added wazuh, not run yet
This commit is contained in:
@@ -67,6 +67,14 @@
|
|||||||
state: present
|
state: present
|
||||||
reload: true
|
reload: true
|
||||||
|
|
||||||
|
- name: Raise vm.max_map_count for Wazuh indexer
|
||||||
|
ansible.posix.sysctl:
|
||||||
|
name: vm.max_map_count
|
||||||
|
value: '262144'
|
||||||
|
sysctl_set: true
|
||||||
|
state: present
|
||||||
|
reload: true
|
||||||
|
|
||||||
- name: pull images
|
- name: pull images
|
||||||
containers.podman.podman_image:
|
containers.podman.podman_image:
|
||||||
name: "{{ item }}"
|
name: "{{ item }}"
|
||||||
@@ -186,6 +194,136 @@
|
|||||||
- npm_internal
|
- npm_internal
|
||||||
ip: '{{ wireguard_ip }}'
|
ip: '{{ wireguard_ip }}'
|
||||||
|
|
||||||
|
# Wazuh SIEM (single-node: indexer + manager + dashboard) on npm_internal
|
||||||
|
# Dashboard is NOT exposed on host ports — NPM proxies wazuh.boxswapper.io to https://10.10.0.40:5601
|
||||||
|
# DNS record must be grey-cloud (Cloudflare 523 lesson from vpn.boxswapper.io), cert via NPM
|
||||||
|
# Config is copied from ./wazuh-docker/config before first deploy
|
||||||
|
- name: Copy Wazuh config files to host
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: ./wazuh-docker/config/
|
||||||
|
dest: /opt/apps/wazuh/config/
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: preserve
|
||||||
|
force: true
|
||||||
|
|
||||||
|
- name: Generate Wazuh certificates
|
||||||
|
ansible.builtin.command: podman run --rm -e CERT_TOOL_VERSION=4.14 -v /opt/apps/wazuh/config/certs.yml:/config/certs.yml:z -v /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/:/certificates:z docker.io/wazuh/wazuh-certs-generator:0.0.3
|
||||||
|
args:
|
||||||
|
creates: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
|
||||||
|
|
||||||
|
- name: Copy root CA as manager root CA
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
|
||||||
|
dest: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem
|
||||||
|
remote_src: true
|
||||||
|
force: false
|
||||||
|
|
||||||
|
- name: Deploy Wazuh indexer
|
||||||
|
containers.podman.podman_container:
|
||||||
|
name: wazuh.indexer
|
||||||
|
image: "docker.io/wazuh/wazuh-indexer:{{ wazuh_version }}"
|
||||||
|
hostname: wazuh.indexer
|
||||||
|
restart_policy: always
|
||||||
|
recreate: true
|
||||||
|
state: started
|
||||||
|
env:
|
||||||
|
OPENSEARCH_JAVA_OPTS: "-Xms1g -Xmx1g"
|
||||||
|
ulimit:
|
||||||
|
- "memlock=-1:-1"
|
||||||
|
- "nofile=65536:65536"
|
||||||
|
volumes:
|
||||||
|
- "wazuh-indexer-data:/var/lib/wazuh-indexer"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem:z"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key:z"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem:z"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem:z"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem:z"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml:z"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml:z"
|
||||||
|
network:
|
||||||
|
- npm_internal
|
||||||
|
ip: '{{ wazuh_indexer_ip }}'
|
||||||
|
|
||||||
|
- name: Wait for Wazuh indexer to be ready
|
||||||
|
ansible.builtin.wait_for:
|
||||||
|
host: '{{ wazuh_indexer_ip }}'
|
||||||
|
port: 9200
|
||||||
|
delay: 10
|
||||||
|
timeout: 300
|
||||||
|
|
||||||
|
- name: Deploy Wazuh manager
|
||||||
|
containers.podman.podman_container:
|
||||||
|
name: wazuh.manager
|
||||||
|
image: "docker.io/wazuh/wazuh-manager:{{ wazuh_version }}"
|
||||||
|
hostname: wazuh.manager
|
||||||
|
restart_policy: always
