From 8064d91dfb76bc38466b5e9382b4d43f3188a444 Mon Sep 17 00:00:00 2001
From: Alex Auvolat <alex@adnab.me>
Date: Sat, 26 Feb 2022 18:56:16 +0100
Subject: Add security to telemetry deployment

---
 app/telemetry/config/apm-config.yaml                               | 6 ++++++
 app/telemetry/config/grafana/provisioning/datasources/elastic.yaml | 4 ++--
 app/telemetry/deploy/telemetry.hcl                                 | 3 +++
 3 files changed, 11 insertions(+), 2 deletions(-)

(limited to 'app')

diff --git a/app/telemetry/config/apm-config.yaml b/app/telemetry/config/apm-config.yaml
index 1c1e645..881cb40 100644
--- a/app/telemetry/config/apm-config.yaml
+++ b/app/telemetry/config/apm-config.yaml
@@ -8,3 +8,9 @@ output.elasticsearch:
   # In case you specify and additional path, the scheme is required: `http://localhost:9200/path`.
   # IPv6 addresses should always be defined as: `https://[2001:db8::1]:9200`.
   hosts: ["localhost:9200"]
+  username: "apm"
+  password: "{{ key "secrets/telemetry/elastic_passwords/apm" }}"
+
+logging:
+  level: warning
+  to_stderr: true
diff --git a/app/telemetry/config/grafana/provisioning/datasources/elastic.yaml b/app/telemetry/config/grafana/provisioning/datasources/elastic.yaml
index 8108a53..a41be6f 100644
--- a/app/telemetry/config/grafana/provisioning/datasources/elastic.yaml
+++ b/app/telemetry/config/grafana/provisioning/datasources/elastic.yaml
@@ -5,8 +5,8 @@ datasources:
     type: elasticsearch
     access: proxy
     url: http://localhost:9200
-    password: ''
-    user: ''
+    password: '{{ key "secrets/telemetry/elastic_passwords/grafana" }}'
+    user: 'grafana'
     database: apm-*
     basicAuth: false
     isDefault: true
diff --git a/app/telemetry/deploy/telemetry.hcl b/app/telemetry/deploy/telemetry.hcl
index e92d0ec..48ea4ea 100644
--- a/app/telemetry/deploy/telemetry.hcl
+++ b/app/telemetry/deploy/telemetry.hcl
@@ -77,6 +77,7 @@ http.port=9200
 cluster.name=es-docker-cluster
 discovery.type=single-node
 bootstrap.memory_lock=true
+xpack.security.enabled=true
 ES_JAVA_OPTS=-Xms512m -Xmx512m
 EOH
         destination = "secrets/env"
@@ -96,6 +97,8 @@ EOH
         data = <<EOH
 SERVER_NAME=kibana.local
 ELASTICSEARCH_HOSTS=http://localhost:9200
+ELASTICSEARCH_USERNAME=kibana_system
+ELASTICSEARCH_PASSWORD={{ key "secrets/telemetry/elastic_passwords/kibana_system" }}
 EOH
         destination = "secrets/env"
         env = true
-- 
cgit v1.2.3