From cf8483fb6e3933036f617a26e1293320453b9284 Mon Sep 17 00:00:00 2001 From: boxswapper Date: Tue, 15 Sep 2026 15:27:59 -0600 Subject: [PATCH] added wazuh, not run yet --- ansible-playbook.yml | 138 ++++++++++++++++++++++++++++++++++++++ deploy-compos-prowler.yml | 62 ----------------- vars.yml | 22 +++--- 3 files changed, 152 insertions(+), 70 deletions(-) delete mode 100755 deploy-compos-prowler.yml diff --git a/ansible-playbook.yml b/ansible-playbook.yml index ebccfc5..fea00f7 100755 --- a/ansible-playbook.yml +++ b/ansible-playbook.yml @@ -67,6 +67,14 @@ state: present reload: true + - name: Raise vm.max_map_count for Wazuh indexer + ansible.posix.sysctl: + name: vm.max_map_count + value: '262144' + sysctl_set: true + state: present + reload: true + - name: pull images containers.podman.podman_image: name: "{{ item }}" @@ -186,6 +194,136 @@ - npm_internal ip: '{{ wireguard_ip }}' + # Wazuh SIEM (single-node: indexer + manager + dashboard) on npm_internal + # Dashboard is NOT exposed on host ports — NPM proxies wazuh.boxswapper.io to https://10.10.0.40:5601 + # DNS record must be grey-cloud (Cloudflare 523 lesson from vpn.boxswapper.io), cert via NPM + # Config is copied from ./wazuh-docker/config before first deploy + - name: Copy Wazuh config files to host + ansible.builtin.copy: + src: ./wazuh-docker/config/ + dest: /opt/apps/wazuh/config/ + owner: root + group: root + mode: preserve + force: true + + - name: Generate Wazuh certificates + ansible.builtin.command: podman run --rm -e CERT_TOOL_VERSION=4.14 -v /opt/apps/wazuh/config/certs.yml:/config/certs.yml:z -v /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/:/certificates:z docker.io/wazuh/wazuh-certs-generator:0.0.3 + args: + creates: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem + + - name: Copy root CA as manager root CA + ansible.builtin.copy: + src: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem + dest: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem + remote_src: true + force: false + + - name: Deploy Wazuh indexer + containers.podman.podman_container: + name: wazuh.indexer + image: "docker.io/wazuh/wazuh-indexer:{{ wazuh_version }}" + hostname: wazuh.indexer + restart_policy: always + recreate: true + state: started + env: + OPENSEARCH_JAVA_OPTS: "-Xms1g -Xmx1g" + ulimit: + - "memlock=-1:-1" + - "nofile=65536:65536" + volumes: + - "wazuh-indexer-data:/var/lib/wazuh-indexer" + - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem:z" + - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key:z" + - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem:z" + - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem:z" + - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem:z" + - "/opt/apps/wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml:z" + - "/opt/apps/wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml:z" + network: + - npm_internal + ip: '{{ wazuh_indexer_ip }}' + + - name: Wait for Wazuh indexer to be ready + ansible.builtin.wait_for: + host: '{{ wazuh_indexer_ip }}' + port: 9200 + delay: 10 + timeout: 300 + + - name: Deploy Wazuh manager + containers.podman.podman_container: + name: wazuh.manager + image: "docker.io/wazuh/wazuh-manager:{{ wazuh_version }}" + hostname: wazuh.manager + restart_policy: always + recreate: true + state: started + env: + INDEXER_URL: "https://wazuh.indexer:9200" + INDEXER_USERNAME: "admin" + INDEXER_PASSWORD: "SecretPassword" + FILEBEAT_SSL_VERIFICATION_MODE: "full" + SSL_CERTIFICATE_AUTHORITIES: "/etc/ssl/root-ca.pem" + SSL_CERTIFICATE: "/etc/ssl/filebeat.pem" + SSL_KEY: "/etc/ssl/filebeat.key" + API_USERNAME: "wazuh-wui" + API_PASSWORD: "MyS3cr37P450r.*-" + ulimit: + - "memlock=-1:-1" + - "nofile=655360:655360" + ports: + - "1514:1514" + - "1515:1515" + - "514:514/udp" + - "55000:55000" + volumes: + - "wazuh_api_configuration:/var/ossec/api/configuration" + - "wazuh_etc:/var/ossec/etc" + - "wazuh_logs:/var/ossec/logs" + - "wazuh_queue:/var/ossec/queue" + - "wazuh_var_multigroups:/var/ossec/var/multigroups" + - "wazuh_active_response:/var/ossec/active-response/bin" + - "wazuh_wodles:/var/ossec/wodles" + - "filebeat_etc:/etc/filebeat" + - "filebeat_var:/var/lib/filebeat" + - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem:z" + - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem:z" + - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key:z" + - "/opt/apps/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf:z" + network: + - npm_internal + ip: '{{ wazuh_manager_ip }}' + + - name: Deploy Wazuh dashboard + containers.podman.podman_container: + name: wazuh.dashboard + image: "docker.io/wazuh/wazuh-dashboard:{{ wazuh_version }}" + hostname: wazuh.dashboard + restart_policy: always + recreate: true + state: started + env: + INDEXER_USERNAME: "admin" + INDEXER_PASSWORD: "SecretPassword" + WAZUH_API_URL: "https://wazuh.manager" + DASHBOARD_USERNAME: "kibanaserver" + DASHBOARD_PASSWORD: "kibanaserver" + API_USERNAME: "wazuh-wui" + API_PASSWORD: "MyS3cr37P450r.