Skip to content

Commit d1ddf1f

Browse files
netr0mnetr0m
authored
feat: wazuh (#25)
* feat(wazuh): templates for wazuh config files * feat(wazuh): defaults and vars for wazuh * feat(wazuh): compose template for wazuh * feat(wazuh): tasks to deploy with compose * docs(wazuh): add section on wazuh config * feat(wazuh): update to v4.11 * fix(wazuh): add to svc_net to expose container ports * ci(lint): resolve linter errors
1 parent d2d955a commit d1ddf1f

File tree

16 files changed

+1199
-0
lines changed

16 files changed

+1199
-0
lines changed

‎README.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ An Ansible role for infrastructure components as Docker containers. Handles task
1313
| [godns](https://github.com/TimothyYe/godns) | Dynamic DNS | No |
1414
| [Wireguard](https://github.com/linuxserver/docker-wireguard) | Remote access VPN | No |
1515
| [Unifi](https://github.com/linuxserver/docker-unifi-controller) | Unifi network management | No |
16+
| [Wazuh](https://github.com/wazuh/wazuh) | Wazuh Security Platform | No |
1617

1718
## Installation
1819

@@ -54,6 +55,14 @@ infra_graylog_password_secret: "super-long-random-string-minimum-64-chars"
5455
# Hash of the password used for the root user [run `echo -n yourpassword | shasum -a 256`]
5556
infra_graylog_password_sha2: "sha256-sum-of-your-password"
5657

