--- - hosts: internal-apps become: true vars_files: - ./vars.yml tasks: - name: Update Packages ansible.builtin.dnf: update_cache: yes - name: Install Packages ansible.builtin.dnf: name: - vim - podman - fail2ban - python3-libdnf5 state: present - name: Create directories file: path: "{{ item }}" state: directory mode: '0755' loop: "{{ directories }}" - name: Create Jellyfin directories file: path: "{{ item }}" state: directory mode: '0777' loop: "{{ directories_jellyfin }}" - name: Create internal podman network containers.podman.podman_network: name: npm_internal ip_range: 10.10.0.128/25 subnet: 10.10.0.0/24 gateway: 10.10.0.1 state: present - name: pull images containers.podman.podman_image: name: "{{ item }}" loop: "{{ images }}" - name: Deploy Nginx Proxy Manager containers.podman.podman_container: image: "docker.io/jc21/nginx-proxy-manager:latest" name: npm restart_policy: always recreate: true state: started ports: - "80:80" - "81:81" - "443:443" volumes: - "/opt/apps/npm:/data:z" - "/opt/apps/letsencrypt:/etc/letsencrypt:z" network: - npm_internal ip: '10.10.0.19' - name: Deploy Gitea containers.podman.podman_container: image: docker.gitea.com/gitea:nightly name: gitea env: USER_UID: 1000 USER_GID: 1000 restart_policy: always recreate: true state: started volumes: - /opt/apps/gitea:/data:z - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro - /etc/localtime:/etc/localtime:ro network: - npm_internal ip: '10.10.0.25' ports: # - "3000:3000" - "222:22" - name: Deploy Jellyfin containers.podman.podman_container: image: lscr.io/linuxserver/jellyfin:latest name: jellyfin env: USER_UID: 1000 USER_GID: 1000 JELLYFIN_PublishedServerUrl: http://jellyfin.boxswapper.io restart_policy: always recreate: true state: started volumes: - /opt/apps/jellyfin/config:/config:z - /opt/apps/jellyfin/tvseries:/data/tvshows:z - /opt/apps/jellyfin/movies:/data/movies:z - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro - /etc/localtime:/etc/localtime:ro network: - npm_internal ip: '10.10.0.30' # ports: # - 8096:8096 # - 8920:8920 #optional # - 7359:7359/udp #optional # - 1900:1900/udp #optional #---- Genearate Wuzah docker certs ---# - name: Generate Wazuh certs containers.podman.podman_container: image: wazuh/wazuh-certs-generator:0.0.3 name: wazuh-certs-generator env: CERT_TOOL_VERSION: 4.14 command: "generator" volumes: - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/:/certificates/ - /opt/apps/wazuh/config/certs.yml:/config/certs.yml #----Wazuh-docker deploy---# - name: Deploy Wazuh Manager containers.podman.podman_container: image: wazuh/wazuh-manager:5.0.0 name: wazuh.manager env: INDEXER_URL: https://wazuh.indexer:9200 INDEXER_USERNAME: admin INDEXER_PASSWORD: SecretPassword FILEBEAT_SSL_VERIFICATION_MODE: full SSL_CERTIFICATE_AUTHORITIES: /etc/ssl/root-ca.pem SSL_CERTIFICATE: /etc/ssl/filebeat.pem SSL_KEY: /etc/ssl/filebeat.key API_USERNAME: wazuh-wui API_PASSWORD: MyS3cr37P450r.*- ulimits: - "memlock:-1:-1" - "nofile:655360:655360" restart_policy: true recreate: true state: started volumes: - /opt/apps/wazuh/wazuh_api_configuration:/var/ossec/api/configuration - /opt/apps/wazuh/wazuh_etc:/var/ossec/etc - /opt/apps/wazuh/wazuh_logs:/var/ossec/logs - /opt/apps/wazuh/wazuh_queue:/var/ossec/queue - /opt/apps/wazuh/wazuh_var_multigroups:/var/ossec/var/multigroups - /opt/apps/wazuh/wazuh_active_response:/var/ossec/active-response/bin - /opt/apps/wazuh/wazuh_wodles:/var/ossec/wodles - /opt/apps/wazuh/filebeat_etc:/etc/filebeat - /opt/apps/wazuh/filebeat_var:/var/lib/filebeat - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key - /opt/apps/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf ports: - "1514:1514" - "1515:1515" - "514:514/udp" - "55000:55000" - name: Deploy Wazuh Indexer containers.podman.podman_container: image: wazuh/wazuh-indexer:5.0.0 name: wazuh.indexer env: OENSEARCH_JAVA_OPTS: "-Xms1g -Xmx1g" ulimits: - "memlock:-1:-1" - "nofile:655360:655360" restart_policy: true recreate: true state: started ports: - "9200:9200" volumes: - /opt/apps/wazuh/wazah-indexer-data/ib/wazuh-indexer - /opt/apps/wazuhconfig/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem - /opt/apps/wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - /opt/apps/wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml - name: Deploy Wazuh Dashboard containers.podman.podman_container: image: wazuh/wazuh-dashboard:5.0.0 name: wazuh.dashboard env: INDEXER_USERNAME: admin INDEXER_PASSWORD: SecretPassword WAZUH_API_URL: https://wazuh.manager DASHBOARD_USERNAME: kibanaserver DASHBOARD_PASSWORD: kibanaserver API_USERNAME: wazuh-wui API_PASSWORD: "MyS3cr37P450r.*-"" ulimits: - "memlock:-1:-1" - "nofile:655360:655360" restart_policy: true recreate: true state: started ports: - "443:5601" volumes: - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem - /opt/apps/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml - /opt/apps/wazuh/config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml - /opt/apps/wazuh/wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config - /opt/apps/wazuh/wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom network: - npm_internal ip: '10.10.0.36' #----N8N deployment, no GPU avail for deployment ------# # - name: Deploy n8n # containers.podman.podman_container: # image: docker.n8n.io/n8nio/n8n # name: n8n # env: # N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: true # N8N_RUNNERS_ENABLED: true # restart_policy: always # recreate: true # state: started # volumes: # - /opt/apps/n8n/data:/home/node/.n8n:z # - /opt/apps/n8n/files:/files:z # - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro # - /etc/localtime:/etc/localtime:ro # network: # - npm_internal # ip: '10.10.0.35' # # ports: # # - 5678:5678