Skip to content

Commit ebf8a79

Browse files
emmanuel-knafoemmanuel-knafo
committed
ready to test defect dojo deployment
1 parent cf7d77c commit ebf8a79

7 files changed

Lines changed: 686 additions & 7 deletions

File tree

‎infra/defect-dojo/deployDefectDojo.ps1‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,13 @@ param (
1212
[Parameter()]
1313
[string]$subscriptionId = "IT Test",
1414
[Parameter()]
15-
[string]$sshKeyPath = "$HOME\.ssh\vm-defectdojo-${nameSuffix}-id_rsa"
15+
[string]$sshKeyPath = "$HOME\.ssh\vm-defectdojo-${nameSuffix}-id_rsa",
16+
[Parameter()]
17+
[string] $username = "ddadmin",
18+
[Parameter()]
19+
[string] $password = "booWgDmaYdgNxO5eNWql",
20+
[Parameter()]
21+
[string] $adminUsername = "azureuser"
1622
)
1723

1824
# function to generate random password
@@ -70,9 +76,9 @@ Write-Output "Public key:"
7076
$sshPublicKey = Get-Content "$sshKeyPath.pub"
7177
Write-Output $sshPublicKey
7278

73-
# generate random password for postgresql
74-
$password = New-Password -length 32
75-
Write-Output "Generated password for PostgreSQL: $password"
79+
# # generate random password for postgresql
80+
# $password = New-Password -length 32
81+
# Write-Output "Generated password for PostgreSQL: $password"
7682

7783
# deploy bicep
7884
Write-Output "Deploying bicep template $templateFile to resource group $resourceGroupName"
@@ -82,7 +88,9 @@ az deployment group create `
8288
--template-file main.bicep `
8389
--parameters sshPublicKey="`"$sshPublicKey`"" `
8490
--parameters administratorLoginPassword="`"$password`"" `
85-
--parameters nameSuffix="`"$nameSuffix`""
91+
--parameters nameSuffix="`"$nameSuffix`"" `
92+
--parameters adminUsername="`"$adminUsername`"" `
93+
--parameters administratorLogin="`"$username`"" `
8694

8795
# output vm public ip address from deployment output
8896
$fqdn = (az deployment group show `

‎infra/defect-dojo/main.bicep‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,12 @@ param virtualNetworkName string = 'vnet-vm-defectdojo-${nameSuffix}-${uniqueStri
77
param networkSecurityGroupName string = 'nsg-vm-defectdojo-${nameSuffix}-${uniqueString(resourceGroup().id)}'
88

99
param location string = resourceGroup().location
10-
param adminUsername string = 'azureuser'
10+
param adminUsername string //= 'azureuser'
1111

1212
param sshPublicKey string //= 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4AAZjNhnoNi/tBRwOFPoVg82Ejvt3qLEutQHEUJcBfohXW31R+aeWaGYkz3t4x1nYejoxX2m2Qk8wUsxU0SYhzI9DkOlov39PJ+MoggSGzKnpAUDeJ324kYIlu/2ZkRxkcnnDSe9t32yMWC4KC0tJMNuFzuAObIyi4h5JFJ/f8WqWuWK9uSv1FqnFqvALks8+f1eg5WMw4u4wa5wWBUICGOqVQ4zzQwq+hcAVgCgvi41mJbYn2oVKJyeX2R8mFDjaV+VPRkhgCMphG55ultCkNoH5naLQxLIjSop2ioDxPeYcdqCdO97MSPvkHhwKZgT03R/JJhQJ89Gm8QAdTIGiV5R16vq9EOL83vaVHsJ1jR1zsgDa/EVsQQBmxVNlybs0tgqlgn138Af+1QTNdYQu05fLqd6ara2Wgl61al0HMNjBrLgtJ1To4yxrYJ1iQY9W4I77a4jrq2Sg0ouObgsJu45dwrRpt22Fbh1OWhkfK/XFoEu5O9vr1ghRcZAwxjU= generated-by-azure'
1313

1414
param flexibleServers_psql_name string = 'psql-defectdojo-${nameSuffix}-${uniqueString(resourceGroup().id)}'
15-
param administratorLogin string = 'ddadmin'
15+
param administratorLogin string //= 'ddadmin'
1616

