updated

.gitignore

@@ -1,3 +1,4 @@
 # ---> Ansible
 *.retry
+*_data/
 

README.md

@@ -1,3 +1,7 @@
 # Internal-apps
 
+```
+ansible-playbook -i inventory.ini ansible-playbook.yml --ask-become-pass
+```
+
 Internal Applications for home use all in Podman Ansible playbooks

ansible-playbook.yml

@@ -0,0 +1,278 @@
+---
+- hosts: internal-apps
+  become: true
+  vars_files: 
+    - ./vars.yml
+  tasks:
+    - name: Update Packages
+      ansible.builtin.dnf:
+        update_cache: yes
+
+    - name: Install Packages
+      ansible.builtin.dnf:
+        name:
+          - vim
+          - podman
+          - fail2ban
+          - python3-libdnf5
+        state: present
+    
+    - name: Create directories 
+      file:
+        path: "{{ item }}"
+        state: directory
+        mode: '0755'
+      loop: "{{ directories }}"
+
+    - name: Create Jellyfin directories 
+      file:
+        path: "{{ item }}"
+        state: directory
+        mode: '0777'
+      loop: "{{ directories_jellyfin }}"
+
+    - name: Create internal podman network
+      containers.podman.podman_network:
+        name: npm_internal
+        ip_range: 10.10.0.128/25
+        subnet: 10.10.0.0/24
+        gateway: 10.10.0.1
+        state: present
+
+    - name: pull images
+      containers.podman.podman_image:
+        name: "{{ item }}"
+      loop: "{{ images }}"
+
+    - name: Deploy Nginx Proxy Manager 
+      containers.podman.podman_container:
+        image: "docker.io/jc21/nginx-proxy-manager:latest"
+        name: npm
+        restart_policy: always
+        recreate: true
+        state: started
+        ports:
+          - "80:80"
+          - "81:81"
+          - "443:443"
+        volumes:
+          - "/opt/apps/npm:/data:z"
+          - "/opt/apps/letsencrypt:/etc/letsencrypt:z"
+        network:
+          - npm_internal
+        ip: '10.10.0.19'
+
+    - name: Deploy Gitea 
+      containers.podman.podman_container:
+        image: docker.gitea.com/gitea:nightly
+        name: gitea
+        env:
+          USER_UID: 1000
+          USER_GID: 1000
+        restart_policy: always
+        recreate: true
+        state: started
+        volumes:
+          - /opt/apps/gitea:/data:z
+          - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
+          - /etc/localtime:/etc/localtime:ro
+        network:
+          - npm_internal
+        ip: '10.10.0.25'
+        ports:
+        #  - "3000:3000"
+          - "222:22"
+
+
+    - name: Deploy Jellyfin
+      containers.podman.podman_container:
+        image: lscr.io/linuxserver/jellyfin:latest
+        name: jellyfin
+        env:
+          USER_UID: 1000
+          USER_GID: 1000
+          JELLYFIN_PublishedServerUrl: http://jellyfin.boxswapper.io
+        restart_policy: always
+        recreate: true
+        state: started
+        volumes:
+          - /opt/apps/jellyfin/config:/config:z
+          - /opt/apps/jellyfin/tvseries:/data/tvshows:z
+          - /opt/apps/jellyfin/movies:/data/movies:z
+          - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
+          - /etc/localtime:/etc/localtime:ro
+        network:
+          - npm_internal
+        ip: '10.10.0.30'
+        # ports:
+        #   - 8096:8096
+      #   - 8920:8920 #optional
+      #   - 7359:7359/udp #optional
+      #   - 1900:1900/udp #optional
+
+#---- Genearate Wuzah docker certs ---#
+    - name: Generate Wazuh certs
+      containers.podman.podman_container:
+        image: wazuh/wazuh-certs-generator:0.0.3
+        name: wazuh-certs-generator
+        env:
+          USER_UID: 1000
+          USER_GID: 1000
+          CERT_TOOL_VERSION: 4.14
+        auto_remove: yes
+        command: "generator"
+        volumes:
+          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/:/certificates/
+          - /opt/apps/wazuh/config/certs.yml:/config/certs.yml
+
+#----Wazuh-docker deploy---#
+
+    - name: Deploy Wazuh Manager
+      containers.podman.podman_container:
+        image: wazuh/wazuh-manager:{{ wazah_version }}
+        name: wazuh.manager
+        env:
+          INDEXER_URL: "https://wazuh.indexer:9200"
+          INDEXER_USERNAME: "admin"
+          INDEXER_PASSWORD: "SecretPassword"
+          FILEBEAT_SSL_VERIFICATION_MODE: "full"
+          SSL_CERTIFICATE_AUTHORITIES: "/etc/ssl/root-ca.pem"
+          SSL_CERTIFICATE: "/etc/ssl/filebeat.pem"
+          SSL_KEY: "/etc/ssl/filebeat.key"
