diff --git a/roles/build/templates/cassandra/Dockerfile.j2 b/roles/build/templates/cassandra/Dockerfile.j2
index f5d2a601c1526e9cf119c01bea5e36c2edf8223d..1be98c2e2e82010dd4d4760ccf3f70c9131587cd 100644
--- a/roles/build/templates/cassandra/Dockerfile.j2
+++ b/roles/build/templates/cassandra/Dockerfile.j2
@@ -16,5 +16,4 @@ RUN echo "[cassandra]" > /etc/yum.repos.d/cassandra.repo && \
sed -i -e 's,/etc/cassandra,/usr/share/cassandra,g' /usr/share/cassandra/cassandra.in.sh && \
yum -y clean all
COPY cassandrasupervisord.conf /etc/supervisord.conf
-EXPOSE 7000 9042
ENTRYPOINT ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
diff --git a/roles/build/templates/cortex/Dockerfile.j2 b/roles/build/templates/cortex/Dockerfile.j2
index a6488add6a4218e6e2d773b5e9f8bd18768e0fa5..7d6de8ff805be2cf23c74474870c7e9dd2513e60 100644
--- a/roles/build/templates/cortex/Dockerfile.j2
+++ b/roles/build/templates/cortex/Dockerfile.j2
@@ -23,6 +23,5 @@ RUN echo "[thehive-project]" > /etc/yum.repos.d/thehive.repo && \
for I in analyzers/*/requirements.txt; do LC_ALL=en_US.UTF-8 pip3 install --no-cache-dir -U -r $I || true; done && \
for I in responders/*/requirements.txt; do LC_ALL=en_US.UTF-8 pip3 install --no-cache-dir -U -r $I || true; done && \
yum -y clean all
-EXPOSE 9001
COPY cortexsupervisord.conf /etc/supervisord.conf
ENTRYPOINT ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
diff --git a/roles/build/templates/elasticsearch/Dockerfile.j2 b/roles/build/templates/elasticsearch/Dockerfile.j2
index 6f273d635c0c0135bf99fc07efe06c37134c5379..7947f249dfbcd76cd796e5599269bdf25d436b29 100644
--- a/roles/build/templates/elasticsearch/Dockerfile.j2
+++ b/roles/build/templates/elasticsearch/Dockerfile.j2
@@ -17,6 +17,5 @@ RUN rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch && \
RUN echo 'elasticsearch ALL=(ALL:ALL) NOPASSWD: ALL' >> /etc/sudoers
-EXPOSE 9200 9300
ENTRYPOINT ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
diff --git a/roles/build/templates/keycloak/Dockerfile.j2 b/roles/build/templates/keycloak/Dockerfile.j2
index 561a6466f121ee2462dab388ed99a580f16ba39c..1b1d181af974dbdcd8882c4eeeb1e0d63c2a8e40 100644
--- a/roles/build/templates/keycloak/Dockerfile.j2
+++ b/roles/build/templates/keycloak/Dockerfile.j2
@@ -34,9 +34,6 @@ ENV PATH="/opt/jboss/keycloak/bin:${PATH}"
WORKDIR /opt/jboss/keycloak
-EXPOSE 8080
-EXPOSE 8443
-
RUN echo 'jboss ALL=(ALL:ALL) NOPASSWD: ALL' >> /etc/sudoers
COPY keycloaksupervisord.conf /etc/supervisord.conf
diff --git a/roles/build/templates/kibana/Dockerfile.j2 b/roles/build/templates/kibana/Dockerfile.j2
index ef2a4768f809d02b8320cb90963ea701cbddec16..db7d064db56e385b1c695a349db18a610346e5a3 100644
--- a/roles/build/templates/kibana/Dockerfile.j2
+++ b/roles/build/templates/kibana/Dockerfile.j2
@@ -17,7 +17,6 @@ RUN rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch && \
RUN echo 'kibana ALL=(ALL:ALL) NOPASSWD: ALL' >> /etc/sudoers
-EXPOSE 5601
COPY kibanasupervisord.conf /etc/supervisord.conf
ENTRYPOINT ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
diff --git a/roles/build/templates/misp/Dockerfile.j2 b/roles/build/templates/misp/Dockerfile.j2
index 4f7518b56e168bcfd5229d4a1381c48dc09b9560..f5e6557cb0d00a5e45dfcac089452e00ebbeb6fc 100644
--- a/roles/build/templates/misp/Dockerfile.j2
+++ b/roles/build/templates/misp/Dockerfile.j2
@@ -80,9 +80,6 @@ RUN chown -R apache:apache /var/www/MISP ; \
COPY misp_rh-php72-php-fpm /etc/logrotate.d/rh-php72-php-fpm
