init projects
This commit is contained in:
commit
c740fd5a50
|
|
@ -0,0 +1,16 @@
|
||||||
|
all:
|
||||||
|
children:
|
||||||
|
security_servers:
|
||||||
|
hosts:
|
||||||
|
security-server-01:
|
||||||
|
ansible_host: 10.0.1.10
|
||||||
|
ansible_user: ubuntu
|
||||||
|
ansible_ssh_private_key_file: ~/.ssh/security-key.pem
|
||||||
|
security-server-02:
|
||||||
|
ansible_host: 10.0.1.11
|
||||||
|
ansible_user: ubuntu
|
||||||
|
ansible_ssh_private_key_file: ~/.ssh/security-key.pem
|
||||||
|
vars:
|
||||||
|
environment: production
|
||||||
|
vault_version: "1.15.2"
|
||||||
|
prometheus_version: "2.47.0"
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
all:
|
||||||
|
children:
|
||||||
|
security_servers:
|
||||||
|
hosts:
|
||||||
|
security-staging-01:
|
||||||
|
ansible_host: 10.0.2.10
|
||||||
|
ansible_user: ubuntu
|
||||||
|
ansible_ssh_private_key_file: ~/.ssh/staging-key.pem
|
||||||
|
vars:
|
||||||
|
environment: staging
|
||||||
|
vault_version: "1.15.2"
|
||||||
|
prometheus_version: "2.47.0"
|
||||||
|
|
@ -0,0 +1,150 @@
|
||||||
|
- name: Deploy Security Monitoring Infrastructure
|
||||||
|
hosts: security_servers
|
||||||
|
become: true
|
||||||
|
vars:
|
||||||
|
prometheus_version: "2.47.0"
|
||||||
|
grafana_version: "10.1.0"
|
||||||
|
node_exporter_version: "1.6.1"
|
||||||
|
alertmanager_version: "0.25.0"
|
||||||
|
monitoring_retention_days: 30
|
||||||
|
|
||||||
|
roles:
|
||||||
|
- prometheus
|
||||||
|
- vault
|
||||||
|
- wazuh
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: Install Node Exporter
|
||||||
|
block:
|
||||||
|
- name: Download Node Exporter
|
||||||
|
get_url:
|
||||||
|
url: "https://github.com/prometheus/node_exporter/releases/download/v{{ node_exporter_version }}/node_exporter-{{ node_exporter_version }}.linux-amd64.tar.gz"
|
||||||
|
dest: /tmp/node_exporter.tar.gz
|
||||||
|
|
||||||
|
- name: Extract Node Exporter
|
||||||
|
unarchive:
|
||||||
|
src: /tmp/node_exporter.tar.gz
|
||||||
|
dest: /opt/
|
||||||
|
remote_src: yes
|
||||||
|
owner: prometheus
|
||||||
|
group: prometheus
|
||||||
|
|
||||||
|
- name: Create Node Exporter symlink
|
||||||
|
file:
|
||||||
|
src: "/opt/node_exporter-{{ node_exporter_version }}.linux-amd64/node_exporter"
|
||||||
|
dest: /usr/local/bin/node_exporter
|
||||||
|
state: link
|
||||||
|
|
||||||
|
- name: Create Node Exporter systemd service
|
||||||
|
copy:
|
||||||
|
content: |
|
||||||
|
[Unit]
|
||||||
|
Description=Node Exporter
|
||||||
|
Wants=network-online.target
|
||||||
|
After=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
User=prometheus
|
||||||
|
Group=prometheus
|
||||||
|
Type=simple
|
||||||
|
ExecStart=/usr/local/bin/node_exporter
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
dest: /etc/systemd/system/node_exporter.service
|
||||||
|
notify:
|
||||||
|
- reload systemd
|
||||||
|
- restart node_exporter
|
||||||
|
|
||||||
|
- name: Install Grafana
|
||||||
|
block:
|
||||||
|
- name: Add Grafana GPG key
|
||||||
|
apt_key:
|
||||||
|
url: https://packages.grafana.com/gpg.key
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Add Grafana repository
|
||||||
|
apt_repository:
|
||||||
|
repo: "deb https://packages.grafana.com/oss/deb stable main"
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Install Grafana
|
||||||
|
apt:
|
||||||
|
name: grafana
|
||||||
|
state: present
|
||||||
|
update_cache: yes
|
||||||
|
|
||||||
|
- name: Start and enable Grafana
|
||||||
|
service:
|
||||||
|
name: grafana-server
|
||||||
|
state: started
|
||||||
|
enabled: yes
|
||||||
|
|
||||||
|
- name: Configure security monitoring alerts
|
||||||
|
copy:
|
||||||
|
content: |
|
||||||
|
groups:
|
||||||
|
- name: security_alerts
