279 lines
8.8 KiB
YAML
279 lines
8.8 KiB
YAML
---
|
|
- hosts: internal-apps
|
|
become: true
|
|
vars_files:
|
|
- ./vars.yml
|
|
tasks:
|
|
- name: Update Packages
|
|
ansible.builtin.dnf:
|
|
update_cache: yes
|
|
|
|
- name: Install Packages
|
|
ansible.builtin.dnf:
|
|
name:
|
|
- vim
|
|
- podman
|
|
- fail2ban
|
|
- python3-libdnf5
|
|
state: present
|
|
|
|
- name: Create directories
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: '0755'
|
|
loop: "{{ directories }}"
|
|
|
|
- name: Create Jellyfin directories
|
|
file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: '0777'
|
|
loop: "{{ directories_jellyfin }}"
|
|
|
|
- name: Create internal podman network
|
|
containers.podman.podman_network:
|
|
name: npm_internal
|
|
ip_range: 10.10.0.128/25
|
|
subnet: 10.10.0.0/24
|
|
gateway: 10.10.0.1
|
|
state: present
|
|
|
|
- name: pull images
|
|
containers.podman.podman_image:
|
|
name: "{{ item }}"
|
|
loop: "{{ images }}"
|
|
|
|
- name: Deploy Nginx Proxy Manager
|
|
containers.podman.podman_container:
|
|
image: "docker.io/jc21/nginx-proxy-manager:latest"
|
|
name: npm
|
|
restart_policy: always
|
|
recreate: true
|
|
state: started
|
|
ports:
|
|
- "80:80"
|
|
- "81:81"
|
|
- "443:443"
|
|
volumes:
|
|
- "/opt/apps/npm:/data:z"
|
|
- "/opt/apps/letsencrypt:/etc/letsencrypt:z"
|
|
network:
|
|
- npm_internal
|
|
ip: '10.10.0.19'
|
|
|
|
- name: Deploy Gitea
|
|
containers.podman.podman_container:
|
|
image: docker.gitea.com/gitea:nightly
|
|
name: gitea
|
|
env:
|
|
USER_UID: 1000
|
|
USER_GID: 1000
|
|
restart_policy: always
|
|
recreate: true
|
|
state: started
|
|
volumes:
|
|
- /opt/apps/gitea:/data:z
|
|
- /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
network:
|
|
- npm_internal
|
|
ip: '10.10.0.25'
|
|
ports:
|
|
# - "3000:3000"
|
|
- "222:22"
|
|
|
|
|
|
- name: Deploy Jellyfin
|
|
containers.podman.podman_container:
|
|
image: lscr.io/linuxserver/jellyfin:latest
|
|
name: jellyfin
|
|
env:
|
|
USER_UID: 1000
|
|
USER_GID: 1000
|
|
JELLYFIN_PublishedServerUrl: http://jellyfin.boxswapper.io
|
|
restart_policy: always
|
|
recreate: true
|
|
state: started
|
|
volumes:
|
|
- /opt/apps/jellyfin/config:/config:z
|
|
- /opt/apps/jellyfin/tvseries:/data/tvshows:z
|
|
- /opt/apps/jellyfin/movies:/data/movies:z
|
|
- /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
network:
|
|
- npm_internal
|
|
ip: '10.10.0.30'
|
|
# ports:
|
|
# - 8096:8096
|
|
# - 8920:8920 #optional
|
|
# - 7359:7359/udp #optional
|
|
# - 1900:1900/udp #optional
|
|
|
|
#---- Genearate Wuzah docker certs ---#
|
|
- name: Generate Wazuh certs
|
|
containers.podman.podman_container:
|
|
image: wazuh/wazuh-certs-generator:0.0.3
|
|
name: wazuh-certs-generator
|
|
env:
|
|
USER_UID: 1000
|
|
USER_GID: 1000
|
|
CERT_TOOL_VERSION: 4.14
|
|
auto_remove: yes
|
|
command: "generator"
|
|
volumes:
|
|
- /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/:/certificates/
|
|
- /opt/apps/wazuh/config/certs.yml:/config/certs.yml
|
|
|
|
#----Wazuh-docker deploy---#
|
|
|
|
- name: Deploy Wazuh Manager
|
|
containers.podman.podman_container:
|
|
image: wazuh/wazuh-manager:{{ wazah_version }}
|
|
name: wazuh.manager
|
|
env:
|
|
INDEXER_URL: "https://wazuh.indexer:9200"
|
|
INDEXER_USERNAME: "admin"
|
|
INDEXER_PASSWORD: "SecretPassword"
|
|
FILEBEAT_SSL_VERIFICATION_MODE: "full"
|
|
SSL_CERTIFICATE_AUTHORITIES: "/etc/ssl/root-ca.pem"
|
|
SSL_CERTIFICATE: "/etc/ssl/filebeat.pem"
|
|
SSL_KEY: "/etc/ssl/filebeat.key"
|
|
API_USERNAME: "wazuh-wui"
|
|
API_PASSWORD: "MyS3cr37P450r.*-"
|
|
ulimits:
|
|
- "memlock:-1:-1"
|
|
- "nofile:655360:655360"
|
|
restart_policy: true
|
|
recreate: true
|
|
state: started