58+
# If `infra_use_wazuh` is true, then
59+
# Password for the wazuh indexer 'admin' user (infra_wazuh_indexer_admin_user)
60+
infra_wazuh_indexer_admin_password: ~
61+
# Password for the wazuh indexer 'dashboard' user (infra_wazuh_indexer_dashboard_user)
62+
infra_wazuh_indexer_dashboard_password: ~
63+
# Password for the wazuh api user (infra_wazuh_api_user). NB: The password for Wazuh API users must be between 8 and 64 characters long. It must contain at least one uppercase and one lowercase letter, a number, and a symbol.
64+
infra_wazuh_api_password: ~
65+
5766
```
5867
5968
### Recommended configuration changes

‎defaults/main/main.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,4 +71,6 @@ infra_use_authentik: true
7171
infra_use_godns: false
7272
# Configure uptime-kuma
7373
infra_use_uptimekuma: true
74+
# Configure wazuh
75+
infra_use_wazuh: false
7476
...

‎defaults/main/wazuh.yml

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
---
2+
### wazuh ###
3+
# Version of the wazuh Docker image to use (see 'infra_wazuh_manager_container_image', 'infra_wazuh_indexer_container_image', 'infra_wazuh_dashboard_container_image')
4+
infra_wazuh_version: 4.11.0
5+
# Version of the wazuh Docker image to use (see 'infra_wazuh_cert_tool_container_image')
6+
infra_wazuh_cert_tool_version: 0.0.2
7+
8+
## wazuh secrets
9+
# Password for the wazuh indexer 'admin' user (infra_wazuh_indexer_admin_user)
10+
infra_wazuh_indexer_admin_password: ~
11+
# Password for the wazuh indexer 'dashboard' user (infra_wazuh_indexer_dashboard_user)
12+
infra_wazuh_indexer_dashboard_password: ~
13+
# Password for the wazuh api user (infra_wazuh_api_user). NB: The password for Wazuh API users must be between 8 and 64 characters long. It must contain at least one uppercase and one lowercase letter, a number, and a symbol.
14+
infra_wazuh_api_password: ~
15+
16+
## wazuh users
17+
# username for the indexer 'admin' user
18+
infra_wazuh_indexer_admin_user: admin
19+
# username for the indexer 'dashboard' user
20+
infra_wazuh_indexer_dashboard_user: kibanaserver
21+
# api username
22+
infra_wazuh_api_user: wazuh-wui
23+
24+
## wazuh settings. see https://github.com/wazuh/wazuh-docker/blob/main/README.md#environment-variables
25+
# wazuh manager settings
26+
infra_wazuh_manager_settings: {}
27+
# wazuh indexer settings
28+
infra_wazuh_indexer_settings: {}
29+
# wazuh dashboard settings
30+
infra_wazuh_dashboard_settings: {}
31+
32+
## init settings
33+
# time (in seconds) to wait for the wazuh indexer to initialize before running securityadmin.sh
34+
infra_wazuh_indexer_init_wait_time: 30
35+
# whether to set the 'vm.max_map_count' value with sysctl
36+
infra_wazuh_set_vm_max_map_count: true
37+
38+
## Directories
39+
# Directory path
40+
infra_wazuh_directory_path: "{{ infra_directory_path }}/wazuh"
41+
# Directory user ownership
42+
infra_wazuh_directory_owner: "{{ infra_directory_owner }}"
43+
# Directory group ownership
44+
infra_wazuh_directory_group: "{{ infra_directory_group }}"
45+
# Directory mode
46+
infra_wazuh_directory_mode: "{{ infra_directory_mode }}"
47+
# wazuh config directory path
48+
infra_wazuh_config_directory_path: "{{ infra_wazuh_directory_path }}/config"
49+
# wazuh config directory user ownership
50+
infra_wazuh_config_directory_owner: "{{ infra_directory_owner }}"
51+
# wazuh configdirectory group ownership
52+
infra_wazuh_config_directory_group: "{{ infra_directory_group }}"
53+
# wazuh configdirectory mode
54+
infra_wazuh_config_directory_mode: "{{ infra_directory_mode }}"
55+
# wazuh certificates directory path
56+
infra_wazuh_certificates_directory_path: "{{ infra_wazuh_config_directory_path }}/certificates"
57+
58+
## File paths
59+
# File mode
60+
infra_wazuh_file_mode: "{{ infra_file_mode }}"
61+
# wazuh compose file path
62+
infra_wazuh_compose_path: "{{ infra_wazuh_directory_path }}/compose.yml"
63+
# wazuh generate-certs compose file path
64+
infra_wazuh_generate_certs_compose_path: "{{ infra_wazuh_directory_path }}/generate-indexer-certs.yml"
65+
# wazuh env file path
66+
infra_wazuh_manager_env_file_path: "{{ infra_wazuh_directory_path }}/wazuh-manager.env"
67+
# wazuh env file path
68+
infra_wazuh_indexer_env_file_path: "{{ infra_wazuh_directory_path }}/wazuh-indexer.env"
69+
# wazuh env file path
70+
infra_wazuh_dashboard_env_file_path: "{{ infra_wazuh_directory_path }}/wazuh-dashboard.env"
71+
# Permissions (mode) for the env files (as an octal)
72+
infra_wazuh_env_file_mode: "0600"
73+
# wazuh certs.yml config file path
74+
infra_wazuh_certs_conf_file_path: "{{ infra_wazuh_config_directory_path }}/certs.yml"
75+
# wazuh manager config file path
76+
infra_wazuh_manager_conf_file_path: "{{ infra_wazuh_config_directory_path }}/wazuh_manager.conf"
77+
# wazuh indexer opensearch config file path
78+
infra_wazuh_indexer_opensearch_config_path: "{{ infra_wazuh_config_directory_path }}/wazuh.indexer.yml"
79+
# wazuh indexer users config file path
80+
infra_wazuh_indexer_internal_users_config_path: "{{ infra_wazuh_config_directory_path }}/internal_users.yml"
81+
# wazuh dashboard config file path
82+
infra_wazuh_dashboard_conf_file_path: "{{ infra_wazuh_config_directory_path }}/wazuh.yml"
83+
# wazuh dashboard opensearch config file path
84+
infra_wazuh_dashboard_opensearch_config_path: "{{ infra_wazuh_config_directory_path }}/opensearch_dashboards.yml"
85+
# wazuh init file path (check if previously initialized)
86+
infra_wazuh_init_file_path: "{{ infra_wazuh_directory_path }}/.initialized"
87+
88+
## Docker service configs
89+
# Base name of the wazuh Docker service
90+
