{"id":2107,"date":"2024-07-27T09:02:40","date_gmt":"2024-07-27T07:02:40","guid":{"rendered":"https:\/\/blog.mhasin.eu\/?p=2107"},"modified":"2024-07-27T09:03:05","modified_gmt":"2024-07-27T07:03:05","slug":"elasticsearch-docker-ssl","status":"publish","type":"post","link":"https:\/\/blog.mhasin.eu\/?p=2107","title":{"rendered":"Elasticsearch docker ssl"},"content":{"rendered":"\n<p>env file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Password for the 'elastic' user (at least 6 characters)\nELASTIC_PASSWORD=\n\n# Password for the 'kibana_system' user (at least 6 characters)\nKIBANA_PASSWORD=\n\n# Version of Elastic products\nSTACK_VERSION=8.1.1\n\n# Set the cluster name\nCLUSTER_NAME=docker-cluster\n\n# Set to 'basic' or 'trial' to automatically start the 30-day trial\nLICENSE=basic\n#LICENSE=trial\n\n# Port to expose Elasticsearch HTTP API to the host\nES_PORT=9200\n#ES_PORT=127.0.0.1:9200\n\n# Port to expose Kibana to the host\nKIBANA_PORT=5601\n#KIBANA_PORT=80\n\n# Increase or decrease based on the available host memory (in bytes)\nMEM_LIMIT=1073741824\n\n# Project namespace (defaults to the current folder name if not set)\n#COMPOSE_PROJECT_NAME=myproject<\/code><\/pre>\n\n\n\n<p>DOcker compose:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>version: \"2.2\"\n\nservices:\n  setup:\n    image: docker.elastic.co\/elasticsearch\/elasticsearch:${STACK_VERSION}\n    volumes:\n      - certs:\/usr\/share\/elasticsearch\/config\/certs\n    user: \"0\"\n    command: >\n      bash -c '\n        if [ x${ELASTIC_PASSWORD} == x ]; then\n          echo \"Set the ELASTIC_PASSWORD environment variable in the .env file\";\n          exit 1;\n        elif [ x${KIBANA_PASSWORD} == x ]; then\n          echo \"Set the KIBANA_PASSWORD environment variable in the .env file\";\n          exit 1;\n        fi;\n        if [ ! -f certs\/ca.zip ]; then\n          echo \"Creating CA\";\n          bin\/elasticsearch-certutil ca --silent --pem -out config\/certs\/ca.zip;\n          unzip config\/certs\/ca.zip -d config\/certs;\n        fi;\n        if [ ! -f certs\/certs.zip ]; then\n          echo \"Creating certs\";\n          echo -ne \\\n          \"instances:\\n\"\\\n          \"  - name: es01\\n\"\\\n          \"    dns:\\n\"\\\n          \"      - es01\\n\"\\\n          \"      - localhost\\n\"\\\n          \"    ip:\\n\"\\\n          \"      - 127.0.0.1\\n\"\\\n          \"  - name: es02\\n\"\\\n          \"    dns:\\n\"\\\n          \"      - es02\\n\"\\\n          \"      - localhost\\n\"\\\n          \"    ip:\\n\"\\\n          \"      - 127.0.0.1\\n\"\\\n          \"  - name: es03\\n\"\\\n          \"    dns:\\n\"\\\n          \"      - es03\\n\"\\\n          \"      - localhost\\n\"\\\n          \"    ip:\\n\"\\\n          \"      - 127.0.0.1\\n\"\\\n          > config\/certs\/instances.yml;\n          bin\/elasticsearch-certutil cert --silent --pem -out config\/certs\/certs.zip --in config\/certs\/instances.yml --ca-cert config\/certs\/ca\/ca.crt --ca-key config\/certs\/ca\/ca.key;\n          unzip config\/certs\/certs.zip -d config\/certs;\n        fi;\n        