[#389] GLPI→OpenVAS feed pilot: script (fixture-tested, 63 targets) + GVM app-test compose + pipeline docs

Feed reads GLPI computers read-only (mglpi identity), parses ts=/mgmt IP comment convention, emits CSV or GMP create_target fragments. Dual shellcheck green. GVM stack = Greenbone community containers, loopback. https://projects.knownelement.com/issues/389
2026-09-05 06:56:00 -05:00
parent 7822abf2eb
commit 8eab675c74
4 changed files with 209 additions and 0 deletions
@@ -0,0 +1,79 @@
+# GVM (OpenVAS) app-test lane — loopback single-host stack [#389]
+#
+# Greenbone Community Containers. App-test only (loopback bind): the scan
+# engine + feeds are heavyweight; bring-up downloads several GB of feeds on
+# first start. Production scan engine placement (kali-tsys VM per #389) is a
+# separate deploy under an approved GLPI CR.
+#
+# Bring-up:
+#   docker compose -f docker-compose.yml up -d          # feeds sync on start
+#   watch: docker compose logs -f gvmd | grep -i feed   # wait for "Feed ... ok"
+#   gsad UI:    http://127.0.0.1:9392  (admin/admin on first login — change)
+#   GMP socket: unix volume `run_gvmd` (gvm-tools service below)
+#
+# Feed targets from GLPI:
+#   ../../openvas/glpi-to-openvas.sh --format gmp > /tmp/targets.gmp
+#   docker compose run --rm gvm-tools script -c "<read(/tmp/targets.gmp)>" ...
+#   (see openvas/README.md for the full pipeline)
+#
+# IMAGE PINNING: version tags now; digest-pin at bring-up proof (house rule).
+
+services:
+  redis:
+    image: redis:7.2-bookworm
+    command: redis-server /etc/redis/redis.conf
+    volumes:
+      - redis_socket:/run/redis
+    restart: unless-stopped
+
+  pg-gvm:
+    image: greenbone/pg-gvm:22.4-stable
+    environment:
+      POSTGRES_USER: gvmd
+    volumes:
+      - psql_data:/var/lib/postgresql
+    restart: unless-stopped
+
+  gvmd:
+    image: greenbone/gvmd:22.5-stable
+    depends_on: [redis, pg-gvm]
+    volumes:
+      - gvmd_data:/var/lib/gvm
+      - run_gvmd:/run/gvmd
+    restart: unless-stopped
+
+  ospd-openvas:
+    image: greenbone/ospd-openvas:22.5-stable
+    depends_on: [redis]
+    volumes:
+      - run_gvmd:/run/gvmd
+      - ospd_openvas_socket:/run/ospd
+      - plugins_data:/var/lib/openvas_plugin_cache
+      - nvts_data:/var/lib/gvm
+    restart: unless-stopped
+
+  gsad:
+    image: greenbone/gsad:22.4-stable
+    depends_on: [gvmd]
+    ports:
+      - "127.0.0.1:9392:9392"   # loopback only (app-test lane rule)
+    restart: unless-stopped
+
+  # one-shot helper container for GMP imports (targets/tasks) via gvm-tools
+  gvm-tools:
+    image: greenbone/gvm-tools:22.9-stable
+    profiles: [tools]
+    entrypoint: ["sleep", "infinity"]
+    volumes:
+      - run_gvmd:/run/gvmd
+
+networks: {}
+
+volumes:
+  redis_socket:
+  psql_data:
+  gvmd_data:
+  run_gvmd:
+  ospd_openvas_socket:
+  plugins_data:
+  nvts_data: