[#389] official Greenbone compose, loopback; gvm-config+nginx digest-pinned
ci / audit (push) Successful in 1m1s
ci / audit (push) Successful in 1m1s
Docker Hub greenbone/* discontinued — official stack from registry.community.greenbone.net via the maintained compose.yaml (already loopback-bound). :latest tags digest-pinned per house rule. https://projects.knownelement.com/issues/389
This commit is contained in:
@@ -0,0 +1,317 @@
|
|||||||
|
name: greenbone-community-edition
|
||||||
|
|
||||||
|
services:
|
||||||
|
vulnerability-tests:
|
||||||
|
image: registry.community.greenbone.net/community/vulnerability-tests
|
||||||
|
environment:
|
||||||
|
FEED_RELEASE: "24.10"
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
volumes:
|
||||||
|
- vt_data_vol:/mnt
|
||||||
|
|
||||||
|
notus-data:
|
||||||
|
image: registry.community.greenbone.net/community/notus-data
|
||||||
|
environment:
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
volumes:
|
||||||
|
- notus_data_vol:/mnt
|
||||||
|
|
||||||
|
scap-data:
|
||||||
|
image: registry.community.greenbone.net/community/scap-data
|
||||||
|
environment:
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
volumes:
|
||||||
|
- scap_data_vol:/mnt
|
||||||
|
|
||||||
|
cert-bund-data:
|
||||||
|
image: registry.community.greenbone.net/community/cert-bund-data
|
||||||
|
environment:
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
volumes:
|
||||||
|
- cert_data_vol:/mnt
|
||||||
|
|
||||||
|
dfn-cert-data:
|
||||||
|
image: registry.community.greenbone.net/community/dfn-cert-data
|
||||||
|
environment:
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
volumes:
|
||||||
|
- cert_data_vol:/mnt
|
||||||
|
depends_on:
|
||||||
|
cert-bund-data:
|
||||||
|
condition: service_healthy
|
||||||
|
|
||||||
|
data-objects:
|
||||||
|
image: registry.community.greenbone.net/community/data-objects
|
||||||
|
environment:
|
||||||
|
FEED_RELEASE: "24.10"
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
volumes:
|
||||||
|
- data_objects_vol:/mnt
|
||||||
|
|
||||||
|
report-formats:
|
||||||
|
image: registry.community.greenbone.net/community/report-formats
|
||||||
|
environment:
|
||||||
|
FEED_RELEASE: "24.10"
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
volumes:
|
||||||
|
- data_objects_vol:/mnt
|
||||||
|
depends_on:
|
||||||
|
data-objects:
|
||||||
|
condition: service_healthy
|
||||||
|
|
||||||
|
gpg-data:
|
||||||
|
image: registry.community.greenbone.net/community/gpg-data
|
||||||
|
volumes:
|
||||||
|
- gpg_data_vol:/mnt
|
||||||
|
|
||||||
|
redis-server:
|
||||||
|
image: registry.community.greenbone.net/community/redis-server
|
||||||
|
deploy:
|
||||||
|
restart_policy:
|
||||||
|
condition: any
|
||||||
|
volumes:
|
||||||
|
- redis_socket_vol:/run/redis/
|
||||||
|
|
||||||
|
pg-gvm:
|
||||||
|
image: registry.community.greenbone.net/community/pg-gvm:stable
|
||||||
|
deploy:
|
||||||
|
restart_policy:
|
||||||
|
condition: any
|
||||||
|
volumes:
|
||||||
|
- psql_data_vol:/var/lib/postgresql
|
||||||
|
- psql_socket_vol:/var/run/postgresql
|
||||||
|
depends_on:
|
||||||
|
pg-gvm-migrator:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
|
||||||
|
pg-gvm-migrator:
|
||||||
|
image: registry.community.greenbone.net/community/pg-gvm-migrator:stable
|
||||||
|
deploy:
|
||||||
|
restart_policy:
|
||||||
|
condition: none
|
||||||
|
volumes:
|
||||||
|
- psql_data_vol:/var/lib/postgresql
|
||||||
|
- psql_socket_vol:/var/run/postgresql
|
||||||
|
|
||||||
|
gvmd:
|
||||||
|
image: registry.community.greenbone.net/community/gvmd:stable
|
||||||
|
deploy:
|
||||||
|
restart_policy:
|
||||||
|
condition: any
|
||||||
|
volumes:
|
||||||
|
- gvmd_data_vol:/var/lib/gvm
|
||||||
|
- scap_data_vol:/var/lib/gvm/scap-data/
