boxswapper/Internal-apps
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
2b72f23ea990cb4c088c54d681ecc4d161e2faf1
Internal-apps/roles/wazuh/tasks/main.yml

164 lines
6.5 KiB
YAML
Raw Blame History

---
# Wazuh SIEM (single-node: indexer + manager + dashboard) on npm_internal
# Dashboard is NOT exposed on host ports — NPM proxies wazuh.boxswapper.io to https://10.10.0.40:5601
# DNS record must be grey-cloud (Cloudflare 523 lesson from vpn.boxswapper.io), cert via NPM
# Config is copied from ./wazuh-docker/config before first deploy
- name: Create Wazuh config directory
ansible.builtin.file:
path: /opt/apps/wazuh/config
state: directory
mode: '0755'
- name: Copy Wazuh config files to host
ansible.builtin.copy:
src: ./wazuh-docker/config/
dest: /opt/apps/wazuh/config/
owner: root
group: root
mode: preserve
force: true
- name: Check for stale Wazuh certificate residue
ansible.builtin.stat:
path: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
register: wazuh_cert_residue
- name: Remove stale Wazuh certificate directories
ansible.builtin.file:
path: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs
state: absent
when: wazuh_cert_residue.stat.exists and wazuh_cert_residue.stat.isdir
- name: Recreate Wazuh certificates directory
ansible.builtin.file:
path: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs
state: directory
mode: '0755'
owner: root
group: root
- name: Generate Wazuh certificates
ansible.builtin.command: >
podman run --rm
-e CERT_TOOL_VERSION=4.14
-v /opt/apps/wazuh/config/certs.yml:/config/certs.yml:z
-v /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/:/certificates:z
docker.io/wazuh/wazuh-certs-generator:0.0.3
args:
creates: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
- name: Copy root CA as manager root CA
ansible.builtin.copy:
src: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem
dest: /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem
remote_src: true
force: false
- name: Deploy Wazuh indexer
containers.podman.podman_container:
name: wazuh.indexer
image: "docker.io/wazuh/wazuh-indexer:{{ wazuh_version }}"
hostname: wazuh.indexer
restart_policy: always
recreate: true
state: started
env:
OPENSEARCH_JAVA_OPTS: "-Xms1g -Xmx1g"
ulimit:
- "memlock=-1:-1"
- "nofile=65536:65536"
volumes:
- "wazuh-indexer-data:/var/lib/wazuh-indexer"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml:z"
- "/opt/apps/wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml:z"
network:
- npm_internal
ip: '{{ wazuh_indexer_ip }}'
- name: Wait for Wazuh indexer to be ready
ansible.builtin.wait_for:
host: '{{ wazuh_indexer_ip }}'
port: 9200
delay: 10
timeout: 300
- name: Deploy Wazuh manager
containers.podman.podman_container:
name: wazuh.manager
image: "docker.io/wazuh/wazuh-manager:{{ wazuh_version }}"
hostname: wazuh.manager
restart_policy: always
recreate: true
state: started
env:
INDEXER_URL: "https://wazuh.indexer:9200"
INDEXER_USERNAME: "admin"
INDEXER_PASSWORD: "*WD*oW9m6iKf4hDovy7BbMmhLxC9D?Tv"
FILEBEAT_SSL_VERIFICATION_MODE: "full"
SSL_CERTIFICATE_AUTHORITIES: "/etc/ssl/root-ca.pem"
SSL_CERTIFICATE: "/etc/ssl/filebeat.pem"
SSL_KEY: "/etc/ssl/filebeat.key"
API_USERNAME: "wazuh-wui"
API_PASSWORD: "MyS3cr37P450r.*-"
ulimit:
- "memlock=-1:-1"
- "nofile=655360:655360"
ports:
- "1514:1514"
- "1515:1515"
- "514:514/udp"
- "55000:55000"
volumes:
- "wazuh_api_configuration:/var/ossec/api/configuration"
- "wazuh_etc:/var/ossec/etc"
- "wazuh_logs:/var/ossec/logs"
- "wazuh_queue:/var/ossec/queue"
- "wazuh_var_multigroups:/var/ossec/var/multigroups"
- "wazuh_integrations:/var/ossec/integrations"
- "wazuh_agentless:/var/ossec/agentless"
- "wazuh_active_response:/var/ossec/active-response/bin"
- "wazuh_wodles:/var/ossec/wodles"
- "filebeat_etc:/etc/filebeat"
- "filebeat_var:/var/lib/filebeat"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key:z"
- "/opt/apps/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf:z"
network:
- npm_internal
ip: '{{ wazuh_manager_ip }}'
- name: Deploy Wazuh dashboard
containers.podman.podman_container:
name: wazuh.dashboard
image: "docker.io/wazuh/wazuh-dashboard:{{ wazuh_version }}"
hostname: wazuh.dashboard
restart_policy: always
recreate: true
state: started
env:
INDEXER_USERNAME: "admin"
INDEXER_PASSWORD: "*WD*oW9m6iKf4hDovy7BbMmhLxC9D?Tv"
WAZUH_API_URL: "https://wazuh.manager"
DASHBOARD_USERNAME: "kibanaserver"
DASHBOARD_PASSWORD: "kibanaserver"
API_USERNAME: "wazuh-wui"
API_PASSWORD: "MyS3cr37P450r.*-"
volumes:
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem:z"
- "/opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem:z"
- "/opt/apps/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml:z"
- "/opt/apps/wazuh/config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml:z"
- "wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config"
- "wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom"
network:
- npm_internal
ip: '{{ wazuh_dashboard_ip }}'
Reference in New Issue View Git Blame Copy Permalink