From 3e7939b682f16f5305f607d0b81ae22a886faac5 Mon Sep 17 00:00:00 2001 From: boxswapper Date: Wed, 16 Sep 2026 09:33:42 -0600 Subject: [PATCH] feat: install wazuh agent in packages role; remove unused deployment files Wazuh agent: - packages role now copies the local wazuh-agent RPM to the host, installs it via dnf, points /var/ossec/etc/ossec.conf at wazuh.boxswapper.io, and enables/starts the wazuh-agent service - new vars: wazuh_agent_rpm, wazuh_server_address (manager version 4.14.1 matches the agent RPM) Cleanup of files not used by the ansible deployment: - removed wazuh-docker/docker-compose.yml, generate-indexer-certs.yml, README.md (role generates certs via podman run, config/ dir is the only part referenced) - removed committed .omo/ session data (already gitignored) Done by Sisyphus. --- .../ses_f9c7a2a4bffeGbArqDu2FhIlC5.json | 10 -- .../ses_f9c868146ffeKpqM2tbofhzWO3.json | 10 -- roles/packages/tasks/main.yml | 25 ++++ vars.yml | 5 + wazuh-docker/README.md | 24 ---- wazuh-docker/docker-compose.yml | 109 ------------------ wazuh-docker/generate-indexer-certs.yml | 10 -- 7 files changed, 30 insertions(+), 163 deletions(-) delete mode 100644 .omo/run-continuation/ses_f9c7a2a4bffeGbArqDu2FhIlC5.json delete mode 100644 .omo/run-continuation/ses_f9c868146ffeKpqM2tbofhzWO3.json delete mode 100755 wazuh-docker/README.md delete mode 100755 wazuh-docker/docker-compose.yml delete mode 100755 wazuh-docker/generate-indexer-certs.yml diff --git a/.omo/run-continuation/ses_f9c7a2a4bffeGbArqDu2FhIlC5.json b/.omo/run-continuation/ses_f9c7a2a4bffeGbArqDu2FhIlC5.json deleted file mode 100644 index e800bbf..0000000 --- a/.omo/run-continuation/ses_f9c7a2a4bffeGbArqDu2FhIlC5.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "sessionID": "ses_f9c7a2a4bffeGbArqDu2FhIlC5", - "updatedAt": "2026-09-02T19:11:53.267Z", - "sources": { - "background-task": { - "state": "idle", - "updatedAt": "2026-09-02T19:11:53.267Z" - } - } -} \ No newline at end of file diff --git a/.omo/run-continuation/ses_f9c868146ffeKpqM2tbofhzWO3.json b/.omo/run-continuation/ses_f9c868146ffeKpqM2tbofhzWO3.json deleted file mode 100644 index 0ba4912..0000000 --- a/.omo/run-continuation/ses_f9c868146ffeKpqM2tbofhzWO3.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "sessionID": "ses_f9c868146ffeKpqM2tbofhzWO3", - "updatedAt": "2026-09-02T19:03:22.170Z", - "sources": { - "background-task": { - "state": "idle", - "updatedAt": "2026-09-02T19:03:22.170Z" - } - } -} \ No newline at end of file diff --git a/roles/packages/tasks/main.yml b/roles/packages/tasks/main.yml index ce4754b..aedcd60 100644 --- a/roles/packages/tasks/main.yml +++ b/roles/packages/tasks/main.yml @@ -11,3 +11,28 @@ - fail2ban - python3-libdnf5 state: present + +- name: Copy Wazuh agent RPM to host + ansible.builtin.copy: + src: "{{ playbook_dir }}/{{ wazuh_agent_rpm }}" + dest: "/tmp/{{ wazuh_agent_rpm }}" + owner: root + group: root + mode: '0644' + +- name: Install Wazuh agent RPM + ansible.builtin.dnf: + name: "/tmp/{{ wazuh_agent_rpm }}" + state: present + +- name: Point Wazuh agent at Wazuh manager + ansible.builtin.replace: + path: /var/ossec/etc/ossec.conf + regexp: '
MANAGER_IP
' + replace: '
{{ wazuh_server_address }}
' + +- name: Enable and start Wazuh agent + ansible.builtin.systemd: + name: wazuh-agent + enabled: true + state: started diff --git a/vars.yml b/vars.yml index 99e37d0..69c993b 100755 --- a/vars.yml +++ b/vars.yml @@ -62,3 +62,8 @@ wazuh_dashboard_ip: 10.10.0.40 wazuh_manager_ip: 10.10.0.41 wazuh_indexer_ip: 10.10.0.42 +## Wazuh agent (installed on this host by packages role) +## Server address the agent reports to (manager reachable on ports 1514/1515 via router forwarding) +wazuh_agent_rpm: wazuh-agent-4.14.1-1.x86_64.rpm +wazuh_server_address: wazuh.boxswapper.io + diff --git a/wazuh-docker/README.md b/wazuh-docker/README.md deleted file mode 100755 index 1a93b6c..0000000 --- a/wazuh-docker/README.md +++ /dev/null @@ -1,24 +0,0 @@ -# Deploy Wazuh Docker in single node configuration - -This deployment is defined in the `docker-compose.yml` file with one Wazuh manager containers, one Wazuh indexer containers, and one Wazuh dashboard