1717
param dnsLabelPrefix string = 'app-defectdojo-${nameSuffix}-${uniqueString(resourceGroup().id)}'
1818

‎infra/defect-dojo/post-install/docker-compose.override.https.initializefalse.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
version: '3.8'
3+
services:
4+
nginx:
5+
environment:
6+
USE_TLS: 'true'
7+
GENERATE_TLS_CERTIFICATE: 'false' # Set to 'true' to generate a self-signed certificate,
8+
# otherwise false if you have your own certificate e.g. from Let's Encrypt
9+
ports:
10+
- target: 8443
11+
published: ${DD_TLS_PORT:-8443}
12+
protocol: tcp
13+
mode: host
14+
uwsgi:
15+
environment:
16+
DD_SESSION_COOKIE_SECURE: 'True'
17+
DD_CSRF_COOKIE_SECURE: 'True'
18+
initializer:
19+
environment:
20+
DD_INITIALIZE: 'False' # Set to 'True' to initialize the database, otherwise false if you have already initialized the database

‎infra/defect-dojo/post-install/docker/environments/postgres-redis.env‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
DD_DATABASE_URL=postgresql://__DD_DATABASE_USER__:__DD_DATABASE_PASSWORD__@__DD_DATABASE_HOST__:__DD_DATABASE_PORT__/__DD_DATABASE_NAME__
2+
DD_DATABASE_ENGINE=django.db.backends.postgresql
3+
DD_DATABASE_HOST=__DD_DATABASE_HOST__
4+
DD_DATABASE_PORT=__DD_DATABASE_PORT__
5+
6+
DD_DATABASE_NAME=__DD_DATABASE_NAME__
7+
DD_DATABASE_USER=__DD_DATABASE_USER__
8+
DD_DATABASE_PASSWORD=__DD_DATABASE_PASSWORD__
9+
10+
DD_TEST_DATABASE_NAME=test_defectdojo
11+
DD_TEST_DATABASE_URL=postgresql://defectdojo:defectdojo@postgres:5432/test_defectdojo
12+
13+
DD_CELERY_BROKER_URL=redis://redis:6379/0
14+
15+
DD_DOCKERCOMPOSE_DATABASE=postgres
16+
DD_DOCKERCOMPOSE_BROKER=redis