|
||||||
|
- cert_data_vol:/var/lib/gvm/cert-data
|
||||||
|
- data_objects_vol:/var/lib/gvm/data-objects/gvmd
|
||||||
|
- vt_data_vol:/var/lib/openvas/plugins
|
||||||
|
- psql_data_vol:/var/lib/postgresql
|
||||||
|
- gvmd_socket_vol:/run/gvmd
|
||||||
|
- ospd_openvas_socket_vol:/run/ospd
|
||||||
|
- psql_socket_vol:/var/run/postgresql
|
||||||
|
depends_on:
|
||||||
|
pg-gvm:
|
||||||
|
condition: service_started
|
||||||
|
scap-data:
|
||||||
|
condition: service_healthy
|
||||||
|
cert-bund-data:
|
||||||
|
condition: service_healthy
|
||||||
|
dfn-cert-data:
|
||||||
|
condition: service_healthy
|
||||||
|
data-objects:
|
||||||
|
condition: service_healthy
|
||||||
|
report-formats:
|
||||||
|
condition: service_healthy
|
||||||
|
|
||||||
|
gsa:
|
||||||
|
image: registry.community.greenbone.net/community/gsa:stable-slim
|
||||||
|
environment:
|
||||||
|
MOUNT_PATH: "/mnt/web"
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
healthcheck:
|
||||||
|
test: [ "CMD-SHELL", "test -e /run/gsa/copying.done" ]
|
||||||
|
start_period: 5s
|
||||||
|
volumes:
|
||||||
|
- gsa_data_vol:/mnt/web
|
||||||
|
|
||||||
|
gsad:
|
||||||
|
image: registry.community.greenbone.net/community/gsad:stable
|
||||||
|
deploy:
|
||||||
|
restart_policy:
|
||||||
|
condition: any
|
||||||
|
environment:
|
||||||
|
GSAD_HTTP_ONLY: "true"
|
||||||
|
GSAD_API_ONLY: "true"
|
||||||
|
GSAD_FOREGROUND: "true"
|
||||||
|
volumes:
|
||||||
|
- gvmd_socket_vol:/run/gvmd
|
||||||
|
depends_on:
|
||||||
|
gvmd:
|
||||||
|
condition: service_started
|
||||||
|
|
||||||
|
gvm-config:
|
||||||
|
image: registry.community.greenbone.net/community/gvm-config@sha256:a83d05963ad5cd15099257baf704c16323cbc9a370e25e6a016a897fbccb43c2
|
||||||
|
environment:
|
||||||
|
ENABLE_NGINX_CONFIG: true
|
||||||
|
ENABLE_TLS_GENERATION: true
|
||||||
|
volumes:
|
||||||
|
- nginx_config_vol:/mnt/nginx/configs
|
||||||
|
- nginx_certificates_vol:/mnt/nginx/certs
|
||||||
|
|
||||||
|
nginx:
|
||||||
|
image: registry.community.greenbone.net/community/nginx@sha256:53bfde7e5db20cef57c2b8a9ca654a08803614193c929248f43dfd8293fd34d1
|
||||||
|
ports:
|
||||||
|
- 127.0.0.1:443:443
|
||||||
|
- 127.0.0.1:9392:9392
|
||||||
|
volumes:
|
||||||
|
- nginx_config_vol:/etc/nginx/conf.d:ro
|
||||||
|
- nginx_certificates_vol:/etc/nginx/certs:ro
|
||||||
|
- gsa_data_vol:/usr/share/nginx/html:ro
|
||||||
|
deploy:
|
||||||
|
restart_policy:
|
||||||
|
condition: any
|
||||||
|
depends_on:
|
||||||
|
gvm-config:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
gsa:
|
||||||
|
condition: service_healthy
|
||||||
|
gsad:
|
||||||
|
condition: service_started
|
||||||
|
|
||||||
|
# Sets log level of openvas to the set LOG_LEVEL within the env
|
||||||
|
# and changes log output to /var/log/openvas instead /var/log/gvm
|
||||||
|
# to reduce likelihood of unwanted log interferences
|
||||||
|
configure-openvas:
|
||||||
|
image: registry.community.greenbone.net/community/openvas-scanner:stable
|
||||||
|
volumes:
|
||||||
|
- openvas_data_vol:/mnt
|
||||||
|
- openvas_log_data_vol:/var/log/openvas
|
||||||
|
command:
|
||||||
|
- /bin/sh
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
printf "table_driven_lsc = yes\nopenvasd_server = http://openvasd:80\n" > /mnt/openvas.conf
|
||||||
|
sed "s/127/128/" /etc/openvas/openvas_log.conf | sed 's/gvm/openvas/' > /mnt/openvas_log.conf
|
||||||
|
chmod 644 /mnt/openvas.conf
|
||||||
|
chmod 644 /mnt/openvas_log.conf
|
||||||
|
touch /var/log/openvas/openvas.log
|
||||||
|
chmod 666 /var/log/openvas/openvas.log
|
||||||
|
|
||||||
|
# shows logs of openvas
|
||||||
|
openvas:
|
||||||
|
image: registry.community.greenbone.net/community/openvas-scanner:stable
|
||||||
|
volumes:
|
||||||
|
