Merge pull request #246 from wazuh/elk-security-dev

Refactor XPack Security configuration tasks

Pipfile

@@ -1,35 +0,0 @@
-[[source]]
-url = "https://pypi.org/simple"
-verify_ssl = true
-name = "pypi"
-
-[packages]
-docker-py = "*"
-ansible = "==2.7.13"
-molecule = "==2.20.2"
-
-[dev-packages]
-
-[requires]
-python_version = "2.7"
-
-[scripts]
-test ="molecule test --destroy=never"
-worker ="molecule test -s worker --destroy=never"
-agent ="molecule test -s wazuh-agent --destroy=never"
-elasticsearch ="molecule test -s elasticsearch  --destroy=never"
-kibana ="molecule test -s kibana --destroy=never"
-
-# Verify ..
-verify ="molecule verify"
-verify_worker ="molecule verify -s worker"
-verify_agent ="molecule verify -s agent"
-verify_elasticsearch ="molecule verify -s elasticsearch"
-verify_kibana ="molecule verify -s kibana"
-
-# Destroy ..
-destroy ="molecule destroy"
-destroy_worker ="molecule destroy -s worker"
-destroy_agent ="molecule destroy -s agent"
-destroy_elasticsearch ="molecule destroy -s elasticsearch"
-destroy_kibana ="molecule destroy -s kibana"

README.md

@@ -47,6 +47,21 @@ These playbooks install and configure Wazuh agent, manager and Elastic Stack.
 * `master` branch contains the latest code, be aware of possible bugs on this branch.
 
 ## Testing
+
+1. Get the `wazuh-ansible` folder from the `wazuh-qa` [repository](https://github.com/wazuh/wazuh-qa/tree/master/ansible/wazuh-ansible).
+
+```
+git clone https://github.com/wazuh/wazuh-qa
+```
+
+2. Copy the `Pipfile` and the `molecule` folder into the root wazuh-ansible directory:
+
+```
+cp wazuh-qa/ansible/wazuh-ansible/* . -R
+```
+
+3. Follow these steps for launching the tests. Check the Pipfile for running different scenarios:
+
 ```
 pip install pipenv
 sudo pipenv install

molecule/default/Dockerfile.j2

@@ -1,14 +0,0 @@
-# Molecule managed
-
-{% if item.registry is defined %}
-FROM {{ item.registry.url }}/{{ item.image }}
-{% else %}
-FROM {{ item.image }}
-{% endif %}
-
-RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get upgrade -y && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
-    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python2-dnf bash && dnf clean all; \
-    elif [ $(command -v yum) ]; then yum makecache fast && yum update -y && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
-    elif [ $(command -v zypper) ]; then zypper refresh && zypper update -y && zypper install -y python sudo bash python-xml && zypper clean -a; \
-    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
-    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

molecule/default/INSTALL.rst

@@ -1,16 +0,0 @@
-*******
-Install
-*******
-
-Requirements
-============
-
-* Docker Engine
-* docker-py
-
-Install
-=======
-
-.. code-block:: bash
-
-  $ sudo pip install docker-py

molecule/default/create.yml

@@ -1,85 +0,0 @@
----
-- name: Create
-  hosts: localhost
-  connection: local
-  gather_facts: false
-  no_log: false
-  tasks:
-    - name: Log into a Docker registry
-      docker_login:
-        username: "{{ item.registry.credentials.username }}"
-        password: "{{ item.registry.credentials.password }}"
-        email: "{{ item.registry.credentials.email | default(omit) }}"
-        registry: "{{ item.registry.url }}"
-        docker_host: "{{ item.docker_host | default('unix://var/run/docker.sock') }}"
-      with_items: "{{ molecule_yml.platforms }}"
-      when:
-        - item.registry is defined
-        - item.registry.credentials is defined
-        - item.registry.credentials.username is defined
-
-    - name: Create Dockerfiles from image names
-      template:
-        src: "{{ molecule_scenario_directory }}/Dockerfile.j2"
-        dest: "{{ molecule_ephemeral_directory }}/Dockerfile_{{ item.image | regex_replace('[^a-zA-Z0-9_]', '_') }}"
-      with_items: "{{ molecule_yml.platforms }}"
-      register: platforms
-
-    - name: Discover local Docker images
-      docker_image_facts:
-        name: "molecule_local/{{ item.item.name }}"
-        docker_host: "{{ item.item.docker_host | default('unix://var/run/docker.sock') }}"
-      with_items: "{{ platforms.results }}"
-      register: docker_images
-
-    - name: Build an Ansible compatible image
-      docker_image:
-        path: "{{ molecule_ephemeral_directory }}"
-        name: "molecule_local/{{ item.item.image }}"
-        docker_host: "{{ item.item.docker_host | default('unix://var/run/docker.sock') }}"
-        dockerfile: "{{ item.item.dockerfile | default(item.invocation.module_args.dest) }}"
-        force: "{{ item.item.force | default(true) }}"
-      with_items: "{{ platforms.results }}"
-      when: platforms.changed or docker_images.results | map(attribute='images') | select('equalto', []) | list | count >= 0
-
-    - name: Create docker network(s)
-      docker_network:
-        name: "main"
-        state: present
-      
-    - name: Sleep 5 seconds till the network gets created if it's not
-        # Pause for 5 minutes to build app cache.
-      pause:
-        seconds: 10
-
-    - name: Create molecule instance(s)
-      docker_container:
-        name: "{{ item.name }}"
-        docker_host: "{{ item.docker_host | default('unix://var/run/docker.sock') }}"
-        hostname: "{{ item.name }}"
-        image: "molecule_local/{{ item.image }}"
-        state: started
-        recreate: false
-        log_driver: json-file
-        command: "{{ item.command | default('bash -c \"while true; do sleep 10000; done\"') }}"
-        privileged: "{{ item.privileged | default(omit) }}"
-        volumes: "{{ item.volumes | default(omit) }}"
-        capabilities: "{{ item.capabilities | default(omit) }}"
-        exposed_ports: "{{ item.exposed_ports | default(omit) }}"
-        published_ports: "{{ item.published_ports | default(omit) }}"
-        ulimits: "{{ item.ulimits | default(omit) }}"
-        networks: 
-          - name: "main"
-        dns_servers: "{{ item.dns_servers | default(omit) }}"
-      register: server
-      with_items: "{{ molecule_yml.platforms }}"
-      async: 7200
-      poll: 0
-
-    - name: Wait for instance(s) creation to complete
-      async_status:
-        jid: "{{ item.ansible_job_id }}"
-      register: docker_jobs
-      until: docker_jobs.finished
-      retries: 300
-      with_items: "{{ server.results }}"

molecule/default/destroy.yml

@@ -1,32 +0,0 @@
----
-- name: Destroy
-  hosts: localhost
-  connection: local
-  gather_facts: false
-  no_log: false
-  tasks:
-    - name: Destroy molecule instance(s)
-      docker_container:
-        name: "{{ item.name }}"
-        docker_host: "{{ item.docker_host | default('unix://var/run/docker.sock') }}"
-        state: absent
-        force_kill: "{{ item.force_kill | default(true) }}"
-      register: server
-      with_items: "{{ molecule_yml.platforms }}"
-      async: 7200
-      poll: 0
-
-    - name: Wait for instance(s) deletion to complete
-      async_status:
-        jid: "{{ item.ansible_job_id }}"
-      register: docker_jobs
-      until: docker_jobs.finished
-      retries: 300
-      with_items: "{{ server.results }}"
-
-    - name: Delete docker network(s)
-      docker_network:
-        name: "{{ item }}"
-        docker_host: "{{ item.docker_host | default('unix://var/run/docker.sock') }}"
-        state: absent
-      with_items: "{{ molecule_yml.platforms | molecule_get_docker_networks }}"

molecule/default/molecule.yml.template

@@ -1,47 +0,0 @@
----
-dependency:
-  name: galaxy
-driver:
-  name: docker
-lint:
-  name: yamllint
-  enabled: false
-platforms:
