ansible works, added sec tools
This commit is contained in:
boxswapper
164
ansible-playbook.yml
Normal file
164
ansible-playbook.yml
Normal file
@@ -0,0 +1,164 @@
|
||||
---
|
||||
- hosts: internal-apps
|
||||
become: true
|
||||
vars_files:
|
||||
- ./vars.yml
|
||||
tasks:
|
||||
- name: Update Packages
|
||||
ansible.builtin.dnf:
|
||||
update_cache: yes
|
||||
|
||||
- name: Install Packages
|
||||
ansible.builtin.dnf:
|
||||
name:
|
||||
- vim
|
||||
- podman
|
||||
- fail2ban
|
||||
- python3-libdnf5
|
||||
state: present
|
||||
|
||||
- name: Create directories
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: '0755'
|
||||
loop: "{{ directories }}"
|
||||
|
||||
- name: Create Jellyfin directories
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: '0777'
|
||||
loop: "{{ directories_jellyfin }}"
|
||||
|
||||
- name: Create internal podman network
|
||||
containers.podman.podman_network:
|
||||
name: npm_internal
|
||||
ip_range: 10.10.0.128/25
|
||||
subnet: 10.10.0.0/24
|
||||
gateway: 10.10.0.1
|
||||
state: present
|
||||
|
||||
- name: pull images
|
||||
containers.podman.podman_image:
|
||||
name: "{{ item }}"
|
||||
loop: "{{ images }}"
|
||||
|
||||
- name: Deploy Nginx Proxy Manager
|
||||
containers.podman.podman_container:
|
||||
image: "docker.io/jc21/nginx-proxy-manager:latest"
|
||||
name: npm
|
||||
restart_policy: always
|
||||
recreate: true
|
||||
state: started
|
||||
ports:
|
||||
- "80:80"
|
||||
- "81:81"
|
||||
- "443:443"
|
||||
volumes:
|
||||
- "/opt/apps/npm:/data:z"
|
||||
- "/opt/apps/letsencrypt:/etc/letsencrypt:z"
|
||||
network:
|
||||
- npm_internal
|
||||
ip: '10.10.0.19'
|
||||
|
||||
- name: Deploy Gitea
|
||||
containers.podman.podman_container:
|
||||
image: docker.gitea.com/gitea:nightly
|
||||
name: gitea
|
||||
env:
|
||||
USER_UID: 1000
|
||||
USER_GID: 1000
|
||||
restart_policy: always
|
||||
recreate: true
|
||||
state: started
|
||||
volumes:
|
||||
- /opt/apps/gitea:/data:z
|
||||
- /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
network:
|
||||
- npm_internal
|
||||
ip: '10.10.0.25'
|
||||
ports:
|
||||
# - "3000:3000"
|
||||
- "222:22"
|
||||
|
||||
|
||||
- name: Deploy Jellyfin
|
||||
containers.podman.podman_container:
|
||||
image: lscr.io/linuxserver/jellyfin:latest
|
||||
name: jellyfin
|
||||
env:
|
||||
USER_UID: 1000
|
||||
USER_GID: 1000
|
||||
JELLYFIN_PublishedServerUrl: http://jellyfin.boxswapper.io
|
||||
restart_policy: always
|
||||
recreate: true
|
||||
state: started
|
||||
volumes:
|
||||
- /opt/apps/jellyfin/config:/config:z
|
||||
- /opt/apps/jellyfin/tvseries:/data/tvshows:z
|
||||
- /opt/apps/jellyfin/movies:/data/movies:z
|
||||
- /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
network:
|
||||
- npm_internal
|
||||
ip: '10.10.0.30'
|
||||
# ports:
|
||||
# - 8096:8096
|
||||
# - 8920:8920 #optional
|
||||
# - 7359:7359/udp #optional
|
||||
# - 1900:1900/udp #optional
|
||||
|
||||
#----Prowler Security suite ------#
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#----N8N deployment, no GPU avail for deployment ------#