+          API_USERNAME: "wazuh-wui"
+          API_PASSWORD: "MyS3cr37P450r.*-"
+        ulimits:
+          - "memlock:-1:-1"
+          - "nofile:655360:655360"
+        restart_policy: true
+        recreate: true
+        state: started
+        volumes:
+          - /opt/apps/wazuh/wazuh_api_configuration:/var/ossec/api/configuration
+          - /opt/apps/wazuh/wazuh_etc:/var/ossec/etc
+          - /opt/apps/wazuh/wazuh_logs:/var/ossec/logs
+          - /opt/apps/wazuh/wazuh_queue:/var/ossec/queue
+          - /opt/apps/wazuh/wazuh_var_multigroups:/var/ossec/var/multigroups
+          - /opt/apps/wazuh/wazuh_active_response:/var/ossec/active-response/bin
+          - /opt/apps/wazuh/wazuh_wodles:/var/ossec/wodles
+          - /opt/apps/wazuh/filebeat_etc:/etc/filebeat
+          - /opt/apps/wazuh/filebeat_var:/var/lib/filebeat
+          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
+          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
+          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
+          - /opt/apps/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
+
+        ports:
+          - "1514:1514"
+          - "1515:1515"
+          - "514:514/udp"
+          - "55000:55000"
+
+
+    - name: Deploy Wazuh Indexer
+      containers.podman.podman_container:
+        image: wazuh/wazuh-indexer:{{ wazah_version }}
+        name: wazuh.indexer
+        env:
+          OENSEARCH_JAVA_OPTS: "-Xms1g -Xmx1g"
+        ulimits:
+          - "memlock:-1:-1"
+          - "nofile:655360:655360"
+        restart_policy: true
+        recreate: true
+        state: started
+        ports:
+          - "9200:9200"
+        volumes:
+          - /opt/apps/wazuh/wazah-indexer-data/ib/wazuh-indexer
+          - /opt/apps/wazuhconfig/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
+          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
+          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
+          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
+          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
+          - /opt/apps/wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
+          - /opt/apps/wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
+
+    - name: Deploy Wazuh Dashboard
+      containers.podman.podman_container:
+        image: wazuh/wazuh-dashboard:{{ wazah_version }}
+        name: wazuh.dashboard
+        env:
+          INDEXER_USERNAME: "admin"
+          INDEXER_PASSWORD: "SecretPassword"
+          WAZUH_API_URL: "https://wazuh.manager"
+          DASHBOARD_USERNAME: "kibanaserver"
+          DASHBOARD_PASSWORD: "kibanaserver"
+          API_USERNAME: "wazuh-wui"
+          API_PASSWORD: "MyS3cr37P450r.*-"
+        ulimits:
+          - "memlock:-1:-1"
+          - "nofile:655360:655360"
+        restart_policy: true
+        recreate: true
+        state: started
+        ports:
+          - "443:5601"
+        volumes:
+          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
+          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
+          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
+          - /opt/apps/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
+          - /opt/apps/wazuh/config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
+          - /opt/apps/wazuh/wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config
+          - /opt/apps/wazuh/wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
+        network:
+          - npm_internal
+        ip: '10.10.0.36'
+        
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+#----N8N deployment, no GPU avail for deployment ------#
+
+    # - name: Deploy n8n
+      # containers.podman.podman_container:
+      #   image: docker.n8n.io/n8nio/n8n
+      #   name: n8n
+      #   env:
+      #     N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: true
+      #     N8N_RUNNERS_ENABLED: true
+      #   restart_policy: always
+      #   recreate: true
+      #   state: started
+      #   volumes:
+      #     - /opt/apps/n8n/data:/home/node/.n8n:z
+      #     - /opt/apps/n8n/files:/files:z
+      #     - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
+      #     - /etc/localtime:/etc/localtime:ro
+
+      #   network:
+      #     - npm_internal
+      #   ip: '10.10.0.35'
+      # # ports:
+      # #   - 5678:5678
+   
+

