mrcharles
8eab675c74
ci / audit (push) Successful in 20s
Feed reads GLPI computers read-only (mglpi identity), parses ts=/mgmt IP comment convention, emits CSV or GMP create_target fragments. Dual shellcheck green. GVM stack = Greenbone community containers, loopback. https://projects.knownelement.com/issues/389
80 lines
2.2 KiB
YAML
80 lines
2.2 KiB
YAML
# GVM (OpenVAS) app-test lane — loopback single-host stack [#389]
|
|
#
|
|
# Greenbone Community Containers. App-test only (loopback bind): the scan
|
|
# engine + feeds are heavyweight; bring-up downloads several GB of feeds on
|
|
# first start. Production scan engine placement (kali-tsys VM per #389) is a
|
|
# separate deploy under an approved GLPI CR.
|
|
#
|
|
# Bring-up:
|
|
# docker compose -f docker-compose.yml up -d # feeds sync on start
|
|
# watch: docker compose logs -f gvmd | grep -i feed # wait for "Feed ... ok"
|
|
# gsad UI: http://127.0.0.1:9392 (admin/admin on first login — change)
|
|
# GMP socket: unix volume `run_gvmd` (gvm-tools service below)
|
|
#
|
|
# Feed targets from GLPI:
|
|
# ../../openvas/glpi-to-openvas.sh --format gmp > /tmp/targets.gmp
|
|
# docker compose run --rm gvm-tools script -c "<read(/tmp/targets.gmp)>" ...
|
|
# (see openvas/README.md for the full pipeline)
|
|
#
|
|
# IMAGE PINNING: version tags now; digest-pin at bring-up proof (house rule).
|
|
|
|
services:
|
|
redis:
|
|
image: redis:7.2-bookworm
|
|
command: redis-server /etc/redis/redis.conf
|
|
volumes:
|
|
- redis_socket:/run/redis
|
|
restart: unless-stopped
|
|
|
|
pg-gvm:
|
|
image: greenbone/pg-gvm:22.4-stable
|
|
environment:
|
|
POSTGRES_USER: gvmd
|
|
volumes:
|
|
- psql_data:/var/lib/postgresql
|
|
restart: unless-stopped
|
|
|
|
gvmd:
|
|
image: greenbone/gvmd:22.5-stable
|
|
depends_on: [redis, pg-gvm]
|
|
volumes:
|
|
- gvmd_data:/var/lib/gvm
|
|
- run_gvmd:/run/gvmd
|
|
restart: unless-stopped
|
|
|
|
ospd-openvas:
|
|
image: greenbone/ospd-openvas:22.5-stable
|
|
depends_on: [redis]
|
|
volumes:
|
|
- run_gvmd:/run/gvmd
|
|
- ospd_openvas_socket:/run/ospd
|
|
- plugins_data:/var/lib/openvas_plugin_cache
|
|
- nvts_data:/var/lib/gvm
|
|
restart: unless-stopped
|
|
|
|
gsad:
|
|
image: greenbone/gsad:22.4-stable
|
|
depends_on: [gvmd]
|
|
ports:
|
|
- "127.0.0.1:9392:9392" # loopback only (app-test lane rule)
|
|
restart: unless-stopped
|
|
|
|
# one-shot helper container for GMP imports (targets/tasks) via gvm-tools
|
|
gvm-tools:
|
|
image: greenbone/gvm-tools:22.9-stable
|
|
profiles: [tools]
|
|
entrypoint: ["sleep", "infinity"]
|
|
volumes:
|
|
- run_gvmd:/run/gvmd
|
|
|
|
networks: {}
|
|
|
|
volumes:
|
|
redis_socket:
|
|
psql_data:
|
|
gvmd_data:
|
|
run_gvmd:
|
|
ospd_openvas_socket:
|
|
plugins_data:
|
|
nvts_data:
|