From 45f60f518194b3d1af3e6d8d408c61272638284a Mon Sep 17 00:00:00 2001 From: boxswapper Date: Sun, 24 Aug 2025 22:13:48 -0600 Subject: [PATCH] ansible works, added sec tools --- ansible-playbook.yml | 164 ++++++++++++++++++++++++++++++++++++++ compose-prowler.yml | 112 ++++++++++++++++++++++++++ deploy-compos-prowler.yml | 62 ++++++++++++++ inventory.ini | 2 + requirements.yml | 4 + vars.yml | 27 +++++++ 6 files changed, 371 insertions(+) create mode 100644 ansible-playbook.yml create mode 100644 compose-prowler.yml create mode 100644 deploy-compos-prowler.yml create mode 100644 inventory.ini create mode 100644 requirements.yml create mode 100644 vars.yml diff --git a/ansible-playbook.yml b/ansible-playbook.yml new file mode 100644 index 0000000..8fd2f43 --- /dev/null +++ b/ansible-playbook.yml @@ -0,0 +1,164 @@ +--- +- hosts: internal-apps + become: true + vars_files: + - ./vars.yml + tasks: + - name: Update Packages + ansible.builtin.dnf: + update_cache: yes + + - name: Install Packages + ansible.builtin.dnf: + name: + - vim + - podman + - fail2ban + - python3-libdnf5 + state: present + + - name: Create directories + file: + path: "{{ item }}" + state: directory + mode: '0755' + loop: "{{ directories }}" + + - name: Create Jellyfin directories + file: + path: "{{ item }}" + state: directory + mode: '0777' + loop: "{{ directories_jellyfin }}" + + - name: Create internal podman network + containers.podman.podman_network: + name: npm_internal + ip_range: 10.10.0.128/25 + subnet: 10.10.0.0/24 + gateway: 10.10.0.1 + state: present + + - name: pull images + containers.podman.podman_image: + name: "{{ item }}" + loop: "{{ images }}" + + - name: Deploy Nginx Proxy Manager + containers.podman.podman_container: + image: "docker.io/jc21/nginx-proxy-manager:latest" + name: npm + restart_policy: always + recreate: true + state: started + ports: + - "80:80" + - "81:81" + - "443:443" + volumes: + - "/opt/apps/npm:/data:z" + - "/opt/apps/letsencrypt:/etc/letsencrypt:z" + network: + - npm_internal + ip: '10.10.0.19' + + - name: Deploy Gitea + containers.podman.podman_container: + image: docker.gitea.com/gitea:nightly + name: gitea + env: + USER_UID: 1000 + USER_GID: 1000 + restart_policy: always + recreate: true + state: started + volumes: + - /opt/apps/gitea:/data:z + - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro + - /etc/localtime:/etc/localtime:ro + network: + - npm_internal + ip: '10.10.0.25' + ports: + # - "3000:3000" + - "222:22" + + + - name: Deploy Jellyfin + containers.podman.podman_container: + image: lscr.io/linuxserver/jellyfin:latest + name: jellyfin + env: + USER_UID: 1000 + USER_GID: 1000 + JELLYFIN_PublishedServerUrl: http://jellyfin.boxswapper.io + restart_policy: always + recreate: true + state: started + volumes: + - /opt/apps/jellyfin/config:/config:z + - /opt/apps/jellyfin/tvseries:/data/tvshows:z + - /opt/apps/jellyfin/movies:/data/movies:z + - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro + - /etc/localtime:/etc/localtime:ro + network: + - npm_internal + ip: '10.10.0.30' + # ports: + # - 8096:8096 + # - 8920:8920 #optional + # - 7359:7359/udp #optional + # - 1900:1900/udp #optional + +#----Prowler Security suite ------# + + + + + + + + + + + + + + + + + + + + + + + + + + +#----N8N deployment, no GPU avail for deployment ------# + + # - name: Deploy n8n + # containers.podman.podman_container: + # image: docker.n8n.io/n8nio/n8n + # name: n8n + # env: + # N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: true + # N8N_RUNNERS_ENABLED: true + # restart_policy: always + # recreate: true + # state: started + # volumes: + # - /opt/apps/n8n/data:/home/node/.n8n:z + # - /opt/apps/n8n/files:/files:z + # - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro + # - /etc/localtime:/etc/localtime:ro + + # network: + # - npm_internal + # ip: '10.10.0.35' + # # ports: + # # - 5678:5678 + + diff --git a/compose-prowler.yml b/compose-prowler.yml new file mode 100644 index 0000000..be634b3 --- /dev/null +++ b/compose-prowler.yml @@ -0,0 +1,112 @@ + +# ... rest of file ... +services: + api: + hostname: "prowler-api" + image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable} + env_file: + - path: .env + required: false + ports: + - "${DJANGO_PORT:-8080}:${DJANGO_PORT:-8080}" + volumes: + - "output:/tmp/prowler_api_output" + depends_on: + postgres: + condition: service_healthy + valkey: + condition: service_healthy + entrypoint: + - "/home/prowler/docker-entrypoint.sh" + - "prod" + networks: + - postgres_nw + + ui: + image: prowlercloud/prowler-ui:${PROWLER_UI_VERSION:-stable} + env_file: + - path: .env + required: false + ports: + - ${UI_PORT:-3001}:${UI_PORT:-3000} + + postgres: + image: postgres:16.3-alpine3.20 + hostname: "postgres-db" + volumes: + - ./_data/postgres:/var/lib/postgresql/data + environment: + - POSTGRES_USER=${POSTGRES_ADMIN_USER} + - POSTGRES_PASSWORD=${POSTGRES_ADMIN_PASSWORD} + - POSTGRES_DB=${POSTGRES_DB} + env_file: + - path: .env + required: false + ports: + - "${POSTGRES_PORT:-5432}:${POSTGRES_PORT:-5432}" + healthcheck: + test: ["CMD-SHELL", "sh -c 'pg_isready -U ${POSTGRES_ADMIN_USER} -d ${POSTGRES_DB}'"] + interval: 5s + timeout: 5s + retries: 5 + networks: + - postgres_nw + + valkey: + image: valkey/valkey:7-alpine3.19 + hostname: "valkey" + volumes: + - ./_data/valkey:/data + env_file: + - path: .env + required: false + ports: + - "${VALKEY_PORT:-6379}:6379" + healthcheck: + test: ["CMD-SHELL", "sh -c 'valkey-cli ping'"] + interval: 10s + timeout: 5s + retries: 3 + + worker: + image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable} + env_file: + - path: .env + required: false + volumes: + - "output:/tmp/prowler_api_output" + depends_on: + valkey: + condition: service_healthy + postgres: + condition: service_healthy + entrypoint: + - "/home/prowler/docker-entrypoint.sh" + - "worker" + networks: + - postgres_nw + + worker-beat: + image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable} + env_file: + - path: ./.env + required: false + depends_on: + valkey: + condition: service_healthy + postgres: + condition: service_healthy + entrypoint: + - "../docker-entrypoint.sh" + - "beat" + networks: + - postgres_nw + +volumes: + output: + driver: local + +networks: + postgres_nw: + internal: true + driver: bridge \ No newline at end of file diff --git a/deploy-compos-prowler.yml b/deploy-compos-prowler.yml new file mode 100644 index 0000000..ebb5512 --- /dev/null +++ b/deploy-compos-prowler.yml @@ -0,0 +1,62 @@ +--- +- name: Deploy compos-prowler using Podman + hosts: internal-apps + become: true + + tasks: + - name: Install required packages for Podman and Docker Compose compatibility + apt: + name: podman + state: present + + - name: Create container network (postgres_nw) if it does not exist + podman_network: + name: postgres_nw + driver: bridge + + - name: Create container output volume if it does not exist + podman_volume: + name: output + driver: local + + - name: Copy compos-prowler.yaml file to internal-apps server + copy: + content: "{{ lookup('file', 'path/to/compos-prowler.yaml') }}" + dest: /home/user/compos-prowler.yaml + mode: '0644' + + - name: Create a Podman service from the YAML file + podman_service: + container_name: compos-prowler + image: "{{ item.image }}" + ports: + - "{{ item.ports[0] }}" + volumes: + - "output:/tmp/prowler_api_output" + depends_on: + - postgres + - valkey + networks: + - postgres_nw + with_items: + - { name: api, image: prowlercloud/prowler-api } + - { name: ui, image: prowlercloud/prowler-ui } + - { name: postgres, image: postgres:16.3-alpine3.20 } + - { name: valkey, image: valkey/valkey:7-alpine3.19 } + - { name: worker, image: prowlercloud/prowler-api } + - { name: worker-beat, image: prowlercloud/prowler-api } + + - name: Start the container + podman_container: + container_name: compos-prowler + state: started + + - name: Wait for all containers to be up and running + wait_for: + host_pattern: "{{ item }}" + port: "{{ item.ports[0] }}" + timeout: 300 + delay: 5 + with_items: + - api + - ui \ No newline at end of file diff --git a/inventory.ini b/inventory.ini new file mode 100644 index 0000000..17273f4 --- /dev/null +++ b/inventory.ini @@ -0,0 +1,2 @@ +[internal-apps] +internal-apps diff --git a/requirements.yml b/requirements.yml new file mode 100644 index 0000000..afe154b --- /dev/null +++ b/requirements.yml @@ -0,0 +1,4 @@ +collections: + - name: containers.podman + + \ No newline at end of file diff --git a/vars.yml b/vars.yml new file mode 100644 index 0000000..8dea951 --- /dev/null +++ b/vars.yml @@ -0,0 +1,27 @@ +## add generic 755 directory for application here +directories: + - /opt/apps/npm + - /opt/apps/jellyfin + - /opt/apps/letsencrypt + - /opt/apps/gitea + - /opt/apps/jellyfin/config + - /opt/apps/n8n/data +# - /opt/apps/n8n/files + +## Jellyfin directories for media +directories_jellyfin: + - /opt/apps/jellyfin/tvseries + - /opt/apps/jellyfin/movies + +images: + - docker.io/jc21/nginx-proxy-manager:latest + - lscr.io/linuxserver/jellyfin:latest +# - docker.n8n.io/n8nio/n8n + - docker.gitea.com/gitea:nightly + +sudo_password: sdfwwww + +POSTGRES_ADMIN_USER: theuseriwant +POSTGRES_PASSWORD: theuserthatineedpaswoord +POSTGRES_DB: thatoneit +