refactor: split monolithic playbook into 9 focused ansible roles

Refactored the single ansible-playbook.yml into granular roles under roles/:
- packages: dnf update + package installs
- directories: /opt/apps/* directory creation
- sysctl: ip_forward, src_valid_mark, vm.max_map_count tuning
- network: npm_internal podman network
- wireguard: kernel module, wg-easy container, nftables hook patching
- npm: Nginx Proxy Manager container
- gitea: Gitea container
- jellyfin: Jellyfin container
- wazuh: cert generation + indexer/manager/dashboard containers

Top-level playbook is now a role dispatcher with image pre-pull kept
upfront. n8n deployment kept as commented-out guidance with an enable
checklist. All variables remain in top-level vars.yml.

Done by Sisyphus.

roles/wazuh/tasks/main.yml

@@ -0,0 +1,157 @@
+---
+# Wazuh SIEM (single-node: indexer + manager + dashboard) on npm_internal
+# Dashboard is NOT exposed on host ports — NPM proxies wazuh.boxswapper.io to https://10.10.0.40:5601
+# DNS record must be grey-cloud (Cloudflare 523 lesson from vpn.boxswapper.io), cert via NPM
+# Config is copied from ./wazuh-docker/config before first deploy
+
+- name: Copy Wazuh config files to host
+  ansible.builtin.copy:
+    src: ./wazuh-docker/config/
+    dest: /opt/apps/wazuh/config/
+    owner: root
+    group: root
+    mode: preserve
+    force: true
+
+- name: Check for stale Wazuh certificate residue
+  ansible.builtin.stat:
+    path: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
+  register: wazuh_cert_residue
+
+- name: Remove stale Wazuh certificate directories
+  ansible.builtin.file:
+    path: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs
+    state: absent
+  when: wazuh_cert_residue.stat.exists and wazuh_cert_residue.stat.isdir
+
+- name: Recreate Wazuh certificates directory
+  ansible.builtin.file:
+    path: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs
+    state: directory
+    mode: '0755'
+    owner: root
+    group: root
+
+- name: Generate Wazuh certificates
+  ansible.builtin.command: >
+    podman run --rm
+    -e CERT_TOOL_VERSION=4.14
+    -v /opt/apps/wazuh/config/certs.yml:/config/certs.yml:z
+    -v /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/:/certificates:z
+    docker.io/wazuh/wazuh-certs-generator:0.0.3
+  args:
+    creates: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
+
+- name: Copy root CA as manager root CA
+  ansible.builtin.copy:
+    src: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
+    dest: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem
+    remote_src: true
+    force: false
+
+- name: Deploy Wazuh indexer
+  containers.podman.podman_container:
+    name: wazuh.indexer
+    image: "docker.io/wazuh/wazuh-indexer:{{ wazuh_version }}"
+    hostname: wazuh.indexer
+    restart_policy: always
+    recreate: true
+    state: started
+    env:
+      OPENSEARCH_JAVA_OPTS: "-Xms1g -Xmx1g"
+    ulimit:
+      - "memlock=-1:-1"
+      - "nofile=65536:65536"
+    volumes:
+      - "wazuh-indexer-data:/var/lib/wazuh-indexer"
+      - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem:z"
+      - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key:z"
+      - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem:z"
+      - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem:z"
+      - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem:z"
+      - "/opt/apps/wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml:z"
+      - "/opt/apps/wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml:z"
+    network:
+      - npm_internal
+    ip: '{{ wazuh_indexer_ip }}'
+
+- name: Wait for Wazuh indexer to be ready
+  ansible.builtin.wait_for:
+    host: '{{ wazuh_indexer_ip }}'
+    port: 9200
+    delay: 10
+    timeout: 300
+
+- name: Deploy Wazuh manager
+  containers.podman.podman_container:
+    name: wazuh.manager
+    image: "docker.io/wazuh/wazuh-manager:{{ wazuh_version }}"
+    hostname: wazuh.manager
+    restart_policy: always
+    recreate: true
+    state: started
+    env:
+      INDEXER_URL: "https://wazuh.indexer:9200"
+      INDEXER_USERNAME: "admin"
+      INDEXER_PASSWORD: "*WD*oW9m6iKf4hDovy7BbMmhLxC9D?Tv"
+      FILEBEAT_SSL_VERIFICATION_MODE: "full"
+      SSL_CERTIFICATE_AUTHORITIES: "/etc/ssl/root-ca.pem"
+      SSL_CERTIFICATE: "/etc/ssl/filebeat.pem"
+      SSL_KEY: "/etc/ssl/filebeat.key"
+      API_USERNAME: "wazuh-wui"
+      API_PASSWORD: "MyS3cr37P450r.*-"
+    ulimit:
+      - "memlock=-1:-1"
+      - "nofile=655360:655360"
+    ports:
+      - "1514:1514"
+      - "1515:1515"
+      - "514:514/udp"
+      - "55000:55000"
+    volumes:
+      - "wazuh_api_configuration:/var/ossec/api/configuration"
+      - "wazuh_etc:/var/ossec/etc"
+      - "wazuh_logs:/var/ossec/logs"
+      - "wazuh_queue:/var/ossec/queue"
+      - "wazuh_var_multigroups:/var/ossec/var/multigroups"
+      - "wazuh_integrations:/var/ossec/integrations"
+      - "wazuh_agentless:/var/ossec/agentless"
+      - "wazuh_active_response:/var/ossec/active-response/bin"
+      - "wazuh_wodles:/var/ossec/wodles"
+      - "filebeat_etc:/etc/filebeat"
+      - "filebeat_var:/var/lib/filebeat"
+      - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem:z"
+      - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem:z"
+      - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key:z"
+      - "/opt/apps/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf:z"
+    network:
+      - npm_internal
+    ip: '{{ wazuh_manager_ip }}'
+
+- name: Deploy Wazuh dashboard
+  containers.podman.podman_container:
+    name: wazuh.dashboard
+    image: "docker.io/wazuh/wazuh-dashboard:{{ wazuh_version }}"
+    hostname: wazuh.dashboard
+    restart_policy: always
+    recreate: true
+    state: started
+    env:
+      INDEXER_USERNAME: "admin"
+      INDEXER_PASSWORD: "*WD*oW9m6iKf4hDovy7BbMmhLxC9D?Tv"
+      WAZUH_API_URL: "https://wazuh.manager"
+      DASHBOARD_USERNAME: "kibanaserver"
+      DASHBOARD_PASSWORD: "kibanaserver"
+      API_USERNAME: "wazuh-wui"
+      API_PASSWORD: "MyS3cr37P450r.*-"
+    volumes:
+      - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem:z"
+      - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem:z"
+      - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem:z"
+      - "/opt/apps/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml:z"
+      - "/opt/apps/wazuh/config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml:z"
+      - "wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config"
+      - "wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom"
+    network:
+      - npm_internal
+    ip: '{{ wazuh_dashboard_ip }}'