-# 80/443 - MISP web server, 3306 - mysql, 6379 - redis, 6666 - MISP modules, 50000 - MISP ZeroMQ
-EXPOSE 80 443 6443 6379 6666 50000
-
ENV PATH "$PATH:/opt/rh/rh-php72/root/bin/"
COPY mispsupervisord.conf /etc/supervisord.conf
diff --git a/roles/build/templates/mysql/Dockerfile.j2 b/roles/build/templates/mysql/Dockerfile.j2
index 393eb3f8a06e049cbdb9b180f0cd4f093e7e86ab..6ce391e96c27329b3284d415e6277ce0b3d8110a 100644
--- a/roles/build/templates/mysql/Dockerfile.j2
+++ b/roles/build/templates/mysql/Dockerfile.j2
@@ -6,7 +6,6 @@ RUN yum -y update && yum install -y epel-release centos-release-scl scl-utils &&
/usr/bin/scl enable rh-mariadb103 -- /opt/rh/rh-mariadb103/root/usr/libexec/mysql-prepare-db-dir /var/opt/rh/rh-mariadb103/lib/mysql
RUN yum clean all
-EXPOSE 3306
COPY mysqlsupervisord.conf /etc/supervisord.conf
ENTRYPOINT ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
diff --git a/roles/build/templates/nifi/Dockerfile.j2 b/roles/build/templates/nifi/Dockerfile.j2
index f85cf4788654c054d76d7f85697d46387ad60c9d..5f8298bbbda5c1b37571007191c305f28c6f1ab7 100644
--- a/roles/build/templates/nifi/Dockerfile.j2
+++ b/roles/build/templates/nifi/Dockerfile.j2
@@ -83,7 +83,6 @@ RUN curl -fSL ${MIRROR_BASE_URL}/${NIFI_BINARY_PATH} -o ${NIFI_BASE_DIR}/nifi-${
RUN echo "#!/bin/sh\n" > $NIFI_HOME/bin/nifi-env.sh
# Web HTTP(s) & Socket Site-to-Site Ports
-EXPOSE 8080 8443 10000 8000
WORKDIR ${NIFI_HOME}
diff --git a/roles/build/templates/odfekibana/Dockerfile-kibana.j2 b/roles/build/templates/odfekibana/Dockerfile-kibana.j2
index 05a1c40b3ac3cb718e524cef5225102e7ece1e55..e61707f4e5eae7e83b4c0fb023ebf3916621dc55 100644
--- a/roles/build/templates/odfekibana/Dockerfile-kibana.j2
+++ b/roles/build/templates/odfekibana/Dockerfile-kibana.j2
@@ -17,7 +17,6 @@ RUN rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch && \
RUN echo 'kibana ALL=(ALL:ALL) NOPASSWD: ALL' >> /etc/sudoers
-EXPOSE 5601
COPY kibanasupervisord.conf /etc/supervisord.conf
ENTRYPOINT ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
diff --git a/roles/build/templates/thehive/Dockerfile.j2 b/roles/build/templates/thehive/Dockerfile.j2
index c1df6fa7d77aaf2a1ce21b10c28b69a00b952d43..fa330f38aef5f963d5694817eef8a803f4c322d2 100644
--- a/roles/build/templates/thehive/Dockerfile.j2
+++ b/roles/build/templates/thehive/Dockerfile.j2
@@ -15,6 +15,5 @@ RUN echo "[thehive-project]" > /etc/yum.repos.d/thehive.repo && \
mkdir -p /home/thehive && \
chown -R thehive:thehive /home/thehive /etc/thehive && \
yum -y clean all
-EXPOSE 9000
COPY thehivesupervisord.conf /etc/supervisord.conf
ENTRYPOINT ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
diff --git a/roles/build/templates/zookeeper/Dockerfile.j2 b/roles/build/templates/zookeeper/Dockerfile.j2
index 19ae977882802ec3725ce8f7875b4801786153cf..a3fd1505d329212c7868a58c6de432403f9ac58e 100644
--- a/roles/build/templates/zookeeper/Dockerfile.j2
+++ b/roles/build/templates/zookeeper/Dockerfile.j2
@@ -25,7 +25,7 @@ RUN curl -fSL ${MIRROR_BASE_URL}/${ZOOKEEPER_BINARY_PATH} -o ${ZOOKEEPER_BASE_DI
&& cp ${ZOOKEEPER_BASE_DIR}/zookeeper/conf/zoo_sample.cfg ${ZOOKEEPER_BASE_DIR}/zookeeper/conf/zoo.cfg
# Web HTTP(s) & Socket Site-to-Site Ports
-EXPOSE 2181 2888 3888
+#EXPOSE 2181 2888 3888
WORKDIR ${ZOOKEEPER_BASE_DIR}/zookeeper
diff --git a/roles/docker/tasks/haproxy.yml b/roles/docker/tasks/haproxy.yml
index 5fb181e93d2ca094431d4d7e7b5a1835d52c2533..665c5e7a4ef55326fc5a961a5f81370455d0876f 100644
--- a/roles/docker/tasks/haproxy.yml
