From 70142d8f605e48db51c2f1b23ed8f8f3abe2f96e Mon Sep 17 00:00:00 2001 From: reachableceo Date: Sat, 5 Sep 2026 07:08:25 -0500 Subject: [PATCH] [#389] official Greenbone compose, loopback; gvm-config+nginx digest-pinned MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Docker Hub greenbone/* discontinued — official stack from registry.community.greenbone.net via the maintained compose.yaml (already loopback-bound). :latest tags digest-pinned per house rule. https://projects.knownelement.com/issues/389 --- docker/gvm-test/compose.yaml | 317 +++++++++++++++++++++++++++++ docker/gvm-test/docker-compose.yml | 79 ------- openvas/README.md | 20 ++ 3 files changed, 337 insertions(+), 79 deletions(-) create mode 100644 docker/gvm-test/compose.yaml delete mode 100644 docker/gvm-test/docker-compose.yml diff --git a/docker/gvm-test/compose.yaml b/docker/gvm-test/compose.yaml new file mode 100644 index 0000000..3de5fcb --- /dev/null +++ b/docker/gvm-test/compose.yaml @@ -0,0 +1,317 @@ +name: greenbone-community-edition + +services: + vulnerability-tests: + image: registry.community.greenbone.net/community/vulnerability-tests + environment: + FEED_RELEASE: "24.10" + KEEP_ALIVE: 1 + volumes: + - vt_data_vol:/mnt + + notus-data: + image: registry.community.greenbone.net/community/notus-data + environment: + KEEP_ALIVE: 1 + volumes: + - notus_data_vol:/mnt + + scap-data: + image: registry.community.greenbone.net/community/scap-data + environment: + KEEP_ALIVE: 1 + volumes: + - scap_data_vol:/mnt + + cert-bund-data: + image: registry.community.greenbone.net/community/cert-bund-data + environment: + KEEP_ALIVE: 1 + volumes: + - cert_data_vol:/mnt + + dfn-cert-data: + image: registry.community.greenbone.net/community/dfn-cert-data + environment: + KEEP_ALIVE: 1 + volumes: + - cert_data_vol:/mnt + depends_on: + cert-bund-data: + condition: service_healthy + + data-objects: + image: registry.community.greenbone.net/community/data-objects + environment: + FEED_RELEASE: "24.10" + KEEP_ALIVE: 1 + volumes: + - data_objects_vol:/mnt + + report-formats: + image: registry.community.greenbone.net/community/report-formats + environment: + FEED_RELEASE: "24.10" + KEEP_ALIVE: 1 + volumes: + - data_objects_vol:/mnt + depends_on: + data-objects: + condition: service_healthy + + gpg-data: + image: registry.community.greenbone.net/community/gpg-data + volumes: + - gpg_data_vol:/mnt + + redis-server: + image: registry.community.greenbone.net/community/redis-server + deploy: + restart_policy: + condition: any + volumes: + - redis_socket_vol:/run/redis/ + + pg-gvm: + image: registry.community.greenbone.net/community/pg-gvm:stable + deploy: + restart_policy: + condition: any + volumes: + - psql_data_vol:/var/lib/postgresql + - psql_socket_vol:/var/run/postgresql + depends_on: + pg-gvm-migrator: + condition: service_completed_successfully + + pg-gvm-migrator: + image: registry.community.greenbone.net/community/pg-gvm-migrator:stable + deploy: + restart_policy: + condition: none + volumes: + - psql_data_vol:/var/lib/postgresql + - psql_socket_vol:/var/run/postgresql + + gvmd: + image: registry.community.greenbone.net/community/gvmd:stable + deploy: + restart_policy: + condition: any + volumes: + - gvmd_data_vol:/var/lib/gvm + - scap_data_vol:/var/lib/gvm/scap-data/ + - cert_data_vol:/var/lib/gvm/cert-data + - data_objects_vol:/var/lib/gvm/data-objects/gvmd + - vt_data_vol:/var/lib/openvas/plugins + - psql_data_vol:/var/lib/postgresql + - gvmd_socket_vol:/run/gvmd + - ospd_openvas_socket_vol:/run/ospd + - psql_socket_vol:/var/run/postgresql + depends_on: + pg-gvm: + condition: service_started + scap-data: + condition: service_healthy + cert-bund-data: + condition: service_healthy + dfn-cert-data: + condition: service_healthy + data-objects: + condition: service_healthy + report-formats: + condition: service_healthy + + gsa: + image: registry.community.greenbone.net/community/gsa:stable-slim + environment: + MOUNT_PATH: "/mnt/web" + KEEP_ALIVE: 1 + healthcheck: + test: [ "CMD-SHELL", "test -e /run/gsa/copying.done" ] + start_period: 5s + volumes: + - gsa_data_vol:/mnt/web + + gsad: + image: registry.community.greenbone.net/community/gsad:stable + deploy: + restart_policy: + condition: any + environment: + GSAD_HTTP_ONLY: "true" + GSAD_API_ONLY: "true" + GSAD_FOREGROUND: "true" + volumes: + - gvmd_socket_vol:/run/gvmd + depends_on: + gvmd: + condition: service_started + + gvm-config: + image: registry.community.greenbone.net/community/gvm-config@sha256:a83d05963ad5cd15099257baf704c16323cbc9a370e25e6a016a897fbccb43c2 + environment: + ENABLE_NGINX_CONFIG: true + ENABLE_TLS_GENERATION: true + volumes: + - nginx_config_vol:/mnt/nginx/configs + - nginx_certificates_vol:/mnt/nginx/certs + + nginx: + image: registry.community.greenbone.net/community/nginx@sha256:53bfde7e5db20cef57c2b8a9ca654a08803614193c929248f43dfd8293fd34d1 + ports: + - 127.0.0.1:443:443 + - 127.0.0.1:9392:9392 + volumes: + - nginx_config_vol:/etc/nginx/conf.d:ro + - nginx_certificates_vol:/etc/nginx/certs:ro + - gsa_data_vol:/usr/share/nginx/html:ro + deploy: + restart_policy: + condition: any + depends_on: + gvm-config: + condition: service_completed_successfully + gsa: + condition: service_healthy + gsad: + condition: service_started + + # Sets log level of openvas to the set LOG_LEVEL within the env + # and changes log output to /var/log/openvas instead /var/log/gvm + # to reduce likelihood of unwanted log interferences + configure-openvas: + image: registry.community.greenbone.net/community/openvas-scanner:stable + volumes: + - openvas_data_vol:/mnt + - openvas_log_data_vol:/var/log/openvas + command: + - /bin/sh + - -c + - | + printf "table_driven_lsc = yes\nopenvasd_server = http://openvasd:80\n" > /mnt/openvas.conf + sed "s/127/128/" /etc/openvas/openvas_log.conf | sed 's/gvm/openvas/' > /mnt/openvas_log.conf + chmod 644 /mnt/openvas.conf + chmod 644 /mnt/openvas_log.conf + touch /var/log/openvas/openvas.log + chmod 666 /var/log/openvas/openvas.log + + # shows logs of openvas + openvas: + image: registry.community.greenbone.net/community/openvas-scanner:stable + volumes: + - openvas_data_vol:/etc/openvas + - openvas_log_data_vol:/var/log/openvas + command: + - /bin/sh + - -c + - | + cat /etc/openvas/openvas.conf + tail -f /var/log/openvas/openvas.log + depends_on: + configure-openvas: + condition: service_completed_successfully + + openvasd: + image: registry.community.greenbone.net/community/openvas-scanner:stable + deploy: + restart_policy: + condition: any + environment: + # `service_notus` is set to disable everything but notus, + # if you want to utilize openvasd directly, remove `OPENVASD_MODE` + OPENVASD_MODE: service_notus + GNUPGHOME: /etc/openvas/gnupg + LISTENING: 0.0.0.0:80 + volumes: + - openvas_data_vol:/etc/openvas + - openvas_log_data_vol:/var/log/openvas + - gpg_data_vol:/etc/openvas/gnupg + - notus_data_vol:/var/lib/notus + # enable port forwarding when you want to use the http api from your host machine + # ports: + # - 127.0.0.1:3000:80 + depends_on: + vulnerability-tests: + condition: service_healthy + notus-data: + condition: service_healthy + configure-openvas: + condition: service_completed_successfully + gpg-data: + condition: service_completed_successfully + networks: + default: + aliases: + - openvasd + + ospd-openvas: + image: registry.community.greenbone.net/community/ospd-openvas:stable + deploy: + restart_policy: + condition: any + hostname: ospd-openvas.local + cap_add: + - NET_ADMIN # for capturing packages in promiscuous mode + - NET_RAW # for raw sockets e.g. used for the boreas alive detection + security_opt: + - seccomp=unconfined + - apparmor=unconfined + command: + [ + "ospd-openvas", + "-f", + "--config", + "/etc/gvm/ospd-openvas.conf", + "--notus-feed-dir", + "/var/lib/notus/advisories", + "-m", + "666", + ] + volumes: + - gpg_data_vol:/etc/openvas/gnupg + - vt_data_vol:/var/lib/openvas/plugins + - notus_data_vol:/var/lib/notus + - ospd_openvas_socket_vol:/run/ospd + - redis_socket_vol:/run/redis/ + - openvas_data_vol:/etc/openvas/ + - openvas_log_data_vol:/var/log/openvas + depends_on: + redis-server: + condition: service_started + gpg-data: + condition: service_completed_successfully + configure-openvas: + condition: service_completed_successfully + vulnerability-tests: + condition: service_healthy + notus-data: + condition: service_healthy + + gvm-tools: + image: registry.community.greenbone.net/community/gvm-tools + volumes: + - gvmd_socket_vol:/run/gvmd + - ospd_openvas_socket_vol:/run/ospd + depends_on: + - gvmd + - ospd-openvas + +volumes: + gpg_data_vol: + scap_data_vol: + cert_data_vol: + data_objects_vol: + gvmd_data_vol: + psql_data_vol: + vt_data_vol: + notus_data_vol: + psql_socket_vol: + gvmd_socket_vol: + ospd_openvas_socket_vol: + redis_socket_vol: + openvas_data_vol: + openvas_log_data_vol: + gsa_data_vol: + nginx_config_vol: + nginx_certificates_vol: diff --git a/docker/gvm-test/docker-compose.yml b/docker/gvm-test/docker-compose.yml deleted file mode 100644 index 3f960a2..0000000 --- a/docker/gvm-test/docker-compose.yml +++ /dev/null @@ -1,79 +0,0 @@ -# GVM (OpenVAS) app-test lane — loopback single-host stack [#389] -# -# Greenbone Community Containers. App-test only (loopback bind): the scan -# engine + feeds are heavyweight; bring-up downloads several GB of feeds on -# first start. Production scan engine placement (kali-tsys VM per #389) is a -# separate deploy under an approved GLPI CR. -# -# Bring-up: -# docker compose -f docker-compose.yml up -d # feeds sync on start -# watch: docker compose logs -f gvmd | grep -i feed # wait for "Feed ... ok" -# gsad UI: http://127.0.0.1:9392 (admin/admin on first login — change) -# GMP socket: unix volume `run_gvmd` (gvm-tools service below) -# -# Feed targets from GLPI: -# ../../openvas/glpi-to-openvas.sh --format gmp > /tmp/targets.gmp -# docker compose run --rm gvm-tools script -c "" ... -# (see openvas/README.md for the full pipeline) -# -# IMAGE PINNING: version tags now; digest-pin at bring-up proof (house rule). - -services: - redis: - image: redis:7.2-bookworm - command: redis-server /etc/redis/redis.conf - volumes: - - redis_socket:/run/redis - restart: unless-stopped - - pg-gvm: - image: greenbone/pg-gvm:22.4-stable - environment: - POSTGRES_USER: gvmd - volumes: - - psql_data:/var/lib/postgresql - restart: unless-stopped - - gvmd: - image: greenbone/gvmd:22.5-stable - depends_on: [redis, pg-gvm] - volumes: - - gvmd_data:/var/lib/gvm - - run_gvmd:/run/gvmd - restart: unless-stopped - - ospd-openvas: - image: greenbone/ospd-openvas:22.5-stable - depends_on: [redis] - volumes: - - run_gvmd:/run/gvmd - - ospd_openvas_socket:/run/ospd - - plugins_data:/var/lib/openvas_plugin_cache - - nvts_data:/var/lib/gvm - restart: unless-stopped - - gsad: - image: greenbone/gsad:22.4-stable - depends_on: [gvmd] - ports: - - "127.0.0.1:9392:9392" # loopback only (app-test lane rule) - restart: unless-stopped - - # one-shot helper container for GMP imports (targets/tasks) via gvm-tools - gvm-tools: - image: greenbone/gvm-tools:22.9-stable - profiles: [tools] - entrypoint: ["sleep", "infinity"] - volumes: - - run_gvmd:/run/gvmd - -networks: {} - -volumes: - redis_socket: - psql_data: - gvmd_data: - run_gvmd: - ospd_openvas_socket: - plugins_data: - nvts_data: diff --git a/openvas/README.md b/openvas/README.md index 157a535..cf91370 100644 --- a/openvas/README.md +++ b/openvas/README.md @@ -38,3 +38,23 @@ GLPI CMDB (computers, read-only via mglpi identity) - [ ] GVM bring-up + first feed import (next run: feeds download several GB) - [ ] First sectestbed scan + findings triage into Redmine - [ ] kali-tsys production engine under CR (#389) + +## GVM stack (app-test lane) — official Greenbone Community Edition + +`docker/gvm-test/compose.yaml` = the OFFICIAL Greenbone compose (fetched +2026-09-05 from https://greenbone.github.io/docs/latest/_static/compose.yaml, +already loopback-bound: 127.0.0.1:443 + 127.0.0.1:9392). Registry: +registry.community.greenbone.net (Docker Hub greenbone/* is discontinued; +ghcr.io/greenbone/gvmd exists but the official stack uses the community +registry — use the official file as-is). + +Bring-up: + cd docker/gvm-test && docker compose -f compose.yaml pull && docker compose -f compose.yaml up -d + # admin password reset: + docker compose -f compose.yaml exec -u gvmd gvmd gvmd --user=admin --new-password='' +Feed sync runs on first start (multi-GB, takes hours — check +`docker compose logs -f gvmd`). + +Import GLPI targets once feeds are loaded (gvm-tools service in the compose): + ../../openvas/glpi-to-openvas.sh --format gmp > /tmp/targets.gmp + docker compose -f compose.yaml run --rm gvm-tools ... # see #389 note