*-" + volumes: + - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem:z" + - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem:z" + - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem:z" + - "/opt/apps/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml:z" + - "/opt/apps/wazuh/config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml:z" + - "wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config" + - "wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom" + network: + - npm_internal + ip: '{{ wazuh_dashboard_ip }}' + diff --git a/deploy-compos-prowler.yml b/deploy-compos-prowler.yml deleted file mode 100755 index ebb5512..0000000 --- a/deploy-compos-prowler.yml +++ /dev/null @@ -1,62 +0,0 @@ ---- -- name: Deploy compos-prowler using Podman - hosts: internal-apps - become: true - - tasks: - - name: Install required packages for Podman and Docker Compose compatibility - apt: - name: podman - state: present - - - name: Create container network (postgres_nw) if it does not exist - podman_network: - name: postgres_nw - driver: bridge - - - name: Create container output volume if it does not exist - podman_volume: - name: output - driver: local - - - name: Copy compos-prowler.yaml file to internal-apps server - copy: - content: "{{ lookup('file', 'path/to/compos-prowler.yaml') }}" - dest: /home/user/compos-prowler.yaml - mode: '0644' - - - name: Create a Podman service from the YAML file - podman_service: - container_name: compos-prowler - image: "{{ item.image }}" - ports: - - "{{ item.ports[0] }}" - volumes: - - "output:/tmp/prowler_api_output" - depends_on: - - postgres - - valkey - networks: - - postgres_nw - with_items: - - { name: api, image: prowlercloud/prowler-api } - - { name: ui, image: prowlercloud/prowler-ui } - - { name: postgres, image: postgres:16.3-alpine3.20 } - - { name: valkey, image: valkey/valkey:7-alpine3.19 } - - { name: worker, image: prowlercloud/prowler-api } - - { name: worker-beat, image: prowlercloud/prowler-api } - - - name: Start the container - podman_container: - container_name: compos-prowler - state: started - - - name: Wait for all containers to be up and running - wait_for: - host_pattern: "{{ item }}" - port: "{{ item.ports[0] }}" - timeout: 300 - delay: 5 - with_items: - - api - - ui \ No newline at end of file diff --git a/vars.yml b/vars.yml index 40fb497..7c96186 100755 --- a/vars.yml +++ b/vars.yml @@ -10,10 +10,11 @@ directories: - /opt/apps/prowler/tmp/prowler_api_output - /opt/apps/prowler/postgres/data - /opt/apps/wireguard -# - /opt/apps/wazuh/config -# - /opt/apps/wazuh/filebeat_etc -# - /opt/apps/wazuh/filebeat_var -# - /opt/apps/wazuh/wazuh_indexer_ssl_certs + - /opt/apps/wazuh/config + - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs + - /opt/apps/wazuh/config/wazuh_cluster + - /opt/apps/wazuh/config/wazuh_dashboard + - /opt/apps/wazuh/config/wazuh_indexer # # - /opt/apps/n8n/files @@ -29,12 +30,12 @@ images: - docker.gitea.com/gitea:nightly - docker.io/wazuh/wazuh-certs-generator:0.0.3 - ghcr.io/wg-easy/wg-easy:15 - # - docker.io/wazuh/wazuh-dashboard:{{ wazah_version }} - # - docker.io/wazuh/wazuh-indexer:{{ wazah_version }} - # - docker.io/wazuh/wazuh-manager:{{ wazah_version }} + - docker.io/wazuh/wazuh-dashboard:{{ wazuh_version }} + - docker.io/wazuh/wazuh-indexer:{{ wazuh_version }} + - docker.io/wazuh/wazuh-manager:{{ wazuh_version }} -wazah_version: 4.14.1 +wazuh_version: 4.14.1 sudo_password: sdfwwww POSTGRES_ADMIN_USER: theuseriwant @@ -56,3 +57,8 @@ wireguard_allowed_ips: 10.10.1.0/24,10.10.0.0/24 wireguard_default_dns: 1.1.1.1 wireguard_ip: 10.10.0.36 +## Wazuh SIEM (static IPs on npm_internal) +wazuh_dashboard_ip: 10.10.0.40 +wazuh_manager_ip: 10.10.0.41 +wazuh_indexer_ip: 10.10.0.42 +