-  - name: manager_platform_
-    image: imagename
-    command: /sbin/init
-    ulimits:
-      - nofile:262144:262144
-    privileged: true
-    memory_reservation: 2048m
-provisioner:
-  name: ansible
-  config_options:
-    defaults:
-      hash_behaviour: merge
-  env:
-    ANSIBLE_ROLES_PATH: ../../roles
-  lint:
-    name: ansible-lint
-    enabled: true
-scenario:
-  name: default
-  test_sequence:
-    - lint
-    - dependency
-    - cleanup
-    - destroy
-    - syntax
-    - create
-    - prepare
-    - converge
-    - idempotence
-    - side_effect
-    - verify
-    - cleanup
-    - destroy
-verifier:
-  name: testinfra
-  lint:
-    name: flake8
-    enabled: true

molecule/default/playbook.yml

@@ -1,19 +0,0 @@
----
-- name: Converge
-  hosts: all
-  roles:
-    - role: wazuh/ansible-wazuh-manager
-      vars:
-        wazuh_manager_config:
-            cluster:
-                disable: 'no'
-                name: 'wazuh'
-                node_name: 'manager'
-                node_type: 'master'
-                key: 'ugdtAnd7Pi9myP7CVts4qZaZQEQcRYZa'
-                port: '1516'
-                bind_addr: '0.0.0.0'
-                nodes:
-                - 'manager_bionic'
-                hidden: 'no'
-    - { role: wazuh/ansible-filebeat, filebeat_output_elasticsearch_hosts: 'elasticsearch_bionic:9200' }

molecule/default/playbook.yml.template

@@ -1,19 +0,0 @@
----
-- name: Converge
-  hosts: all
-  roles:
-    - role: wazuh/ansible-wazuh-manager
-      vars:
-        wazuh_manager_config:
-            cluster:
-                disable: 'no'
-                name: 'wazuh'
-                node_name: 'manager'
-                node_type: 'master'
-                key: 'ugdtAnd7Pi9myP7CVts4qZaZQEQcRYZa'
-                port: '1516'
-                bind_addr: '0.0.0.0'
-                nodes:
-                - 'manager_platform'
-                hidden: 'no'
-    - { role: wazuh/ansible-filebeat, filebeat_output_elasticsearch_hosts: 'elasticsearch_platform:9200' }

molecule/default/prepare.yml

@@ -1,36 +0,0 @@
----
-- name: Prepare
-  hosts: all
-  gather_facts: true
-  tasks:
-
-    - name: "Install Python packages for Trusty to solve trust issues"
-      package:
-        name:
-          - python-setuptools
-          - python-pip
-        state: latest
-      register: wazuh_manager_trusty_packages_installed
-      until: wazuh_manager_trusty_packages_installed is succeeded
-      when:
-        - ansible_distribution == "Ubuntu"
-        - ansible_distribution_major_version | int == 14
-
-    - name: "Install dependencies"
-      package:
-        name:
-          - curl
-          - net-tools
-        state: latest
-      register: wazuh_manager_dependencies_packages_installed
-      until: wazuh_manager_dependencies_packages_installed is succeeded
-
-    - name: "Install (RedHat) dependencies"
-      package:
-        name:
-          - initscripts
-        state: latest
-      register: wazuh_manager_dependencies_packages_installed
-      until: wazuh_manager_dependencies_packages_installed is succeeded
-      when:
-        - ansible_os_family == 'RedHat'

molecule/default/tests/test_default.py

@@ -1,89 +0,0 @@
-import os
-import pytest
-
-import testinfra.utils.ansible_runner
-
-testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
-    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
-
-
-def get_wazuh_version():
-    """This return the version of Wazuh."""
-    return "3.10.0"
-
-
-def test_wazuh_packages_are_installed(host):
-    """Test if the main packages are installed."""
-    manager = host.package("wazuh-manager")
-    api = host.package("wazuh-api")
-
-    distribution = host.system_info.distribution.lower()
-    if distribution == 'centos':
-        if host.system_info.release == "7":
-            assert manager.is_installed
-            assert manager.version.startswith(get_wazuh_version())
-            assert api.is_installed
-            assert api.version.startswith(get_wazuh_version())
-        elif host.system_info.release.startswith("6"):
-            assert manager.is_installed
-            assert manager.version.startswith(get_wazuh_version())
-    elif distribution == 'ubuntu':
-        assert manager.is_installed
-        assert manager.version.startswith(get_wazuh_version())
-
-
-def test_wazuh_services_are_running(host):
-    """Test if the services are enabled and running.
-
-    When assert commands are commented, this means that the service command has
-    a wrong exit code: https://github.com/wazuh/wazuh-ansible/issues/107
-    """
-    manager = host.service("wazuh-manager")
-    api = host.service("wazuh-api")
-
-    distribution = host.system_info.distribution.lower()
-    if distribution == 'centos':
-        # assert manager.is_running
-        assert manager.is_enabled
-        # assert not api.is_running
-        assert not api.is_enabled
-    elif distribution == 'ubuntu':
-        # assert manager.is_running
-        assert manager.is_enabled
-        # assert api.is_running
-        assert api.is_enabled
-
-
-@pytest.mark.parametrize("wazuh_file, wazuh_owner, wazuh_group, wazuh_mode", [
-    ("/var/ossec/etc/sslmanager.cert", "root", "root", 0o640),
-    ("/var/ossec/etc/sslmanager.key", "root", "root", 0o640),
-    ("/var/ossec/etc/rules/local_rules.xml", "root", "ossec", 0o640),
-    ("/var/ossec/etc/lists/audit-keys", "root", "ossec", 0o640),
-])
-def test_wazuh_files(host, wazuh_file, wazuh_owner, wazuh_group, wazuh_mode):
-    """Test if Wazuh related files exist and have proper owners and mode."""
-    wazuh_file_host = host.file(wazuh_file)
-
-    assert wazuh_file_host.user == wazuh_owner
-    assert wazuh_file_host.group == wazuh_group
-    assert wazuh_file_host.mode == wazuh_mode
-
-
-def test_open_ports(host):
-    """Test if the main port is open and the agent-auth is not open."""
-    distribution = host.system_info.distribution.lower()
-    if distribution == 'ubuntu':
-        assert host.socket("tcp://0.0.0.0:1516").is_listening
-        assert host.socket("tcp://0.0.0.0:1515").is_listening
-        assert host.socket("tcp://0.0.0.0:1514").is_listening
-    elif distribution == 'centos':
-        assert host.socket("tcp://0.0.0.0:1516").is_listening
-        assert host.socket("tcp://127.0.0.1:1515").is_listening
-        assert host.socket("tcp://127.0.0.1:1514").is_listening
-
-
-def test_filebeat_is_installed(host):
-    """Test if the elasticsearch package is installed."""
-    filebeat = host.package("filebeat")
-    assert filebeat.is_installed
-    assert filebeat.version.startswith('7.3.2')

molecule/elasticsearch/Dockerfile.j2

@@ -1,14 +0,0 @@
-# Molecule managed
-
-{% if item.registry is defined %}
-FROM {{ item.registry.url }}/{{ item.image }}
-{% else %}
-FROM {{ item.image }}
-{% endif %}
-
-RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
-    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
-    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
-    elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
-    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
-    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

molecule/elasticsearch/INSTALL.rst

@@ -1,22 +0,0 @@
-*******
-Docker driver installation guide
-*******
-
-Requirements
-============
-
-* Docker Engine
-
-Install
-=======
-
-Please refer to the `Virtual environment`_ documentation for installation best
-practices. If not using a virtual environment, please consider passing the
-widely recommended `'--user' flag`_ when invoking ``pip``.