echo \"Setting file permissions\"\n        chown -R root:root config\/certs;\n        find . -type d -exec chmod 750 \\{\\} \\;;\n        find . -type f -exec chmod 640 \\{\\} \\;;\n        echo \"Waiting for Elasticsearch availability\";\n        until curl -s --cacert config\/certs\/ca\/ca.crt https:\/\/es01:9200 | grep -q \"missing authentication credentials\"; do sleep 30; done;\n        echo \"Setting kibana_system password\";\n        until curl -s -X POST --cacert config\/certs\/ca\/ca.crt -u elastic:${ELASTIC_PASSWORD} -H \"Content-Type: application\/json\" https:\/\/es01:9200\/_security\/user\/kibana_system\/_password -d \"{\\\"password\\\":\\\"${KIBANA_PASSWORD}\\\"}\" | grep -q \"^{}\"; do sleep 10; done;\n        echo \"All done!\";\n      '\n    healthcheck:\n      test: [\"CMD-SHELL\", \"[ -f config\/certs\/es01\/es01.crt ]\"]\n      interval: 1s\n      timeout: 5s\n      retries: 120\n\n  es01:\n    depends_on:\n      setup:\n        condition: service_healthy\n    image: docker.elastic.co\/elasticsearch\/elasticsearch:${STACK_VERSION}\n    volumes:\n      - certs:\/usr\/share\/elasticsearch\/config\/certs\n      - esdata01:\/usr\/share\/elasticsearch\/data\n    ports:\n      - ${ES_PORT}:9200\n    environment:\n      - node.name=es01\n      - cluster.name=${CLUSTER_NAME}\n      - cluster.initial_master_nodes=es01,es02,es03\n      - discovery.seed_hosts=es02,es03\n      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}\n      - bootstrap.memory_lock=true\n      - xpack.security.enabled=true\n      - xpack.security.http.ssl.enabled=true\n      - xpack.security.http.ssl.key=certs\/es01\/es01.key\n      - xpack.security.http.ssl.certificate=certs\/es01\/es01.crt\n      - xpack.security.http.ssl.certificate_authorities=certs\/ca\/ca.crt\n      - xpack.security.http.ssl.verification_mode=certificate\n      - xpack.security.transport.ssl.enabled=true\n      - xpack.security.transport.ssl.key=certs\/es01\/es01.key\n      - xpack.security.transport.ssl.certificate=certs\/es01\/es01.crt\n      - xpack.security.transport.ssl.certificate_authorities=certs\/ca\/ca.crt\n      - xpack.security.transport.ssl.verification_mode=certificate\n      - xpack.license.self_generated.type=${LICENSE}\n    mem_limit: ${MEM_LIMIT}\n    ulimits:\n      memlock:\n        soft: -1\n        hard: -1\n    healthcheck:\n      test:\n        [\n          \"CMD-SHELL\",\n          \"curl -s --cacert config\/certs\/ca\/ca.crt https:\/\/localhost:9200 | grep -q 'missing authentication credentials'\",\n        ]\n      interval: 10s\n      timeout: 10s\n      retries: 120\n\n  es02:\n    depends_on:\n      - es01\n    image: docker.elastic.co\/elasticsearch\/elasticsearch:${STACK_VERSION}\n    volumes:\n      - certs:\/usr\/share\/elasticsearch\/config\/certs\n      - esdata02:\/usr\/share\/elasticsearch\/data\n    environment:\n      - node.name=es02\n      - cluster.name=${CLUSTER_NAME}\n      - cluster.initial_master_nodes=es01,es02,es03\n      - discovery.seed_hosts=es01,es03\n      - bootstrap.memory_lock=true\n      - xpack.security.enabled=true\n      - xpack.security.http.ssl.enabled=true\n      - xpack.security.http.ssl.key=certs\/es02\/es02.key\n      - xpack.security.http.ssl.certificate=certs\/es02\/es02.crt\n      - xpack.security.http.ssl.certificate_authorities=certs\/ca\/ca.crt\n      - xpack.security.http.ssl.verification_mode=certificate\n      - xpack.security.transport.ssl.enabled=true\n      - xpack.security.transport.ssl.key=certs\/es02\/es02.key\n      - xpack.security.transport.ssl.certificate=certs\/es02\/es02.crt\n      - xpack.security.transport.ssl.certificate_authorities=certs\/ca\/ca.crt\n      - xpack.security.transport.ssl.verification_mode=certificate\n      - xpack.license.self_generated.type=${LICENSE}\n    mem_limit: ${MEM_LIMIT}\n    ulimits:\n      memlock:\n        soft: -1\n        hard: -1\n    healthcheck:\n      test:\n        [\n          \"CMD-SHELL\",\n          \"curl -s --cacert config\/certs\/ca\/ca.crt https:\/\/localhost:9200 | grep -q 'missing authentication credentials'\",\n        ]\n      interval: 10s\n      timeout: 10s\n      retries: 120\n\n  es03:\n    depends_on:\n      - es02\n    image: docker.elastic.co\/elasticsearch\/elasticsearch:${STACK_VERSION}\n    volumes:\n      - certs:\/usr\/share\/elasticsearch\/config\/certs\n      - esdata03:\/usr\/share\/elasticsearch\/data\n    environment:\n      - node.name=es03\n      - cluster.name=${CLUSTER_NAME}\n      - cluster.initial_master_nodes=es01,es02,es03\n      - discovery.seed_hosts=es01,es02\n      - bootstrap.memory_lock=true\n      - xpack.security.enabled=true\n      - xpack.security.http.ssl.enabled=true\n      - xpack.security.http.ssl.key=certs\/es03\/es03.key\n      - xpack.security.http.ssl.certificate=certs\/es03\/es03.crt\n      - xpack.security.http.ssl.certificate_authorities=certs\/ca\/ca.crt\n      - xpack.security.http.ssl.verification_mode=certificate\n      - xpack.security.transport.ssl.enabled=true\n      - xpack.security.transport.ssl.key=certs\/es03\/es03.key\n      - xpack.security.transport.ssl.certificate=certs\/es03\/es03.crt\n      - xpack.security.transport.ssl.certificate_authorities=certs\/ca\/ca.crt\n      - xpack.security.transport.ssl.verification_mode=certificate\n      - xpack.license.self_generated.type=${LICENSE}\n    mem_limit: ${MEM_LIMIT}\n    ulimits:\n      memlock:\n        soft: -1\n        hard: -1\n    healthcheck:\n      test:\n        [\n          \"CMD-SHELL\",\n          \"curl -s --cacert config\/certs\/ca\/ca.crt https:\/\/localhost:9200 | grep -q 'missing authentication credentials'\",\n        ]\n      interval: 10s\n      timeout: 10s\n      retries: 120\n\n  kibana:\n    depends_on:\n      es01:\n        condition: service_healthy\n      es02:\n        condition: service_healthy\n      es03:\n        condition: service_healthy\n    image: docker.elastic.co\/kibana\/kibana:${STACK_VERSION}\n    volumes:\n      - certs:\/usr\/share\/kibana\/config\/certs\n      - kibanadata:\/usr\/share\/kibana\/data\n    ports:\n      - ${KIBANA_PORT}:5601\n    environment:\n      - SERVERNAME=kibana\n      - ELASTICSEARCH_HOSTS=https:\/\/es01:9200\n      - ELASTICSEARCH_USERNAME=kibana_system\n      - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}\n      - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=config\/certs\/ca\/ca.crt\n    mem_limit: ${MEM_LIMIT}\n    healthcheck:\n      test:\n        [\n          \"CMD-SHELL\",\n          \"curl -s -I http:\/\/localhost:5601 | grep -q 'HTTP\/1.1 302 Found'\",\n        ]\n      interval: 10s\n      timeout: 10s\n      retries: 120\n\nvolumes:\n  certs:\n    driver: local\n  esdata01:\n    driver: local\n  esdata02:\n    driver: local\n  esdata03:\n    driver: local\n  kibanadata:\n    driver: local<\/code><\/pre>\n\n\n\n<p>Viac info:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/www.elastic.org.cn\/docs\/8.1\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/docker.html\n<\/div><\/figure>\n<div class=\"pdf24Plugin-cp\"> \t<form name=\"pdf24Form0\" method=\"post\" action=\"https:\/\/doc2pdf.pdf24.org\/wordpress.php\" target=\"pdf24PopWin\" onsubmit=\"var pdf24Win = window.open('about:blank', 'pdf24PopWin', 'resizable=yes,scrollbars=yes,width=600,height=250,left='+(screen.width\/2-300)+',top='+(screen.height\/3-125)+''); pdf24Win.focus(); if(typeof pdf24OnCreatePDF === 'function'){void(pdf24OnCreatePDF(this,pdf24Win));}\"> \t\t<input type=\"hidden\" name=\"blogCharset\" value=\"Cw1x07UAAA==\" \/><input type=\"hidden\" name=\"blogPosts\" value=\"MwQA\" \/><input type=\"hidden\" name=\"blogUrl\" value=\"yygpKSi20tdPyslP18vNSCzOzNNLLQUA\" \/><input type=\"hidden\" name=\"blogName\" value=\"c\/LxdwcA\" \/><input type=\"hidden\" name=\"blogValueEncoding\" value=\"gzdeflate base64\" \/><input type=\"hidden\" name=\"postId_0\" value=\"MzI0MAcA\" \/><input type=\"hidden\" name=\"postTitle_0\" value=\"c81JLC7JTC5OTSxKzlBIyU\/OTi1SKC7OAQA=\" \/><input type=\"hidden\" name=\"postLink_0\" value=\"yygpKSi20tdPyslP18vNSCzOzNNLLdW3L7A1MjQwBwA=\" \/><input type=\"hidden\" name=\"postAuthor_0\" value=\"y00syfcwNAIA\" \/><input type=\"hidden\" name=\"postDateTime_0\" value=\"MzIwMtE1MNc1MlcwsLQyMLcyMQAA\" \/><input type=\"hidden\" name=\"postContent_0\" value=\"7Vrrb+M2Ev+uv2KqLJotUEl+7KtObMD1uoi7ySawvNv7kD2BkeiYjV4VJSduLv\/7DUlZkWwrdnKL2wDdBFAicmY4nMdvhrS1w7hHwzlMmU87h1bc0\/DnME4ouD7hvKtfx8aFH7lXhht5VO8dij+9PTjDyeso8WAaJZDOKOxTpE+Zuw8Zpwm8JCn4FEfgDbgzkhA3pQn\/SRse9+3JaOCc9W37j9Px+66mbRJ2xS5ISBy+4CkNtoj8MPq1\/7FflfgZZ1gUQjSFodIL4iTyMjflmj3pDz44n4dje3T6sfvObJpNwWLTVK7t+hkumkBIAqoNjj\/Zk+HY+dg\/GXY9NANNjJyg4Ilg\/4JwsXPUfj9NGPH3xSjJ0igguDTx\/QXwlCRqgXbD8MgCJKF2PBoMP9rDrpSg7S1f1aQwTZTIJehNHHG63AynJHFncDSZnEH\/bCQIhORZxFNtaDtnp+NJ95dWo6HtLd+arbdmA3+bHTm+LvmDtHhF0tKwgv\/1m0ZT2yuPvJNSRqGboE+o2LtH8\/9xM9QDNL8QReaE+eTCV0IhoEGULOAlC+FikVL038nwxDkenYxQycbb9ttXzXetV1LBJPqTuql0BI+JS+GlR6ck81O+VNPNkoSGKcaN7+UuAzaFMEqB0\/QnbW9wenJ2ag+ds\/Hp78PBRPkxWMRK9KEloxnDPqF54PfenwongxsFwiy7p8RcRVwH9JbZ0jUNI3bOXMo7Gghdslj8A8ACckk7oELJzHPGdCOLlj1bfeu8uK3E7J2UNI\/8LFDyxY8BLk1S3rEynlgc04OuiHSjcMouLUkleURSoboNXb7hhgMSeh3o5QLRiTMwXNjP30FY9se9X5oHcPPidjWP76DbhRv4ciD8EhYsANSdRaAvk2uVDRB7WBKFgfDinGDUi0BhKnLMJTDpB2WBNyyF5v0I9ct6rYDBjmqtcH0FrabsYN1uP4AxVW6yXGL+zeJaxQaYSCkLL2HQryxzwcKqWw0hLkuZDy4Bw+CoF+psGDENwIiyFMpuz1ctC8