|
||||||
|
recreate: true
|
||||||
|
state: started
|
||||||
|
env:
|
||||||
|
INDEXER_URL: "https://wazuh.indexer:9200"
|
||||||
|
INDEXER_USERNAME: "admin"
|
||||||
|
INDEXER_PASSWORD: "SecretPassword"
|
||||||
|
FILEBEAT_SSL_VERIFICATION_MODE: "full"
|
||||||
|
SSL_CERTIFICATE_AUTHORITIES: "/etc/ssl/root-ca.pem"
|
||||||
|
SSL_CERTIFICATE: "/etc/ssl/filebeat.pem"
|
||||||
|
SSL_KEY: "/etc/ssl/filebeat.key"
|
||||||
|
API_USERNAME: "wazuh-wui"
|
||||||
|
API_PASSWORD: "MyS3cr37P450r.*-"
|
||||||
|
ulimit:
|
||||||
|
- "memlock=-1:-1"
|
||||||
|
- "nofile=655360:655360"
|
||||||
|
ports:
|
||||||
|
- "1514:1514"
|
||||||
|
- "1515:1515"
|
||||||
|
- "514:514/udp"
|
||||||
|
- "55000:55000"
|
||||||
|
volumes:
|
||||||
|
- "wazuh_api_configuration:/var/ossec/api/configuration"
|
||||||
|
- "wazuh_etc:/var/ossec/etc"
|
||||||
|
- "wazuh_logs:/var/ossec/logs"
|
||||||
|
- "wazuh_queue:/var/ossec/queue"
|
||||||
|
- "wazuh_var_multigroups:/var/ossec/var/multigroups"
|
||||||
|
- "wazuh_active_response:/var/ossec/active-response/bin"
|
||||||
|
- "wazuh_wodles:/var/ossec/wodles"
|
||||||
|
- "filebeat_etc:/etc/filebeat"
|
||||||
|
- "filebeat_var:/var/lib/filebeat"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem:z"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem:z"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key:z"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf:z"
|
||||||
|
network:
|
||||||
|
- npm_internal
|
||||||
|
ip: '{{ wazuh_manager_ip }}'
|
||||||
|
|
||||||
|
- name: Deploy Wazuh dashboard
|
||||||
|
containers.podman.podman_container:
|
||||||
|
name: wazuh.dashboard
|
||||||
|
image: "docker.io/wazuh/wazuh-dashboard:{{ wazuh_version }}"
|
||||||
|
hostname: wazuh.dashboard
|
||||||
|
restart_policy: always
|
||||||
|
recreate: true
|
||||||
|
state: started
|
||||||
|
env:
|
||||||
|
INDEXER_USERNAME: "admin"
|
||||||
|
INDEXER_PASSWORD: "SecretPassword"
|
||||||
|
WAZUH_API_URL: "https://wazuh.manager"
|
||||||
|
DASHBOARD_USERNAME: "kibanaserver"
|
||||||
|
DASHBOARD_PASSWORD: "kibanaserver"
|
||||||
|
API_USERNAME: "wazuh-wui"
|
||||||
|
API_PASSWORD: "MyS3cr37P450r.*-"
|
||||||
|
volumes:
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem:z"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem:z"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem:z"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml:z"
|
||||||
|
- "/opt/apps/wazuh/config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml:z"
|
||||||
|
- "wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config"
|
||||||
|
- "wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom"
|
||||||
|
network:
|
||||||
|
- npm_internal
|
||||||
|
ip: '{{ wazuh_dashboard_ip }}'
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@@ -1,62 +0,0 @@
|
|||||||
---
|
|
||||||
- name: Deploy compos-prowler using Podman
|
|
||||||
hosts: internal-apps
|
|
||||||
become: true
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Install required packages for Podman and Docker Compose compatibility
|
|
||||||
apt:
|
|
||||||
name: podman
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Create container network (postgres_nw) if it does not exist
|
|
||||||
podman_network:
|
|
||||||
name: postgres_nw
|
|
||||||
driver: bridge
|
|
||||||
|
|
||||||
- name: Create container output volume if it does not exist
|
|
||||||
podman_volume:
|
|
||||||
name: output
|
|
||||||
driver: local
|
|
||||||
|
|
||||||
- name: Copy compos-prowler.yaml file to internal-apps server