-
-.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
-.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
-
-.. code-block:: bash
-
-    $ pip install 'molecule[docker]'

molecule/elasticsearch/molecule.yml

@@ -1,57 +0,0 @@
----
-dependency:
-  name: galaxy
-driver:
-  name: docker
-lint:
-  name: yamllint
-  options:
-    config-data:
-      ignore: .virtualenv
-bionics:
-  - name: elasticsearch_bionic
-    image: solita/ubuntu-systemd:bionic
-    command: /sbin/init
-    ulimits:
-      - nofile:262144:262144
-    privileged: true
-    memory_reservation: 2048m
-provisioner:
-  name: ansible
-  config_options:
-    defaults:
-      hash_behaviour: merge
-  playbooks:
-    docker:
-      create: ../default/create.yml
-      destroy: ../default/destroy.yml
-      prepare: ../default/prepare.yml
-  env:
-    ANSIBLE_ROLES_PATH: ../../roles
-  lint:
-    name: ansible-lint
-    enabled: true
-  inventory:
-    group_vars:
-      all:
-        elasticsearch_jvm_xms: 512
-scenario:
-  name: elasticsearch
-  test_sequence:
-    - lint
-    - dependency
-    - cleanup
-    - destroy
-    - syntax
-    - create
-    - prepare
-    - converge
-    #- idempotence
-    - side_effect
-    - verify
-    - cleanup
-    - destroy
-verifier:
-  name: testinfra
-  lint:
-    name: flake8

molecule/elasticsearch/molecule.yml.template

@@ -1,57 +0,0 @@
----
-dependency:
-  name: galaxy
-driver:
-  name: docker
-lint:
-  name: yamllint
-  options:
-    config-data:
-      ignore: .virtualenv
-platforms:
-  - name: elasticsearch_platform_
-    image: imagename
-    command: /sbin/init
-    ulimits:
-      - nofile:262144:262144
-    privileged: true
-    memory_reservation: 2048m
-provisioner:
-  name: ansible
-  config_options:
-    defaults:
-      hash_behaviour: merge
-  playbooks:
-    docker:
-      create: ../default/create.yml
-      destroy: ../default/destroy.yml
-      prepare: ../default/prepare.yml
-  env:
-    ANSIBLE_ROLES_PATH: ../../roles
-  lint:
-    name: ansible-lint
-    enabled: true
-  inventory:
-    group_vars:
-      all:
-        elasticsearch_jvm_xms: 512
-scenario:
-  name: elasticsearch
-  test_sequence:
-    - lint
-    - dependency
-    - cleanup
-    - destroy
-    - syntax
-    - create
-    - prepare
-    - converge
-    - idempotence
-    - side_effect
-    - verify
-    - cleanup
-    - destroy
-verifier:
-  name: testinfra
-  lint:
-    name: flake8

molecule/elasticsearch/playbook.yml

@@ -1,6 +0,0 @@
----
-- name: Converge
-  hosts: all
-  roles:
-    - role: elastic-stack/ansible-elasticsearch
-      elasticsearch_network_host: 'elasticsearch_bionic'

molecule/elasticsearch/playbook.yml.template

@@ -1,6 +0,0 @@
----
-- name: Converge
-  hosts: all
-  roles:
-    - role: elastic-stack/ansible-elasticsearch
-      elasticsearch_network_host: 'elasticsearch_platform'

molecule/elasticsearch/tests/test_default.py

@@ -1,20 +0,0 @@
-import os
-
-import testinfra.utils.ansible_runner
-
-testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
-    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
-
-
-def test_elasticsearch_is_installed(host):
-    """Test if the elasticsearch package is installed."""
-    elasticsearch = host.package("elasticsearch")
-    assert elasticsearch.is_installed
-    assert elasticsearch.version.startswith('7.3.2')
-
-
-def test_elasticsearch_is_running(host):
-    """Test if the services are enabled and running."""
-    elasticsearch = host.service("elasticsearch")
-    assert elasticsearch.is_enabled
-    assert elasticsearch.is_running

molecule/kibana/Dockerfile.j2

@@ -1,14 +0,0 @@
-# Molecule managed
-
-{% if item.registry is defined %}
-FROM {{ item.registry.url }}/{{ item.image }}
-{% else %}
-FROM {{ item.image }}
-{% endif %}
-
-RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
-    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
-    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
-    elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
-    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
-    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

molecule/kibana/INSTALL.rst

@@ -1,22 +0,0 @@
-*******
-Docker driver installation guide
-*******
-
-Requirements
-============
-
-* Docker Engine
-
-Install
-=======
-
-Please refer to the `Virtual environment`_ documentation for installation best
-practices. If not using a virtual environment, please consider passing the
-widely recommended `'--user' flag`_ when invoking ``pip``.
-
-.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
-.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
-
-.. code-block:: bash
-
-    $ pip install 'molecule[docker]'

molecule/kibana/molecule.yml.template

@@ -1,40 +0,0 @@
----
-dependency:
-  name: galaxy
-driver:
-  name: docker
-lint:
-  name: yamllint
-  options:
-    config-data:
-      ignore: .virtualenv
-platforms:
-  - name: kibana_platform_
-    image: imagename
-    command: /sbin/init
-    ulimits:
-      - nofile:262144:262144
-    privileged: true
-    memory_reservation: 1024m
-provisioner:
-  name: ansible
-  config_options:
-    defaults:
-      hash_behaviour: merge
-  playbooks:
-    docker:
-      create: ../default/create.yml
-      destroy: ../default/destroy.yml
-  env:
-    ANSIBLE_ROLES_PATH: ../../roles
-  lint:
-    name: ansible-lint
-    enabled: true
-  inventory:
-    group_vars:
-      all:
-        elasticsearch_jvm_xms: 256
-verifier:
-  name: testinfra
-  lint:
-    name: flake8

molecule/kibana/playbook.yml

@@ -1,6 +0,0 @@
----
-- name: Converge
-  hosts: all
-  roles:
-    - role: elastic-stack/ansible-kibana
-      elasticsearch_network_host: 'elasticsearch_bionic'

molecule/kibana/playbook.yml.template

@@ -1,6 +0,0 @@
----
-- name: Converge
-  hosts: all
-  roles:
-    - role: elastic-stack/ansible-kibana
-      elasticsearch_network_host: 'elasticsearch_platform'

molecule/kibana/prepare.yml

@@ -1,36 +0,0 @@
----
-- name: Prepare
-  hosts: all
-  gather_facts: true
-  pre_tasks:
-
-    - name: "Install Python packages for Trusty to solve trust issues"
-      package:
-        name:
-          - python-setuptools
-          - python-pip
-        state: latest
-      register: wazuh_manager_trusty_packages_installed
-      until: wazuh_manager_trusty_packages_installed is succeeded
-      when:
-        - ansible_distribution == "Ubuntu"
-        - ansible_distribution_major_version | int == 14
-
-    - name: "Install dependencies"
-      package:
-        name:
-          - curl
-          - net-tools
-        state: latest
-      register: wazuh_manager_dependencies_packages_installed
-      until: wazuh_manager_dependencies_packages_installed is succeeded
-
-    - name: "Install (RedHat) dependencies"
-      package:
-        name:
-          - initscripts
-        state: latest
-      register: wazuh_manager_dependencies_packages_installed
-      until: wazuh_manager_dependencies_packages_installed is succeeded
-      when:
-        - ansible_os_family == 'RedHat'

molecule/kibana/tests/test_default.py

@@ -1,24 +0,0 @@
-import os
-
-import testinfra.utils.ansible_runner
-
-testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
-    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
-
-
-def test_port_kibana_is_open(host):
-    """Test if the port 5601 is open and listening to connections."""
-    host.socket("tcp://0.0.0.0:5601").is_listening
-
-
-def test_find_correct_elasticsearch_version(host):
-    """Test if we find the kibana/elasticsearch version in package.json"""
-    kibana = host.file("/usr/share/kibana/plugins/wazuh/package.json")
-    assert kibana.contains("7.3.2")
-
-
-def test_wazuh_plugin_installed(host):
-    """Make sure there is a plugin wazuh directory."""
-    kibana = host.file("/usr/share/kibana/plugins/wazuh/")
-
-    assert kibana.is_directory

molecule/run_cluster_mode.sh

@@ -1,43 +0,0 @@
-#!/bin/bash
-
-paths=( "molecule/default/" "molecule/worker/" "molecule/elasticsearch/" "molecule/kibana/" )
-images=( "solita/ubuntu-systemd:bionic" "solita/ubuntu-systemd:xenial" "milcom/centos7-systemd" "ubuntu:trusty" "centos:6" )
-platform=( "bionic" "xenial" "centos7" "trusty" "centos6" )
-
-echo "Please select an image. "
-
-select IMAGE in "${images[@]}";
-do
-     echo "You picked $IMAGE ($REPLY)"
-     break
-done
-
-index=$(($REPLY - 1))
-
-if [ -z "$IMAGE" ]
-then
-      echo "Platform not selected. Please select a platform of [bionuc, xenial or centos7]. => Aborting"
-      exit
-else
-        for i in "${paths[@]}"
-        do
-            cp "$i/playbook.yml.template" "$i/playbook.yml"
-            sed -i "s/platform/${platform[$index]}/g" "$i/playbook.yml"
-
-            cp "$i/molecule.yml.template" "$i/molecule.yml"
-            sed -i "s|imagename|${images[$index]}|g" "$i/molecule.yml"
-            sed -i "s/platform_/${platform[$index]}/g" "$i/molecule.yml"    
-
-        done
-fi
-
-sudo pipenv run elasticsearch
-sudo pipenv run test
-sudo pipenv run worker
-sudo pipenv run kibana
-
-sudo pipenv run destroy
-sudo pipenv run destroy_worker
-sudo pipenv run destroy_elasticsearch
-sudo pipenv run destroy_kibana
-

molecule/wazuh-agent/Dockerfile.j2

@@ -1,14 +0,0 @@
-# Molecule managed
-
-{% if item.registry is defined %}
-FROM {{ item.registry.url }}/{{ item.image }}
-{% else %}
-FROM {{ item.image }}
-{% endif %}
-
-RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
-    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
-    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
-    elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
-    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
-    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

molecule/wazuh-agent/INSTALL.rst

@@ -1,22 +0,0 @@
-*******
-Docker driver installation guide
-*******
-
-Requirements
-============
-
-* Docker Engine
-
-Install
-=======
-
-Please refer to the `Virtual environment`_ documentation for installation best
-practices. If not using a virtual environment, please consider passing the
-widely recommended `'--user' flag`_ when invoking ``pip``.
-
-.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
-.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
-
-.. code-block:: bash
-
-    $ pip install 'molecule[docker]'

molecule/wazuh-agent/molecule.yml

@@ -1,89 +0,0 @@
----
-dependency:
-  name: galaxy
-driver:
-  name: docker
-  #lint:
-  #  name: yamllint
-lint:
-  name: yamllint
-  options:
-    config-data:
-      ignore: .virtualenv
-platforms:
-  #- name: wazuh_server_centos7
-  #  image: milcom/centos7-systemd
-  #  networks:
-  #    - name: wazuh
-  #  privileged: true
-  #  groups:
-  #    - manager
-  - name: wazuh_agent_bionic
-    image: ubuntu:bionic
-    networks:
-      - name: wazuh
-    groups:
-      - agent
-  #- name: wazuh_agent_xenial
-  #  image: solita/ubuntu-systemd:xenial
-  #  privileged: true
-  #  command: /sbin/init
-  #  networks:
-  #    - name: wazuh
-  #  groups:
-  #    - agent
-  #- name: wazuh_agent_trusty
-  #  image: ubuntu:trusty
-  #  networks:
-  #    - name: wazuh
-  #  groups:
-  #    - agent
-  #- name: wazuh_agent_centos6
-  #  image: centos:6
-  #  networks:
-  #    - name: wazuh
-  #  groups:
-  #    - agent
-  #- name: wazuh_agent_centos7
-  #  image: milcom/centos7-systemd
-  #  privileged: true
-  #  networks:
-  #    - name: wazuh
-  #  groups:
-  #    - agent
-provisioner:
-  name: ansible
-  config_options:
-    defaults:
-      hash_behaviour: merge
-  playbooks:
-    docker:
-      create: ../default/create.yml
-      destroy: ../default/destroy.yml
-  env:
-    ANSIBLE_ROLES_PATH: ../../roles
-  inventory:
-    group_vars:
-      agent:
-        api_pass: password
-        wazuh_managers:
-          - address: "{{ wazuh_manager_ip }}"
-            port: 1514
-            protocol: tcp
-            api_port: 55000
-            api_proto: 'http'
-            api_user: null
-        wazuh_agent_authd:
-          enable: true
-          port: 1515
-          ssl_agent_ca: null
-          ssl_agent_cert: null
-          ssl_agent_key: null
-          ssl_auto_negotiate: 'no'
-  lint:
-    name: ansible-lint
-    enabled: true
-verifier:
-  name: testinfra
-  lint:
-    name: flake8

molecule/wazuh-agent/molecule.yml.template

@@ -1,89 +0,0 @@
----
-dependency:
-  name: galaxy
-driver:
-  name: docker
-  #lint:
-  #  name: yamllint
-lint:
-  name: yamllint
-  options:
-    config-data:
-      ignore: .virtualenv
-platforms:
-  #- name: wazuh_server_centos7
-  #  image: milcom/centos7-systemd
-  #  networks:
-  #    - name: wazuh
-  #  privileged: true
-  #  groups:
-  #    - manager
-  - name: wazuh_agent_bionic
-    image: ubuntu:bionic
-    networks:
-      - name: wazuh
-    groups:
-      - agent
-  #- name: wazuh_agent_xenial
-  #  image: solita/ubuntu-systemd:xenial
-  #  privileged: true
-  #  command: /sbin/init
-  #  networks:
-  #    - name: wazuh
-  #  groups:
-  #    - agent
-  #- name: wazuh_agent_trusty
-  #  image: ubuntu:trusty
-  #  networks:
-  #    - name: wazuh
-  #  groups:
-  #    - agent
-  #- name: wazuh_agent_centos6
-  #  image: centos:6
-  #  networks:
-  #    - name: wazuh
-  #  groups:
-  #    - agent
-  #- name: wazuh_agent_centos7
-  #  image: milcom/centos7-systemd
-  #  privileged: true
-  #  networks:
-  #    - name: wazuh
-  #  groups:
-  #    - agent
-provisioner:
-  name: ansible
-  config_options:
-    defaults:
-      hash_behaviour: merge
-  playbooks:
-    docker:
-      create: ../default/create.yml
-      destroy: ../default/destroy.yml
-  env:
-    ANSIBLE_ROLES_PATH: ../../roles
-  inventory:
-    group_vars:
-      agent:
-        api_pass: password
-        wazuh_managers:
-          - address: "{{ wazuh_manager_ip }}"
-            port: 1514
-            protocol: tcp
-            api_port: 55000
-            api_proto: 'http'
-            api_user: null
-        wazuh_agent_authd:
-          enable: true
-          port: 1515
-          ssl_agent_ca: null
-          ssl_agent_cert: null
-          ssl_agent_key: null
-          ssl_auto_negotiate: 'no'
-  lint:
-    name: ansible-lint
-    enabled: true
-verifier:
-  name: testinfra
-  lint:
-    name: flake8

molecule/wazuh-agent/playbook.yml

@@ -1,18 +0,0 @@
----
-- name: Converge
-  hosts: all
-  roles:
-    - role: wazuh/ansible-wazuh-agent
-  vars:
-    wazuh_managers:
-      - address: 'manager_platform'
-        port: 1514
-        protocol: tcp
-        api_port: 55000
-        api_proto: 'http'
-        api_user: ansible
-    wazuh_agent_authd:
-      enable: true
-      port: 1515
-      ssl_agent_ca: null
-      ssl_auto_negotiate: 'no'    

molecule/wazuh-agent/playbook.yml.template

@@ -1,18 +0,0 @@
----
-- name: Converge
-  hosts: all
-  roles:
-    - role: wazuh/ansible-wazuh-agent
-  vars:
-    wazuh_managers:
-      - address: 'manager_platform'
-        port: 1514
-        protocol: tcp
-        api_port: 55000
-        api_proto: 'http'
-        api_user: ansible
-    wazuh_agent_authd:
-      enable: true
-      port: 1515
-      ssl_agent_ca: null
-      ssl_auto_negotiate: 'no'    

molecule/wazuh-agent/prepare.yml

@@ -1,43 +0,0 @@
----
-- name: Prepare
-  hosts: manager
-  gather_facts: true
-  tasks:
-
-    - name: "Install dependencies"
-      package:
-        name:
-          - curl
-          - net-tools
-        state: latest
-      register: wazuh_manager_dependencies_packages_installed
-      until: wazuh_manager_dependencies_packages_installed is succeeded
-
-  roles:
-    - role: wazuh/ansible-wazuh-manager
-
-- name: Prepare
-  hosts: agent
-  gather_facts: true
-  tasks:
-
-    - name: "Install Python packages for Trusty to solve trust issues"
-      package:
-        name:
-          - python-setuptools
-          - python-pip
-        state: latest
-      register: wazuh_manager_trusty_packages_installed
-      until: wazuh_manager_trusty_packages_installed is succeeded
-      when:
-        - ansible_distribution == "Ubuntu"
-        - ansible_distribution_major_version | int == 14
-
-    - name: "Install dependencies"
-      package:
-        name:
-          - curl
-          - net-tools
-        state: latest
-      register: wazuh_agent_dependencies_packages_installed
-      until: wazuh_agent_dependencies_packages_installed is succeeded

molecule/wazuh-agent/tests/test_agents.py

@@ -1,28 +0,0 @@
-import os
-import pytest
-
-import testinfra.utils.ansible_runner
-
-testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
-    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('agent')
-
-
-def get_wazuh_version():
-    """This return the version of Wazuh."""
-    return "3.10.0"
-
-
-def test_ossec_package_installed(Package):
-    ossec = Package('wazuh-agent')
-    assert ossec.is_installed
-
-
-@pytest.mark.parametrize("wazuh_service, wazuh_owner", (
-        ("ossec-agentd", "ossec"),
-        ("ossec-execd", "root"),
-        ("ossec-syscheckd", "root"),
-        ("wazuh-modulesd", "root"),
-))
-def test_wazuh_processes_running(host, wazuh_service, wazuh_owner):
-    master = host.process.get(user=wazuh_owner, comm=wazuh_service)
-    assert master.args == "/var/ossec/bin/" + wazuh_service

molecule/wazuh-agent/tests/test_manager.py

@@ -1,15 +0,0 @@
-import os
-
-import testinfra.utils.ansible_runner
-
-testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
-    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('manager')
-
-
-def test_agents_registered_on_manager(host):
-    cmd = host.run("/var/ossec/bin/manage_agents -l")
-    assert 'wazuh_agent_bionic' in cmd.stdout
-    assert 'wazuh_agent_xenial' in cmd.stdout
-    assert 'wazuh_agent_trusty' in cmd.stdout
-    assert 'wazuh_agent_centos6' in cmd.stdout
-    assert 'wazuh_agent_centos7' in cmd.stdout

molecule/worker/Dockerfile.j2

@@ -1,14 +0,0 @@
-# Molecule managed
-
-{% if item.registry is defined %}
-FROM {{ item.registry.url }}/{{ item.image }}
-{% else %}
-FROM {{ item.image }}
-{% endif %}
-
-RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
-    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
-    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
-    elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
-    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
-    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

molecule/worker/molecule.yml.template

@@ -1,53 +0,0 @@
----
-dependency:
-  name: galaxy
-driver:
-  name: docker
-lint:
-  name: yamllint
-  options:
-    config-data:
-      ignore: .virtualenv
-platforms:
-  - name: worker_platform_
-    image: imagename
-    command: /sbin/init
-    ulimits:
-      - nofile:262144:262144
-    privileged: true
-    memory_reservation: 2048m
-provisioner:
-  name: ansible
-  config_options:
-    defaults:
-      hash_behaviour: merge
-  playbooks:
-    docker:
-      create: ../default/create.yml
-      destroy: ../default/destroy.yml
-      prepare: ../default/prepare.yml
-  env:
-    ANSIBLE_ROLES_PATH: ../../roles
-  lint:
-    name: ansible-lint
-    enabled: true
-scenario:
-  name: worker
-  test_sequence:
-    - lint
-    - dependency
-    - cleanup
-    - destroy
-    - syntax
-    - create
-    - prepare
-    - converge
-    - idempotence
-    - side_effect
-    - verify
-    - cleanup
-    - destroy
-verifier:
-  name: testinfra
-  lint:
-    name: flake8

molecule/worker/playbook.yml

@@ -1,21 +0,0 @@
----
-- name: Converge
-  hosts: all
-  roles:
-    - role: wazuh/ansible-wazuh-manager
-      vars:
-        wazuh_manager_config:
-            cluster:
-                disable: 'no'
-                name: 'wazuh'
-                node_name: 'worker-01'
-                node_type: 'worker'
-                key: 'ugdtAnd7Pi9myP7CVts4qZaZQEQcRYZa'
-                port: '1516'
-                bind_addr: '0.0.0.0'
-                nodes:
-                - 'manager_bionic'
-                hidden: 'no'
-    - { role: wazuh/ansible-filebeat, filebeat_output_elasticsearch_hosts: 'elasticsearch_bionic:9200' }
-
-

molecule/worker/playbook.yml.template

@@ -1,21 +0,0 @@
----
-- name: Converge
-  hosts: all
-  roles:
-    - role: wazuh/ansible-wazuh-manager
-      vars:
-        wazuh_manager_config:
-            cluster:
-                disable: 'no'
-                name: 'wazuh'
-                node_name: 'worker-01'
-                node_type: 'worker'
-                key: 'ugdtAnd7Pi9myP7CVts4qZaZQEQcRYZa'
-                port: '1516'
-                bind_addr: '0.0.0.0'
-                nodes:
-                - 'manager_platform'
-                hidden: 'no'
-    - { role: wazuh/ansible-filebeat, filebeat_output_elasticsearch_hosts: 'elasticsearch_platform:9200' }
-
-

molecule/worker/tests/test_default.py

@@ -1,85 +0,0 @@
-import os
-import pytest
-
-import testinfra.utils.ansible_runner
-
-testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
-    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
-
-
-def get_wazuh_version():
-    """This return the version of Wazuh."""
-    return "3.10.0"
-
-
-def test_wazuh_packages_are_installed(host):
-    """Test if the main packages are installed."""
-    manager = host.package("wazuh-manager")
-    api = host.package("wazuh-api")
-
-    distribution = host.system_info.distribution.lower()
-    if distribution == 'centos':
-        if host.system_info.release == "7":
-            assert manager.is_installed
-            assert manager.version.startswith(get_wazuh_version())
-            assert api.is_installed
-            assert api.version.startswith(get_wazuh_version())
-        elif host.system_info.release.startswith("6"):
-            assert manager.is_installed
-            assert manager.version.startswith(get_wazuh_version())
-    elif distribution == 'ubuntu':
-        assert manager.is_installed
-        assert manager.version.startswith(get_wazuh_version())
-
-
-def test_wazuh_services_are_running(host):
-    """Test if the services are enabled and running.
-
-    When assert commands are commented, this means that the service command has
-    a wrong exit code: https://github.com/wazuh/wazuh-ansible/issues/107
-    """
-    manager = host.service("wazuh-manager")
-    api = host.service("wazuh-api")
-
-    distribution = host.system_info.distribution.lower()
-    if distribution == 'centos':
-        # assert manager.is_running
-        assert manager.is_enabled
-        # assert not api.is_running
-        assert not api.is_enabled
-    elif distribution == 'ubuntu':
-        # assert manager.is_running
-        assert manager.is_enabled
-        # assert api.is_running
-        assert api.is_enabled
-
-
-@pytest.mark.parametrize("wazuh_file, wazuh_owner, wazuh_group, wazuh_mode", [
-    ("/var/ossec/etc/sslmanager.cert", "root", "root", 0o640),
-    ("/var/ossec/etc/sslmanager.key", "root", "root", 0o640),
-    ("/var/ossec/etc/rules/local_rules.xml", "root", "ossec", 0o640),
-    ("/var/ossec/etc/lists/audit-keys", "root", "ossec", 0o640),
-])
-def test_wazuh_files(host, wazuh_file, wazuh_owner, wazuh_group, wazuh_mode):
-    """Test if Wazuh related files exist and have proper owners and mode."""
-    wazuh_file_host = host.file(wazuh_file)
-
-    assert wazuh_file_host.user == wazuh_owner
-    assert wazuh_file_host.group == wazuh_group
-    assert wazuh_file_host.mode == wazuh_mode
-
-
-def test_open_ports(host):
-    """Test if the main port is open and the agent-auth is not open."""
-    distribution = host.system_info.distribution.lower()
-    if distribution == 'ubuntu':
-        assert host.socket("tcp://0.0.0.0:1514").is_listening
-    elif distribution == 'centos':
-        assert host.socket("tcp://127.0.0.1:1514").is_listening
-
-
-def test_filebeat_is_installed(host):
-    """Test if the elasticsearch package is installed."""
-    filebeat = host.package("filebeat")
-    assert filebeat.is_installed
-    assert filebeat.version.startswith('7.3.2')

playbooks/wazuh-elastic_stack-distributed.yml

@@ -17,16 +17,18 @@
       elasticsearch_xpack_security: true
       node_certs_generator: true
       elasticsearch_xpack_security_password: elastic_pass
+      single_node: false
 
   vars:
     instances:
-      - name: node-1       # Important: must be equal to elasticsearch_node_name.                    
+      node1:
+        name: node-1       # Important: must be equal to elasticsearch_node_name.                    
         ip: <node-1 IP>   # When unzipping, the node will search for its node name folder to get the cert.
-
-      - name: node-2
+      node2:
+        name: node-2
         ip: <node-2 IP>
-
-      - name: node-3
+      node3:
+        name: node-3
         ip: <node-3 IP>
 
 - hosts: <node-2 IP>
@@ -34,6 +36,7 @@
     - role: /etc/ansible/roles/wazuh-ansible/roles/elastic-stack/ansible-elasticsearch
       elasticsearch_network_host: <node-2 IP>
       elasticsearch_node_name: node-2
+      single_node: false
       elasticsearch_xpack_security: true
       elasticsearch_master_candidate: true
       elasticsearch_discovery_nodes:
@@ -46,6 +49,7 @@
     - role: /etc/ansible/roles/wazuh-ansible/roles/elastic-stack/ansible-elasticsearch 
       elasticsearch_network_host: <node-3 IP>
       elasticsearch_node_name: node-3
+      single_node: false
       elasticsearch_xpack_security: true
       elasticsearch_master_candidate: true
       elasticsearch_discovery_nodes:

roles/elastic-stack/ansible-elasticsearch/defaults/main.yml

@@ -19,15 +19,17 @@ elasticsearch_xpack_security_user: elastic
 elasticsearch_xpack_security_password: elastic_pass
 
 node_certs_generator: false
-node_certs_generator_ip: 172.16.0.161
 node_certs_source: /usr/share/elasticsearch
 node_certs_destination: /etc/elasticsearch/certs
 
-# Rsync
-rsync_path: /usr/bin/rsync
-rsync_user: vagrant
-rsync_extra_parameters: -avg -e 'ssh -o StrictHostKeyChecking=no' --rsync-path='sudo rsync'
-
+
+
+# CA generation
+master_certs_path: /es_certs
+generate_CA: true
+ca_key_name: ""
+ca_cert_name: ""
+ca_password: ""
 
 
 

roles/elastic-stack/ansible-elasticsearch/tasks/main.yml

@@ -63,140 +63,10 @@
 - import_tasks: "RMRedHat.yml"
   when: ansible_os_family == "RedHat"
 
-- name: Check if certificate exists locally
-  stat:
-    path: "{{ node_certs_destination }}/{{ elasticsearch_node_name }}.crt"
-  register: certificate_file_exists
+- import_tasks: "xpack_security.yml"
   when:
     - elasticsearch_xpack_security
 
-- name: Write the instances.yml file in the selected node (force = no)
-  template:
-    src: instances.yml.j2
-    dest: "{{ node_certs_source }}/instances.yml"
-    force: no
-  register: instances_file_exists
-  tags:
-    - config
-    - xpack-security
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-    - not certificate_file_exists.stat.exists
-
-- name: Update instances.yml status after generation
-  stat:
-    path: "{{ node_certs_source }}/instances.yml"
-  register: instances_file_exists
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-
-- name: Check if the certificates ZIP file exists
-  stat:
-    path: "{{ node_certs_source }}/certs.zip"
-  register: xpack_certs_zip
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-
-- name: Generating certificates for Elasticsearch security
-  command: >-
-     "/usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in
-     {{ node_certs_source }}/instances.yml --out {{ node_certs_source }}/certs.zip"
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-    - not xpack_certs_zip.stat.exists
-    - not certificate_file_exists.stat.exists
-  register: certs_file_generated
-  tags: xpack-security
-
-- name: Unzip generated certs.zip
-  unarchive:
-    src: "{{ node_certs_source }}/certs.zip"
-    dest: "{{ node_certs_source }}/"
-    remote_src: yes
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-    - certs_file_generated is defined
-    - not certificate_file_exists.stat.exists
-  tags: xpack-security
-
-- name: Copy key & certificate files in generator node (locally)
-  synchronize:
-    src: "{{ node_certs_source }}/{{ elasticsearch_node_name }}/"
-    dest: "{{ node_certs_destination }}/"
-  delegate_to: "{{ node_certs_generator_ip }}"
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-  tags: xpack-security
-
-- name: Copy ca certificate file in generator node (locally)
-  synchronize:
-    src: "{{ node_certs_source }}/ca/"
-    dest: "{{ node_certs_destination }}/"
-  delegate_to: "{{ node_certs_generator_ip }}"
-  register: check_certs_permissions
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-  tags: xpack-security
-
-- name: Importing key & certificate files from generator node
-  command: >-
-    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
-    {{ node_certs_source }}/{{ elasticsearch_node_name }}/ {{ node_certs_destination }}/
-  when:
-    - not node_certs_generator
-    - elasticsearch_xpack_security
-    - not certificate_file_exists.stat.exists
-  tags: xpack-security
-
-- name: Importing ca certificate file from generator node
-  command: >-
-    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
-    {{ node_certs_source }}/ca/ {{ node_certs_destination }}/
-  when:
-    - not node_certs_generator
-    - elasticsearch_xpack_security
-    - not certificate_file_exists.stat.exists
-  register: check_certs_permissions
-  tags: xpack-security
-
-- name: Ensuring certificates folder owner
-  file:
-    path: "{{ node_certs_destination }}/"
-    state: directory
-    recurse: yes
-    owner: elasticsearch
-    group: elasticsearch
-  when:
-    - check_certs_permissions is defined
-    - elasticsearch_xpack_security
-  tags: xpack-security
-
-- name: Ensuring certificates folder owner
-  file:
-    path: "{{ node_certs_destination }}/"
-    mode: '0770'
-    recurse: yes
-  when:
-    - check_certs_permissions is defined
-    - elasticsearch_xpack_security
-  tags: xpack-security
-
-- name: Remove generated certs file
-  file:
-    state: absent
-    path: "{{ node_certs_source }}/certs.zip*"
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-  tags: xpack-security
-
 - name: Configure Elasticsearch.
