added manager for wazuh, part of indexer (main template) imported

ansible-playbook.yml

@@ -110,8 +110,109 @@
       #   - 7359:7359/udp #optional
       #   - 1900:1900/udp #optional
 
-#----Prowler Security suite ------#
+#----Wazuh-docker deploy---#
-  
+    - name: Deploy Wazuh Manager
+      containers.podman.podman_container:
+        image: wazuh/wazuh-manager:5.0.0
+        name: wazuh.manager
+        env:
+          INDEXER_URL: https://wazuh.indexer:9200
+          INDEXER_USERNAME: admin
+          INDEXER_PASSWORD: SecretPassword
+          FILEBEAT_SSL_VERIFICATION_MODE: full
+          SSL_CERTIFICATE_AUTHORITIES: /etc/ssl/root-ca.pem
+          SSL_CERTIFICATE: /etc/ssl/filebeat.pem
+          SSL_KEY: /etc/ssl/filebeat.key
+          API_USERNAME: wazuh-wui
+          API_PASSWORD: MyS3cr37P450r.*-
+        ulimits:
+          - "memlock:-1:-1"
+          - "nofile:655360:655360"
+        restart_policy: true
+        recreate: true
+        state: started
+        volumes:
+          - /opt/apps/wazuh/wazuh_api_configuration:/var/ossec/api/configuration
+          - /opt/apps/wazuh/wazuh_etc:/var/ossec/etc
+          - /opt/apps/wazuh/wazuh_logs:/var/ossec/logs
+          - /opt/apps/wazuh/wazuh_queue:/var/ossec/queue
+          - /opt/apps/wazuh/wazuh_var_multigroups:/var/ossec/var/multigroups
+          - /opt/apps/wazuh/wazuh_active_response:/var/ossec/active-response/bin
+          - /opt/apps/wazuh/wazuh_wodles:/var/ossec/wodles
+          - /opt/apps/wazuh/filebeat_etc:/etc/filebeat
+          - /opt/apps/wazuh/filebeat_var:/var/lib/filebeat
+          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
+          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
+          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
+          - /opt/apps/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
+        network:
+          - npm_internal
+        ip: '10.10.0.36'
+        ports:
+          - "1514:1514"
+          - "1515:1515"
+          - "514:514/udp"
+          - "55000:55000"
+
+
+    - name: Deploy Wazuh Indexer
+      containers.podman.podman_container:
+        image: wazuh/wazuh-indexer:5.0.0
+        name: wazuh.indexer
+
+
+  wazuh.indexer:
+    image: wazuh/wazuh-indexer:5.0.0
+    hostname: wazuh.indexer
+    restart: always
+    ports:
+      - "9200:9200"
+    environment:
+      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+      nofile:
+        soft: 65536
+        hard: 65536
+    volumes:
+      - wazuh-indexer-data:/var/lib/wazuh-indexer
+      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
+      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
+      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
+      - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
+      - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
+      - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
+      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
+
+  wazuh.dashboard:
+    image: wazuh/wazuh-dashboard:5.0.0
+    hostname: wazuh.dashboard
+    restart: always
+    ports:
+      - 443:5601
+    environment:
+      - INDEXER_USERNAME=admin
+      - INDEXER_PASSWORD=SecretPassword
+      - WAZUH_API_URL=https://wazuh.manager
+      - DASHBOARD_USERNAME=kibanaserver
+      - DASHBOARD_PASSWORD=kibanaserver
+      - API_USERNAME=wazuh-wui
+      - API_PASSWORD=MyS3cr37P450r.*-
+    volumes:
+      - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
+      - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
+      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
+      - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
+      - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
+      - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config
+      - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
+    depends_on:
+      - wazuh.indexer
+    links:
+      - wazuh.indexer:wazuh.indexer
+      - wazuh.manager:wazuh.manager
 
 
 

vars.yml

@@ -9,7 +9,9 @@ directories:
   - /opt/apps/prowler/data
   - /opt/apps/prowler/tmp/prowler_api_output
   - /opt/apps/prowler/postgres/data
+  - /opt/apps/wazuh
 #  - /opt/apps/n8n/files
+  - 
 
 ## Jellyfin directories for media
 directories_jellyfin: