# 安裝基礎環境
yum install git
curl -fsSL https://get.docker.com | bash -s docker --mirror Aliyun
sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose

# 拉取docker elasticsearch/kibana 環境
cd /opt
git clone https://github.com/117503445/elasticsearch-deploy.git
# deploy edit password in .env

docker-compose up -d
# 檢視日誌
docker logs -f

# visit http://localhost:5601
# default username: elastic
# default password: mypassword
 

# 配置啟用x-path 白金版
cd /opt/elasticsearch-deploy
curl -XPUT -u elastic:mypassword 'http://172.22.2.222:9200/_xpack/license' -H "Content-Type: application/json" -d @license.json
docker-compose restart

# 配置ldap
# vim elasticsearch.yml

---
## Default Elasticsearch configuration from Elasticsearch base image.
## https://github.com/elastic/elasticsearch/blob/master/distribution/docker/src/docker/config/elasticsearch.yml
#
cluster.name: "docker-cluster"
network.host: 0.0.0.0

## X-Pack settings
## see https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-xpack.html

xpack.security.enabled: true
xpack.monitoring.collection.enabled: true
xpack:
  security:
    authc:
      realms:
        ldap:
          ldap1:
            order: 0
            url: "ldap://172.22.2.22:389"
            bind_dn: "cn=root,ou=管理,ou=企業,dc=tpping,dc=tp"
            user_search:
              base_dn: "ou=技術,ou=企業,dc=tpping,dc=tp"
              filter: "(cn={0})"
            group_search:
              base_dn: "ou=技術,ou=企業,dc=tpping,dc=tp"
            unmapped_groups_as_roles: false
 

# 配置ldap root使用者管理密碼
docker exec -it elasticsearch bash
elasticsearch-keystore add xpack.security.authc.realms.ldap.ldap1.secure_bind_password
# 互動式輸入密碼
docker-compose restart

# 授權chen.da 超級使用者許可權
curl -X PUT -u elastic:mypassword "http://172.22.2.222:9200/_security/role_mapping/admins?pretty" -H 'Content-Type: application/json' -d'
{
  "roles" : [ "superuser" ],
  "rules" : { "field" : {
    "groups" : "cn=chen.da,ou=管理,ou=企業,dc=tpping,dc=tp" 
  } },
  "enabled": true
}
'
# 檢查,可以查出license為正常
curl -XGET -u chen.da:ww232ww http://172.22.2.222:9200/_license