   template:
     src: elasticsearch.yml.j2
@@ -207,13 +77,6 @@
   notify: restart elasticsearch
   tags: configure
 
-- name: Set elasticsearch bootstrap password
-  shell: |
-     set -o pipefail
-     "echo '{{ elasticsearch_xpack_security_password }}' | {{ node_certs_source }}/bin/elasticsearch-keystore add -xf 'bootstrap.password'"
-  when:
-    - elasticsearch_xpack_security
-
 - name: Trusty | set MAX_LOCKED_MEMORY=unlimited in Elasticsearch in /etc/security/limits.conf
   lineinfile:
     path: /etc/security/limits.conf
@@ -236,20 +99,14 @@
     - ansible_distribution == "Ubuntu"
     - ansible_distribution_major_version | int == 14
 
-- name: Distribution != one of [ centos 6.*,  trusty ] | Reload systemd
-  systemd: daemon_reload=true
-  ignore_errors: true
-  when:
-    - not (ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA")
-    - not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<'))
-    - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
-    - not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))
-
 - name: Ensure Elasticsearch started and enabled
   service:
     name: elasticsearch
     enabled: true
     state: started
+  tags:
+    - configure
+    - init
 
 - name: Make sure Elasticsearch is running before proceeding
   wait_for: host={{ elasticsearch_network_host }} port={{ elasticsearch_http_port }} delay=3 timeout=400
@@ -257,32 +114,6 @@
     - configure
     - init
 
-- name: Check for Wazuh Alerts template (http)
-  uri:
-    url: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}/_template/wazuh"
-    method: GET
-    status_code: 200, 404
-  when:
-    - elasticsearch_bootstrap_node or single_node
-    - not elasticsearch_xpack_security
-  poll: 30
-  register: wazuh_alerts_template_exits
-  until: wazuh_alerts_template_exits is succeeded
-  tags: init
-
-- name: Installing Wazuh Alerts template (http)
-  uri:
-    url: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}/_template/wazuh"
-    method: PUT
-    status_code: 200
-    body_format: json
-    body: "{{ lookup('template','wazuh-elastic7-template-alerts.json.j2') }}"
-  when:
-    - wazuh_alerts_template_exits.status is defined
-    - wazuh_alerts_template_exits.status != 200
-    - not elasticsearch_xpack_security
-  tags: init
-
 - import_tasks: "RMRedHat.yml"
   when: ansible_os_family == "RedHat"
 

roles/elastic-stack/ansible-elasticsearch/tasks/xpack_security.yml

@@ -0,0 +1,186 @@
+
+- name: Install unzip dependency.
+  package:
+    name: unzip
+    state: present
+  delegate_to: "127.0.0.1"
+  when:
+    - node_certs_generator
+
+- name: Check if certificate exists locally
+  stat:
+    path: "{{ node_certs_destination }}/{{ elasticsearch_node_name }}.crt"
+  register: certificate_file_exists
+
+- name: Write the instances.yml file in the selected node (force = no)
+  template:
+    src: instances.yml.j2
+    dest: "{{ node_certs_source }}/instances.yml"
+    force: no
+  register: instances_file_exists
+  tags:
+    - config
+    - xpack-security
+  when:
+    - node_certs_generator
+    - not certificate_file_exists.stat.exists
+
+- name: Update instances.yml status after generation
+  stat:
+    path: "{{ node_certs_source }}/instances.yml"
+  register: instances_file_exists
+  when:
+    - node_certs_generator
+
+- name: Check if the certificates ZIP file exists
+  stat:
+    path: "{{ node_certs_source }}/certs.zip"
+  register: xpack_certs_zip
+  when:
+    - node_certs_generator
+
+- name: Importing custom CA key
+  copy:
+    src: "{{ master_certs_path }}/ca/{{ ca_key_name }}"
+    dest: "{{ node_certs_source }}/{{ ca_key_name }}"
+    mode: '0664'
+  when:
+   - not generate_CA
+   - node_certs_generator
+  tags: xpack-security
+
+- name: Importing custom CA cert
+  copy:
+    src: "{{ master_certs_path }}/ca/{{ ca_cert_name }}"
+    dest: "{{ node_certs_source }}/{{ ca_cert_name }}"
+    mode: '0664'
+  when:
+    - not generate_CA
+    - node_certs_generator
+  tags: xpack-security
+
+- name: Generating certificates for Elasticsearch security (generating CA)
+  command: >-
+    /usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem
+    --in {{ node_certs_source }}/instances.yml
+    --out {{ node_certs_source }}/certs.zip
+  when:
+    - node_certs_generator
+    - not xpack_certs_zip.stat.exists
+    - generate_CA
+  tags: xpack-security
+
+- name: Generating certificates for Elasticsearch security (using provided CA | Without CA Password)
+  command: >-
+    /usr/share/elasticsearch/bin/elasticsearch-certutil cert
+    --ca-key {{ node_certs_source }}/{{ ca_key_name }}
+    --ca-cert {{ node_certs_source }}/{{ ca_cert_name }}
+    --pem --in {{ node_certs_source }}/instances.yml
+    --out {{ node_certs_source }}/certs.zip
+  when:
+    - node_certs_generator
+    - not xpack_certs_zip.stat.exists
+    - not generate_CA
+    - ca_password | length == 0
+  tags: xpack-security
+
+- name: Generating certificates for Elasticsearch security (using provided CA | Using CA Password)
+  command: >-
+    /usr/share/elasticsearch/bin/elasticsearch-certutil cert
+    --ca-key {{ node_certs_source }}/{{ ca_key_name }}
+    --ca-cert {{ node_certs_source }}/{{ ca_cert_name }}
+    --pem --in {{ node_certs_source }}/instances.yml --out {{ node_certs_source }}/certs.zip
+    --ca-pass {{ ca_password }}
+  when:
+    - node_certs_generator
+    - not xpack_certs_zip.stat.exists
+    - not generate_CA
+    - ca_password | length > 0
+  tags: xpack-security
+
+- name: Verify the Elastic certificates directory
+  file:
+    path: "{{ master_certs_path }}"
+    state: directory
+    mode: '0700'
+  delegate_to: "127.0.0.1"
+  when:
+    - node_certs_generator
+
+- name: Verify the Certificates Authority directory
+  file:
+    path: "{{ master_certs_path }}/ca/"
+    state: directory
+    mode: '0700'
+  delegate_to: "127.0.0.1"
+  when:
+    - node_certs_generator
+
+- name: Copying certificates to Ansible master
+  fetch:
+    src: "{{ node_certs_source }}/certs.zip"
+    dest: "{{ master_certs_path }}/"
+    flat: yes
+    mode: 0700
+  when:
+    - node_certs_generator
+  tags: xpack-security
+
+- name: Delete certs.zip in Generator node
+  file:
+    state: absent
+    path: "{{ node_certs_source }}/certs.zip"
+  when:
+    - node_certs_generator
+
+- name: Unzip generated certs.zip
+  unarchive:
+    src: "{{ master_certs_path }}/certs.zip"
+    dest: "{{ master_certs_path }}/"
+  become: true
+  delegate_to: "127.0.0.1"
+  when:
+    - node_certs_generator
+  tags: xpack-security
+
+- name: Copying node's certificate from master
+  copy:
+    src: "{{ item }}"
+    dest: "{{ node_certs_destination }}/"
+  with_items:
+    - "{{ master_certs_path }}/{{ elasticsearch_node_name }}/{{ elasticsearch_node_name }}.key"
+    - "{{ master_certs_path }}/{{ elasticsearch_node_name }}/{{ elasticsearch_node_name }}.crt"
+    - "{{ master_certs_path }}/ca/ca.crt"
+  when:
+    - generate_CA
+  tags: xpack-security
+
+- name: Copying node's certificate from master (Custom CA)
