diff --git a/.gitignore b/.gitignore index 5c199eb..0ff3973 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ # ---> Ansible *.retry +*_data/ diff --git a/prowler/.env b/prowler/.env new file mode 100644 index 0000000..55f47e1 --- /dev/null +++ b/prowler/.env @@ -0,0 +1,154 @@ +#### Important Note #### +# This file is used to store environment variables for the Prowler App. +# For production, it is recommended to use a secure method to store these variables and change the default secret keys. + +#### Prowler UI Configuration #### +PROWLER_UI_VERSION="stable" +AUTH_URL=http://localhost:3000 +API_BASE_URL=http://prowler-api:8080/api/v1 +NEXT_PUBLIC_API_BASE_URL=${API_BASE_URL} +NEXT_PUBLIC_API_DOCS_URL=http://prowler-api:8080/api/v1/docs +AUTH_TRUST_HOST=true +UI_PORT=3000 +# Temp URL for feeds need to use actual +RSS_FEED_URL=https://prowler.com/blog/rss +# openssl rand -base64 32 +AUTH_SECRET="N/c6mnaS5+SWq81+819OrzQZlmx1Vxtp/orjttJSmw8=" +# Google Tag Manager ID +NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID="" + + +#### Prowler API Configuration #### +PROWLER_API_VERSION="stable" +# PostgreSQL settings +# If running Django and celery on host, use 'localhost', else use 'postgres-db' +POSTGRES_HOST=postgres-db +POSTGRES_PORT=5432 +POSTGRES_ADMIN_USER=prowler_admin +POSTGRES_ADMIN_PASSWORD=postgres +POSTGRES_USER=prowler +POSTGRES_PASSWORD=postgres +POSTGRES_DB=prowler_db + +# Celery-Prowler task settings +TASK_RETRY_DELAY_SECONDS=0.1 +TASK_RETRY_ATTEMPTS=5 + +# Valkey settings +# If running Valkey and celery on host, use localhost, else use 'valkey' +VALKEY_HOST=valkey +VALKEY_PORT=6379 +VALKEY_DB=0 + +# API scan settings + +# The path to the directory where scan output should be stored +DJANGO_TMP_OUTPUT_DIRECTORY="/tmp/prowler_api_output" + +# The maximum number of findings to process in a single batch +DJANGO_FINDINGS_BATCH_SIZE=1000 + +# The AWS access key to be used when uploading scan output to an S3 bucket +# If left empty, default AWS credentials resolution behavior will be used +DJANGO_OUTPUT_S3_AWS_ACCESS_KEY_ID="" + +# The AWS secret key to be used when uploading scan output to an S3 bucket +DJANGO_OUTPUT_S3_AWS_SECRET_ACCESS_KEY="" + +# An optional AWS session token +DJANGO_OUTPUT_S3_AWS_SESSION_TOKEN="" + +# The AWS region where your S3 bucket is located (e.g., "us-east-1") +DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION="" + +# The name of the S3 bucket where scan output should be stored +DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET="" + +# Django settings +DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,prowler-api +DJANGO_BIND_ADDRESS=0.0.0.0 +DJANGO_PORT=8080 +DJANGO_DEBUG=False +DJANGO_SETTINGS_MODULE=config.django.production +# Select one of [ndjson|human_readable] +DJANGO_LOGGING_FORMATTER=human_readable +# Select one of [DEBUG|INFO|WARNING|ERROR|CRITICAL] +# Applies to both Django and Celery Workers +DJANGO_LOGGING_LEVEL=INFO +# Defaults to the maximum available based on CPU cores if not set. +DJANGO_WORKERS=4 +# Token lifetime is in minutes +DJANGO_ACCESS_TOKEN_LIFETIME=30 +# Token lifetime is in minutes +DJANGO_REFRESH_TOKEN_LIFETIME=1440 +DJANGO_CACHE_MAX_AGE=3600 +DJANGO_STALE_WHILE_REVALIDATE=60 +DJANGO_MANAGE_DB_PARTITIONS=True +# openssl genrsa -out private.pem 2048 +DJANGO_TOKEN_SIGNING_KEY="-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDs4e+kt7SnUJek +6V5r9zMGzXCoU5qnChfPiqu+BgANyawz+MyVZPs6RCRfeo6tlCknPQtOziyXYM2I +7X+qckmuzsjqp8+u+o1mw3VvUuJew5k2SQLPYwsiTzuFNVJEOgRo3hywGiGwS2iv +/5nh2QAl7fq2qLqZEXQa5+/xJlQggS1CYxOJgggvLyra50QZlBvPve/AxKJ/EV/Q +irWTZU5lLNI8sH2iZR05vQeBsxZ0dCnGMT+vGl+cGkqrvzQzKsYbDmabMcfTYhYi +78fpv6A4uharJFHayypYBjE39PwhMyyeycrNXlpm1jpq+03HgmDuDMHydk1tNwuT +nEC7m7iNAgMBAAECggEAA2m48nJcJbn9SVi8bclMwKkWmbJErOnyEGEy2sTK3Of+ +NWx9BB0FmqAPNxn0ss8K7cANKOhDD7ZLF9E2MO4/HgfoMKtUzHRbM7MWvtEepldi +nnvcUMEgULD8Dk4HnqiIVjt3BdmGiTv46OpBnRWrkSBV56pUL+7msZmMZTjUZvh2 +ZWv0+I3gtDIjo2Zo/FiwDV7CfwRjJarRpYUj/0YyuSA4FuOUYl41WAX1I301FKMH +xo3jiAYi1s7IneJ16OtPpOA34Wg5F6ebm/UO0uNe+iD4kCXKaZmxYQPh5tfB0Qa3 +qj1T7GNpFNyvtG7VVdauhkb8iu8X/wl6PCwbg0RCKQKBgQD9HfpnpH0lDlHMRw9K +X7Vby/1fSYy1BQtlXFEIPTN/btJ/asGxLmAVwJ2HAPXWlrfSjVAH7CtVmzN7v8oj +HeIHfeSgoWEu1syvnv2AMaYSo03UjFFlfc/GUxF7DUScRIhcJUPCP8jkAROz9nFv +DByNjUL17Q9r43DmDiRsy0IFqQKBgQDvlJ9Uhl+Sp7gRgKYwa/IG0+I4AduAM+Gz +Dxbm52QrMGMTjaJFLmLHBUZ/ot+pge7tZZGws8YR8ufpyMJbMqPjxhIvRRa/p1Tf +E3TQPW93FMsHUvxAgY3MV5MzXFPhlNAKb+akP/RcXUhetGAuZKLubtDCWa55ZQuL +wj2OS+niRQKBgE7K8zUqNi6/22S8xhy/2GPgB1qPObbsABUofK0U6CAGLo6te+gc +6Jo84IyzFtQbDNQFW2Fr+j1m18rw9AqkdcUhQndiZS9AfG07D+zFB86LeWHt4DS4 +ymIRX8Kvaak/iDcu/n3Mf0vCrhB6aetImObTj4GgrwlFvtJOmrYnO8EpAoGAIXXP +Xt25gWD9OyyNiVu6HKwA/zN7NYeJcRmdaDhO7B1A6R0x2Zml4AfjlbXoqOLlvLAf +zd79vcoAC82nH1eOPiSOq51plPDI0LMF8IN0CtyTkn1Lj7LIXA6rF1RAvtOqzppc +SvpHpZK9pcRpXnFdtBE0BMDDtl6fYzCIqlP94UUCgYEAnhXbAQMF7LQifEm34Dx8 +BizRMOKcqJGPvbO2+Iyt50O5X6onU2ITzSV1QHtOvAazu+B1aG9pEuBFDQ+ASxEu +L9ruJElkOkb/o45TSF6KCsHd55ReTZ8AqnRjf5R+lyzPqTZCXXb8KTcRvWT4zQa3 +VxyT2PnaSqEcexWUy4+UXoQ= +-----END PRIVATE KEY-----" +# openssl rsa -in private.pem -pubout -out public.pem +DJANGO_TOKEN_VERIFYING_KEY="-----BEGIN PUBLIC KEY----- +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7OHvpLe0p1CXpOlea/cz +Bs1wqFOapwoXz4qrvgYADcmsM/jMlWT7OkQkX3qOrZQpJz0LTs4sl2DNiO1/qnJJ +rs7I6qfPrvqNZsN1b1LiXsOZNkkCz2MLIk87hTVSRDoEaN4csBohsEtor/+Z4dkA +Je36tqi6mRF0Gufv8SZUIIEtQmMTiYIILy8q2udEGZQbz73vwMSifxFf0Iq1k2VO +ZSzSPLB9omUdOb0HgbMWdHQpxjE/rxpfnBpKq780MyrGGw5mmzHH02IWIu/H6b+g +OLoWqyRR2ssqWAYxN/T8ITMsnsnKzV5aZtY6avtNx4Jg7gzB8nZNbTcLk5xAu5u4 +jQIDAQAB +-----END PUBLIC KEY-----" +# openssl rand -base64 32 +DJANGO_SECRETS_ENCRYPTION_KEY="oE/ltOhp/n1TdbHjVmzcjDPLcLA41CVI/4Rk+UB5ESc=" +DJANGO_BROKER_VISIBILITY_TIMEOUT=86400 +DJANGO_SENTRY_DSN= + +# Sentry settings +SENTRY_ENVIRONMENT=local +SENTRY_RELEASE=local + +#### Prowler release version #### +NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.10.0 + +# Social login credentials +SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google" +SOCIAL_GOOGLE_OAUTH_CLIENT_ID="" +SOCIAL_GOOGLE_OAUTH_CLIENT_SECRET="" + +SOCIAL_GITHUB_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/github" +SOCIAL_GITHUB_OAUTH_CLIENT_ID="" +SOCIAL_GITHUB_OAUTH_CLIENT_SECRET="" + +# Single Sign-On (SSO) +SAML_SSO_CALLBACK_URL="${AUTH_URL}/api/auth/callback/saml" + +# Lighthouse tracing +LANGSMITH_TRACING=false +LANGSMITH_ENDPOINT="https://api.smith.langchain.com" +LANGSMITH_API_KEY="" +LANGCHAIN_PROJECT="" diff --git a/compose-prowler.yml b/prowler/docker-compose.yml similarity index 84% rename from compose-prowler.yml rename to prowler/docker-compose.yml index be634b3..cd39b27 100644 --- a/compose-prowler.yml +++ b/prowler/docker-compose.yml @@ -1,5 +1,3 @@ - -# ... rest of file ... services: api: hostname: "prowler-api" @@ -19,22 +17,20 @@ services: entrypoint: - "/home/prowler/docker-entrypoint.sh" - "prod" - networks: - - postgres_nw ui: image: prowlercloud/prowler-ui:${PROWLER_UI_VERSION:-stable} env_file: - - path: .env + - path: .env required: false ports: - - ${UI_PORT:-3001}:${UI_PORT:-3000} + - ${UI_PORT:-3000}:${UI_PORT:-3000} postgres: image: postgres:16.3-alpine3.20 hostname: "postgres-db" volumes: - - ./_data/postgres:/var/lib/postgresql/data + - ./_data/postgres:/var/lib/postgresql/data:z environment: - POSTGRES_USER=${POSTGRES_ADMIN_USER} - POSTGRES_PASSWORD=${POSTGRES_ADMIN_PASSWORD} @@ -49,14 +45,12 @@ services: interval: 5s timeout: 5s retries: 5 - networks: - - postgres_nw valkey: image: valkey/valkey:7-alpine3.19 hostname: "valkey" volumes: - - ./_data/valkey:/data + - ./_data/valkey:/data:z env_file: - path: .env required: false @@ -83,8 +77,6 @@ services: entrypoint: - "/home/prowler/docker-entrypoint.sh" - "worker" - networks: - - postgres_nw worker-beat: image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable} @@ -99,14 +91,7 @@ services: entrypoint: - "../docker-entrypoint.sh" - "beat" - networks: - - postgres_nw volumes: - output: - driver: local + output: {} -networks: - postgres_nw: - internal: true - driver: bridge \ No newline at end of file