boxswapper/Internal-apps
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added wazuh, not run yet

Browse Source
This commit is contained in:
boxswapper
2026-09-15 15:27:59 -06:00
parent 0b846dca62
commit cf8483fb6e
3 changed files with 152 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

138
ansible-playbook.yml
View File

@@ -67,6 +67,14 @@
state: present
reload: true
- name: Raise vm.max_map_count for Wazuh indexer
ansible.posix.sysctl:
name: vm.max_map_count
value: '262144'
sysctl_set: true
state: present
reload: true
- name: pull images
containers.podman.podman_image:
name: "{{ item }}"
@@ -186,6 +194,136 @@
- npm_internal
ip: '{{ wireguard_ip }}'
# Wazuh SIEM (single-node: indexer + manager + dashboard) on npm_internal
# Dashboard is NOT exposed on host ports — NPM proxies wazuh.boxswapper.io to https://10.10.0.40:5601
# DNS record must be grey-cloud (Cloudflare 523 lesson from vpn.boxswapper.io), cert via NPM
# Config is copied from ./wazuh-docker/config before first deploy
- name: Copy Wazuh config files to host
ansible.builtin.copy:
src: ./wazuh-docker/config/
dest: /opt/apps/wazuh/config/
owner: root
group: root
mode: preserve
force: true
- name: Generate Wazuh certificates
ansible.builtin.command: podman run --rm -e CERT_TOOL_VERSION=4.14 -v /opt/apps/wazuh/config/certs.yml:/config/certs.yml:z -v /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/:/certificates:z docker.io/wazuh/wazuh-certs-generator:0.0.3
args:
creates: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
- name: Copy root CA as manager root CA
ansible.builtin.copy:
src: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
dest: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem
remote_src: true
force: false
- name: Deploy Wazuh indexer
containers.podman.podman_container:
name: wazuh.indexer
image: "docker.io/wazuh/wazuh-indexer:{{ wazuh_version }}"
hostname: wazuh.indexer
restart_policy: always
recreate: true
state: started
env:
OPENSEARCH_JAVA_OPTS: "-Xms1g -Xmx1g"
ulimit:
- "memlock=-1:-1"
- "nofile=65536:65536"
volumes:
- "wazuh-indexer-data:/var/lib/wazuh-indexer"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml:z"
- "/opt/apps/wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml:z"
network:
- npm_internal
ip: '{{ wazuh_indexer_ip }}'
- name: Wait for Wazuh indexer to be ready
ansible.builtin.wait_for:
host: '{{ wazuh_indexer_ip }}'
port: 9200
delay: 10
timeout: 300
- name: Deploy Wazuh manager
containers.podman.podman_container:
name: wazuh.manager
image: "docker.io/wazuh/wazuh-manager:{{ wazuh_version }}"
hostname: wazuh.manager
restart_policy: always
recreate: true
state: started
env:
INDEXER_URL: "https://wazuh.indexer:9200"
INDEXER_USERNAME: "admin"
INDEXER_PASSWORD: "SecretPassword"
FILEBEAT_SSL_VERIFICATION_MODE: "full"
SSL_CERTIFICATE_AUTHORITIES: "/etc/ssl/root-ca.pem"
SSL_CERTIFICATE: "/etc/ssl/filebeat.pem"
SSL_KEY: "/etc/ssl/filebeat.key"
API_USERNAME: "wazuh-wui"
API_PASSWORD: "MyS3cr37P450r.*-"
ulimit:
- "memlock=-1:-1"
- "nofile=655360:655360"
ports:
- "1514:1514"
- "1515:1515"
- "514:514/udp"
- "55000:55000"
volumes:
- "wazuh_api_configuration:/var/ossec/api/configuration"
- "wazuh_etc:/var/ossec/etc"
- "wazuh_logs:/var/ossec/logs"
- "wazuh_queue:/var/ossec/queue"
- "wazuh_var_multigroups:/var/ossec/var/multigroups"
- "wazuh_active_response:/var/ossec/active-response/bin"
- "wazuh_wodles:/var/ossec/wodles"
- "filebeat_etc:/etc/filebeat"
- "filebeat_var:/var/lib/filebeat"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key:z"
- "/opt/apps/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf:z"
network:
- npm_internal
ip: '{{ wazuh_manager_ip }}'
- name: Deploy Wazuh dashboard
containers.podman.podman_container:
name: wazuh.dashboard
image: "docker.io/wazuh/wazuh-dashboard:{{ wazuh_version }}"
hostname: wazuh.dashboard
restart_policy: always
recreate: true
state: started
env:
INDEXER_USERNAME: "admin"
INDEXER_PASSWORD: "SecretPassword"
WAZUH_API_URL: "https://wazuh.manager"
DASHBOARD_USERNAME: "kibanaserver"
DASHBOARD_PASSWORD: "kibanaserver"
API_USERNAME: "wazuh-wui"
API_PASSWORD: "MyS3cr37P450r.*-"
volumes:
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem:z"
- "/opt/apps/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml:z"
- "/opt/apps/wazuh/config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml:z"
- "wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config"
- "wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom"
network:
- npm_internal
ip: '{{ wazuh_dashboard_ip }}'

