registry - signing_policy: registry
- public_key: /etc/pki/redis.key - public_key: /etc/pki/redis.key
{% if grains.role in ['so-heavynode'] %}
- CN: {{ heavynode }}
{% else %}
- CN: {{ manager }} - CN: {{ manager }}
{% endif %}
- days_remaining: 0 - days_remaining: 0
- days_valid: 820 - days_valid: 820
- backup: True - backup: True
@@ -315,7 +326,11 @@ miniokeyperms:
# Create a cert for elasticsearch # Create a cert for elasticsearch
/etc/pki/elasticsearch.key: /etc/pki/elasticsearch.key:
x509.private_key_managed: x509.private_key_managed:
{% if grains.role in ['so-heavynode'] %}
- CN: {{ heavynode }}
{% else %}
- CN: {{ manager }} - CN: {{ manager }}
{% endif %}
- bits: 4096 - bits: 4096
- days_remaining: 0 - days_remaining: 0
- days_valid: 820 - days_valid: 820
@@ -335,7 +350,11 @@ miniokeyperms:
- ca_server: {{ ca_server }} - ca_server: {{ ca_server }}
- signing_policy: registry - signing_policy: registry
- public_key: /etc/pki/elasticsearch.key - public_key: /etc/pki/elasticsearch.key
{% if grains.role in ['so-heavynode'] %}
- CN: {{ heavynode }}
{% else %}
- CN: {{ manager }} - CN: {{ manager }}
{% endif %}
- days_remaining: 0 - days_remaining: 0
- days_valid: 820 - days_valid: 820
- backup: True - backup: True