‎infra/defect-dojo/post-install/post-install.sh‎

Lines changed: 229 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,229 @@
1+
# prompt the user for the variables
2+
# ask for the instance name
3+
#echo "Enter the instance name (e.g. defectdojo-002):"
4+
#read instanceName
5+
#echo "Instance name is: $instanceName"
6+
# set as environment variable
7+
export instanceName="app-defectdojo-ek005"
8+
9+
# set all variables here:
10+
export USERNAME="ddadmin"
11+
export PASSWORD="booWgDmaYdgNxO5eNWql"
12+
export postgresHostname="$instanceName-postgresql.devopsshield.com"
13+
export NEWHOSTNAME="$instanceName.devopsshield.com"
14+
export nginx_folder="$HOME/django-DefectDojo/nginx"
15+
export databaseName="defectdojo"
16+
export databasePort="5432"
17+
export doPauses="false" # set to "true" to pause after each step
18+
# wait time for the container to be up and migrations to be done
19+
export waitTime=300
20+
21+
export EMAIL="emmanuel.knafo@devopsshield.com"
22+
export adminUser="emmanuel"
23+
export adminPassword="N9rw04entPmou3Rbf6JP!"
24+
25+
# check that the hostname is correct
26+
echo "The hostname is: $NEWHOSTNAME"
27+
# check that it resolves to the correct IP
28+
echo "The IP address for the hostname is:"
29+
dig +short $NEWHOSTNAME
30+
31+
32+
# update the system
33+
# skip a line
34+
echo ""
35+
echo "STEP 1: Updating the system"
36+
echo "==========================="
37+
38+
# disble auto updates
39+
sudo apt-get update -y
40+
sudo apt-get upgrade -y
41+
#sudo apt-get autoremove -y
42+
#sudo apt-get autoclean -y
43+
sudo NEEDRESTART_MODE=a apt-get dist-upgrade --yes
44+
45+
# find and replace the variables in the files
46+
find $HOME/OSS_django-DefectDojo/docker/environments/postgres-redis.env -type f -exec sed -i "s/__DD_DATABASE_USER__/$USERNAME/g" {} \;
47+
find $HOME/OSS_django-DefectDojo/docker/environments/postgres-redis.env -type f -exec sed -i "s/__DD_DATABASE_PASSWORD__/$PASSWORD/g" {} \;
48+
find $HOME/OSS_django-DefectDojo/docker/environments/postgres-redis.env -type f -exec sed -i "s/__DD_DATABASE_HOST__/$postgresHostname/g" {} \;
49+
find $HOME/OSS_django-DefectDojo/docker/environments/postgres-redis.env -type f -exec sed -i "s/__DD_DATABASE_NAME__/$databaseName/g" {} \;
50+
find $HOME/OSS_django-DefectDojo/docker/environments/postgres-redis.env -type f -exec sed -i "s/__DD_DATABASE_PORT__/$databasePort/g" {} \;
51+
52+
# show the files
53+
cat $HOME/OSS_django-DefectDojo/docker/environments/postgres-redis.env
54+
55+
# pause if needed
56+
if [ "$doPauses" = "true" ]; then
57+
read -p "Press enter to continue"
58+
fi
59+
60+
echo ""
61+
echo "STEP 2: Installing Docker and Docker Compose"
62+
echo "============================================"
63+
64+
# install docker and docker compose
65+
# on Ubuntu 22.04
66+
# Add Docker's official GPG key:
67+
sudo apt-get update -y
68+
sudo apt-get install ca-certificates curl -y
69+
sudo install -m 0755 -d /etc/apt/keyrings
70+
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
71+
sudo chmod a+r /etc/apt/keyrings/docker.asc
72+
73+
# Add the repository to Apt sources:
74+
echo \
75+
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
76+
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
77+
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
78+
sudo apt-get update -y
79+
80+
# install docker-compose
81+
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin -y
82+
83+
# allow to run docker without sudo
84+
sudo groupadd docker
85+
sudo usermod -aG docker $USER
86+
sudo apt install acl -y
87+
sudo setfacl -m user:$USER:rw /var/run/docker.sock
88+
docker run hello-world
89+
90+
# pause if needed
91+
if [ "$doPauses" = "true" ]; then
92+
read -p "Press enter to continue"
93+
fi
94+
95+
echo ""
96+
echo "STEP 3: Fix hostname and create certificates"
97+
echo "============================================"
98+
99+
# hostname change
100+
# set the hostname
101+
sudo hostnamectl set-hostname $NEWHOSTNAME
102+
sudo hostnamectl set-hostname "Defect Dojo VM" --pretty
103+
sudo hostnamectl set-hostname $NEWHOSTNAME --static
104+
sudo hostnamectl set-hostname $NEWHOSTNAME --transient
105+
106+
# check hostname
107+
hostnamectl
108+
109+
# create certificates using certbot -- should be done after the DNS is set
110+
# may need to set dns entry for the hostname
111+
sudo apt-get update -y
112+
sudo apt-get install certbot -y
113+
sudo certbot certonly --standalone --non-interactive -d $NEWHOSTNAME --agree-tos --email $EMAIL
114+
115+
# copy certificates to the nginx folder
116+