- openvas_data_vol:/etc/openvas
|
||||||
|
- openvas_log_data_vol:/var/log/openvas
|
||||||
|
command:
|
||||||
|
- /bin/sh
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
cat /etc/openvas/openvas.conf
|
||||||
|
tail -f /var/log/openvas/openvas.log
|
||||||
|
depends_on:
|
||||||
|
configure-openvas:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
|
||||||
|
openvasd:
|
||||||
|
image: registry.community.greenbone.net/community/openvas-scanner:stable
|
||||||
|
deploy:
|
||||||
|
restart_policy:
|
||||||
|
condition: any
|
||||||
|
environment:
|
||||||
|
# `service_notus` is set to disable everything but notus,
|
||||||
|
# if you want to utilize openvasd directly, remove `OPENVASD_MODE`
|
||||||
|
OPENVASD_MODE: service_notus
|
||||||
|
GNUPGHOME: /etc/openvas/gnupg
|
||||||
|
LISTENING: 0.0.0.0:80
|
||||||
|
volumes:
|
||||||
|
- openvas_data_vol:/etc/openvas
|
||||||
|
- openvas_log_data_vol:/var/log/openvas
|
||||||
|
- gpg_data_vol:/etc/openvas/gnupg
|
||||||
|
- notus_data_vol:/var/lib/notus
|
||||||
|
# enable port forwarding when you want to use the http api from your host machine
|
||||||
|
# ports:
|
||||||
|
# - 127.0.0.1:3000:80
|
||||||
|
depends_on:
|
||||||
|
vulnerability-tests:
|
||||||
|
condition: service_healthy
|
||||||
|
notus-data:
|
||||||
|
condition: service_healthy
|
||||||
|
configure-openvas:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
gpg-data:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
networks:
|
||||||
|
default:
|
||||||
|
aliases:
|
||||||
|
- openvasd
|
||||||
|
|
||||||
|
ospd-openvas:
|
||||||
|
image: registry.community.greenbone.net/community/ospd-openvas:stable
|
||||||
|
deploy:
|
||||||
|
restart_policy:
|
||||||
|
condition: any
|
||||||
|
hostname: ospd-openvas.local
|
||||||
|
cap_add:
|
||||||
|
- NET_ADMIN # for capturing packages in promiscuous mode
|
||||||
|
- NET_RAW # for raw sockets e.g. used for the boreas alive detection
|
||||||
|
security_opt:
|
||||||
|
- seccomp=unconfined
|
||||||
|
- apparmor=unconfined
|
||||||
|
command:
|
||||||
|
[
|
||||||
|
"ospd-openvas",
|
||||||
|
"-f",
|
||||||
|
"--config",
|
||||||
|
"/etc/gvm/ospd-openvas.conf",
|
||||||
|
"--notus-feed-dir",
|
||||||
|
"/var/lib/notus/advisories",
|
||||||
|
"-m",
|
||||||
|
"666",
|
||||||
|
]
|
||||||
|
volumes:
|
||||||
|
- gpg_data_vol:/etc/openvas/gnupg
|
||||||
|
- vt_data_vol:/var/lib/openvas/plugins
|
||||||
|
- notus_data_vol:/var/lib/notus
|
||||||
|
- ospd_openvas_socket_vol:/run/ospd
|
||||||
|
- redis_socket_vol:/run/redis/
|
||||||
|
- openvas_data_vol:/etc/openvas/
|
||||||
|
- openvas_log_data_vol:/var/log/openvas
|
||||||
|
depends_on:
|
||||||
|
redis-server:
|
||||||
|
condition: service_started
|
||||||
|
gpg-data:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
configure-openvas:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
vulnerability-tests:
|
||||||
|
condition: service_healthy
|
||||||
|
notus-data:
|
||||||
|
condition: service_healthy
|
||||||
|
|
||||||
|
gvm-tools:
|
||||||
|
image: registry.community.greenbone.net/community/gvm-tools
|
||||||
|
volumes:
|
||||||
|
- gvmd_socket_vol:/run/gvmd
|
||||||
|
- ospd_openvas_socket_vol:/run/ospd
|
||||||
|
depends_on:
|
||||||
|
- gvmd
|
||||||
|
- ospd-openvas
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
gpg_data_vol:
|
||||||
|
scap_data_vol:
|
||||||
|
cert_data_vol:
|
||||||
|
data_objects_vol:
|
||||||
|
gvmd_data_vol:
|
||||||
|
psql_data_vol:
|
||||||
|
vt_data_vol:
|
||||||
|
notus_data_vol:
|
||||||
|
psql_socket_vol:
|
||||||
|
gvmd_socket_vol:
|
||||||
|
ospd_openvas_socket_vol:
|
||||||
|
redis_socket_vol:
|
||||||
|
openvas_data_vol:
|
||||||
|
openvas_log_data_vol:
|
||||||
|
gsa_data_vol:
|
||||||
|
nginx_config_vol:
|
||||||
|
nginx_certificates_vol:
|
||||||
@@ -1,79 +0,0 @@
|
|||||||
# GVM (OpenVAS) app-test lane — loopback single-host stack [#389]
|
|
||||||
#
|
|
||||||
# Greenbone Community Containers. App-test only (loopback bind): the scan
|
|
||||||
# engine + feeds are heavyweight; bring-up downloads several GB of feeds on
|
|
||||||
# first start. Production scan engine placement (kali-tsys VM per #389) is a
|
|
||||||
# separate deploy under an approved GLPI CR.
|
|
||||||
#
|
|
||||||
# Bring-up:
|
|
||||||
# docker compose -f docker-compose.yml up -d # feeds sync on start
|
|
||||||
# watch: docker compose logs -f gvmd | grep -i feed # wait for "Feed ... ok"
|
|
||||||
# gsad UI: http://127.0.0.1:9392 (admin/admin on first login — change)
|
|
||||||
# GMP socket: unix volume `run_gvmd` (gvm-tools service below)
|
|
||||||
#
|
|
||||||
# Feed targets from GLPI:
|
|
||||||
# ../../openvas/glpi-to-openvas.sh --format gmp > /tmp/targets.gmp
|
|
||||||
# docker compose run --rm gvm-tools script -c "<read(/tmp/targets.gmp)>" ...
|
|
||||||
# (see openvas/README.md for the full pipeline)
|
|
||||||
#
|
|
||||||
# IMAGE PINNING: version tags now; digest-pin at bring-up proof (house rule).
|
|
||||||
|
|
||||||
services:
|
|
||||||
redis:
|
|
||||||
image: redis:7.2-bookworm
|
|
||||||
command: redis-server /etc/redis/redis.conf
|
|
||||||
volumes:
|
|
||||||
- redis_socket:/run/redis
|
|
||||||
restart: unless-stopped
|
|
||||||
|
|
||||||
pg-gvm:
|
|
||||||
image: greenbone/pg-gvm:22.4-stable
|
|
||||||
environment:
|
|
||||||
POSTGRES_USER: gvmd
|
|
||||||
volumes:
|
|
||||||
- psql_data:/var/lib/postgresql
|
|
||||||
restart: unless-stopped
|
|
||||||
|
|
||||||
gvmd:
|
|
||||||
image: greenbone/gvmd:22.5-stable
|
|
||||||
depends_on: [redis, pg-gvm]
|
|
||||||
volumes:
|
|
||||||
- gvmd_data:/var/lib/gvm
|
|
||||||
- run_gvmd:/run/gvmd
|
|
||||||
restart: unless-stopped
|
|
||||||
|
|
||||||
ospd-openvas:
|
|
||||||
image: greenbone/ospd-openvas:22.5-stable
|
|
||||||
depends_on: [redis]
|
|
||||||
volumes:
|
|
||||||
- run_gvmd:/run/gvmd
|
|
||||||
- ospd_openvas_socket:/run/ospd
|
|
||||||
- plugins_data:/var/lib/openvas_plugin_cache
|
|
||||||
- nvts_data:/var/lib/gvm
|
|
||||||
restart: unless-stopped
|
|
||||||
|
|
||||||
gsad:
|
|
||||||
image: greenbone/gsad:22.4-stable
|
|
||||||
depends_on: [gvmd]
|
|
||||||
ports:
|
|
||||||
