# A password-protected multi-node cluster with Docker Compose

**URL:** <https://discuss.elastic.co/t/a-password-protected-multi-node-cluster-with-docker-compose/216560>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security, docker\
**Created:** [January 26, 2020, 8:23am UTC](https://discuss.elastic.co/t/a-password-protected-multi-node-cluster-with-docker-compose/216560 "2020-01-26T08:23:28Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![alza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alza/32/50143_2.png) [@alza](https://discuss.elastic.co/u/alza)\
**Post date:** [January 26, 2020, 8:23am UTC](https://discuss.elastic.co/t/a-password-protected-multi-node-cluster-with-docker-compose/216560/1 "2020-01-26T08:23:29Z")

</div>

I wonder if there is a way to password protect (not using SSL, just a simple password) the multi-node cluster (using Docker Compose and with basic/free license) that explained [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html)?

I tried to add `ELASTIC_PASSWORD=mypass` as env variable to elastic nodes in `docker-compose.yml` file but it didn't worked.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 26, 2020, 9:08am UTC](https://discuss.elastic.co/t/a-password-protected-multi-node-cluster-with-docker-compose/216560/2 "2020-01-26T09:08:16Z")

</div>

Here is how I'm setting that with docker compose ( `docker-compose.yml`):

```auto
---
version: '3'
services:

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:$ELASTIC_VERSION
    environment:
      - bootstrap.memory_lock=true
      - discovery.type=single-node
      - "ES_JAVA_OPTS=-Xms2g -Xmx2g"
      - ELASTIC_PASSWORD=$ELASTIC_PASSWORD
      - xpack.security.enabled=$ELASTIC_SECURITY
    ulimits:
      memlock:
        soft: -1
        hard: -1
    ports:
      - 9200:9200
    networks: ['stack']

  kibana:
    image: docker.elastic.co/kibana/kibana:$ELASTIC_VERSION
    environment:
      - ELASTICSEARCH_USERNAME=elastic
      - ELASTICSEARCH_PASSWORD=$ELASTIC_PASSWORD
    ports: ['5601:5601']
    networks: ['stack']
    links: ['elasticsearch']
    depends_on: ['elasticsearch']

networks:
  stack: {}

```

`.env` file is:

```auto
ELASTIC_VERSION=7.5.2
ELASTIC_SECURITY=true
ELASTIC_PASSWORD=changeme

```

---

<div class="post-metadata">

**Author:** ![alza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alza/32/50143_2.png) [@alza](https://discuss.elastic.co/u/alza)\
**Post date:** [January 26, 2020, 9:31am UTC](https://discuss.elastic.co/t/a-password-protected-multi-node-cluster-with-docker-compose/216560/3 "2020-01-26T09:31:22Z")

</div>

Thanks @dadoonet. It works for **single-node** elastic. But is does not works for **multi-node** ELK, and the main node of cluster shot down.

```
version: '2.2'
services:
  es01:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.5.2
    container_name: es01
    environment:
      - node.name=es01
      - cluster.name=es-docker-cluster
      - discovery.seed_hosts=es02,es03
      - cluster.initial_master_nodes=es01,es02,es03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - ELASTIC_PASSWORD=$ELASTIC_PASSWORD
      - xpack.security.enabled=$ELASTIC_SECURITY
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - data01:/usr/share/elasticsearch/data
    ports:
      - 9200:9200
    networks:
      - elastic
  es02:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.5.2
    container_name: es02
    environment:
      - node.name=es02
      - cluster.name=es-docker-cluster
      - discovery.seed_hosts=es01,es03
      - cluster.initial_master_nodes=es01,es02,es03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - ELASTIC_PASSWORD=$ELASTIC_PASSWORD
      - xpack.security.enabled=$ELASTIC_SECURITY
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - data02:/usr/share/elasticsearch/data
    networks:
      - elastic
  es03:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.5.2
    container_name: es03
    environment:
      - node.name=es03
      - cluster.name=es-docker-cluster
      - discovery.seed_hosts=es01,es02
      - cluster.initial_master_nodes=es01,es02,es03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - ELASTIC_PASSWORD=$ELASTIC_PASSWORD
      - xpack.security.enabled=$ELASTIC_SECURITY
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - data03:/usr/share/elasticsearch/data
    networks:
      - elastic

volumes:
  data01:
    driver: local
  data02:
    driver: local
  data03:
    driver: local

networks:
  elastic:
    driver: bridge
```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 26, 2020, 11:01am UTC](https://discuss.elastic.co/t/a-password-protected-multi-node-cluster-with-docker-compose/216560/4 "2020-01-26T11:01:02Z")

</div>

You can't have "security" without encryption of data transfer between nodes.  
Therefore you need to have TLS I think.

---

<div class="post-metadata">

**Author:** ![alza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alza/32/50143_2.png) [@alza](https://discuss.elastic.co/u/alza)\
**Post date:** [January 26, 2020, 11:17am UTC](https://discuss.elastic.co/t/a-password-protected-multi-node-cluster-with-docker-compose/216560/5 "2020-01-26T11:17:37Z")

</div>

Hmm...  
and I think for TLS we can't use basic (free) license with **multi-node**!?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 26, 2020, 1:23pm UTC](https://discuss.elastic.co/t/a-password-protected-multi-node-cluster-with-docker-compose/216560/6 "2020-01-26T13:23:12Z")

</div>

You can.

---

<div class="post-metadata">

**Author:** ![alza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alza/32/50143_2.png) [@alza](https://discuss.elastic.co/u/alza)\
**Post date:** [January 26, 2020, 1:43pm UTC](https://discuss.elastic.co/t/a-password-protected-multi-node-cluster-with-docker-compose/216560/7 "2020-01-26T13:43:16Z")

</div>

thanks @dadoonet, can you give me a hint how to do it, or probably send a blogpost or GitHub link.  
I followed this [link](https://www.elastic.co/guide/en/elasticsearch/reference/6.8/configuring-tls-docker.html), but it uses `xpack.license.self_generated.type=trial`, can I just change it to basic?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 26, 2020, 2:23pm UTC](https://discuss.elastic.co/t/a-password-protected-multi-node-cluster-with-docker-compose/216560/8 "2020-01-26T14:23:55Z")

</div>

I'd remove this line

---

<div class="post-metadata">

**Author:** ![alza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alza/32/50143_2.png) [@alza](https://discuss.elastic.co/u/alza)\
**Post date:** [January 27, 2020, 12:24pm UTC](https://discuss.elastic.co/t/a-password-protected-multi-node-cluster-with-docker-compose/216560/9 "2020-01-27T12:24:09Z")

</div>

Thanks @dadoonet. It worked!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 24, 2020, 12:24pm UTC](https://discuss.elastic.co/t/a-password-protected-multi-node-cluster-with-docker-compose/216560/10 "2020-02-24T12:24:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.