|
|
volumes:
|
|
- /opt/apps/wazuh/wazuh_api_configuration:/var/ossec/api/configuration
|
|
- /opt/apps/wazuh/wazuh_etc:/var/ossec/etc
|
|
- /opt/apps/wazuh/wazuh_logs:/var/ossec/logs
|
|
- /opt/apps/wazuh/wazuh_queue:/var/ossec/queue
|
|
- /opt/apps/wazuh/wazuh_var_multigroups:/var/ossec/var/multigroups
|
|
- /opt/apps/wazuh/wazuh_active_response:/var/ossec/active-response/bin
|
|
- /opt/apps/wazuh/wazuh_wodles:/var/ossec/wodles
|
|
- /opt/apps/wazuh/filebeat_etc:/etc/filebeat
|
|
- /opt/apps/wazuh/filebeat_var:/var/lib/filebeat
|
|
- /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
|
|
- /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
|
|
- /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
|
|
- /opt/apps/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
|
|
|
|
ports:
|
|
- "1514:1514"
|
|
- "1515:1515"
|
|
- "514:514/udp"
|
|
- "55000:55000"
|
|
|
|
|
|
- name: Deploy Wazuh Indexer
|
|
containers.podman.podman_container:
|
|
image: wazuh/wazuh-indexer:{{ wazah_version }}
|
|
name: wazuh.indexer
|
|
env:
|
|
OENSEARCH_JAVA_OPTS: "-Xms1g -Xmx1g"
|
|
ulimits:
|
|
- "memlock:-1:-1"
|
|
- "nofile:655360:655360"
|
|
restart_policy: true
|
|
recreate: true
|
|
state: started
|
|
ports:
|
|
- "9200:9200"
|
|
volumes:
|
|
- /opt/apps/wazuh/wazah-indexer-data/ib/wazuh-indexer
|
|
- /opt/apps/wazuhconfig/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
|
- /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
|
|
- /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
|
|
- /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
|
|
- /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
|
|
- /opt/apps/wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
|
- /opt/apps/wazuh/config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
|
|
|
|
- name: Deploy Wazuh Dashboard
|
|
containers.podman.podman_container:
|
|
image: wazuh/wazuh-dashboard:{{ wazah_version }}
|
|
name: wazuh.dashboard
|
|
env:
|
|
INDEXER_USERNAME: "admin"
|
|
INDEXER_PASSWORD: "SecretPassword"
|
|
WAZUH_API_URL: "https://wazuh.manager"
|
|
DASHBOARD_USERNAME: "kibanaserver"
|
|
DASHBOARD_PASSWORD: "kibanaserver"
|
|
API_USERNAME: "wazuh-wui"
|
|
API_PASSWORD: "MyS3cr37P450r.*-"
|
|
ulimits:
|
|
- "memlock:-1:-1"
|
|
- "nofile:655360:655360"
|
|
restart_policy: true
|
|
recreate: true
|
|
state: started
|
|
ports:
|
|
- "443:5601"
|
|
volumes:
|
|
- /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
|
|
- /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
|
|
- /opt/apps/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
|
|
- /opt/apps/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
|
|
- /opt/apps/wazuh/config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
|
|
- /opt/apps/wazuh/wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config
|
|
- /opt/apps/wazuh/wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
|
|
network:
|
|
- npm_internal
|
|
ip: '10.10.0.36'
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
#----N8N deployment, no GPU avail for deployment ------#
|
|
|
|
# - name: Deploy n8n
|
|
# containers.podman.podman_container:
|
|
# image: docker.n8n.io/n8nio/n8n
|
|
# name: n8n
|
|
# env:
|
|
# N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: true
|
|
# N8N_RUNNERS_ENABLED: true
|
|
# restart_policy: always
|
|
# recreate: true
|
|
# state: started
|
|
# volumes:
|
|
# - /opt/apps/n8n/data:/home/node/.n8n:z
|
|
# - /opt/apps/n8n/files:/files:z
|
|
# - /usr/share/zoneinfo/America/Denver:/etc/timezone:ro
|
|
# - /etc/localtime:/etc/localtime:ro
|
|
|
|
# network:
|
|
# - npm_internal
|
|
# ip: '10.10.0.35'
|
|
# # ports:
|
|
# # - 5678:5678
|
|
|
|
|