https://github.com/osquery/osquery logo
Join Slack
Powered by
hello, i have fleet installed via docker compose a...
# fleet
i
hello, i have fleet installed via docker compose and want to migrate it to other server, how can i do it without redistributing the agent, since it will be reachable always from the same link asset.company.it?
k
As long as the server url isn't changing and that's what you're using as your tls hostname in osquery, you should be good to go.
i
thanks @Kathy Satterlee for the reply, so to do the migration, you confirm that it would be enough to just copy the docker compose file and run it on the new server? the secret key with which the hosts connect will not change? by copying the docker compose without copying the db, will the hosts do the automatic enroll?
k
I'd generally recommend migrating your database as well. If you aren't going to do that, you'll need to make sure you note your enroll secret so that you can apply that to the new Fleet instance. I'd also recommend doing the same with your org settings and agent options just so you don't run in to any surprises.
i
ok, thanks
Hi @Kathy Satterlee I am trying to complete the migration but it fails, to be exact the situation is as follows: in the docker-compose file of the previous server the configuration was as follows: 
fleetdm:
restart: always
container_name: Fleet
image: fleetdm/fleet:v4.34.1
volumes:
- /data/docker/appdata/fleet:/fleet
command: sh -c "echo '\n' | /usr/bin/fleet prepare db && /usr/bin/fleet serve"
environment:
FLEET_MYSQL_ADDRESS: 172.21.0.4:3306
FLEET_MYSQL_DATABASE: fleet
FLEET_MYSQL_USERNAME: app
FLEET_MYSQL_PASSWORD: ***
FLEET_REDIS_ADDRESS: redis:6379
FLEET_SERVER_CERT: /fleet/itl-cslapp-54t.local.crt
FLEET_SERVER_KEY: /fleet/itl-cslapp-54t.local.key
FLEET_LOGGING_JSON: "true"
FLEET_AUTH_JWT_KEY:
ports:
- "443:8080"
networks:
- Proxy
But now adding fleet on the new server I have to keep it in the following situation: pfsense => traefik proxy => Fleet so the tls is handled by the pfsense, is it possible to change the docker-compose configuration to have fleet talk in the clear instead of on port 8080 tls, without having to redistribute the agents that were created with the certificate that was inserted in the docker compose? or other solution? to get the fleet container to communicate to the proxy, I had to add the following lines to docker composem and comment out the port exposure: labels: - "traefik.enable=true" - "traefik.http.routers.fleetdm.rule=Host(
<http://it-asset.company.it|it-asset.company.it>
)" - "traefik.http.routers.fleetdm.entrypoints=web" - "traefik.http.services.fleetdm.loadbalancer.server.port=8080"
Open in Slack
PreviousNext
Powered by