62
deploy-compos-prowler.yml
View File

@@ -1,62 +0,0 @@
---
- name: Deploy compos-prowler using Podman
hosts: internal-apps
become: true
tasks:
- name: Install required packages for Podman and Docker Compose compatibility
apt:
name: podman
state: present
- name: Create container network (postgres_nw) if it does not exist
podman_network:
name: postgres_nw
driver: bridge
- name: Create container output volume if it does not exist
podman_volume:
name: output
driver: local
- name: Copy compos-prowler.yaml file to internal-apps server
copy:
content: "{{ lookup('file', 'path/to/compos-prowler.yaml') }}"
dest: /home/user/compos-prowler.yaml
mode: '0644'
- name: Create a Podman service from the YAML file
podman_service:
container_name: compos-prowler
image: "{{ item.image }}"
ports:
- "{{ item.ports[0] }}"
volumes:
- "output:/tmp/prowler_api_output"
depends_on:
- postgres
- valkey
networks:
- postgres_nw
with_items:
- { name: api, image: prowlercloud/prowler-api }
- { name: ui, image: prowlercloud/prowler-ui }
- { name: postgres, image: postgres:16.3-alpine3.20 }
- { name: valkey, image: valkey/valkey:7-alpine3.19 }
- { name: worker, image: prowlercloud/prowler-api }
- { name: worker-beat, image: prowlercloud/prowler-api }
- name: Start the container
podman_container:
container_name: compos-prowler
state: started
- name: Wait for all containers to be up and running
wait_for:
host_pattern: "{{ item }}"
port: "{{ item.ports[0] }}"
timeout: 300
delay: 5
with_items:
- api
- ui

22
vars.yml
View File

@@ -10,10 +10,11 @@ directories:
- /opt/apps/prowler/tmp/prowler_api_output
- /opt/apps/prowler/postgres/data
- /opt/apps/wireguard
# - /opt/apps/wazuh/config
# - /opt/apps/wazuh/filebeat_etc
# - /opt/apps/wazuh/filebeat_var
# - /opt/apps/wazuh/wazuh_indexer_ssl_certs
- /opt/apps/wazuh/config
- /opt/apps/wazuh/config/wazuh_indexer_ssl_certs
- /opt/apps/wazuh/config/wazuh_cluster
- /opt/apps/wazuh/config/wazuh_dashboard
- /opt/apps/wazuh/config/wazuh_indexer
# # - /opt/apps/n8n/files
@@ -29,12 +30,12 @@ images:
- docker.gitea.com/gitea:nightly
- docker.io/wazuh/wazuh-certs-generator:0.0.3
- ghcr.io/wg-easy/wg-easy:15
# - docker.io/wazuh/wazuh-dashboard:{{ wazah_version }}
# - docker.io/wazuh/wazuh-indexer:{{ wazah_version }}
# - docker.io/wazuh/wazuh-manager:{{ wazah_version }}
- docker.io/wazuh/wazuh-dashboard:{{ wazuh_version }}
- docker.io/wazuh/wazuh-indexer:{{ wazuh_version }}
- docker.io/wazuh/wazuh-manager:{{ wazuh_version }}
wazah_version: 4.14.1
wazuh_version: 4.14.1
sudo_password: sdfwwww
POSTGRES_ADMIN_USER: theuseriwant
@@ -56,3 +57,8 @@ wireguard_allowed_ips: 10.10.1.0/24,10.10.0.0/24
wireguard_default_dns: 1.1.1.1
wireguard_ip: 10.10.0.36
## Wazuh SIEM (static IPs on npm_internal)
wazuh_dashboard_ip: 10.10.0.40
wazuh_manager_ip: 10.10.0.41
wazuh_indexer_ip: 10.10.0.42