From 935e48215e4e2f708bc2c74bea29e3f6d7f3599f Mon Sep 17 00:00:00 2001 From: vladd-bit Date: Wed, 4 Mar 2026 12:31:31 +0000 Subject: [PATCH 1/3] Docs: updated ES/OS setup docs. --- docs/deploy/services.md | 14 ++++++++++++- docs/security/elasticsearch_opensearch.md | 24 ++++++++++++++++++++++- 2 files changed, 36 insertions(+), 2 deletions(-) diff --git a/docs/deploy/services.md b/docs/deploy/services.md index 288290cf..3874707a 100644 --- a/docs/deploy/services.md +++ b/docs/deploy/services.md @@ -410,11 +410,23 @@ Web UI for exploring indexed data, visualising documents, managing index templat - URL: **https://localhost:5601** -#### credentials +#### Credentials - **OpenSearch Dashboards:** `admin` / `admin` - **Elasticsearch Native:** `elastic` / `kibanaserver` +#### First login setup (OpenSearch Dashboards) + +After signing in to OpenSearch Dashboards: + +1. Open the user menu and choose **Switch tenant**. +2. Select `Global` so saved objects are shared across users/roles. +3. Go to **Stack Management** → **Workspaces** and click **Create workspace**. +4. Create a workspace (for example `cogstack-main`) in the `Global` tenant. +5. Create data views/dashboards in that workspace. + +`Private` tenant is isolated per user and should be avoided for shared environments. + #### Containers - `cogstack-kibana` (OpenSearch Dashboards or Kibana depending on configuration) diff --git a/docs/security/elasticsearch_opensearch.md b/docs/security/elasticsearch_opensearch.md index 90f96466..65a3331a 100644 --- a/docs/security/elasticsearch_opensearch.md +++ b/docs/security/elasticsearch_opensearch.md @@ -145,7 +145,7 @@ security/certificates/elastic/opensearch/ | **Kibana** | `elasticsearch-{1,2,3}.crt`, `elasticsearch-{1,2,3}.key`, `elastic-stack-ca.crt.pem` | `security/certificates/elastic/elasticsearch/` | | **OpenDashboard (OpenSearch)** | `admin.pem`, `admin-key.pem`, `es_kibana_client.pem`, `es_kibana_client.key` | `security/certificates/elastic/opensearch/` | -All certificate references in `services/kibana/config/kibana_opensearch.yml` or `services.yml` must point to these locations. +All certificate references in `services/kibana/config/opensearch.yml` or `services.yml` must point to these locations. --- @@ -218,6 +218,28 @@ Troubleshooting: OpenSearch includes default roles (`admin`, `kibanaserver`, `readall`, `snapshotrestore`, etc.) — always change their passwords after first run. +##### OpenSearch Dashboards post-login setup (Global tenant + workspace) + +After your first login to `https://localhost:5601` (default: `admin` / `admin`): + +1. Open the user menu (top-right) and select **Switch tenant**. +2. Select `Global`, then apply the change. +3. Open **Stack Management** → **Workspaces** (or the workspace switcher in the header) and click **Create workspace**. +4. Enter a workspace name (for example `cogstack-main`) and keep it in the `Global` tenant. +5. Save, then create data views and dashboards inside this workspace. + +Use `Global` for shared dashboards and saved objects. +`Private` tenant content is user-specific and not visible to other users. + +If tenant switching or workspace creation is not available in the UI, verify these settings in `services/kibana/config/opensearch.yml`: + +```yaml +opensearch_security.multitenancy.enabled: true +opensearch_security.multitenancy.tenants.enable_global: true +opensearch_security.multitenancy.tenants.preferred: ["Global"] +workspace.enabled: true +``` + --- #### Elasticsearch (native) From fefb1e1d00b2fafde2f9c696a03be68ef85e18c1 Mon Sep 17 00:00:00 2001 From: vladd-bit Date: Wed, 22 Apr 2026 09:06:58 +0100 Subject: [PATCH 2/3] NiFi: fixed localhost url issues after 2.9 update. --- deploy/nifi.env | 5 +++-- nifi/Dockerfile | 6 +++--- services/nginx/config/nginx.conf.template | 7 +++++++ 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/deploy/nifi.env b/deploy/nifi.env index 7dedcbfd..4fdc3fcf 100644 --- a/deploy/nifi.env +++ b/deploy/nifi.env @@ -44,8 +44,9 @@ NIFI_WEB_PROXY_CONTEXT_PATH="/nifi" # if you wish to run NiFi on another port, this goes for both NIFI_WEB_PROXY_HOST and NIFI_INTERNAL_PORT # you will also need to change the NGINX configuration -# if you wish to -NIFI_WEB_PROXY_HOST="localhost:8443" +# If browsers have trouble with localhost-scoped auth cookies, using 127.0.0.1 +# avoids the special-case cookie handling around localhost. +NIFI_WEB_PROXY_HOST="localhost:8443,127.0.0.1:8443" NIFI_INTERNAL_PORT=8443 diff --git a/nifi/Dockerfile b/nifi/Dockerfile index 74cc912d..a164ddd3 100644 --- a/nifi/Dockerfile +++ b/nifi/Dockerfile @@ -4,7 +4,7 @@ FROM apache/nifi:${NIFI_VERSION} SHELL ["/bin/bash", "-o", "pipefail", "-c"] -ARG NIFI_VERSION=2.8.0 +ARG NIFI_VERSION=2.9.0 ARG GROOVY_VERSION=5.0.4 ARG HTTP_PROXY="" @@ -149,8 +149,8 @@ RUN $GROOVY_BIN/grape -V install org.apache.avro avro 1.12.0 # INSTALL NAR extensions WORKDIR /opt/nifi/nifi-current/lib/ -# --- Hotfix: NiFi 2.7.2 + Azure + Netty QUIC missing class (netty 4.2.9.Final) --- -ARG NETTY_VERSION=4.2.9.Final +# --- Hotfix: NiFi 2.7.2 + Azure + Netty QUIC missing class (netty 4.2.12.Final) --- +ARG NETTY_VERSION=4.2.12.Final RUN set -eux; \ cd /opt/nifi/nifi-current/lib; \ curl -fL --retry 5 --retry-delay 2 \ diff --git a/services/nginx/config/nginx.conf.template b/services/nginx/config/nginx.conf.template index a046069a..b80ba73e 100644 --- a/services/nginx/config/nginx.conf.template +++ b/services/nginx/config/nginx.conf.template @@ -83,6 +83,13 @@ http { proxy_ssl_server_name on; + # Firefox has trouble with the localhost-scoped NiFi auth cookie. + # Redirect localhost to 127.0.0.1 so the browser gets a stable IP-scoped + # cookie domain instead. + if ($host = localhost) { + return 308 https://127.0.0.1:8443$request_uri; + } + ssl_certificate /certificates/nifi/nifi.pem; ssl_certificate_key /certificates/nifi/nifi.key; ssl_client_certificate /certificates/root/root-ca.pem; From da4a9b939f4de10cfd6832635e8cab624a89727d Mon Sep 17 00:00:00 2001 From: vladd-bit Date: Wed, 24 Jun 2026 16:17:32 +0100 Subject: [PATCH 3/3] Update submodules to latest release tags (or default branch) --- services/cogstack-jupyter-hub | 2 +- services/cogstack-nlp | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/services/cogstack-jupyter-hub b/services/cogstack-jupyter-hub index 0362e4bc..ea5a6851 160000 --- a/services/cogstack-jupyter-hub +++ b/services/cogstack-jupyter-hub @@ -1 +1 @@ -Subproject commit 0362e4bce262fa72a0b270d4d1a85e76e9109ab0 +Subproject commit ea5a68511702553d7f1ccac41939919fa38b6d86 diff --git a/services/cogstack-nlp b/services/cogstack-nlp index 14cb02e2..7b193624 160000 --- a/services/cogstack-nlp +++ b/services/cogstack-nlp @@ -1 +1 @@ -Subproject commit 14cb02e2c8b8b188cd12f727a20991a3097a6537 +Subproject commit 7b193624e10aa550fec44890b76a4c84cdc65897