|
||||||
|
rules:
|
||||||
|
- alert: WazuhManagerDown
|
||||||
|
expr: up{job="wazuh"} == 0
|
||||||
|
for: 2m
|
||||||
|
labels:
|
||||||
|
severity: critical
|
||||||
|
annotations:
|
||||||
|
summary: "Wazuh Manager is down"
|
||||||
|
|
||||||
|
- alert: VaultSealed
|
||||||
|
expr: vault_core_unsealed == 0
|
||||||
|
for: 1m
|
||||||
|
labels:
|
||||||
|
severity: critical
|
||||||
|
annotations:
|
||||||
|
summary: "Vault is sealed"
|
||||||
|
|
||||||
|
- alert: HighCPUUsage
|
||||||
|
expr: 100 - (avg by(instance) (irate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80
|
||||||
|
for: 5m
|
||||||
|
labels:
|
||||||
|
severity: warning
|
||||||
|
annotations:
|
||||||
|
summary: "High CPU usage on {{ $labels.instance }}"
|
||||||
|
dest: /etc/prometheus/security_rules.yml
|
||||||
|
owner: prometheus
|
||||||
|
group: prometheus
|
||||||
|
notify: restart prometheus
|
||||||
|
|
||||||
|
handlers:
|
||||||
|
- name: reload systemd
|
||||||
|
systemd:
|
||||||
|
daemon_reload: yes
|
||||||
|
|
||||||
|
- name: restart prometheus
|
||||||
|
service:
|
||||||
|
name: prometheus
|
||||||
|
state: restarted
|
||||||
|
|
||||||
|
- name: restart node_exporter
|
||||||
|
service:
|
||||||
|
name: node_exporter
|
||||||
|
state: restarted
|
||||||
|
enabled: yes
|
||||||
|
|
||||||
|
post_tasks:
|
||||||
|
- name: Verify monitoring services
|
||||||
|
service:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: started
|
||||||
|
enabled: yes
|
||||||
|
loop:
|
||||||
|
- prometheus
|
||||||
|
- node_exporter
|
||||||
|
- grafana-server
|
||||||
|
|
||||||
|
- name: Display monitoring URLs
|
||||||
|
debug:
|
||||||
|
msg: |
|
||||||
|
Monitoring services available at:
|
||||||
|
- Prometheus: http://{{ ansible_default_ipv4.address }}:9090
|
||||||
|
- Grafana: http://{{ ansible_default_ipv4.address }}:3000
|
||||||
|
- Node Exporter: http://{{ ansible_default_ipv4.address }}:9100
|
||||||
|
|
@ -0,0 +1,33 @@
|
||||||
|
---
|
||||||
|
- name: Deploy Centralized Security Server
|
||||||
|
hosts: security_servers
|
||||||
|
become: true
|
||||||
|
vars:
|
||||||
|
server_environment: production
|
||||||
|
vault_version: "1.15.2"
|
||||||
|
wazuh_version: "4.7.0"
|
||||||
|
|
||||||
|
roles:
|
||||||
|
- common # Base system hardening
|
||||||
|
- docker # Container runtime
|
||||||
|
- nginx-proxy # Reverse proxy with SSL
|
||||||
|
- vault # HashiCorp Vault
|
||||||
|
- wazuh-server # OSSEC/Wazuh server
|
||||||
|
- elasticsearch # Log storage
|
||||||
|
- prometheus # Metrics collection
|
||||||
|
- grafana # Dashboards
|
||||||
|
- vulnerability-scanner # Security scanning
|
||||||
|
- backup-setup # Backup configuration
|
||||||
|
|
||||||
|
post_tasks:
|
||||||
|
- name: Verify all services are running
|
||||||
|
service:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: started
|
||||||
|
enabled: yes
|
||||||
|
loop:
|
||||||
|
- vault
|
||||||
|
- wazuh-manager
|
||||||
|
- elasticsearch
|
||||||
|
- prometheus
|
||||||
|
- grafana
|
||||||
|
|
@ -0,0 +1,46 @@
|
||||||
|
# roles/prometheus/tasks/main.yml
|
||||||
|
---
|
||||||
|
- name: Create prometheus user
|
||||||
|
user:
|
||||||
|
name: prometheus
|
||||||
|
system: yes
|
||||||
|
shell: /bin/false
|
||||||
|
|
||||||
|
- name: Create prometheus directories
|
||||||
|
file:
|
||||||
|
path: "{{ item }}"
|
||||||
|
state: directory
|
||||||
|
owner: prometheus
|
||||||
|
group: prometheus
|
||||||
|
loop:
|
||||||
|
- /etc/prometheus
|
||||||
|
- /var/lib/prometheus
|
||||||
|
|
||||||
|
- name: Download Prometheus
|
||||||
|
get_url:
|
||||||
|
url: "https://github.com/prometheus/prometheus/releases/download/v{{ prometheus_version }}/prometheus-{{ prometheus_version }}.linux-amd64.tar.gz"
