mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-10-31 17:59:00 +01:00
Mike Reeves
11c8fe3093
Anchor the grid CA and blocklist the eMudhra roots in the host trust store (new ca.trust state, also used by the desktop role), then mount the extracted store into each container instead of the frozen copies made by so-catrust. Containers restart when the host trust changes.
13 lines
703 B
Django/Jinja
13 lines
703 B
Django/Jinja
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
|
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
|
# https://securityonion.net/license; you may not use this file except in compliance with the
|
|
# Elastic License 2.0.
|
|
|
|
{# Containers mount the extracted directory rather than single files: update-ca-trust replaces
|
|
files by rename, so a file bind mount would keep pointing at the old inode. #}
|
|
{% set CATRUST = {
|
|
'dir': '/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro',
|
|
'java': '/etc/pki/ca-trust/extracted/java/cacerts',
|
|
'pem': '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem'
|
|
} %}
|