--- # Wazuh SIEM (single-node: indexer + manager + dashboard) on npm_internal # Dashboard is NOT exposed on host ports — NPM proxies wazuh.boxswapper.io to https://10.10.0.40:5601 # DNS record must be grey-cloud (Cloudflare 523 lesson from vpn.boxswapper.io), cert via NPM # Config is copied from ./wazuh-docker/config before first deploy - name: Create Wazuh config directory ansible.builtin.file: path: /opt/apps/wazuh/config state: directory mode: '0755' - name: Copy Wazuh config files to host ansible.builtin.copy: src: ./wazuh-docker/config/ dest: /opt/apps/wazuh/config/ owner: root group: root mode: preserve force: true - name: Check for stale Wazuh certificate residue ansible.builtin.stat: path: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem register: wazuh_cert_residue - name: Remove stale Wazuh certificate directories ansible.builtin.file: path: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs state: absent when: wazuh_cert_residue.stat.exists and wazuh_cert_residue.stat.isdir - name: Recreate Wazuh certificates directory ansible.builtin.file: path: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs state: directory mode: '0755' owner: root group: root - name: Generate Wazuh certificates ansible.builtin.command: > podman run --rm -e CERT_TOOL_VERSION=4.14 -v /opt/apps/wazuh/config/certs.yml:/config/certs.yml:z -v /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/:/certificates:z docker.io/wazuh/wazuh-certs-generator:0.0.3 args: creates: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem - name: Copy root CA as manager root CA ansible.builtin.copy: src: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem dest: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem remote_src: true force: false - name: Deploy Wazuh indexer containers.podman.podman_container: name: wazuh.indexer image: "docker.io/wazuh/wazuh-indexer:{{ wazuh_version }}" hostname: wazuh.indexer restart_policy: always recreate: true state: started env: OPENSEARCH_JAVA_OPTS: "-Xms1g -Xmx1g" ulimit: - "memlock=-1:-1" - "nofile=65536:65536" volumes: - "wazuh-indexer-data:/var/lib/wazuh-indexer" - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem:z" - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key:z" - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem:z" - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem:z" - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem:z" - "/opt/apps/wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml:z" - "/opt/apps/wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml:z" network: - npm_internal ip: '{{ wazuh_indexer_ip }}' - name: Wait for Wazuh indexer to be ready ansible.builtin.wait_for: host: '{{ wazuh_indexer_ip }}' port: 9200 delay: 10 timeout: 300 - name: Deploy Wazuh manager containers.podman.podman_container: name: wazuh.manager image: "docker.io/wazuh/wazuh-manager:{{ wazuh_version }}" hostname: wazuh.manager restart_policy: always recreate: true state: started env: INDEXER_URL: "https://wazuh.indexer:9200" INDEXER_USERNAME: "admin" INDEXER_PASSWORD: "*WD*oW9m6iKf4hDovy7BbMmhLxC9D?Tv" FILEBEAT_SSL_VERIFICATION_MODE: "full" SSL_CERTIFICATE_AUTHORITIES: "/etc/ssl/root-ca.pem" SSL_CERTIFICATE: "/etc/ssl/filebeat.pem" SSL_KEY: "/etc/ssl/filebeat.key" API_USERNAME: "wazuh-wui" API_PASSWORD: "MyS3cr37P450r.*-" ulimit: - "memlock=-1:-1" - "nofile=655360:655360" ports: - "1514:1514" - "1515:1515" - "514:514/udp" - "55000:55000" volumes: - "wazuh_api_configuration:/var/ossec/api/configuration" - "wazuh_etc:/var/ossec/etc" - "wazuh_logs:/var/ossec/logs" - "wazuh_queue:/var/ossec/queue" - "wazuh_var_multigroups:/var/ossec/var/multigroups" - "wazuh_integrations:/var/ossec/integrations" - "wazuh_agentless:/var/ossec/agentless" - "wazuh_active_response:/var/ossec/active-response/bin" - "wazuh_wodles:/var/ossec/wodles" - "filebeat_etc:/etc/filebeat" - "filebeat_var:/var/lib/filebeat" - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem:z" - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem:z" - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key:z" - "/opt/apps/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf:z" network: - npm_internal ip: '{{ wazuh_manager_ip }}' - name: Deploy Wazuh dashboard containers.podman.podman_container: name: wazuh.dashboard image: "docker.io/wazuh/wazuh-dashboard:{{ wazuh_version }}" hostname: wazuh.dashboard restart_policy: always recreate: true state: started env: INDEXER_USERNAME: "admin" INDEXER_PASSWORD: "*WD*oW9m6iKf4hDovy7BbMmhLxC9D?Tv" WAZUH_API_URL: "https://wazuh.manager" DASHBOARD_USERNAME: "kibanaserver" DASHBOARD_PASSWORD: "kibanaserver" API_USERNAME: "wazuh-wui" API_PASSWORD: "MyS3cr37P450r.*-" volumes: - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem:z" - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem:z" - "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem:z" - "/opt/apps/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml:z" - "/opt/apps/wazuh/config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml:z" - "wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config" - "wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom" network: - npm_internal ip: '{{ wazuh_dashboard_ip }}'