Feature/embedded configurations

dynamite_nsm/confs/elasticsearch/elasticsearch.yml

@@ -0,0 +1,101 @@
+# ======================== Elasticsearch Configuration =========================
+#
+# NOTE: Elasticsearch comes with reasonable defaults for most settings.
+#       Before you set out to tweak and tune the configuration, make sure you
+#       understand what are you trying to accomplish and the consequences.
+#
+# The primary way of configuring a node is via this file. This template lists
+# the most important settings you may want to configure for a production cluster.
+#
+# Please consult the documentation for further information on configuration options:
+# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
+#
+# ---------------------------------- Cluster -----------------------------------
+#
+# Use a descriptive name for your cluster:
+#
+cluster.name: dynamite-nsm-cluster
+#
+# ------------------------------------ Node ------------------------------------
+#
+# Use a descriptive name for the node:
+#
+node.name: dynamite-es-node
+#
+# Add custom attributes to the node:
+#
+#node.attr.rack: r1
+#
+# ----------------------------------- Paths ------------------------------------
+#
+# Path to directory where to store the data (separate multiple locations by comma):
+#
+path.data: /opt/dynamite/elasticsearch/data/
+#
+# Path to log files:
+#
+path.logs: /var/log/dynamite/elasticsearch/
+#
+# ----------------------------------- Memory -----------------------------------
+#
+# Lock the memory on startup:
+#
+#bootstrap.memory_lock: true
+#
+# Make sure that the heap size is set to about half the memory available
+# on the system and that the owner of the process is allowed to use this
+# limit.
+#
+# Elasticsearch performs poorly when the system is swapping the memory.
+#
+# ---------------------------------- Network -----------------------------------
+#
+# Set the bind address to a specific IP (IPv4 or IPv6):
+#
+network.host: 0.0.0.0
+#
+# Set a custom port for HTTP:
+#
+http.port: 9200
+#
+# For more information, consult the network module documentation.
+#
+# --------------------------------- Discovery ----------------------------------
+#
+# Pass an initial list of hosts to perform discovery when this node is started:
+# The default list of hosts is ["127.0.0.1", "[::1]"]
+#
+discovery.seed_hosts: ["localhost"]
+#
+# Bootstrap the cluster using an initial set of master-eligible nodes:
+#
+cluster.initial_master_nodes: ["dynamite-node"]
+#
+# For more information, consult the discovery and cluster formation module documentation.
+#
+# ---------------------------------- Gateway -----------------------------------
+#
+# Block initial recovery after a full cluster restart until N nodes are started:
+#
+#gateway.recover_after_nodes: 3
+#
+# For more information, consult the gateway module documentation.
+#
+# ---------------------------------- Various -----------------------------------
+#
+# Require explicit names when deleting indices:
+search.max_buckets: 10000
+opendistro_security.disabled: false
+opendistro_security.ssl.transport.enabled: true
+opendistro_security.ssl.http.enabled: true
+
+opendistro_security.ssl.http.pemcert_filepath: security/auth/admin.pem
+opendistro_security.ssl.http.pemkey_filepath: security/auth/admin-key.pem
+opendistro_security.ssl.http.pemtrustedcas_filepath: security/auth/root-ca.pem
+opendistro_security.ssl.transport.pemcert_filepath: security/auth/admin.pem
+opendistro_security.ssl.transport.pemkey_filepath: security/auth/admin-key.pem
+opendistro_security.ssl.transport.pemtrustedcas_filepath: security/auth/root-ca.pem
+
+opendistro_security.authcz.admin_dn:
+- C=US,ST=GA,L=Atlanta,O=Dynamite,OU=R&D,CN=dynamite.ai
+- CN=dynamite.ai,OU=R&D,O=Dynamite,L=Atlanta,ST=GA,C=US