|
|
||||||
copy:
|
|
||||||
content: "{{ lookup('file', 'path/to/compos-prowler.yaml') }}"
|
|
||||||
dest: /home/user/compos-prowler.yaml
|
|
||||||
mode: '0644'
|
|
||||||
|
|
||||||
- name: Create a Podman service from the YAML file
|
|
||||||
podman_service:
|
|
||||||
container_name: compos-prowler
|
|
||||||
image: "{{ item.image }}"
|
|
||||||
ports:
|
|
||||||
- "{{ item.ports[0] }}"
|
|
||||||
volumes:
|
|
||||||
- "output:/tmp/prowler_api_output"
|
|
||||||
depends_on:
|
|
||||||
- postgres
|
|
||||||
- valkey
|
|
||||||
networks:
|
|
||||||
- postgres_nw
|
|
||||||
with_items:
|
|
||||||
- { name: api, image: prowlercloud/prowler-api }
|
|
||||||
- { name: ui, image: prowlercloud/prowler-ui }
|
|
||||||
- { name: postgres, image: postgres:16.3-alpine3.20 }
|
|
||||||
- { name: valkey, image: valkey/valkey:7-alpine3.19 }
|
|
||||||
- { name: worker, image: prowlercloud/prowler-api }
|
|
||||||
- { name: worker-beat, image: prowlercloud/prowler-api }
|
|
||||||
|
|
||||||
- name: Start the container
|
|
||||||
podman_container:
|
|
||||||
container_name: compos-prowler
|
|
||||||
state: started
|
|
||||||
|
|
||||||
- name: Wait for all containers to be up and running
|
|
||||||
wait_for:
|
|
||||||
host_pattern: "{{ item }}"
|
|
||||||
port: "{{ item.ports[0] }}"
|
|
||||||
timeout: 300
|
|
||||||
delay: 5
|
|
||||||
with_items:
|
|
||||||
- api
|
|
||||||
- ui
|
|
||||||
22
vars.yml
22
vars.yml
@@ -10,10 +10,11 @@ directories:
|
|||||||
- /opt/apps/prowler/tmp/prowler_api_output
|
- /opt/apps/prowler/tmp/prowler_api_output
|
||||||
- /opt/apps/prowler/postgres/data
|
- /opt/apps/prowler/postgres/data
|
||||||
- /opt/apps/wireguard
|
- /opt/apps/wireguard
|
||||||
# - /opt/apps/wazuh/config
|
- /opt/apps/wazuh/config
|
||||||
# - /opt/apps/wazuh/filebeat_etc
|
- /opt/apps/wazuh/config/wazuh_indexer_ssl_certs
|
||||||
# - /opt/apps/wazuh/filebeat_var
|
- /opt/apps/wazuh/config/wazuh_cluster
|
||||||
# - /opt/apps/wazuh/wazuh_indexer_ssl_certs
|
- /opt/apps/wazuh/config/wazuh_dashboard
|
||||||
|
- /opt/apps/wazuh/config/wazuh_indexer
|
||||||
# # - /opt/apps/n8n/files
|
# # - /opt/apps/n8n/files
|
||||||
|
|
||||||
|
|
||||||
@@ -29,12 +30,12 @@ images:
|
|||||||
- docker.gitea.com/gitea:nightly
|
- docker.gitea.com/gitea:nightly
|
||||||
- docker.io/wazuh/wazuh-certs-generator:0.0.3
|
- docker.io/wazuh/wazuh-certs-generator:0.0.3
|
||||||
- ghcr.io/wg-easy/wg-easy:15
|
- ghcr.io/wg-easy/wg-easy:15
|
||||||
# - docker.io/wazuh/wazuh-dashboard:{{ wazah_version }}
|
- docker.io/wazuh/wazuh-dashboard:{{ wazuh_version }}
|
||||||
# - docker.io/wazuh/wazuh-indexer:{{ wazah_version }}
|
- docker.io/wazuh/wazuh-indexer:{{ wazuh_version }}
|
||||||
# - docker.io/wazuh/wazuh-manager:{{ wazah_version }}
|
- docker.io/wazuh/wazuh-manager:{{ wazuh_version }}
|
||||||
|
|
||||||
|
|
||||||
wazah_version: 4.14.1
|
wazuh_version: 4.14.1
|
||||||
sudo_password: sdfwwww
|
sudo_password: sdfwwww
|
||||||
|
|
||||||
POSTGRES_ADMIN_USER: theuseriwant
|
POSTGRES_ADMIN_USER: theuseriwant
|
||||||
@@ -56,3 +57,8 @@ wireguard_allowed_ips: 10.10.1.0/24,10.10.0.0/24
|
|||||||
wireguard_default_dns: 1.1.1.1
|
wireguard_default_dns: 1.1.1.1
|
||||||
wireguard_ip: 10.10.0.36
|
wireguard_ip: 10.10.0.36
|
||||||
|
|
||||||
|
## Wazuh SIEM (static IPs on npm_internal)
|
||||||
|
wazuh_dashboard_ip: 10.10.0.40
|
||||||
|
wazuh_manager_ip: 10.10.0.41
|
||||||
|
wazuh_indexer_ip: 10.10.0.42
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user