|
||||
|
||||
# - name: Deploy n8n
|
||||
# containers.podman.podman_container:
|
||||
# image: docker.n8n.io/n8nio/n8n
|
||||
# name: n8n
|
||||
# env:
|
||||
# N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: true
|
||||
# N8N_RUNNERS_ENABLED: true
|
||||
# restart_policy: always
|
||||
# recreate: true
|
||||
# state: started
|
||||
# volumes:
|
||||
# - /opt/apps/n8n/data:/home/node/.n8n:z
|
||||
# - /opt/apps/n8n/files:/files:z
|
||||
# - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
|
||||
# - /etc/localtime:/etc/localtime:ro
|
||||
|
||||
# network:
|
||||
# - npm_internal
|
||||
# ip: '10.10.0.35'
|
||||
# # ports:
|
||||
# # - 5678:5678
|
||||
|
||||
|
||||
112
compose-prowler.yml
Normal file
112
compose-prowler.yml
Normal file
@@ -0,0 +1,112 @@
|
||||
|
||||
# ... rest of file ...
|
||||
services:
|
||||
api:
|
||||
hostname: "prowler-api"
|
||||
image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable}
|
||||
env_file:
|
||||
- path: .env
|
||||
required: false
|
||||
ports:
|
||||
- "${DJANGO_PORT:-8080}:${DJANGO_PORT:-8080}"
|
||||
volumes:
|
||||
- "output:/tmp/prowler_api_output"
|
||||
depends_on:
|
||||
postgres:
|
||||
condition: service_healthy
|
||||
valkey:
|
||||
condition: service_healthy
|
||||
entrypoint:
|
||||
- "/home/prowler/docker-entrypoint.sh"
|
||||
- "prod"
|
||||
networks:
|
||||
- postgres_nw
|
||||
|
||||
ui:
|
||||
image: prowlercloud/prowler-ui:${PROWLER_UI_VERSION:-stable}
|
||||
env_file:
|
||||
- path: .env
|
||||
required: false
|
||||
ports:
|
||||
- ${UI_PORT:-3001}:${UI_PORT:-3000}
|
||||
|
||||
postgres:
|
||||
image: postgres:16.3-alpine3.20
|
||||
hostname: "postgres-db"
|
||||
volumes:
|
||||
- ./_data/postgres:/var/lib/postgresql/data
|
||||
environment:
|
||||
- POSTGRES_USER=${POSTGRES_ADMIN_USER}
|
||||
- POSTGRES_PASSWORD=${POSTGRES_ADMIN_PASSWORD}
|
||||
- POSTGRES_DB=${POSTGRES_DB}
|
||||
env_file:
|
||||
- path: .env
|
||||
required: false
|
||||
ports:
|
||||
- "${POSTGRES_PORT:-5432}:${POSTGRES_PORT:-5432}"
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "sh -c 'pg_isready -U ${POSTGRES_ADMIN_USER} -d ${POSTGRES_DB}'"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
networks:
|
||||
- postgres_nw
|
||||
|
||||
valkey:
|
||||
image: valkey/valkey:7-alpine3.19
|
||||
hostname: "valkey"
|
||||
volumes:
|
||||
- ./_data/valkey:/data
|
||||
env_file:
|
||||
- path: .env
|
||||
required: false
|
||||
ports:
|
||||
- "${VALKEY_PORT:-6379}:6379"
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "sh -c 'valkey-cli ping'"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
|
||||
worker:
|
||||
image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable}
|
||||
env_file:
|
||||
- path: .env
|
||||
required: false
|
||||
volumes:
|
||||
- "output:/tmp/prowler_api_output"
|
||||
depends_on:
|
||||
valkey:
|
||||
condition: service_healthy
|
||||
postgres:
|
||||
condition: service_healthy
|
||||
entrypoint:
|
||||
- "/home/prowler/docker-entrypoint.sh"
|
||||
- "worker"
|
||||
networks:
|
||||
- postgres_nw
|
||||
|
||||
worker-beat:
|
||||
image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable}
|
||||
env_file:
|
||||
- path: ./.env
|
||||
required: false
|
||||
depends_on:
|
||||
valkey:
|
||||
condition: service_healthy
|
||||
postgres:
|
||||
condition: service_healthy
|
||||
entrypoint:
|
||||
- "../docker-entrypoint.sh"