infra_wazuh_service_name: wazuh
91+
# Name of the wazuh manager Docker service
92+
infra_wazuh_manager_service_name: "{{ infra_wazuh_service_name }}.manager"
93+
# Name of the wazuh indexer Docker service
94+
infra_wazuh_indexer_service_name: "{{ infra_wazuh_service_name }}.indexer"
95+
# Name of the wazuh dashboard Docker service
96+
infra_wazuh_dashboard_service_name: "{{ infra_wazuh_service_name }}.dashboard"
97+
# Container image to use for the wazuh manager service
98+
infra_wazuh_manager_container_image: "docker.io/wazuh/wazuh-manager:{{ infra_wazuh_version }}"
99+
# Container image to use for the wazuh indexer service
100+
infra_wazuh_indexer_container_image: "docker.io/wazuh/wazuh-indexer:{{ infra_wazuh_version }}"
101+
# Container image to use for the wazuh dashboard service
102+
infra_wazuh_dashboard_container_image: "docker.io/wazuh/wazuh-dashboard:{{ infra_wazuh_version }}"
103+
# Container image to use for the wazuh certificates tool
104+
infra_wazuh_cert_tool_container_image: "docker.io/wazuh/wazuh-certs-generator:{{ infra_wazuh_cert_tool_version }}"
105+
# Hostname of the wazuh manager Docker container
106+
infra_wazuh_manager_container_hostname: "{{ infra_wazuh_manager_service_name }}"
107+
# Hostname of the wazuh indexer Docker container
108+
infra_wazuh_indexer_container_hostname: "{{ infra_wazuh_indexer_service_name }}"
109+
# Hostname of the wazuh dashboard Docker container
110+
infra_wazuh_dashboard_container_hostname: "{{ infra_wazuh_dashboard_service_name }}"
111+
# Hostname of the wazuh cert-tool Docker container
112+
infra_wazuh_cert_tool_hostname: "{{ infra_wazuh_service_name }}-certs-generator"
113+
# FQDN of the wazuh dashboard Docker container
114+
infra_wazuh_fqdn: "{{ infra_wazuh_service_name }}.{{ infra_domain }}"
115+
# Restart policy for the wazuh Docker containers
116+
infra_wazuh_restart_policy: "{{ infra_restart_policy }}"
117+
# Memory limit for the wazuh manager container
118+
infra_wazuh_manager_container_memory: 4g
119+
# Memory limit for the wazuh indexer container
120+
infra_wazuh_indexer_container_memory: 6g
121+
# Memory limit for the wazuh dashboard container
122+
infra_wazuh_dashboard_container_memory: 2g
123+
# agentd port (secure event listener) for the wazuh manager (TCP)
124+
infra_wazuh_manager_port_agentd: 1514
125+
# agentAuthd port (agent enrollment service) for the wazuh manager (TCP)
126+
infra_wazuh_manager_port_auth: 1515
127+
# syslog port (event listener) for the wazuh manager (UDP)
128+
infra_wazuh_manager_port_syslog: 514
129+
# api port for the wazuh manager (TCP)
130+
infra_wazuh_manager_port_api: 55000
131+
# api port for the wazuh indexer (HTTPS)
132+
infra_wazuh_indexer_port_api: 9200
133+
# Log driver for the wazuh containers
134+
infra_wazuh_log_driver: local
135+
# Log driver options for the containers
136+
infra_wazuh_log_options:
137+
max-size: 20m
138+
max-file: '5'
139+
compress: 'true'
140+
# soft ulimit for memlock
141+
infra_wazuh_ulimit_memlock_soft: -1
142+
# hard ulimit for memlock
143+
infra_wazuh_ulimit_memlock_hard: -1
144+
# soft ulimit for nofile
145+
infra_wazuh_ulimit_nofile_soft: 65536
146+
# hard ulimit for nofile
147+
infra_wazuh_ulimit_nofile_hard: 65536
148+
149+
## Docker volume configs
150+
# Name of the manager api config Docker volume
151+
infra_wazuh_manager_volume_name_api_config: "{{ infra_wazuh_service_name }}_api_config"
152+
# Name of the manager ossec config Docker volume
153+
infra_wazuh_manager_volume_name_ossec_config: "{{ infra_wazuh_service_name }}_ossec_config"
154+
# Name of the manager logs Docker volume
155+
infra_wazuh_manager_volume_name_ossec_logs: "{{ infra_wazuh_service_name }}_ossec_logs"
156+
# Name of the manager ossec queue Docker volume
157+
infra_wazuh_manager_volume_name_ossec_queue: "{{ infra_wazuh_service_name }}_ossec_queue"
158+
# Name of the manager ossec multigroups Docker volume
159+
infra_wazuh_manager_volume_name_ossec_multigroups: "{{ infra_wazuh_service_name }}_ossec_multigroups"
160+
# Name of the manager ossec integrations Docker volume
161+
infra_wazuh_manager_volume_name_ossec_integrations: "{{ infra_wazuh_service_name }}_ossec_integrations"
162+
# Name of the manager ossec active-response Docker volume
163+
infra_wazuh_manager_volume_name_ossec_active_response: "{{ infra_wazuh_service_name }}_ossec_active-response"
164+
# Name of the manager ossec agentless Docker volume
165+
infra_wazuh_manager_volume_name_ossec_agentless: "{{ infra_wazuh_service_name }}_ossec_agentless"
166+
# Name of the manager ossec wodles Docker volume
167+
infra_wazuh_manager_volume_name_ossec_wodles: "{{ infra_wazuh_service_name }}_ossec_wodles"
168+
# Name of the manager filebeat etc Docker volume
169+
infra_wazuh_manager_volume_name_filebeat_etc: "{{ infra_wazuh_service_name }}_filebeat_etc"
170+
# Name of the manager filebeat var Docker volume
171+
infra_wazuh_manager_volume_name_filebeat_var: "{{ infra_wazuh_service_name }}_filebeat_var"
172+
# Name of the indexer data Docker volume
173+
infra_wazuh_indexer_volume_name_data: "{{ infra_wazuh_service_name }}_indexer_data"
174+
# Name of the dashboard config Docker volume
175+
infra_wazuh_dashboard_volume_name_config: "{{ infra_wazuh_service_name }}_dashboard_config"
176+
# Name of the dashboard custom plugins Docker volume
177+
infra_wazuh_dashboard_volume_name_custom_plugins: "{{ infra_wazuh_service_name }}_dashboard_custom"
178+
# Labels to attach to the Docker volumes for this service
179+
infra_wazuh_volume_labels:
180+
netr0m.infra.service: wazuh
181+
...

0 commit comments

Comments
 (0)