- "127.0.0.1:9392:9392" # loopback only (app-test lane rule)
|
|
||||||
restart: unless-stopped
|
|
||||||
|
|
||||||
# one-shot helper container for GMP imports (targets/tasks) via gvm-tools
|
|
||||||
gvm-tools:
|
|
||||||
image: greenbone/gvm-tools:22.9-stable
|
|
||||||
profiles: [tools]
|
|
||||||
entrypoint: ["sleep", "infinity"]
|
|
||||||
volumes:
|
|
||||||
- run_gvmd:/run/gvmd
|
|
||||||
|
|
||||||
networks: {}
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
redis_socket:
|
|
||||||
psql_data:
|
|
||||||
gvmd_data:
|
|
||||||
run_gvmd:
|
|
||||||
ospd_openvas_socket:
|
|
||||||
plugins_data:
|
|
||||||
nvts_data:
|
|
||||||
@@ -38,3 +38,23 @@ GLPI CMDB (computers, read-only via mglpi identity)
|
|||||||
- [ ] GVM bring-up + first feed import (next run: feeds download several GB)
|
- [ ] GVM bring-up + first feed import (next run: feeds download several GB)
|
||||||
- [ ] First sectestbed scan + findings triage into Redmine
|
- [ ] First sectestbed scan + findings triage into Redmine
|
||||||
- [ ] kali-tsys production engine under CR (#389)
|
- [ ] kali-tsys production engine under CR (#389)
|
||||||
|
|
||||||
|
## GVM stack (app-test lane) — official Greenbone Community Edition
|
||||||
|
|
||||||
|
`docker/gvm-test/compose.yaml` = the OFFICIAL Greenbone compose (fetched
|
||||||
|
2026-09-05 from https://greenbone.github.io/docs/latest/_static/compose.yaml,
|
||||||
|
already loopback-bound: 127.0.0.1:443 + 127.0.0.1:9392). Registry:
|
||||||
|
registry.community.greenbone.net (Docker Hub greenbone/* is discontinued;
|
||||||
|
ghcr.io/greenbone/gvmd exists but the official stack uses the community
|
||||||
|
registry — use the official file as-is).
|
||||||
|
|
||||||
|
Bring-up:
|
||||||
|
cd docker/gvm-test && docker compose -f compose.yaml pull && docker compose -f compose.yaml up -d
|
||||||
|
# admin password reset:
|
||||||
|
docker compose -f compose.yaml exec -u gvmd gvmd gvmd --user=admin --new-password='<pw>'
|
||||||
|
Feed sync runs on first start (multi-GB, takes hours — check
|
||||||
|
`docker compose logs -f gvmd`).
|
||||||
|
|
||||||
|
Import GLPI targets once feeds are loaded (gvm-tools service in the compose):
|
||||||
|
../../openvas/glpi-to-openvas.sh --format gmp > /tmp/targets.gmp
|
||||||
|
docker compose -f compose.yaml run --rm gvm-tools ... # see #389 note
|
||||||
|
|||||||
Reference in New Issue
Block a user