dynamite_nsm/confs/elasticsearch/jvm.options

@@ -0,0 +1,20 @@
+-Xms4g
+-Xmx4g
+8-13:-XX:+UseConcMarkSweepGC
+8-13:-XX:CMSInitiatingOccupancyFraction=75
+8-13:-XX:+UseCMSInitiatingOccupancyOnly
+14-:-XX:+UseG1GC
+14-:-XX:G1ReservePercent=25
+14-:-XX:InitiatingHeapOccupancyPercent=30
+-Djava.io.tmpdir=${ES_TMPDIR}
+-XX:+HeapDumpOnOutOfMemoryError
+-XX:HeapDumpPath=data
+-XX:ErrorFile=logs/hs_err_pid%p.log
+8:-XX:+PrintGCDetails
+8:-XX:+PrintGCDateStamps
+8:-XX:+PrintTenuringDistribution
+8:-XX:+PrintGCApplicationStoppedTime
+8:-Xloggc:logs/gc.log
+8:-XX:+UseGCLogFileRotation
+8:-XX:NumberOfGCLogFiles=32
+8:-XX:GCLogFileSize=64m

dynamite_nsm/confs/elasticsearch/security/action_groups.yml

@@ -0,0 +1,3 @@
+_meta:
+  type: "actiongroups"
+  config_version: 2

dynamite_nsm/confs/elasticsearch/security/audit.yml

@@ -0,0 +1,85 @@
+_meta:
+  type: "audit"
+  config_version: 2
+
+config:
+  # enable/disable audit logging
+  enabled: true
+
+  audit:
+    # Enable/disable REST API auditing
+    enable_rest: true
+
+    # Categories to exclude from REST API auditing
+    disabled_rest_categories:
+      - AUTHENTICATED
+      - GRANTED_PRIVILEGES
+
+    # Enable/disable Transport API auditing
+    enable_transport: true
+
+    # Categories to exclude from Transport API auditing
+    disabled_transport_categories:
+      - AUTHENTICATED
+      - GRANTED_PRIVILEGES
+
+    # Users to be excluded from auditing. Wildcard patterns are supported. Eg:
+    # ignore_users: ["test-user", "employee-*"]
+    ignore_users:
+      - kibanaserver
+
+    # Requests to be excluded from auditing. Wildcard patterns are supported. Eg:
+    # ignore_requests: ["indices:data/read/*", "SearchRequest"]
+    ignore_requests: []
+
+    # Log individual operations in a bulk request
+    resolve_bulk_requests: false
+
+    # Include the body of the request (if available) for both REST and the transport layer
+    log_request_body: true
+
+    # Logs all indices affected by a request. Resolves aliases and wildcards/date patterns
+    resolve_indices: true
+
+    # Exclude sensitive headers from being included in the logs. Eg: Authorization
+    exclude_sensitive_headers: true
+
+  compliance:
+    # enable/disable compliance
+    enabled: true
+
+    # Log updates to internal security changes
+    internal_config: true
+
+    # Log external config files for the node
+    external_config: false
+
+    # Log only metadata of the document for read events
+    read_metadata_only: true
+
+    # Map of indexes and fields to monitor for read events. Wildcard patterns are supported for both index names and fields. Eg:
+    # read_watched_fields: {
+    #   "twitter": ["message"]
+    #   "logs-*": ["id", "attr*"]
+    # }
+    read_watched_fields: {}
+
+    # List of users to ignore for read events. Wildcard patterns are supported. Eg:
+    # read_ignore_users: ["test-user", "employee-*"]
+    read_ignore_users:
+      - kibanaserver
+
+    # Log only metadata of the document for write events
+    write_metadata_only: true
+
+    # Log only diffs for document updates
+    write_log_diffs: false
+
+    # List of indices to watch for write events. Wildcard patterns are supported
+    # write_watched_indices: ["twitter", "logs-*"]
+    write_watched_indices: []
+
+    # List of users to ignore for write events. Wildcard patterns are supported. Eg:
+    # write_ignore_users: ["test-user", "employee-*"]
+    write_ignore_users:
+      - kibanaserver