Skip to content

Commit 61e2595

Browse files
jonuwzjonuwz
committed
too much to list
1 parent c6cbda7 commit 61e2595

File tree

14 files changed

+460
-30
lines changed

14 files changed

+460
-30
lines changed

‎.images/splunk/Dockerfile

+35-3
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,48 @@ ARG VERSION=8.2.0
22
ARG TOOL=splunk
33
FROM splunk/${TOOL}:${VERSION}
44

5+
56
USER root
67

8+
# Do this 1st - it takes the longest
9+
RUN sed -i 's/41812/1000/g' /etc/passwd && \
10+
sed -i 's/41812/1000/g' /etc/group && \
11+
chown -R 1000:1000 /home/splunk /opt/splunk*
12+
713
RUN update-ca-trust && \
814
microdnf install -y vim git-core jq nmap net-tools lsof && \
915
microdnf clean all
1016

11-
RUN sed -i 's/41812/1000/g' /etc/passwd && \
12-
sed -i 's/41812/1000/g' /etc/group && \
13-
chown -R 1000:1000 /home/splunk /opt/splunk*
17+
RUN curl -s -L -f -o /tmp/tcpdump.rpm http://mirror.centos.org/centos/8-stream/AppStream/x86_64/os/Packages/tcpdump-4.9.3-1.el8.x86_64.rpm && \
18+
rpm -i /tmp/tcpdump.rpm && \
19+
rm /tmp/tcpdump.rpm
1420

1521
ADD ./refresh /usr/bin/refresh
22+
ADD ./web.conf /tmp/web.conf
23+
RUN chown -R 1000:1000 /tmp/web.conf
24+
25+
26+
USER splunk
27+
28+
# add splunk to the path
29+
RUN if [[ -e /opt/splunk-etc ]];then \
30+
echo -e '\nexport PATH=$PATH:/opt/splunk/bin' >> $HOME/.bashrc ; fi
31+
32+
RUN if [[ -e /opt/splunkforwarder-etc ]];then \
33+
echo -e '\nexport PATH=$PATH:/opt/splunkforwarder/bin' >> $HOME/.bashrc ; fi
34+
35+
# disable caching of web assets on splunk servers
36+
RUN if [[ -e /opt/splunk-etc ]];then \
37+
mkdir -p /opt/splunk-etc/system/local && \
38+
cp /tmp/web.conf /opt/splunk-etc/system/local/web.conf ; fi
39+
RUN rm -f /tmp/web.conf
40+
41+
# install suit toolkit if splunk server
42+
RUN if [[ -e /opt/splunk-etc ]];then \
43+
(curl -s -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash) && \
44+
source ~/.bashrc && \
45+
nvm install lts/fermium && \
46+
npm install -g @splunk/create && \
47+
npm install -g yarn ; fi
1648

1749
USER ansible

‎.images/splunk/web.conf

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[settings]
2+
cacheEntriesLimit = 0
3+
cacheBytesLimit = 0

‎basic/docker-compose.yaml

+7-6
Original file line numberDiff line numberDiff line change
@@ -2,40 +2,41 @@ version: '3.4'
22

33
networks:
44
default:
5-
external:
6-
name: apps
5+
name: apps
76

87
services:
98

109
sbs:
11-
image: local/splunk:8.1.3
10+
image: local/splunk:8.2.6
1211
build:
1312
context: ../.images/splunk
1413
network: host
1514
args:
16-
VERSION: 8.1.3
15+
VERSION: 8.2.6
1716
TOOL: splunk
1817
container_name: sbs
1918
hostname: sbs
2019
ports:
2120
- "8000:8000"
2221
- "8089:8089"
22+
- "8088:8088"
2323
environment:
2424
SPLUNK_DISABLE_POPUPS: "true"
2525
LANG: en_US.utf8
2626
SPLUNK_ROLE: splunk_standalone
2727
SPLUNK_START_ARGS: --accept-license
2828
SPLUNK_PASSWORD: password
29+
SPLUNK_HEC_TOKEN: password
2930
volumes:
3031
- ${HOME}/projects:/projects
3132

3233
sbf:
33-
image: local/universalforwarder:8.1.3
34+
image: local/universalforwarder:8.2.6
3435
build:
3536
context: ../.images/splunk
3637
network: host
3738
args:
38-
VERSION: 8.1.3
39+
VERSION: 8.2.6
3940
TOOL: universalforwarder
4041
container_name: sbf
4142
hostname: sbf

