配置文件大概如下
```elasticsearch.yml
cluster.name: "docker-cluster"
network.host: 0.0.0.0
logger.level: ERROR
xpack.security.enabled: true
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: elastic-certificates.p12
xpack.security.http.ssl.truststore.path: elastic-certificates.p12
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
ingest.geoip.downloader.enabled: false
```
需要的证书可以从 es 容器里面直接生成
```sh
docker run --name es --rm -it elasticsearch:8.6.2 bash
bin/elasticsearch-certutil cert -out config/elastic-certificates.p12 -pass ""
exit
```
```
mkdir certs
docker cp es:/usr/share/elasticsearch/config/elastic-certificates.p12 ./certs/
docker stop es
chown -R 1000:root certs/
```
然后把证书挂载到容器 /usr/share/elasticsearch/config/elastic-certificates.p12
```sh
docker run --name es --restart=always -d \
-p 0.0.0.0:9200:9200 \
-p 0.0.0.0:9300:9300 \
-e "discovery.type=single-node" \
-e "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true" \
-v $(pwd)/es/data:/usr/share/elasticsearch/data
-v $(pwd)/es/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
-v $(pwd)/es/certs/elastic-certificates.p12:/usr/share/elasticsearch/config/elastic-certificates.p12 \
docker.elastic.co/elasticsearch/elasticsearch:8.6.2```