Initial commit

scripts/nessus-bootstrap.sh

@@ -0,0 +1,121 @@
+#!/bin/bash
+# Nessus Bootstrap Script - Fully Automated
+# This script runs as a presync hook to set up Nessus dependencies
+
+set -euo pipefail
+
+echo "=================================================================="
+echo "Nessus Presync - Fully Automated Bootstrap"
+echo "=================================================================="
+echo "This will set up:"
+echo "  ✓ PostgreSQL database (CloudNativePG) with low resources"
+echo "  ✓ Auto-generated database password (via ESO)"
+echo "  ✓ Admin credentials from Vault"
+echo "  ✓ Persistent storage for scan data"
+echo "  ✓ OAuth2-Proxy authentication (Authentik SSO)"
+echo ""
+echo "Expected time: 3-5 minutes"
+echo "=================================================================="
+echo ""
+
+NS=nessus
+CLUSTER=pg-nessus
+
+# Get the script directory and move to repo root
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+cd "${REPO_ROOT}/apps" || exit 1
+
+# 1) Ensure namespace exists
+echo "⚙️  Creating namespace ${NS}..."
+kubectl get ns "${NS}" >/dev/null 2>&1 || kubectl create ns "${NS}"
+
+# 2) Apply CNPG cluster (auto-generates DB password)
+echo "⚙️  Deploying PostgreSQL cluster (low resources)..."
+kubectl apply -f nessus/cnpg-cluster.yaml
+
+# 3) Wait for CNPG cluster to be ready
+echo "⏳ Waiting for PostgreSQL cluster to be ready..."
+kubectl -n "${NS}" wait --for=condition=Ready "cluster/${CLUSTER}" --timeout=300s || {
+  echo "⚠️  WARNING: PostgreSQL cluster not ready yet"
+  echo "   This is normal on first deployment - rerun 'helmfile apply' in a few minutes"
+  exit 0
+}
+echo "✅ PostgreSQL cluster ready"
+echo ""
+
+# 4) Apply ESO secrets (auto-rotate DB passwords)
+echo "⚙️  Configuring auto-rotating database passwords..."
+kubectl apply -f nessus/cnpg-secrets.yaml
+
+# Wait for DB secret to sync
+echo "⏳ Waiting for database secret to sync..."
+for i in {1..30}; do
+  if kubectl -n "${NS}" get secret nessus-db-secret >/dev/null 2>&1; then
+    echo "✅ Database secret synced"
+    break
+  fi
+  echo "   waiting... (attempt $i/30)"
+  sleep 2
+done
+
+# 5) Apply Nessus admin credentials ExternalSecret
+echo "⚙️  Syncing admin credentials from Vault..."
+kubectl apply -f nessus/external-secret.yaml
+
+# Wait for admin secret to sync
+echo "⏳ Waiting for admin credentials to sync from Vault..."
+for i in {1..30}; do
+  if kubectl -n "${NS}" get secret nessus-admin-credentials >/dev/null 2>&1; then
+    echo "✅ Admin credentials synced from Vault"
+    break
+  fi
+  echo "   waiting... (attempt $i/30)"
+  sleep 2
+done
+
+# Check if credentials exist in Vault
+if ! kubectl -n "${NS}" get secret nessus-admin-credentials >/dev/null 2>&1; then
+  echo ""
+  echo "⚠️  WARNING: Nessus admin credentials not found in Vault!"
+  echo ""
+  echo "BOOTSTRAP REQUIRED - Run this command first:"
+  echo "=================================================================="
+  echo "kubectl exec -n vault vault-0 -- vault kv put secret/nessus \\"
+  echo "  admin-username=\"admin\" \\"
+  echo "  admin-password=\"YourSecurePassword123!\""
+  echo "=================================================================="
+  echo ""
+  echo "After storing credentials, rerun: helmfile apply"
+  echo ""
+  exit 1
+fi
+
+# 6) Apply PVC for Nessus scan data
+echo "⚙️  Creating persistent storage for scan data..."
+kubectl apply -f nessus/pvc.yaml
+
+# 7) Apply Nessus deployment
+echo "⚙️  Deploying Nessus scanner..."
+kubectl apply -f nessus/deployment.yaml
+
+# 8) Apply Nessus ingress
+echo "⚙️  Configuring ingress with OAuth2-Proxy..."
+kubectl apply -f nessus/ingress.yaml
+
+echo ""
+echo "✅ Nessus presync complete - fully automated!"
+echo ""
+echo "=================================================================="
+echo "IMPORTANT: First-time setup instructions"
+echo "=================================================================="
+echo ""
+echo "If you haven't already, store Nessus credentials in Vault:"
+echo ""
+echo "kubectl exec -n vault vault-0 -- vault kv put secret/nessus \\"
+echo "  admin-username=\"admin\" \\"
+echo "  admin-password=\"YourSecurePassword123!\""
+echo ""
+echo "Then rerun: helmfile apply"
+echo "=================================================================="
+echo ""