Build Stack Consul

# docker-compose up -d --build consul-server-1

Create Bootstrap ACL

Create Policy/Token Agent

# consul acl policy create -name "agent-token" -description "Agent's Token Policy" -rules @agent-policy.hcl
# consul acl token create -description "Agent Token" -policy-name "agent-token"
# consul acl set-agent-token default "<SecretID>"

Create Policy/Token Vault

# consul acl policy create -name "vault-token" -description "Vault Token Policy" -rules @vault-policy.hcl
# consul acl token create -description "Vault Token" -policy-name "vault-token"

Create Policy/Token Rabbitmq

# consul acl policy create -name "rabbitmq-token" -description "Rabbitmq Token Policy" -rules @rabbitmq-policy.hcl
# consul acl token create -description "Rabbitmq Token" -policy-name "rabbitmq-token"

Build Stack Rabbitmq

# docker-compose up -d --build rabbitmq-server-1
# docker-compose up -d --build rabbitmq-server-2
# docker-compose up -d --build rabbitmq-server-3

Build Stack Vault

# docker-compose up -d --build vault

Unsealed Vault Server

# docker exec -it redstack_vault_1 /bin/sh
# vault operator init
# vault operator unseal (repeat process 3x use 3 tokens # )
# vault login (Insert Root Token)

Enable Dynamic Secrets Rabbitmq

# vault secrets enable rabbitmq
# vault write rabbitmq/config/connection connection_uri="http://10.5.0.6:15672" username="guest" password="guest"
# vault write rabbitmq/roles/dc1-rabbitmq vhosts='{"/":{"configure": ".*", "write": ".*", "read": ".*"}}'

Test Dynamic Secrets Vault <-> Rabbitmq

# vault read rabbitmq/creds/dc1-rabbitmq

# cd validate-rabbitmq-go

Configure Receive (Rabbitmq)

# go run consumer/receive.go

Configure Producer Send (Rabbitmq)

# sh producer/loop.sh

Build Stack Cassandra

# docker-compose up -d --build cassandra-server-1
# docker-compose up -d --build cassandra-server-2
# docker-compose up -d --build cassandra-server-3

Enable Dynamic Secrets Cassandra

# vault secrets enable database

# vault write database/config/cassandra-database \
    plugin_name="cassandra-database-plugin" \
    hosts=10.5.0.9 \
    protocol_version=4 \
    username=cassandra \
    password=cassandra \
    allowed_roles=cassandra-access

# vault write database/roles/cassandra-access \
plugin_name="cassandra-database-plugin" \
db_name=cassandra-database \
creation_statements="CREATE USER '{{username}}' WITH PASSWORD '{{password}}' NOSUPERUSER; \
     GRANT SELECT ON ALL KEYSPACES TO {{username}};" \
default_ttl="1h" \
max_ttl="24h"

Test Dynamics Secrets Vault/Cassandra

# vault read database/creds/cassandra-access

# cqlsh 10.5.0.9 -u<vaultuserdynamic> -p<vaultpassworddynamic>

Build Stack Wazuh

On the host that will build the stack build the following command:

# sysctl -w vm.max_map_count=262144

Next Steps:

# docker-compose up -d --build wazuh

# docker-compose up -d --build elasticsearch

# docker-compose up -d --build kibana

# docker-compose up -d --build nginx

Access:

https://10.5.0.15/

login: foo
password: bar

Terraform Under Construction

Reference Links

Consul Acl
Rabbitmq Cluster-Formation
Vault RabbitMQ Secrets Engine
Vault Cassandra Database