+++ b/roles/docker/tasks/haproxy.yml
@@ -9,16 +9,17 @@
- name: "{{ soctools_netname}}"
networks_cli_compatible: yes
published_ports:
- - "443:443"
- "8888:8888"
- - "8443:8443"
- "9443:9443"
- "9200:9200"
- "7750:7750"
- - "5000-5099:5000-5099"
- - "6000-6099:6000-6099"
- "9000:9000"
- "9001:9001"
+ - "12443:12443"
+ - "5601:5601"
+ - "6443:6443"
+ - "5000-5099:5000-5099"
+ - "6000-6099:6000-6099"
interactive: "yes"
tags:
- start-docker-containers
diff --git a/roles/docker/tasks/keycloak.yml b/roles/docker/tasks/keycloak.yml
index dfc073cbc62c75d2605d51202b7285d9b71c02e3..719344903170c49c8166204108efd2ff99f73e98 100644
--- a/roles/docker/tasks/keycloak.yml
+++ b/roles/docker/tasks/keycloak.yml
@@ -8,8 +8,6 @@
networks:
- name: "{{ soctools_netname }}"
networks_cli_compatible: yes
- published_ports:
- - "12443:8443"
interactive: "yes"
with_items: "{{ groups['keycloakcontainers'] }}"
tags:
diff --git a/roles/docker/tasks/misp.yml b/roles/docker/tasks/misp.yml
index 953f3869b88613156415ed87ad02f9b54236a0d7..acba5eadac6af1f644a5177df1f7c7716afc6492 100644
--- a/roles/docker/tasks/misp.yml
+++ b/roles/docker/tasks/misp.yml
@@ -9,8 +9,6 @@
- name: "{{ soctools_netname}}"
interactive: "yes"
networks_cli_compatible: yes
- published_ports:
- - "6443:6443"
tags:
- start-docker-containers
diff --git a/roles/docker/tasks/odfekibana.yml b/roles/docker/tasks/odfekibana.yml
index af5662297eef035ece118686b1ae6c4865f2a082..8426ce61d2d839917dca6fddfb7166a52f39d7cc 100644
--- a/roles/docker/tasks/odfekibana.yml
+++ b/roles/docker/tasks/odfekibana.yml
@@ -8,8 +8,6 @@
networks:
- name: "{{ soctools_netname }}"
networks_cli_compatible: yes
- published_ports:
- - "5601:5601"
interactive: "yes"
with_items: "{{ groups['odfekibanacontainers'] }}"
tags:
diff --git a/roles/haproxy/templates/haproxy.cfg.j2 b/roles/haproxy/templates/haproxy.cfg.j2
index 86ee05bfc6fef364b734bea561560f412271ed36..a66a23440dc4718f55d85a4272c213750ed3ac86 100644
--- a/roles/haproxy/templates/haproxy.cfg.j2
+++ b/roles/haproxy/templates/haproxy.cfg.j2
@@ -49,7 +49,7 @@ listen odfeserv
{% endfor %}
listen keycloakserv
- bind *:10443 ssl crt /etc/ssl/haproxy alpn h2,http/1.1
+ bind *:12443 ssl crt /etc/ssl/haproxy alpn h2,http/1.1
mode http
maxconn 5000
fullconn 5000
@@ -86,36 +86,30 @@ listen cortexserv
server {{cortexhost}} {{cortexhost}}:9001 check verify none
{% endfor %}
-{% for port in range(50, 60) %}
-listen nifiservtcp77{{port}}
- bind *:77{{port}}
- mode tcp
+listen kibanaserv
+ bind *:5601 ssl crt /etc/ssl/haproxy alpn h2,http/1.1
+ mode http
maxconn 5000
fullconn 5000
balance source
option tcpka
- option tcp-check
- option tcplog
- tcp-check connect port 77{{port}}
-{% for nifihost in groups['nificontainers'] %}
- server {{nifihost}} {{nifihost}}:77{{port}} check
-
-{% endfor %}
+ option forwardfor
+ option httplog
+{% for kibanahost in groups['odfekibanacontainers'] %}
+ server {{kibanahost}} {{kibanahost}}:5601 ssl check verify none
{% endfor %}
-
-listen nifiservtcp7771
- bind *:7771
- mode tcp
+listen mispserv
+ bind *:6443 ssl crt /etc/ssl/haproxy alpn h2,http/1.1
+ mode http
maxconn 5000
fullconn 5000
balance source
option tcpka
- option tcp-check
- option tcplog
- tcp-check connect port 7771
-{% for nifihost in groups['nificontainers'] %}
- server {{nifihost}} {{nifihost}}:7771 check
+ option forwardfor
+ option httplog
+{% for misphost in groups['mispcontainers'] %}
+ server {{misphost}} {{misphost}}:6443 ssl check verify none
{% endfor %}