Cambios script.sh y journal-upload.sh
parent
dae74aa2f6
commit
eee03c37ee
|
|
@ -0,0 +1,57 @@
|
|||
#!/bin/bash
|
||||
|
||||
set -e # Detener el script si ocurre un error
|
||||
|
||||
# Verificar que la variable de entorno IP_SERVER esté configurada
|
||||
if [[ -z "$IP_SERVER" ]]; then
|
||||
echo "ERROR: La variable de entorno IP_SERVER no está configurada."
|
||||
echo "Por favor, exporta IP_SERVER antes de ejecutar este script."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Actualizando paquetes e instalando dependencias..."
|
||||
apt-get update
|
||||
apt-get -y install \
|
||||
prometheus-node-exporter \
|
||||
systemd-journal-remote
|
||||
|
||||
echo "Configurando TLS y copiando certificados..."
|
||||
|
||||
# Copiar el certificado de la CA a /etc/ssl/certs/
|
||||
cp CA/certs/ca.crt.pem /etc/ssl/certs/
|
||||
|
||||
# Crear un enlace simbólico para el certificado de la CA
|
||||
ln -sf /etc/ssl/certs/ca.crt.pem /etc/ssl/certs/$(openssl x509 -in /etc/ssl/certs/ca.crt.pem -hash -noout).0
|
||||
|
||||
# Copiar los certificados del servidor
|
||||
cp CA/certs/ogserver.mytld.crt.pem /etc/ssl/certs/
|
||||
cp CA/private/ogserver.mytld.key.nopass.pem /etc/ssl/private/ogserver.mytld.key.pem
|
||||
|
||||
# Asegurar permisos en los archivos de certificados
|
||||
chmod 600 /etc/ssl/private/ogserver.mytld.key.pem
|
||||
chown root:root /etc/ssl/private/ogserver.mytld.key.pem
|
||||
|
||||
echo "Configurando systemd-journal-upload..."
|
||||
|
||||
# Modificar el archivo de unidad para que el servicio se ejecute como root
|
||||
sed -i -e '/DynamicUser/s/.*/DynamicUser=no/' /usr/lib/systemd/system/systemd-journal-upload.service
|
||||
sed -i -e '/User/ s/.*/User=root/' /usr/lib/systemd/system/systemd-journal-upload.service
|
||||
|
||||
# Recargar los servicios de systemd para aplicar los cambios
|
||||
systemctl daemon-reload
|
||||
|
||||
# Configurar el archivo de configuración de systemd-journal-upload
|
||||
sed -i -e '/URL/ s%.*%URL=https://oglog-jrem.mytld:19532%' /etc/systemd/journal-upload.conf
|
||||
sed -i -e '/ServerKeyFile/ s%.*%ServerKeyFile=/etc/ssl/private/ogserver.mytld.key.pem%' /etc/systemd/journal-upload.conf
|
||||
sed -i -e '/ServerCertificateFile/ s%.*%ServerCertificateFile=/etc/ssl/certs/ogserver.mytld.crt.pem%' /etc/systemd/journal-upload.conf
|
||||
sed -i -e '/TrustedCertificateFile/s%.*%TrustedCertificateFile=/etc/ssl/certs/ca.crt.pem%' /etc/systemd/journal-upload.conf
|
||||
|
||||
# Habilitar e iniciar el servicio
|
||||
echo "Habilitando y arrancando systemd-journal-upload..."
|
||||
systemctl enable --now systemd-journal-upload
|
||||
|
||||
# Verificar el estado del servicio
|
||||
systemctl status systemd-journal-upload --no-pager
|
||||
|
||||
echo "Configuración completada con éxito. Los logs se están enviando al servidor remoto."