deploy-compos-prowler.yml

@@ -0,0 +1,62 @@
+---
+- name: Deploy compos-prowler using Podman
+  hosts: internal-apps
+  become: true
+
+  tasks:
+  - name: Install required packages for Podman and Docker Compose compatibility
+    apt:
+      name: podman
+      state: present
+
+  - name: Create container network (postgres_nw) if it does not exist
+    podman_network:
+      name: postgres_nw
+      driver: bridge
+
+  - name: Create container output volume if it does not exist
+    podman_volume:
+      name: output
+      driver: local
+
+  - name: Copy compos-prowler.yaml file to internal-apps server
+    copy:
+      content: "{{ lookup('file', 'path/to/compos-prowler.yaml') }}"
+      dest: /home/user/compos-prowler.yaml
+      mode: '0644'
+
+  - name: Create a Podman service from the YAML file
+    podman_service:
+      container_name: compos-prowler
+      image: "{{ item.image }}"
+      ports:
+        - "{{ item.ports[0] }}"
+      volumes:
+        - "output:/tmp/prowler_api_output"
+      depends_on:
+        - postgres
+        - valkey
+      networks:
+        - postgres_nw
+    with_items:
+      - { name: api, image: prowlercloud/prowler-api }
+      - { name: ui, image: prowlercloud/prowler-ui }
+      - { name: postgres, image: postgres:16.3-alpine3.20 }
+      - { name: valkey, image: valkey/valkey:7-alpine3.19 }
+      - { name: worker, image: prowlercloud/prowler-api }
+      - { name: worker-beat, image: prowlercloud/prowler-api }
+
+  - name: Start the container
+    podman_container:
+      container_name: compos-prowler
+      state: started
+
+  - name: Wait for all containers to be up and running
+    wait_for:
+      host_pattern: "{{ item }}"
+      port: "{{ item.ports[0] }}"
+      timeout: 300
+      delay: 5
+    with_items:
+      - api
+      - ui

inventory.ini

@@ -0,0 +1,2 @@
+[internal-apps]
+internal-apps

requirements.yml

@@ -0,0 +1,4 @@
+collections:
+  - name: containers.podman
+
+  

vars.yml

@@ -0,0 +1,41 @@
+## add generic 755 directory for application here
+directories:
+  - /opt/apps/npm
+  - /opt/apps/jellyfin
+  - /opt/apps/letsencrypt
+  - /opt/apps/gitea
+  - /opt/apps/jellyfin/config
+  - /opt/apps/n8n/data
+  - /opt/apps/prowler/data
+  - /opt/apps/prowler/tmp/prowler_api_output
+  - /opt/apps/prowler/postgres/data
+  - /opt/apps/wazuh/config
+  - /opt/apps/wazuh/filebeat_etc
+  - /opt/apps/wazuh/filebeat_var
+  - /opt/apps/wazuh/wazuh_indexer_ssl_certs
+#  - /opt/apps/n8n/files
+
+
+## Jellyfin directories for media
+directories_jellyfin:
+  - /opt/apps/jellyfin/tvseries
+  - /opt/apps/jellyfin/movies
+
+images:
+  - docker.io/jc21/nginx-proxy-manager:latest
+  - lscr.io/linuxserver/jellyfin:latest
+#  - docker.n8n.io/n8nio/n8n
+  - docker.gitea.com/gitea:nightly
+  - docker.io/wazuh/wazuh-certs-generator:0.0.3
+  - docker.io/wazuh/wazuh-dashboard:{{ wazah_version }}
+  - docker.io/wazuh/wazuh-indexer:{{ wazah_version }}
+  - docker.io/wazuh/wazuh-manager:{{ wazah_version }}
+
+
+wazah_version: 4.14.1
+sudo_password: sdfwwww
+
+POSTGRES_ADMIN_USER: theuseriwant
+POSTGRES_PASSWORD: theuserthatineedpaswoord
+POSTGRES_DB: thatoneit
+