Internal-apps/ansible-playbook.yml

---
- hosts: internal-apps
  become: true
  vars_files: 
    - ./vars.yml
  tasks:
    - name: Update Packages
      ansible.builtin.dnf:
        update_cache: yes

    - name: Install Packages
      ansible.builtin.dnf:
        name:
          - vim
          - podman
          - fail2ban
          - python3-libdnf5
        state: present
    
    - name: Create directories 
      file:
        path: "{{ item }}"
        state: directory
        mode: '0755'
      loop: "{{ directories }}"

    - name: Create Jellyfin directories 
      file:
        path: "{{ item }}"
        state: directory
        mode: '0777'
      loop: "{{ directories_jellyfin }}"

    - name: Create internal podman network
      containers.podman.podman_network:
        name: npm_internal
        ip_range: 10.10.0.128/25
        subnet: 10.10.0.0/24
        gateway: 10.10.0.1
        state: present

    - name: pull images
      containers.podman.podman_image:
        name: "{{ item }}"
      loop: "{{ images }}"

    - name: Deploy Nginx Proxy Manager 
      containers.podman.podman_container:
        image: "docker.io/jc21/nginx-proxy-manager:latest"
        name: npm
        restart_policy: always
        recreate: true
        state: started
        ports:
          - "80:80"
          - "81:81"
          - "443:443"
        volumes:
          - "/opt/apps/npm:/data:z"
          - "/opt/apps/letsencrypt:/etc/letsencrypt:z"
        network:
          - npm_internal
        ip: '10.10.0.19'

    - name: Deploy Gitea 
      containers.podman.podman_container:
        image: docker.gitea.com/gitea:nightly
        name: gitea
        env:
          USER_UID: 1000
          USER_GID: 1000
        restart_policy: always
        recreate: true
        state: started
        volumes:
          - /opt/apps/gitea:/data:z
          - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
          - /etc/localtime:/etc/localtime:ro
        network:
          - npm_internal
        ip: '10.10.0.25'
        ports:
        #  - "3000:3000"
          - "222:22"


    - name: Deploy Jellyfin
      containers.podman.podman_container:
        image: lscr.io/linuxserver/jellyfin:latest
        name: jellyfin
        env:
          USER_UID: 1000
          USER_GID: 1000
          JELLYFIN_PublishedServerUrl: http://jellyfin.boxswapper.io
        restart_policy: always
        recreate: true
        state: started
        volumes:
          - /opt/apps/jellyfin/config:/config:z
          - /opt/apps/jellyfin/tvseries:/data/tvshows:z
          - /opt/apps/jellyfin/movies:/data/movies:z
          - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
          - /etc/localtime:/etc/localtime:ro
        network:
          - npm_internal
        ip: '10.10.0.30'
        # ports:
        #   - 8096:8096
      #   - 8920:8920 #optional
      #   - 7359:7359/udp #optional
      #   - 1900:1900/udp #optional

#----Wazuh-docker deploy---#
    - name: Deploy Wazuh Manager
      containers.podman.podman_container:
        image: wazuh/wazuh-manager:5.0.0
        name: wazuh.manager
        env:
          INDEXER_URL: https://wazuh.indexer:9200
          INDEXER_USERNAME: admin
          INDEXER_PASSWORD: SecretPassword
          FILEBEAT_SSL_VERIFICATION_MODE: full
          SSL_CERTIFICATE_AUTHORITIES: /etc/ssl/root-ca.pem
          SSL_CERTIFICATE: /etc/ssl/filebeat.pem
          SSL_KEY: /etc/ssl/filebeat.key
          API_USERNAME: wazuh-wui
          API_PASSWORD: MyS3cr37P450r.*-
        ulimits:
          - "memlock:-1:-1"
          - "nofile:655360:655360"
        restart_policy: true
        recreate: true
        state: started
        volumes:
          - /opt/apps/wazuh/wazuh_api_configuration:/var/ossec/api/configuration
          - /opt/apps/wazuh/wazuh_etc:/var/ossec/etc
          - /opt/apps/wazuh/wazuh_logs:/var/ossec/logs
          - /opt/apps/wazuh/wazuh_queue:/var/ossec/queue
          - /opt/apps/wazuh/wazuh_var_multigroups:/var/ossec/var/multigroups
          - /opt/apps/wazuh/wazuh_active_response:/var/ossec/active-response/bin
          - /opt/apps/wazuh/wazuh_wodles:/var/ossec/wodles
          - /opt/apps/wazuh/filebeat_etc:/etc/filebeat
          - /opt/apps/wazuh/filebeat_var:/var/lib/filebeat
          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
          - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
          - /opt/apps/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
        network:
          - npm_internal
        ip: '10.10.0.36'
        ports:
          - "1514:1514"
          - "1515:1515"
          - "514:514/udp"
          - "55000:55000"


    - name: Deploy Wazuh Indexer
      containers.podman.podman_container:
        image: wazuh/wazuh-indexer:5.0.0
        name: wazuh.indexer


  wazuh.indexer:
    image: wazuh/wazuh-indexer:5.0.0
    hostname: wazuh.indexer
    restart: always
    ports:
      - "9200:9200"
    environment:
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - wazuh-indexer-data:/var/lib/wazuh-indexer
      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
      - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
      - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
      - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml

  wazuh.dashboard:
    image: wazuh/wazuh-dashboard:5.0.0
    hostname: wazuh.dashboard
    restart: always
    ports:
      - 443:5601
    environment:
      - INDEXER_USERNAME=admin
      - INDEXER_PASSWORD=SecretPassword
      - WAZUH_API_URL=https://wazuh.manager
      - DASHBOARD_USERNAME=kibanaserver
      - DASHBOARD_PASSWORD=kibanaserver
      - API_USERNAME=wazuh-wui
      - API_PASSWORD=MyS3cr37P450r.*-
    volumes:
      - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
      - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
      - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
      - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
      - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config
      - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
    depends_on:
      - wazuh.indexer
    links:
      - wazuh.indexer:wazuh.indexer
      - wazuh.manager:wazuh.manager

























#----N8N deployment, no GPU avail for deployment ------#

    # - name: Deploy n8n
      # containers.podman.podman_container:
      #   image: docker.n8n.io/n8nio/n8n
      #   name: n8n
      #   env:
      #     N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: true
      #     N8N_RUNNERS_ENABLED: true
      #   restart_policy: always
      #   recreate: true
      #   state: started
      #   volumes:
      #     - /opt/apps/n8n/data:/home/node/.n8n:z
      #     - /opt/apps/n8n/files:/files:z
      #     - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
      #     - /etc/localtime:/etc/localtime:ro

      #   network:
      #     - npm_internal
      #   ip: '10.10.0.35'
      # # ports:
      # #   - 5678:5678