ansible works, added sec tools

ansible-playbook.yml

@@ -0,0 +1,164 @@
+---
+- hosts: internal-apps
+  become: true
+  vars_files: 
+    - ./vars.yml
+  tasks:
+    - name: Update Packages
+      ansible.builtin.dnf:
+        update_cache: yes
+
+    - name: Install Packages
+      ansible.builtin.dnf:
+        name:
+          - vim
+          - podman
+          - fail2ban
+          - python3-libdnf5
+        state: present
+    
+    - name: Create directories 
+      file:
+        path: "{{ item }}"
+        state: directory
+        mode: '0755'
+      loop: "{{ directories }}"
+
+    - name: Create Jellyfin directories 
+      file:
+        path: "{{ item }}"
+        state: directory
+        mode: '0777'
+      loop: "{{ directories_jellyfin }}"
+
+    - name: Create internal podman network
+      containers.podman.podman_network:
+        name: npm_internal
+        ip_range: 10.10.0.128/25
+        subnet: 10.10.0.0/24
+        gateway: 10.10.0.1
+        state: present
+
+    - name: pull images
+      containers.podman.podman_image:
+        name: "{{ item }}"
+      loop: "{{ images }}"
+
+    - name: Deploy Nginx Proxy Manager 
+      containers.podman.podman_container:
+        image: "docker.io/jc21/nginx-proxy-manager:latest"
+        name: npm
+        restart_policy: always
+        recreate: true
+        state: started
+        ports:
+          - "80:80"
+          - "81:81"
+          - "443:443"
+        volumes:
+          - "/opt/apps/npm:/data:z"
+          - "/opt/apps/letsencrypt:/etc/letsencrypt:z"
+        network:
+          - npm_internal
+        ip: '10.10.0.19'
+
+    - name: Deploy Gitea 
+      containers.podman.podman_container:
+        image: docker.gitea.com/gitea:nightly
+        name: gitea
+        env:
+          USER_UID: 1000
+          USER_GID: 1000
+        restart_policy: always
+        recreate: true
+        state: started
+        volumes:
+          - /opt/apps/gitea:/data:z
+          - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
+          - /etc/localtime:/etc/localtime:ro
+        network:
+          - npm_internal
+        ip: '10.10.0.25'
+        ports:
+        #  - "3000:3000"
+          - "222:22"
+
+
+    - name: Deploy Jellyfin
+      containers.podman.podman_container:
+        image: lscr.io/linuxserver/jellyfin:latest
+        name: jellyfin
+        env:
+          USER_UID: 1000
+          USER_GID: 1000
+          JELLYFIN_PublishedServerUrl: http://jellyfin.boxswapper.io
+        restart_policy: always
+        recreate: true
+        state: started
+        volumes:
+          - /opt/apps/jellyfin/config:/config:z
+          - /opt/apps/jellyfin/tvseries:/data/tvshows:z
+          - /opt/apps/jellyfin/movies:/data/movies:z
+          - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
+          - /etc/localtime:/etc/localtime:ro
+        network:
+          - npm_internal
+        ip: '10.10.0.30'
+        # ports:
+        #   - 8096:8096
+      #   - 8920:8920 #optional
+      #   - 7359:7359/udp #optional
+      #   - 1900:1900/udp #optional
+
+#----Prowler Security suite ------#
+  
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+#----N8N deployment, no GPU avail for deployment ------#
+
+    # - name: Deploy n8n
+      # containers.podman.podman_container:
+      #   image: docker.n8n.io/n8nio/n8n
+      #   name: n8n
+      #   env:
+      #     N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: true
+      #     N8N_RUNNERS_ENABLED: true
+      #   restart_policy: always
+      #   recreate: true
+      #   state: started
+      #   volumes:
+      #     - /opt/apps/n8n/data:/home/node/.n8n:z
+      #     - /opt/apps/n8n/files:/files:z
+      #     - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
+      #     - /etc/localtime:/etc/localtime:ro
+
+      #   network:
+      #     - npm_internal
+      #   ip: '10.10.0.35'
+      # # ports:
+      # #   - 5678:5678
+   
+

