forked from SUNET/soc-ops
IntelMQ API.
This commit is contained in:
parent
4fcd099e21
commit
ff842b1989
GPG key ID:
5E8401339C7F5037
5 changed files with 172 additions and 0 deletions
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"intelmq_ctl_cmd": ["sudo", "-u", "intelmq", "/opt/intelmq/venv/bin/intelmqctl"],
|
||||
"allowed_path": "/opt/intelmq/var/lib/bots/",
|
||||
"session_store": "/etc/intelmq/api-session.sqlite",
|
||||
"session_duration": 86400,
|
||||
"allow_origins": ["*"]
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
[Unit]
|
||||
Description=Gunicorn deamon to serve the IntelMQ API
|
||||
Requires=intelmq-api.socket
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
|
||||
# To override settings path, use e.g.:
|
||||
# Environment="INTELMQ_API_CONFIG=/etc/intelmq/api-config.json"
|
||||
|
||||
Environment="ROOT_PATH=/intelmq"
|
||||
User=www-data
|
||||
Group=www-data
|
||||
RuntimeDirectory=gunicorn
|
||||
WorkingDirectory=/opt/intelmq/venv/lib/python3.11/site-packages/intelmq_api
|
||||
ExecStart=/opt/intelmq/venv/bin/gunicorn intelmq_api.main:app --workers 4 --worker-class uvicorn.workers.UvicornWorker --bind unix:intelmq_api.sock --log-level DEBUG
|
||||
ExecReload=/bin/kill -s HUP $MAINPID
|
||||
KillMode=mixed
|
||||
TimeoutStopSec=5
|
||||
PrivateTmp=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
[Unit]
|
||||
Description=The socket to handle IntelMQ API requests
|
||||
|
||||
[Socket]
|
||||
ListenStream=/opt/intelmq/venv/lib/python3.11/site-packages/intelmq_api/intelmq_api.sock
|
||||
SocketUser=www-data
|
||||
|
||||
[Install]
|
||||
WantedBy=sockets.target
|
||||
|
|
@ -1,5 +1,11 @@
|
|||
class soc::intelmq(
|
||||
Optional[String] $tls_cert = undef,
|
||||
Optional[String] $tls_chain = undef,
|
||||
Optional[String] $tls_key = undef,
|
||||
String $servername = $::fact['networking.fqdn'],
|
||||
Boolean $use_snakeoil = false,
|
||||
) {
|
||||
include sunet::systemd_reload
|
||||
|
||||
group { 'intelmq':
|
||||
ensure => present,
|
||||
|
|
@ -88,4 +94,51 @@ class soc::intelmq(
|
|||
notify => Service['apache2'],
|
||||
}
|
||||
|
||||
file { '/etc/apache2/sites-available/intelmq-vhost.conf':
|
||||
ensure => file,
|
||||
template => 'soc/intelmq/intelmq-vhost.conf.erb'
|
||||
}
|
||||
|
||||
file { '/etc/intelmq/api-config.json':
|
||||
ensure => file,
|
||||
owner => 'intelmq',
|
||||
group => 'intelmq',
|
||||
mode => '0444'
|
||||
content => 'soc/intelmq/api-config.json',
|
||||
}
|
||||
|
||||
file { 'api-session.sqlite':
|
||||
ensure => 'present',
|
||||
replace => 'no',
|
||||
owner => 'intelmq',
|
||||
group => 'www-data',
|
||||
mode => '0660'
|
||||
}
|
||||
|
||||
file { '/etc/systemd/system/intelmq-api.service':
|
||||
ensure => file,
|
||||
content => 'soc/intelmq/intelmq-api.service',
|
||||
notify => [Class['sunet:systemd_reload'], Service['intelmq-api.service'],],
|
||||
}
|
||||
|
||||
file { '/etc/systemd/system/intelmq-api.socket':
|
||||
ensure => file,
|
||||
content => 'soc/intelmq/intelmq-api.socket',
|
||||
notify => [Class['sunet:systemd_reload'], Service['intelmq-api.socket'],],
|
||||
}
|
||||
|
||||
service { 'intelmq-api.service':
|
||||
ensure => running,
|
||||