|
||||
|
||||
|
|
@ -51,7 +51,7 @@ chown opensearch:opensearch /etc/opensearch/{ca.crt.pem,oglog-os.mytld.crt.pem,o
|
|||
|
||||
cp CA/certs/oglog-osdb.mytld.crt.pem /etc/opensearch-dashboards/
|
||||
cp CA/private/oglog-osdb.mytld.key.nopass.pem /etc/opensearch-dashboards/oglog-osdb.mytld.key.pem
|
||||
chown opensearch-dashboards:opensearch-dashboards /etc/opensearch-dashboards/oglog-osdb.mytld.crt.pem /etc/opensearch-dashboards/oglog-osdb.key.pem
|
||||
chown opensearch-dashboards:opensearch-dashboards /etc/opensearch-dashboards/oglog-osdb.mytld.crt.pem /etc/opensearch-dashboards/oglog-osdb.mytld.key.pem
|
||||
|
||||
sed -i -e '/^plugins.security.ssl.http.pemcert_filepath:/ s/: .*/: oglog-os.mytld.crt.pem/' /etc/opensearch/opensearch.yml
|
||||
sed -i -e '/^plugins.security.ssl.http.pemkey_filepath:/ s/: .*/: oglog-os.mytld.key.pem/' /etc/opensearch/opensearch.yml
|
||||
|
|
@ -121,7 +121,17 @@ sed -i -e '/^ARGS/s%"$%--web.config.file=/etc/prometheus/web-config.yml"%' /etc/
|
|||
systemctl restart prometheus
|
||||
|
||||
# Configurar Journalbeat
|
||||
wget https://artifacts.elastic.co/downloads/beats/journalbeat/journalbeat-oss-7.12.1-amd64.deb -P /tmp/
|
||||
|
||||
# Verificar si la URL es accesible
|
||||
curl -I --connect-timeout 10 --max-time 30 "https://artifacts.elastic.co/downloads/beats/journalbeat/journalbeat-oss-7.12.1-amd64.deb" -o /dev/null -s
|
||||
if [[ $? -ne 0 ]]; then
|
||||
echo "ERROR: No se puede resolver la URL. Verifica tu conexión a Internet o la disponibilidad del servidor."
|
||||
exit 1 # Detener el script
|
||||
fi
|
||||
|
||||
echo "La URL es accesible. Continuando..."
|
||||
|
||||
curl --connect-timeout 10 --max-time 60 -L -o /tmp/journalbeat-oss-7.12.1-amd64.deb https://artifacts.elastic.co/downloads/beats/journalbeat/journalbeat-oss-7.12.1-amd64.deb
|
||||
dpkg -i /tmp/journalbeat-oss-7.12.1-amd64.deb
|
||||
cp CA/certs/oglog-jb.mytld.crt.pem /etc/journalbeat/
|
||||
cp CA/private/oglog-jb.mytld.key.nopass.pem /etc/journalbeat/oglog-jb.mytld.key.pem
|
||||
|
|
@ -154,7 +164,15 @@ EOF
|
|||
systemctl enable --now journalbeat
|
||||
|
||||
# Configurar Grafana
|
||||
wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor >/etc/apt/keyrings/grafana.gpg
|
||||
# Prueba de conexión a la URL de la clave GPG
|
||||
echo "Verificando conectividad con https://apt.grafana.com/gpg.key..."
|
||||
curl -I --connect-timeout 10 --max-time 30 -s -o /dev/null https://apt.grafana.com/gpg.key
|
||||
|
||||
if [[ $? -ne 0 ]]; then
|
||||
echo "ERROR: No se puede conectar a https://apt.grafana.com/gpg.key. Verifica tu conexión a Internet o la disponibilidad del servidor."
|
||||
exit 1
|
||||
fi
|
||||
curl --connect-timeout 10 --max-time 30 -s https://apt.grafana.com/gpg.key | gpg --dearmor > /etc/apt/keyrings/grafana.gpg
|
||||
echo "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main" >/etc/apt/sources.list.d/grafana.list
|
||||
apt-get update
|
||||
apt-get install --yes grafana
|
||||
|
|
|
|||
Loading…
Reference in New Issue