compose-prowler.yml

@@ -0,0 +1,112 @@
+
+# ... rest of file ...
+services:
+  api:
+    hostname: "prowler-api"
+    image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable}
+    env_file:
+      - path: .env
+        required: false
+    ports:
+      - "${DJANGO_PORT:-8080}:${DJANGO_PORT:-8080}"
+    volumes:
+      - "output:/tmp/prowler_api_output"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      valkey:
+        condition: service_healthy
+    entrypoint:
+      - "/home/prowler/docker-entrypoint.sh"
+      - "prod"
+    networks:
+      - postgres_nw
+
+  ui:
+    image: prowlercloud/prowler-ui:${PROWLER_UI_VERSION:-stable}
+    env_file:
+        - path: .env
+        required: false
+    ports:
+      - ${UI_PORT:-3001}:${UI_PORT:-3000}
+
+  postgres:
+    image: postgres:16.3-alpine3.20
+    hostname: "postgres-db"
+    volumes:
+      - ./_data/postgres:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_USER=${POSTGRES_ADMIN_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_ADMIN_PASSWORD}
+      - POSTGRES_DB=${POSTGRES_DB}
+    env_file:
+      - path: .env
+        required: false
+    ports:
+      - "${POSTGRES_PORT:-5432}:${POSTGRES_PORT:-5432}"
+    healthcheck:
+      test: ["CMD-SHELL", "sh -c 'pg_isready -U ${POSTGRES_ADMIN_USER} -d ${POSTGRES_DB}'"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    networks:
+      - postgres_nw
+
+  valkey:
+    image: valkey/valkey:7-alpine3.19
+    hostname: "valkey"
+    volumes:
+      - ./_data/valkey:/data
+    env_file:
+      - path: .env
+        required: false
+    ports:
+      - "${VALKEY_PORT:-6379}:6379"
+    healthcheck:
+      test: ["CMD-SHELL", "sh -c 'valkey-cli ping'"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+
+  worker:
+    image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable}
+    env_file:
+      - path: .env
+        required: false
+    volumes:
+      - "output:/tmp/prowler_api_output"
+    depends_on:
+      valkey:
+        condition: service_healthy
+      postgres:
+        condition: service_healthy
+    entrypoint:
+      - "/home/prowler/docker-entrypoint.sh"
+      - "worker"
+    networks:
+      - postgres_nw
+
+  worker-beat:
+    image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable}
+    env_file:
+      - path: ./.env
+        required: false
+    depends_on:
+      valkey:
+        condition: service_healthy
+      postgres:
+        condition: service_healthy
+    entrypoint:
+      - "../docker-entrypoint.sh"
+      - "beat"
+    networks:
+      - postgres_nw
+
+volumes:
+  output:
+    driver: local
+
+networks:
+  postgres_nw:
+    internal: true
+    driver: bridge

deploy-compos-prowler.yml

@@ -0,0 +1,62 @@
+---
+- name: Deploy compos-prowler using Podman
+  hosts: internal-apps
+  become: true
+
+  tasks:
+  - name: Install required packages for Podman and Docker Compose compatibility
+    apt:
+      name: podman
+      state: present
+
+  - name: Create container network (postgres_nw) if it does not exist
+    podman_network:
+      name: postgres_nw
+      driver: bridge
+
+  - name: Create container output volume if it does not exist
+    podman_volume:
+      name: output
+      driver: local
+
+  - name: Copy compos-prowler.yaml file to internal-apps server
+    copy:
+      content: "{{ lookup('file', 'path/to/compos-prowler.yaml') }}"
+      dest: /home/user/compos-prowler.yaml
+      mode: '0644'
+
+  - name: Create a Podman service from the YAML file
+    podman_service:
+      container_name: compos-prowler
+      image: "{{ item.image }}"
+      ports:
+        - "{{ item.ports[0] }}"
+      volumes:
+        - "output:/tmp/prowler_api_output"
+      depends_on:
+        - postgres
+        - valkey
+      networks:
+        - postgres_nw
+    with_items:
+      - { name: api, image: prowlercloud/prowler-api }
+      - { name: ui, image: prowlercloud/prowler-ui }
+      - { name: postgres, image: postgres:16.3-alpine3.20 }
+      - { name: valkey, image: valkey/valkey:7-alpine3.19 }
+      - { name: worker, image: prowlercloud/prowler-api }
+      - { name: worker-beat, image: prowlercloud/prowler-api }
+
+  - name: Start the container
+    podman_container:
+      container_name: compos-prowler
+      state: started
+
+  - name: Wait for all containers to be up and running
+    wait_for:
+      host_pattern: "{{ item }}"
+      port: "{{ item.ports[0] }}"
+      timeout: 300
+      delay: 5
+    with_items:
+      - api
+      - ui

inventory.ini

@@ -0,0 +1,2 @@
+[internal-apps]
+internal-apps

requirements.yml

@@ -0,0 +1,4 @@
+collections:
+  - name: containers.podman
+
+  

vars.yml

@@ -0,0 +1,27 @@
+## add generic 755 directory for application here
+directories:
+  - /opt/apps/npm
+  - /opt/apps/jellyfin
+  - /opt/apps/letsencrypt
+  - /opt/apps/gitea
+  - /opt/apps/jellyfin/config
+  - /opt/apps/n8n/data
+#  - /opt/apps/n8n/files
+
+## Jellyfin directories for media
+directories_jellyfin:
+  - /opt/apps/jellyfin/tvseries
+  - /opt/apps/jellyfin/movies
+
+images:
+  - docker.io/jc21/nginx-proxy-manager:latest
+  - lscr.io/linuxserver/jellyfin:latest
+#  - docker.n8n.io/n8nio/n8n
+  - docker.gitea.com/gitea:nightly
+
+sudo_password: sdfwwww
+
+POSTGRES_ADMIN_USER: theuseriwant
+POSTGRES_PASSWORD: theuserthatineedpaswoord
+POSTGRES_DB: thatoneit
+