name => 'intelmq-api.service',
|
||||
enabled => true,
|
||||
hasrestart => true,
|
||||
}
|
||||
|
||||
service { 'intelmq-api.socket':
|
||||
ensure => running,
|
||||
name => 'intelmq-api.socket',
|
||||
enabled => true,
|
||||
hasrestart => true,
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,80 @@
|
|||
<VirtualHost *:80>
|
||||
ServerName <%= @servername %>
|
||||
ServerAdmin cert@cert.sunet.se
|
||||
DocumentRoot /var/www/html
|
||||
|
||||
RewriteEngine On
|
||||
RewriteRule ^(.*)$ https://<%= @servername %>/$1 [R,L]
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/access.log combined
|
||||
</VirtualHost>
|
||||
|
||||
<VirtualHost *:443>
|
||||
ServerName <%= @servername %>
|
||||
ServerAdmin cert@cert.sunet.se
|
||||
|
||||
SSLEngine on
|
||||
<% if @use_snakeoil -%>
|
||||
SSLCertificateFile /etc/letsencrypt/live/intelmq-test.cert.sunet.se/cert.pem
|
||||
SSLCertificateKeyFile /etc/letsencrypt/live/intelmq-test.cert.sunet.se/privkey.pem
|
||||
<% else -%>
|
||||
SSLCertificateFile <%= @tls_cert %>
|
||||
SSLCertificateKeyFile <%= @tls_key %>
|
||||
SSLCertificateChainFile <%= @tls_chain %>
|
||||
<% end -%>
|
||||
|
||||
SSLCACertificatePath /etc/ssl/certs/
|
||||
SSLCACertificateFile /etc/ssl/certs/ca-certificates.crt
|
||||
|
||||
Protocols h2 http/1.1
|
||||
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.2
|
||||
SSLHonorCipherOrder off
|
||||
SSLSessionTickets off
|
||||
Header always set Strict-Transport-Security "max-age=63072000"
|
||||
|
||||
<IfModule mod_proxy.c>
|
||||
ProxyRequests Off
|
||||
<Location "/api">
|
||||
ProxyPass "http://127.0.0.1:8666/api"
|
||||
ProxyPassReverse "http://127.0.0.1:8666/api"
|
||||
Header always set X-DEBUG-PATH "/api"
|
||||
</Location>
|
||||
</IfModule>
|
||||
|
||||
# RewriteEngine on
|
||||
# RewriteCond %{REQUEST_URI} !^/(index.html|static|api|intelmq-webinput)
|
||||
# RewriteRule .* /index.html [PT]
|
||||
|
||||
DocumentRoot /opt/intelmq/www-fody
|
||||
<Directory /opt/intelmq/www-fody>
|
||||
<IfModule mod_headers.c>
|
||||
Header set Content-Security-Policy "script-src 'self'"
|
||||
Header set X-Content-Security-Policy "script-src 'self'"
|
||||
</IfModule>
|
||||
Require all granted
|
||||
Options FollowSymLinks
|
||||
</Directory>
|
||||
|
||||
Alias /intelmq-manager /usr/share/intelmq_manager/html/
|
||||
<Directory /usr/share/intelmq_manager/html>
|
||||
# AuthType Basic
|
||||
# AuthName "IntelMQ"
|
||||
# AuthBasicProvider file
|
||||
# AuthUserFile /etc/apache2/htpasswd
|
||||
# Require user sunetcert
|
||||
|
||||
<IfModule mod_headers.c>
|
||||
Header set Content-Security-Policy "script-src 'self'"
|
||||
Header set X-Content-Security-Policy "script-src 'self'"
|
||||
</IfModule>
|
||||
</Directory>
|
||||
|
||||
<Location /intelmq/>
|
||||
ProxyPass unix:/opt/intelmq/venv/lib/python3.11/site-packages/intelmq_api/intelmq_api.sock|http://127.0.0.1/
|
||||
ProxyPassReverse unix:/opt/intelmq/venv/lib/python3.11/site-packages/intelmq_api/intelmq_api.sock|http://127.0.0.1/
|
||||
</Location>
|
||||
|
||||
ErrorLog ${APACHE_LOG_DIR}/error.log
|
||||
CustomLog ${APACHE_LOG_DIR}/access.log combined
|
||||
</VirtualHost>
|
||||
Loading…
Add table
Reference in a new issue