sudo cp /etc/letsencrypt/live/$NEWHOSTNAME/fullchain.pem $nginx_folder/nginx.crt
117+
sudo cp /etc/letsencrypt/live/$NEWHOSTNAME/privkey.pem $nginx_folder/nginx.key
118+
ls -ls $nginx_folder
119+
120+
# pause if needed
121+
if [ "$doPauses" = "true" ]; then
122+
read -p "Press enter to continue"
123+
fi
124+
125+
echo ""
126+
echo "STEP 4: Install Postgresql client and create database"
127+
echo "====================================================="
128+
129+
# install postgresql client
130+
sudo apt update -y
131+
sudo apt install gnupg2 wget vim -y
132+
sudo sh -c 'echo "deb https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
133+
sudo wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
134+
sudo apt update -y
135+
sudo apt-get install postgresql-client-16 -y
136+
137+
#psql "postgres://$USERNAME:$PASSWORD@$postgresHostname:5432/postgres"
138+
139+
# create database and user in psql client
140+
141+
# create the database with psql then exit
142+
echo "CREATE DATABASE defectdojo on $postgresHostname"
143+
psql "postgres://$USERNAME:$PASSWORD@$postgresHostname:5432/postgres" -c 'create database defectdojo;'
144+
145+
#psql "postgres://$USERNAME:$PASSWORD@$postgresHostname:5432/postgres" -c 'create database defectdojo; quit();'
146+
147+
# pause if needed
148+
if [ "$doPauses" = "true" ]; then
149+
read -p "Press enter to continue"
150+
fi
151+
152+
echo ""
153+
echo "STEP 5: Install DefectDojo"
154+
echo "=========================="
155+
156+
rm -f docker-compose.override.yml
157+
ln -s docker-compose.override.https.yml docker-compose.override.yml
158+
159+
echo "current docker-compose.override.yml"
160+
cat docker-compose.override.yml
161+
162+
# build and run the docker-compose
163+
# first time should take a while
164+
sudo ./dc-build.sh
165+
#sudo ./dc-up.sh
166+
sudo ./dc-up-d.sh
167+
168+
# check the logs if your quick
169+
# look for the Admin user
170+
# loop until the logs are available
171+
#docker logs dojo-initializer-1 | grep Admin
172+
173+
# wait for container to be up and migrations to be done
174+
echo "Waiting for the container to be up and migrations to be done for $waitTime seconds..."
175+
sleep $waitTime
176+
177+
# pause if needed
178+
if [ "$doPauses" = "true" ]; then
179+
read -p "Press enter to continue"
180+
fi
181+
182+
echo ""
183+
echo "STEP 6: Create a superuser"
184+
echo "=========================="
185+
186+
# create a superuser
187+
#docker exec -it oss_django-defectdojo-uwsgi-1 /bin/bash
188+
#python manage.py createsuperuser
189+
#export DJANGO_SUPERUSER_PASSWORD="admin7"; python manage.py createsuperuser --no-input --username admin7 --email admin7@defectdojo.local;
190+
#docker exec oss_django-defectdojo-uwsgi-1 /bin/bash -c 'export DJANGO_SUPERUSER_PASSWORD="admin9"; python manage.py createsuperuser --no-input --username admin9 --email admin9@defectdojo.local;'
191+
192+
export COMMAND="export DJANGO_SUPERUSER_PASSWORD="$adminPassword"; export DJANGO_SUPERUSER_USERNAME="$adminUser"; export DJANGO_SUPERUSER_EMAIL="$EMAIL"; python manage.py createsuperuser --no-input"
193+
echo "COMMAND: $COMMAND"
194+
docker exec oss_django-defectdojo-uwsgi-1 /bin/bash -c "$COMMAND"
195+
196+
# test the application
197+
# open a browser and go to https://$NEWHOSTNAME:8443/dashboard
198+
echo "https://$NEWHOSTNAME:8443/dashboard"
199+
200+
# pause if needed
201+
if [ "$doPauses" = "true" ]; then
202+
read -p "Press enter to continue"
203+
fi
204+
205+
echo ""
206+
echo "STEP 7: Setup systemd service for docker-compose automation"
207+
echo "==========================================================="
208+
209+
# put back DD_INITIALIZE to false
210+
rm -f docker-compose.override.yml
211+
ln -s docker-compose.override.https.initializefalse.yml docker-compose.override.yml
212+
213+
echo "current docker-compose.override.yml"
214+
cat docker-compose.override.yml
215+
216+
# docker-compose service
217+
sudo cp $HOME/OSS_django-DefectDojo/systemd/defectdojo-composer.service /etc/systemd/system/
218+
sudo systemctl enable defectdojo-composer
219+
220+
echo ""
221+
echo "STEP 8: Double check there are 5 running containers"
222+
echo "==================================================="
223+
224+
docker ps
225+
226+
echo "Done!"
227+
echo "The DefectDojo instance is now available at https://$NEWHOSTNAME:8443/dashboard"
228+
echo "The superuser is $adminUser with password $adminPassword"
229+
echo "Don't forget to change the password for the superuser!"

0 commit comments

Comments
 (0)