|
||||
- "beat"
|
||||
networks:
|
||||
- postgres_nw
|
||||
|
||||
volumes:
|
||||
output:
|
||||
driver: local
|
||||
|
||||
networks:
|
||||
postgres_nw:
|
||||
internal: true
|
||||
driver: bridge
|
||||
62
deploy-compos-prowler.yml
Normal file
62
deploy-compos-prowler.yml
Normal file
@@ -0,0 +1,62 @@
|
||||
---
|
||||
- name: Deploy compos-prowler using Podman
|
||||
hosts: internal-apps
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Install required packages for Podman and Docker Compose compatibility
|
||||
apt:
|
||||
name: podman
|
||||
state: present
|
||||
|
||||
- name: Create container network (postgres_nw) if it does not exist
|
||||
podman_network:
|
||||
name: postgres_nw
|
||||
driver: bridge
|
||||
|
||||
- name: Create container output volume if it does not exist
|
||||
podman_volume:
|
||||
name: output
|
||||
driver: local
|
||||
|
||||
- name: Copy compos-prowler.yaml file to internal-apps server
|
||||
copy:
|
||||
content: "{{ lookup('file', 'path/to/compos-prowler.yaml') }}"
|
||||
dest: /home/user/compos-prowler.yaml
|
||||
mode: '0644'
|
||||
|
||||
- name: Create a Podman service from the YAML file
|
||||
podman_service:
|
||||
container_name: compos-prowler
|
||||
image: "{{ item.image }}"
|
||||
ports:
|
||||
- "{{ item.ports[0] }}"
|
||||
volumes:
|
||||
- "output:/tmp/prowler_api_output"
|
||||
depends_on:
|
||||
- postgres
|
||||
- valkey
|
||||
networks:
|
||||
- postgres_nw
|
||||
with_items:
|
||||
- { name: api, image: prowlercloud/prowler-api }
|
||||
- { name: ui, image: prowlercloud/prowler-ui }
|
||||
- { name: postgres, image: postgres:16.3-alpine3.20 }
|
||||
- { name: valkey, image: valkey/valkey:7-alpine3.19 }
|
||||
- { name: worker, image: prowlercloud/prowler-api }
|
||||
- { name: worker-beat, image: prowlercloud/prowler-api }
|
||||
|
||||
- name: Start the container
|
||||
podman_container:
|
||||
container_name: compos-prowler
|
||||
state: started
|
||||
|
||||
- name: Wait for all containers to be up and running
|
||||
wait_for:
|
||||
host_pattern: "{{ item }}"
|
||||
port: "{{ item.ports[0] }}"
|
||||
timeout: 300
|
||||
delay: 5
|
||||
with_items:
|
||||
- api
|
||||
- ui
|
||||
2
inventory.ini
Normal file
2
inventory.ini
Normal file
@@ -0,0 +1,2 @@
|
||||
[internal-apps]
|
||||
internal-apps
|
||||
4
requirements.yml
Normal file
4
requirements.yml
Normal file
@@ -0,0 +1,4 @@
|
||||
collections:
|
||||
- name: containers.podman
|
||||
|
||||
|
||||
27
vars.yml
Normal file
27
vars.yml
Normal file
@@ -0,0 +1,27 @@
|
||||
## add generic 755 directory for application here
|
||||
directories:
|
||||
- /opt/apps/npm
|
||||
- /opt/apps/jellyfin
|
||||
- /opt/apps/letsencrypt
|
||||
- /opt/apps/gitea
|
||||
- /opt/apps/jellyfin/config
|
||||
- /opt/apps/n8n/data
|
||||
# - /opt/apps/n8n/files
|
||||
|
||||
## Jellyfin directories for media
|
||||
directories_jellyfin:
|
||||
- /opt/apps/jellyfin/tvseries
|
||||
- /opt/apps/jellyfin/movies
|
||||
|
||||
images:
|
||||
- docker.io/jc21/nginx-proxy-manager:latest
|
||||
- lscr.io/linuxserver/jellyfin:latest
|
||||
# - docker.n8n.io/n8nio/n8n
|
||||
- docker.gitea.com/gitea:nightly
|
||||
|
||||
sudo_password: sdfwwww
|
||||
|
||||
POSTGRES_ADMIN_USER: theuseriwant
|
||||
POSTGRES_PASSWORD: theuserthatineedpaswoord
|
||||
POSTGRES_DB: thatoneit
|
||||
|
||||
Reference in New Issue
Block a user