|
||||||
|
dest: /tmp/prometheus.tar.gz
|
||||||
|
|
||||||
|
- name: Extract Prometheus
|
||||||
|
unarchive:
|
||||||
|
src: /tmp/prometheus.tar.gz
|
||||||
|
dest: /opt/
|
||||||
|
remote_src: yes
|
||||||
|
owner: prometheus
|
||||||
|
group: prometheus
|
||||||
|
|
||||||
|
- name: Configure Prometheus
|
||||||
|
template:
|
||||||
|
src: prometheus.yml.j2
|
||||||
|
dest: /etc/prometheus/prometheus.yml
|
||||||
|
owner: prometheus
|
||||||
|
group: prometheus
|
||||||
|
notify: restart prometheus
|
||||||
|
|
||||||
|
- name: Create Prometheus systemd service
|
||||||
|
template:
|
||||||
|
src: prometheus.service.j2
|
||||||
|
dest: /etc/systemd/system/prometheus.service
|
||||||
|
notify:
|
||||||
|
- reload systemd
|
||||||
|
- restart prometheus
|
||||||
|
|
@ -0,0 +1,58 @@
|
||||||
|
# roles/vault/tasks/main.yml
|
||||||
|
---
|
||||||
|
- name: Create vault user
|
||||||
|
user:
|
||||||
|
name: vault
|
||||||
|
system: yes
|
||||||
|
shell: /bin/false
|
||||||
|
home: /opt/vault
|
||||||
|
|
||||||
|
- name: Download Vault binary
|
||||||
|
get_url:
|
||||||
|
url: "https://releases.hashicorp.com/vault/{{ vault_version }}/vault_{{ vault_version }}_linux_amd64.zip"
|
||||||
|
dest: /tmp/vault.zip
|
||||||
|
mode: '0644'
|
||||||
|
|
||||||
|
- name: Extract Vault binary
|
||||||
|
unarchive:
|
||||||
|
src: /tmp/vault.zip
|
||||||
|
dest: /usr/local/bin/
|
||||||
|
remote_src: yes
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: '0755'
|
||||||
|
|
||||||
|
- name: Create Vault directories
|
||||||
|
file:
|
||||||
|
path: "{{ item }}"
|
||||||
|
state: directory
|
||||||
|
owner: vault
|
||||||
|
group: vault
|
||||||
|
mode: '0750'
|
||||||
|
loop:
|
||||||
|
- /etc/vault.d
|
||||||
|
- /opt/vault/data
|
||||||
|
- /opt/vault/logs
|
||||||
|
|
||||||
|
- name: Generate Vault configuration
|
||||||
|
template:
|
||||||
|
src: vault.hcl.j2
|
||||||
|
dest: /etc/vault.d/vault.hcl
|
||||||
|
owner: vault
|
||||||
|
group: vault
|
||||||
|
mode: '0640'
|
||||||
|
notify: restart vault
|
||||||
|
|
||||||
|
- name: Create Vault systemd service
|
||||||
|
template:
|
||||||
|
src: vault.service.j2
|
||||||
|
dest: /etc/systemd/system/vault.service
|
||||||
|
notify:
|
||||||
|
- reload systemd
|
||||||
|
- restart vault
|
||||||
|
|
||||||
|
- name: Start and enable Vault service
|
||||||
|
service:
|
||||||
|
name: vault
|
||||||
|
state: started
|
||||||
|
enabled: yes
|
||||||
|
|
@ -0,0 +1,42 @@
|
||||||
|
# roles/wazuh-server/tasks/main.yml
|
||||||
|
---
|
||||||
|
- name: Add Wazuh repository
|
||||||
|
get_url:
|
||||||
|
url: https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
||||||
|
dest: /tmp/GPG-KEY-WAZUH
|
||||||
|
|
||||||
|
- name: Add Wazuh GPG key
|
||||||
|
apt_key:
|
||||||
|
file: /tmp/GPG-KEY-WAZUH
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Add Wazuh repository
|
||||||
|
apt_repository:
|
||||||
|
repo: "deb https://packages.wazuh.com/4.x/apt/ stable main"
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Install Wazuh manager
|
||||||
|
apt:
|
||||||
|
name:
|
||||||
|
- wazuh-manager
|
||||||
|
- wazuh-indexer
|
||||||
|
- wazuh-dashboard
|
||||||
|
state: present
|
||||||
|
update_cache: yes
|
||||||
|
|
||||||
|
- name: Configure Wazuh manager
|
||||||
|
template:
|
||||||
|
src: ossec.conf.j2
|
||||||
|
dest: /var/ossec/etc/ossec.conf
|
||||||
|
backup: yes
|
||||||
|
notify: restart wazuh-manager
|
||||||
|
|
||||||
|
- name: Start Wazuh services
|
||||||
|
service:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: started
|
||||||
|
enabled: yes
|
||||||
|
loop:
|
||||||
|
- wazuh-manager
|
||||||
|
- wazuh-indexer
|
||||||
|
- wazuh-dashboard
|
||||||
Loading…
Reference in New Issue