allow setting custom settings

.gitignore

@@ -13,3 +13,4 @@ docker-compose.override.yml
 .DS_Store
 .AppleDouble
 .LSOverride
+settings.json

README.md

@@ -100,6 +100,23 @@ If you push a change to add or remove an environment variable, please look in "c
 
 The misp-core container has definitions for minimum safe default settings which are set if needed each time the container starts. They will only be set if there is no existing entry in the config.php file or database for these settings. If you specify a custom value for any of these settings it will be respected. See the definitions of these in "core/files/etc/misp-docker" where the filenames contain the word "defaults".
 
+#### Setting custom settings
+
+If you want to set custom MISP settings on startup please take the following steps:
+
+- create a `settings.json` file in the project root
+- uncomment the `settings.json` mountpoint in the `misp-core` image in `docker-compose.yml`
+- if you change the default mount path, be sure to update `MISP_SETTINGS_FILE` in your `.env` file
+- add the settings to your json
+
+##### Example
+
+```json
+{
+  "MISP.curl_request_timeout": "600"
+}
+```
+
 #### Storing system settings in the DB
 
 This container includes the "ENABLE_DB_SETTINGS" environment variable, which can be used to set "MISP.system_setting_db" to true or false. This changes the behaviour of where MISP chooses to store operator made settings changes; in config.php or in the system_settings database table. By default this is set to false.
@@ -238,7 +255,6 @@ LDAPAUTH_LDAPTLSPROTOCOLMIN=LDAP_OPT_X_TLS_PROTOCOL_TLS1_2
 STARTTLS is set to false as it's meant to upgrade an unencrypted connection (LDAP) to a secure one if possible automatically (LDAPS).
 As we use LDAPS (hardcoded) or no connection at all, this isn't desired.
 
-
 #### OIDC Authentication
 
 OIDC Auth is implemented through the MISP OidcAuth plugin.

core/files/configure_misp.sh

@@ -26,6 +26,28 @@ init_workers() {
     stdbuf -oL supervisorctl start misp-workers:*
 }
 
+set_misp_settings() {
+    if [ -f "${MISP_SETTINGS_FILE}" ]; then
+        # Validate that the settings file contains a JSON object before processing.
+        if ! jq -e 'type == "object"' "${MISP_SETTINGS_FILE}" >/dev/null 2>&1; then
+            echo "Error: ${MISP_SETTINGS_FILE} must contain a JSON object with key/value settings."
+            return 1
+        fi
+
+        # Capture jq output while checking its exit status so parse failures are not masked.
+        settings_entries=$(jq -c 'to_entries[]' "${MISP_SETTINGS_FILE}") || return 1
+
+        while IFS= read -r entry; do
+            key=$(echo "$entry" | jq -r '.key')
+            value=$(echo "$entry" | jq -r '.value')
+
+            echo "Setting $key to $value"
+
+            sudo -u www-data /var/www/MISP/app/Console/cake Admin setSetting -q "$key" "$value"
+        done <<< "$settings_entries"
+    fi
+}
+
 configure_gnupg() {
     if [ "$AUTOCONF_GPG" != "true" ]; then
         echo "... GPG auto configuration disabled"
@@ -748,6 +770,8 @@ echo "MISP | Apply DB updates ..." && apply_updates
 
 echo "MISP | Configure GPG key ..." && configure_gnupg
 
+echo "MISP | Set MISP settings ..." && set_misp_settings
+
 echo "MISP | Init default user and organization ..." && init_user
 
 echo "MISP | Resolve critical issues ..." && apply_critical_fixes

docker-compose.yml

@@ -132,12 +132,14 @@ services:
       - "./files/:/var/www/MISP/app/files/:Z"
       - "./gnupg/:/var/www/MISP/.gnupg/:Z"
       - "misp_guard_ca:/usr/local/share/ca-certificates/misp_guard:Z"
+      # custom MISP settings to be set on each boot, If changing the default path, be sure to also set MISP_SETTINGS_FILE
+      # - "./settings.json:/settings.json:ro"
+      # customize by replacing ${CUSTOM_PATH} with a path containing 'files/customize_misp.sh'
+      # - "${CUSTOM_PATH}/:/custom/:Z"
+      # mount custom ca root certificates
+      # - "./rootca.pem:/usr/local/share/ca-certificates/rootca.crt:Z"
     cap_add:
       - AUDIT_WRITE
-    # customize by replacing ${CUSTOM_PATH} with a path containing 'files/customize_misp.sh'
-    # - "${CUSTOM_PATH}/:/custom/:Z"
-    # mount custom ca root certificates
-    # - "./rootca.pem:/usr/local/share/ca-certificates/rootca.crt:Z"
     environment:
       - "BASE_URL=${BASE_URL:?The BASE_URL variable is now mandatory because the SSL logic is changed, see README.md for instructions.}"
       - "CRON_USER_ID=${CRON_USER_ID}"
@@ -327,6 +329,8 @@ services:
       - "PHP_SESSION_COOKIE_SAMESITE=${PHP_SESSION_COOKIE_SAMESITE:-Lax}"
       # compose profiles
       - "COMPOSE_PROFILES=${COMPOSE_PROFILES}"
+      # MISP settings
+      - "MISP_SETTINGS_FILE=${MISP_SETTINGS_FILE:-/settings.json}"
 
   misp-nginx:
     image: ${REGISTRY_MIRROR_URL:-}ghcr.io/misp/misp-docker/misp-nginx:${CORE_RUNNING_TAG:-latest}

template.env

@@ -177,6 +177,8 @@ SYNCSERVERS_1_PULL_RULES=
 # Disable CA refresh
 # DISABLE_CA_REFRESH=true
 
+# Custom MISP settings
+# MISP_SETTINGS_FILE=/settings.json
 # Enforce external authentication, disabling the builtin login form.
 # Applies to any external provider (OIDC/LDAP/AAD/CustomAuth)
 # WARNING: enable only after the external method is verified working, else you'll need to disable via the cli (cake)