Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!
1. Describe your incident:
After following the steps outlined here to create a self-signed cert:
Setting Up Graylog HTTPS
I’m unable to start any inputs due to the IP address not being verified in the cert. The main issue to me appears to be that the docker container changes that IP every restart, so I’m unable to know which IP to place in the SAN field.
WARN : org.graylog2.shared.rest.resources.ProxiedResource - Failed to call API on node <7f8024d2-680f-4c69-88b1-b51abb2c4484>, cause: Hostname 10.89.0.150 not verified:
2. Describe your environment:
-
OS Information: Redhat 9.4
-
Package Version: Graylog 6.1.1
-
Service logs, configurations, and environment variables:
My docker-comose.yml:
networks:
graynet:
driver: bridge
volumes:
mongo_data:
driver: local
log_data:
driver: local
graylog_data:
driver: local
graylog_journal:
driver: local
services:
mongo:
image: docker.io/mongo:6.0.14-jammy
container_name: mongodb
volumes:
- "${PWD}/data/mongodb/mongo_data:/data/db:z"
networks:
- graynet
restart: unless-stopped
opensearch:
image: opensearchproject/opensearch:2.15.0
container_name: opensearch
environment:
- "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
- "bootstrap.memory_lock=true"
- "discovery.type=single-node"
- "action.auto_create_index=false"
- "plugins.security.ssl.http.enabled=false"
- "plugins.security.disabled=true"
- "OPENSEARCH_INITIAL_ADMIN_PASSWORD=353984727881"
volumes:
- "log_data:/usr/share/opensearch/data:z"
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 65536
hard: 65536
ports:
- 9200:9200/tcp
networks:
- graynet
restart: unless-stopped
graylog:
image: graylog/graylog:6.1
container_name: graylog
environment:
GRAYLOG_PASSWORD_SECRET: "pUj0XLCi2gk74lh3QE6KNIC8eMdiVgiD7UWJBKsWH4LDqUteuO42a0XmuW3RoLrQo5SheDUlGs8VX8GdwZbwkgnhh5xo8J3k"
# Password: admin
GRAYLOG_ROOT_PASSWORD_SHA2: "c775e7b757ede264cd0aa1113bd102661ab38829ca52a6422ab782862f268646"
GRAYLOG_HTTP_BIND_ADDRESS: "0.0.0.0:9000"
GRAYLOG_PUBLISH_URI: "https://graylog.test.com:9000/"
GRAYLOG_HTTP_ENABLE_TLS: "true"
GRAYLOG_HTTP_TLS_CERT_FILE: "/opt/graylog/tls/cert.pem"
GRAYLOG_HTTP_TLS_KEY_FILE: "/opt/graylog/tls/pkcs8-plain.pem"
GRAYLOG_SERVER_JAVA_OPTS: "-Xms8g -Xmx8g -XX:NewRatio=1 -server -XX:+ResizeTLAB -XX:-OmitStackTraceInFastThrow -Djavax.net.ssl.trustStore=/opt/graylog/tls/graylog.jks"
GRAYLOG_TLS_KEY_PASSWORD: "changeit"
GRAYLOG_ELASTICSEARCH_HOSTS: "http://opensearch:9200"
GRAYLOG_MESSAGE_JOURNAL_MAX_SIZE: "10gb"
GRAYLOG_MONGODB_URI: "mongodb://mongodb:27017/graylog"
GRAYLOG_ROOT_TIMEZONE: "America/New_York"
GRAYLOG_TIMEZONE: "America/New_York"
TZ: "America/New_York"
entrypoint: /usr/bin/tini -- wait-for-it opensearch:9200 -- /docker-entrypoint.sh
volumes:
- "${PWD}/config/graylog/graylog.conf:/usr/share/graylog/config/graylog.conf:z"
- "${PWD}/config/tls:/opt/graylog/tls:z"
- "${PWD}/data/graylog/graylog_data:/usr/share/graylog/data/data:z"
- "${PWD}/data/graylog/graylog_journal:/usr/share/graylog/data/journal:z"
networks:
- graynet
restart: always
depends_on:
opensearch:
condition: "service_started"
mongo:
condition: "service_started"
ports:
- 9000:9000/tcp # Graylog web interface and REST API
- 1514:1514/tcp # Syslog
- 1514:1514/udp # Syslog
- 5555:5555/tcp # RAW
- 5555:5555/udp # RAW
- 12201:12201/tcp # GELF
- 12201:12201/udp # GELF
3. What steps have you already taken to try and solve the problem?
I’ve attempted to add the whole range of IP’s to the SAN IP field, but I feel like this isn’t the best way to handle this.
4. How can the community help?
Does anyone have any ideas on what my problem might be?
Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]