mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
122 lines
4.1 KiB
Bash
Executable File
122 lines
4.1 KiB
Bash
Executable File
#!/bin/bash
|
|
# Nessus Bootstrap Script - Fully Automated
|
|
# This script runs as a presync hook to set up Nessus dependencies
|
|
|
|
set -euo pipefail
|
|
|
|
echo "=================================================================="
|
|
echo "Nessus Presync - Fully Automated Bootstrap"
|
|
echo "=================================================================="
|
|
echo "This will set up:"
|
|
echo " ✓ PostgreSQL database (CloudNativePG) with low resources"
|
|
echo " ✓ Auto-generated database password (via ESO)"
|
|
echo " ✓ Admin credentials from Vault"
|
|
echo " ✓ Persistent storage for scan data"
|
|
echo " ✓ OAuth2-Proxy authentication (Authentik SSO)"
|
|
echo ""
|
|
echo "Expected time: 3-5 minutes"
|
|
echo "=================================================================="
|
|
echo ""
|
|
|
|
NS=nessus
|
|
CLUSTER=pg-nessus
|
|
|
|
# Get the script directory and move to repo root
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
|
|
cd "${REPO_ROOT}/apps" || exit 1
|
|
|
|
# 1) Ensure namespace exists
|
|
echo "⚙️ Creating namespace ${NS}..."
|
|
kubectl get ns "${NS}" >/dev/null 2>&1 || kubectl create ns "${NS}"
|
|
|
|
# 2) Apply CNPG cluster (auto-generates DB password)
|
|
echo "⚙️ Deploying PostgreSQL cluster (low resources)..."
|
|
kubectl apply -f nessus/cnpg-cluster.yaml
|
|
|
|
# 3) Wait for CNPG cluster to be ready
|
|
echo "⏳ Waiting for PostgreSQL cluster to be ready..."
|
|
kubectl -n "${NS}" wait --for=condition=Ready "cluster/${CLUSTER}" --timeout=300s || {
|
|
echo "⚠️ WARNING: PostgreSQL cluster not ready yet"
|
|
echo " This is normal on first deployment - rerun 'helmfile apply' in a few minutes"
|
|
exit 0
|
|
}
|
|
echo "✅ PostgreSQL cluster ready"
|
|
echo ""
|
|
|
|
# 4) Apply ESO secrets (auto-rotate DB passwords)
|
|
echo "⚙️ Configuring auto-rotating database passwords..."
|
|
kubectl apply -f nessus/cnpg-secrets.yaml
|
|
|
|
# Wait for DB secret to sync
|
|
echo "⏳ Waiting for database secret to sync..."
|
|
for i in {1..30}; do
|
|
if kubectl -n "${NS}" get secret nessus-db-secret >/dev/null 2>&1; then
|
|
echo "✅ Database secret synced"
|
|
break
|
|
fi
|
|
echo " waiting... (attempt $i/30)"
|
|
sleep 2
|
|
done
|
|
|
|
# 5) Apply Nessus admin credentials ExternalSecret
|
|
echo "⚙️ Syncing admin credentials from Vault..."
|
|
kubectl apply -f nessus/external-secret.yaml
|
|
|
|
# Wait for admin secret to sync
|
|
echo "⏳ Waiting for admin credentials to sync from Vault..."
|
|
for i in {1..30}; do
|
|
if kubectl -n "${NS}" get secret nessus-admin-credentials >/dev/null 2>&1; then
|
|
echo "✅ Admin credentials synced from Vault"
|
|
break
|
|
fi
|
|
echo " waiting... (attempt $i/30)"
|
|
sleep 2
|
|
done
|
|
|
|
# Check if credentials exist in Vault
|
|
if ! kubectl -n "${NS}" get secret nessus-admin-credentials >/dev/null 2>&1; then
|
|
echo ""
|
|
echo "⚠️ WARNING: Nessus admin credentials not found in Vault!"
|
|
echo ""
|
|
echo "BOOTSTRAP REQUIRED - Run this command first:"
|
|
echo "=================================================================="
|
|
echo "kubectl exec -n vault vault-0 -- vault kv put secret/nessus \\"
|
|
echo " admin-username=\"admin\" \\"
|
|
echo " admin-password=\"YourSecurePassword123!\""
|
|
echo "=================================================================="
|
|
echo ""
|
|
echo "After storing credentials, rerun: helmfile apply"
|
|
echo ""
|
|
exit 1
|
|
fi
|
|
|
|
# 6) Apply PVC for Nessus scan data
|
|
echo "⚙️ Creating persistent storage for scan data..."
|
|
kubectl apply -f nessus/pvc.yaml
|
|
|
|
# 7) Apply Nessus deployment
|
|
echo "⚙️ Deploying Nessus scanner..."
|
|
kubectl apply -f nessus/deployment.yaml
|
|
|
|
# 8) Apply Nessus ingress
|
|
echo "⚙️ Configuring ingress with OAuth2-Proxy..."
|
|
kubectl apply -f nessus/ingress.yaml
|
|
|
|
echo ""
|
|
echo "✅ Nessus presync complete - fully automated!"
|
|
echo ""
|
|
echo "=================================================================="
|
|
echo "IMPORTANT: First-time setup instructions"
|
|
echo "=================================================================="
|
|
echo ""
|
|
echo "If you haven't already, store Nessus credentials in Vault:"
|
|
echo ""
|
|
echo "kubectl exec -n vault vault-0 -- vault kv put secret/nessus \\"
|
|
echo " admin-username=\"admin\" \\"
|
|
echo " admin-password=\"YourSecurePassword123!\""
|
|
echo ""
|
|
echo "Then rerun: helmfile apply"
|
|
echo "=================================================================="
|
|
echo ""
|