xCocYGIjC8yvAjtiaeu+1OklbtKAiMkMJ5aVBnIcJnKLLpPNQrMyLwRdp3gPJGc30WwAs3camUqeMRc5jhxBeQtYmAxbUyC6R9UNXWE1RtfRtV209Qtf3\/UrVXjd0iUMxF4O+aOPjPDqlTRLVhIBLUr4rzLpHSV9NKZJYr10KCK7rYNI\/D29LzXpFdMrQAOplwArcgpknAuKhWXC\/okOw6BGMMSRSlHfGoFR56YIKRLmIKHhj0hrrIHUQevH3dgPPb8zs4P6ihn1bo37zaQK8U\/oMwpTD2FdWmJ+8nmM\/SRQk6slD6MkvQAVya+CEXzNI0xlppCQCQHRH8By4Tijb9C3RpHFwbGzhEL9HApaKXxObGE6\/ER8jCCg7cp8jRboiXkNaZvNLKQpy3uvWa\/wuwY5ls3YGRQR7PnU3V2DhCmI3CFBU2Jmj5DpA49vOtWH\/yKNTXjWA5nKIeaFhLNAdWRXXLWeouAk+\/PdeX7+d651xfL73n+p1eNuu\/b+\/KdmvW2K3v+3L8h8JEqgOZUeKnM3dG3atlz4PtY9pRBUgfnLw37KPh8bH+M+iqJomKVDae2Kd8SAN+0b\/kYhiaKZkTvwNNvpTMAooQ0IHXy5GEYk+OBQiRCBtfkKVD6eHRmIYed7D5y2lL\/Z5qrUKPpbI5zLtCR21m8dxaQoXeHkkJbq6WTcxL8jgS4gtOjEN12rhThwzp0\/tO6p4wxIbZFPWlK6x4r606WKmZF7fls9fdGhELmUhFJyDi1REiuRT3s6iU4tEueDzG3Qgb9IXJKfUcUX4k7QrZ2tl0Q2IVxBeIkDxNSGyqE40jTgR4bstoQXKDh5Yrc5lS2DeKNtJ7kEakpMm5\/zhiLBrd1RDHsa18godNBSjQ7oYUeQy\/I8AywmnMke4KVm2Vg65RYjBHHCwMSptcch032j7kIgJ3tleV45FGqzI\/0XK1Qp5ivqqwx9gQ6wANOUVR\/tS5pCFNkMYzRYXGmM\/vIFSoY3A7PgsYQuGL2+KkruYyOVEAAJKKHLjHPR5Nkc1oFgOIJV4xUIfnBbUE8XIvWIL48vBja37Rgq4W\/v3thX+\/tPSG8tFYqx\/3QxsKSKuugKiTyTOuDq0dqsN26G99O+hvVsmeLZq35OPpaJ7z\/7PQfLvRdkDz7Zb7jubf0byE5u0H0bz1jNG8\/VXQvP2N0bz1\/NG8LR9PR\/Oc\/5+F5tuNtgOab7fcdzT\/juZLNFcXX3V4fn\/1s8PtTrnR35W8\/b\/fHakd5H+eWkFyIRtLh5oT5WEDR\/0NUekT5LuO\/FC5trjYwzHqKz+xVWJXL2rsYX88OHKOTu2J3V27zKyh\/mRXZOaXmzXEpZug1dvNGg7bPnYGw\/Fk9Nto0J8M+58mR6fj0WQ0tLubQ39rJn\/9XBzJdKtkm\/BEOdvENwusptmEdqMFv0VZ6H217CqFnQo4lWUJm4uPo6VKsp\/KbyEfmm09ONvePFsK3PX5Td8I+MyIi1udRvdfBkA\/Zhu+D0CDC+rpvUOPzTfPOc41diUxTfSetgzY6+vrInGj5NJ0QwvTmVvvzGZlDpP6MmMeNmgrn2RZCZ3ShIYutfLvQ1g5HszSwNcOLVQHd6R07mn\/BQ==\" \/> \t\t<a href=\"https:\/\/www.pdf24.org\" target=\"_blank\" title=\"www.pdf24.org\" rel=\"nofollow\"><img src=\"https:\/\/blog.mhasin.eu\/wp-content\/plugins\/pdf24-post-to-pdf\/img\/pdf_32x32.png\" alt=\"\" border=\"0\" height=\"32\" \/><\/a> \t\t<span class=\"pdf24Plugin-cp-space\">\u00a0\u00a0<\/span> \t\t<span class=\"pdf24Plugin-cp-text\">Send article as PDF<\/span> \t\t<span class=\"pdf24Plugin-cp-space\">\u00a0\u00a0<\/span> \t\t<input class=\"pdf24Plugin-cp-input\" style=\"margin: 0px;\" type=\"text\" name=\"sendEmailTo\" placeholder=\"Enter email address\" \/> \t\t<input class=\"pdf24Plugin-cp-submit\" style=\"margin: 0px;\" type=\"submit\" value=\"Send\" \/> \t<\/form> <\/div>","protected":false},"excerpt":{"rendered":"env file: DOcker compose: Viac info: \u00a0\u00a0 Send article as PDF \u00a0\u00a0\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"arc_restricted_post":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-2107","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/posts\/2107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2107"}],"version-history":[{"count":1,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/posts\/2107\/revisions"}],"predecessor-version":[{"id":2108,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=\/wp\/v2\/posts\/2107\/revisions\/2108"}],"wp:attachment":[{"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mhasin.eu\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}