container. It can be deployed by following these steps: - -1) Increase max_map_count on your host (Linux). This command must be run with root permissions: -``` -$ sysctl -w vm.max_map_count=262144 -``` -2) Run the certificate creation script: -``` -$ docker compose -f generate-indexer-certs.yml run --rm generator -``` -3) Start the environment with docker compose: - -- In the foregroud: -``` -$ docker compose up -``` -- In the background: -``` -$ docker compose up -d -``` - -The environment takes about 1 minute to get up (depending on your Docker host) for the first time since Wazuh Indexer must be started for the first time and the indexes and index patterns must be generated. diff --git a/wazuh-docker/docker-compose.yml b/wazuh-docker/docker-compose.yml deleted file mode 100755 index 0447460..0000000 --- a/wazuh-docker/docker-compose.yml +++ /dev/null @@ -1,109 +0,0 @@ -# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) -services: - wazuh.manager: - image: wazuh/wazuh-manager:5.0.0 - hostname: wazuh.manager - restart: always - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 655360 - hard: 655360 - ports: - - "1514:1514" - - "1515:1515" - - "514:514/udp" - - "55000:55000" - environment: - - INDEXER_URL=https://wazuh.indexer:9200 - - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=*WD*oW9m6iKf4hDovy7BbMmhLxC9D?Tv - - FILEBEAT_SSL_VERIFICATION_MODE=full - - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem - - SSL_CERTIFICATE=/etc/ssl/filebeat.pem - - SSL_KEY=/etc/ssl/filebeat.key - - API_USERNAME=wazuh-wui - - API_PASSWORD=MyS3cr37P450r.*- - volumes: - - wazuh_api_configuration:/var/ossec/api/configuration - - wazuh_etc:/var/ossec/etc - - wazuh_logs:/var/ossec/logs - - wazuh_queue:/var/ossec/queue - - wazuh_var_multigroups:/var/ossec/var/multigroups - - wazuh_active_response:/var/ossec/active-response/bin - - wazuh_wodles:/var/ossec/wodles - - filebeat_etc:/etc/filebeat - - filebeat_var:/var/lib/filebeat - - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key - - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf - - wazuh.indexer: - image: wazuh/wazuh-indexer:5.0.0 - hostname: wazuh.indexer - restart: always - ports: - - "9200:9200" - environment: - - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - wazuh-indexer-data:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key - - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem - - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem - - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem - - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml - - wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0 - hostname: wazuh.dashboard - restart: always - ports: - - 443:5601 - environment: - - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=SecretPassword - - WAZUH_API_URL=https://wazuh.manager - - DASHBOARD_USERNAME=kibanaserver - - DASHBOARD_PASSWORD=kibanaserver - - API_USERNAME=wazuh-wui - - API_PASSWORD=MyS3cr37P450r.*- - volumes: - - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem - - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml - - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml - - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config - - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom - depends_on: - - wazuh.indexer - links: - - wazuh.indexer:wazuh.indexer - - wazuh.manager:wazuh.manager - -volumes: - wazuh_api_configuration: - wazuh_etc: - wazuh_logs: - wazuh_queue: - wazuh_var_multigroups: - wazuh_active_response: - wazuh_wodles: - filebeat_etc: - filebeat_var: - wazuh-indexer-data: - wazuh-dashboard-config: - wazuh-dashboard-custom: diff --git a/wazuh-docker/generate-indexer-certs.yml b/wazuh-docker/generate-indexer-certs.yml deleted file mode 100755 index a941280..0000000 --- a/wazuh-docker/generate-indexer-certs.yml +++ /dev/null @@ -1,10 +0,0 @@ -# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) -services: - generator: - image: wazuh/wazuh-certs-generator:0.0.3 - hostname: wazuh-certs-generator - environment: - - CERT_TOOL_VERSION=4.14 - volumes: - - ./config/wazuh_indexer_ssl_certs/:/certificates/ - - ./config/certs.yml:/config/certs.yml