‎heavy_forwarder/docker-compose.yaml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
version: '3.4'
2+
3+
networks:
4+
default:
5+
external:
6+
name: apps
7+
8+
services:
9+
10+
sh1:
11+
image: local/splunk:8.2.6
12+
build:
13+
context: ../.images/splunk
14+
network: host
15+
args:
16+
VERSION: 8.2.6
17+
TOOL: splunk
18+
container_name: hf1
19+
hostname: hf1
20+
ports:
21+
- "8300:8000"
22+
- "8389:8089"
23+
environment:
24+
LANG: en_US.utf8
25+
SPLUNK_PASSWORD: password
26+
SPLUNK_DISABLE_POPUPS: "true"
27+
SPLUNK_START_ARGS: --accept-license
28+
SPLUNK_ROLE: splunk_heavy_forwarder
29+
SPLUNK_CLUSTER_MASTER_URL: cm1
30+
SPLUNK_IDXC_PASS4SYMMKEY: cm_and_indexer_comms
31+
SPLUNK_IDXC_DISCOVERYPASS4SYMMKEY: cm_and_forwarder_comms
32+
volumes:
33+
- ${HOME}/projects:/projects

‎indexer_singlesite/docker-compose.yaml

+39-11
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,50 @@
1-
version: '3.4'
1+
version: '3.6'
22

33
networks:
44
default:
5-
external:
6-
name: apps
5+
name: apps
76

87
services:
98

9+
sh1:
10+
profiles: [ "sh" ]
11+
image: &image local/splunk:8.2.6
12+
build:
13+
context: ../.images/splunk
14+
network: host
15+
args:
16+
VERSION: &version 8.2.6
17+
TOOL: splunk
18+
container_name: sh1
19+
hostname: sh1
20+
ports:
21+
- "8100:8000"
22+
- "8189:8089"
23+
environment:
24+
LANG: en_US.utf8
25+
SPLUNK_PASSWORD: password
26+
SPLUNK_DISABLE_POPUPS: "true"
27+
SPLUNK_START_ARGS: --accept-license
28+
SPLUNK_ROLE: splunk_search_head
29+
SPLUNK_CLUSTER_MASTER_URL: cm1
30+
SPLUNK_IDXC_PASS4SYMMKEY: cm_and_indexer_comms
31+
SPLUNK_IDXC_DISCOVERYPASS4SYMMKEY: cm_and_forwarder_comms
32+
volumes:
33+
- ${HOME}/projects:/projects
34+
1035
cm1:
11-
image: local/splunk:8.1.3
36+
image: *image
1237
build:
1338
context: ../.images/splunk
1439
network: host
1540
args:
16-
VERSION: 8.1.3
41+
VERSION: *version
1742
TOOL: splunk
1843
container_name: cm1
1944
hostname: cm1
2045
ports:
21-
- "8100:8000"
22-
- "8189:8089"
46+
- "8101:8000"
47+
- "8190:8089"
2348
environment:
2449
LANG: en_US.utf8
2550
SPLUNK_PASSWORD: password
@@ -36,15 +61,17 @@ services:
3661
- ${HOME}/projects:/projects
3762

3863
idx1-1:
39-
image: local/splunk:8.1.3
64+
image: *image
4065
build:
4166
context: ../.images/splunk
4267
network: host
4368
args:
44-
VERSION: 8.1.3
69+
VERSION: *version
4570
TOOL: splunk
4671
container_name: idx1-1
4772
hostname: idx1-1
73+
ports:
74+
- "8188:8088"
4875
environment:
4976
LANG: en_US.utf8
5077
SPLUNK_PASSWORD: password
@@ -53,16 +80,17 @@ services:
5380
SPLUNK_ROLE: splunk_indexer
5481
SPLUNK_CLUSTER_MASTER_URL: cm1
5582
SPLUNK_IDXC_PASS4SYMMKEY: cm_and_indexer_comms
83+
SPLUNK_HEC_TOKEN: password
5684
volumes:
5785
- ${HOME}/projects:/projects
5886

5987
idx1-2:
60-
image: local/splunk:8.1.3
88+
image: *image
6189
build:
6290
context: ../.images/splunk
6391
network: host
6492
args:
65-
VERSION: 8.1.3
93+
VERSION: *version
6694
TOOL: splunk
6795
container_name: idx1-2
6896
hostname: idx1-2

‎search_head/docker-compose.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,12 @@ networks:
88
services:
99

1010
sh1:
11-
image: local/splunk:8.1.3
11+
image: local/splunk:8.2.6
1212
build:
1313
context: ../.images/splunk
1414
network: host
1515
args:
16-
VERSION: 8.1.3
16+
VERSION: 8.2.6
1717
TOOL: splunk
1818
container_name: sh1
1919
hostname: sh1

‎search_head_cluster/docker-compose.yaml

+8-8
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,12 @@ services:
2525
- ./haproxy:/usr/local/etc/haproxy
2626

2727
deployer:
28-
image: local/splunk:8.1.3
28+
image: local/splunk:8.2.6
2929
build:
3030
context: ../.images/splunk
3131
network: host
3232
args:
33-
VERSION: 8.1.3
33+
VERSION: 8.2.6
3434
TOOL: splunk
3535
container_name: deployer
3636
hostname: deployer
@@ -51,12 +51,12 @@ services:
5151
sh1:
5252
depends_on:
5353
- deployer
54-
image: local/splunk:8.1.3
54+
image: local/splunk:8.2.6
5555
build:
5656
context: ../.images/splunk
5757
network: host
5858
args:
59-
VERSION: 8.1.3
59+
VERSION: 8.2.6
6060
TOOL: splunk
6161
container_name: sh1
6262
hostname: sh1
@@ -80,12 +80,12 @@ services:
8080
sh2:
8181
depends_on:
8282
- deployer
83-
image: local/splunk:8.1.3
83+
image: local/splunk:8.2.6
8484
build:
8585
context: ../.images/splunk
8686
network: host
8787
args:
88-
VERSION: 8.1.3
88+
VERSION: 8.2.6
8989
TOOL: splunk
9090
container_name: sh2
9191
hostname: sh2
@@ -109,12 +109,12 @@ services:
109109
sh3:
110110
depends_on:
111111
- deployer
112-
image: local/splunk:8.1.3
112+
image: local/splunk:8.2.6
113113
build:
114114
context: ../.images/splunk
115115
network: host
116116
args:
117-
VERSION: 8.1.3
117+
VERSION: 8.2.6
118118
TOOL: splunk
119119
container_name: sh3
120120
hostname: sh3

‎searchhead_singlesite/docker-compose.yaml

+78
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
version: '3.4'
2+
3+
networks:
4+
default:
5+
external:
6+
name: apps
7+
8+
services:
9+
10+
cm1:
11+
image: local/splunk:8.2.6
12+
build:
13+
context: ../.images/splunk
14+
network: host
15+
args:
16+
VERSION: 8.2.6
17+
TOOL: splunk
18+
container_name: cm1
19+
hostname: cm1
20+
ports:
21+
- "8100:8000"
22+
- "8189:8089"
23+
environment:
24+
LANG: en_US.utf8
25+
SPLUNK_PASSWORD: password
26+
SPLUNK_DISABLE_POPUPS: "true"
27+
SPLUNK_START_ARGS: --accept-license
28+
SPLUNK_ROLE: splunk_cluster_master
29+
SPLUNK_CLUSTER_MASTER_URL: cm1
30+
SPLUNK_IDXC_REPLICATION_FACTOR: 2
31+
SPLUNK_IDXC_SEARCH_FACTOR: 2
32+
SPLUNK_IDXC_LABEL: docker_idx
33+
SPLUNK_IDXC_PASS4SYMMKEY: cm_and_indexer_comms
34+
SPLUNK_IDXC_DISCOVERYPASS4SYMMKEY: cm_and_forwarder_comms
35+
volumes:
36+
- ${HOME}/projects:/projects
37+
38+
idx1-1:
39+
image: local/splunk:8.2.6
40+
build:
41+
context: ../.images/splunk
42+
network: host
43+
args:
44+
VERSION: 8.2.6
45+
TOOL: splunk
46+
container_name: idx1-1
47+
hostname: idx1-1
48+
environment:
49+
LANG: en_US.utf8
50+
SPLUNK_PASSWORD: password
51+
SPLUNK_DISABLE_POPUPS: "true"
52+
SPLUNK_START_ARGS: --accept-license
53+
SPLUNK_ROLE: splunk_indexer
54+
SPLUNK_CLUSTER_MASTER_URL: cm1
55+
SPLUNK_IDXC_PASS4SYMMKEY: cm_and_indexer_comms
56+
volumes:
57+
- ${HOME}/projects:/projects
58+
59+
idx1-2:
60+
image: local/splunk:8.2.6
61+
build:
62+
context: ../.images/splunk
63+
network: host
64+
args:
65+
VERSION: 8.2.6
66+
TOOL: splunk
67+
container_name: idx1-2
68+
hostname: idx1-2
69+
environment:
70+
LANG: en_US.utf8
71+
SPLUNK_PASSWORD: password
72+
SPLUNK_DISABLE_POPUPS: "true"
73+
SPLUNK_START_ARGS: --accept-license
74+
SPLUNK_ROLE: splunk_indexer
75+
SPLUNK_CLUSTER_MASTER_URL: cm1
76+
SPLUNK_IDXC_PASS4SYMMKEY: cm_and_indexer_comms
77+
volumes:
78+
- ${HOME}/projects:/projects

0 commit comments

Comments
 (0)