+  copy:
+    src: "{{ item }}"
+    dest: "{{ node_certs_destination }}/"
+  with_items:
+    - "{{ master_certs_path }}/{{ elasticsearch_node_name }}/{{ elasticsearch_node_name }}.key"
+    - "{{ master_certs_path }}/{{ elasticsearch_node_name }}/{{ elasticsearch_node_name }}.crt"
+    - "{{ master_certs_path }}/ca/{{ ca_cert_name }}"
+  when:
+    - not generate_CA
+  tags: xpack-security
+
+- name: Ensuring folder permissions
+  file:
+    path: "{{ node_certs_destination }}/"
+    mode: '0774'
+    state: directory
+    recurse: yes
+  when:
+    - elasticsearch_xpack_security
+    - generate_CA
+  tags: xpack-security
+
+- name: Set elasticsearch bootstrap password
+  shell: >-
+    set -o pipefail;
+    echo {{ elasticsearch_xpack_security_password }} | {{ node_certs_source }}/bin/elasticsearch-keystore add -xf bootstrap.password
+  when:
+    - node_certs_generator

roles/elastic-stack/ansible-elasticsearch/templates/elasticsearch.yml.j2

@@ -35,11 +35,18 @@ xpack.security.transport.ssl.enabled: true
 xpack.security.transport.ssl.verification_mode: certificate 
 xpack.security.transport.ssl.key: {{node_certs_destination}}/{{ elasticsearch_node_name }}.key 
 xpack.security.transport.ssl.certificate: {{node_certs_destination}}/{{ elasticsearch_node_name }}.crt
+{% if generate_CA == true %}
 xpack.security.transport.ssl.certificate_authorities: [ "{{ node_certs_destination }}/ca.crt" ]
-
+{% elif generate_CA == false %}
+xpack.security.transport.ssl.certificate_authorities: [ "{{ node_certs_destination }}/{{ca_cert_name}}" ]
+{% endif %}
 xpack.security.http.ssl.enabled: true
 xpack.security.http.ssl.verification_mode: certificate
 xpack.security.http.ssl.key: {{node_certs_destination}}/{{ elasticsearch_node_name }}.key 
 xpack.security.http.ssl.certificate: {{node_certs_destination}}/{{ elasticsearch_node_name }}.crt 
+{% if generate_CA == true %}
 xpack.security.http.ssl.certificate_authorities: [ "{{ node_certs_destination }}/ca.crt" ]
+{% elif generate_CA == false %}
+xpack.security.http.ssl.certificate_authorities: [ "{{ node_certs_destination }}/{{ca_cert_name}}" ]
+{% endif %}
 {% endif %}

roles/elastic-stack/ansible-elasticsearch/templates/instances.yml.j2

@@ -4,10 +4,10 @@
 
 {% if node_certs_generator %}
 instances:
-{% for node in instances %}
-- name: "{{ node.name }}"
+{% for (key,value) in instances.iteritems() %}
+- name: "{{ value.name }}" 
   ip:
-   - "{{ node.ip }}"
+   - "{{ value.ip }}"
 {% endfor %}
 
 {% endif %}

roles/elastic-stack/ansible-kibana/defaults/main.yml

@@ -15,13 +15,10 @@ elasticsearch_xpack_security_user: elastic
 elasticsearch_xpack_security_password: elastic_pass
 
 node_certs_generator: false
-node_certs_generator_ip: 172.16.0.161
 node_certs_source: /usr/share/elasticsearch
 node_certs_destination: /etc/kibana/certs
 
-# Rsync
-rsync_path: /usr/bin/rsync
-rsync_user: vagrant
-rsync_extra_parameters: -avg -e 'ssh -o StrictHostKeyChecking=no' --rsync-path='sudo rsync'
-
-kibana_plugin_install_ignore_error: true
+# CA Generation
+master_certs_path: /es_certs
+generate_CA: true
+ca_cert_name: ""

roles/elastic-stack/ansible-kibana/tasks/main.yml

@@ -15,54 +15,31 @@
     - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
     - not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))
 
-- name: Check if certificate exists locally
-  stat:
-    path: "{{ node_certs_destination }}/{{ kibana_node_name }}.crt"
-  register: certificate_file_exists
-  when:
-    - kibana_xpack_security
-
-- name: Copy key & certificate files in generator node (locally)
-  synchronize:
-    src: "{{ node_certs_source }}/{{ kibana_node_name }}/"
+- name: Copying node's certificate from master
+  copy:
+    src: "{{item}}"
     dest: "{{node_certs_destination}}/"
-  delegate_to: "{{ node_certs_generator_ip }}"
-  when:
-    - node_certs_generator
-    - kibana_xpack_security
-    - not certificate_file_exists.stat.exists
+  with_items: 
+    - "{{master_certs_path}}/{{kibana_node_name}}/{{ kibana_node_name }}.key" 
+    - "{{master_certs_path}}/{{kibana_node_name}}/{{ kibana_node_name }}.crt"
+    - "{{master_certs_path}}/ca/ca.crt"
   tags: xpack-security
+  when:
+    - kibana_xpack_security
+    - generate_CA
 
-- name: Copy ca certificate file in generator node (locally)
-  synchronize:
-    src: "{{ node_certs_source }}/ca/"
+- name: Copying node's certificate from master (Custom CA)
+  copy:
+    src: "{{item}}"
     dest: "{{node_certs_destination}}/"
-  delegate_to: "{{ node_certs_generator_ip }}"
+    mode: '0664' 
+  with_items: 
+    - "{{master_certs_path}}/{{kibana_node_name}}/{{ kibana_node_name }}.key" 
+    - "{{master_certs_path}}/{{kibana_node_name}}/{{ kibana_node_name }}.crt"
+    - "{{master_certs_path}}/ca/{{ca_cert_name}}"
   when:
-    - node_certs_generator
     - kibana_xpack_security
-    - not certificate_file_exists.stat.exists
-  tags: xpack-security
-
-- name: Importing key & certificate files from generator node
-  command: >-
-    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
-    {{ node_certs_source }}/{{ kibana_node_name }}/ {{ node_certs_destination }}/
-  when:
-    - not node_certs_generator
-    - kibana_xpack_security
-    - not certificate_file_exists.stat.exists
-  tags: xpack-security
-
-- name: Importing ca certificate file from generator node
-  command: >-
-    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
-    {{ node_certs_source }}/ca/ {{ node_certs_destination }}/
-  when:
-    - not node_certs_generator
-    - kibana_xpack_security
-    - not certificate_file_exists.stat.exists
-  register: check_certs_permissions
+    - not generate_CA
   tags: xpack-security
 
 - name: Ensuring certificates folder owner
@@ -73,7 +50,6 @@
     owner: kibana
     group: kibana
   when:
-    - check_certs_permissions is defined
     - kibana_xpack_security
   tags: xpack-security
 
@@ -83,7 +59,6 @@
     mode: '0770'
     recurse: yes
   when:
-    - check_certs_permissions is defined
     - kibana_xpack_security
   notify: restart kibana
   tags: xpack-security
@@ -94,7 +69,7 @@
     dest: /etc/kibana/kibana.yml
     owner: root
     group: root
-    mode: 0664
+    mode: '0664' 
   notify: restart kibana
   tags: configure
 

roles/elastic-stack/ansible-kibana/templates/kibana.yml.j2

@@ -110,5 +110,9 @@ elasticsearch.password: "{{ elasticsearch_xpack_security_password }}"
 server.ssl.enabled: true
 server.ssl.key: "{{node_certs_destination}}/{{ kibana_node_name }}.key"
 server.ssl.certificate: "{{node_certs_destination}}/{{ kibana_node_name }}.crt"
+{% if generate_CA == true %}
 elasticsearch.ssl.certificateAuthorities: ["{{ node_certs_destination }}/ca.crt"]
+{% elif generate_CA == false %}
+elasticsearch.ssl.certificateAuthorities: ["{{ node_certs_destination }}/{{ca_cert_name}}"]
+{% endif %}
 {% endif %}

roles/wazuh/ansible-filebeat/defaults/main.yml

@@ -28,6 +28,11 @@ filebeat_ssl_certificate_file: ""
 filebeat_ssl_key_file: ""
 filebeat_ssl_insecure: "false"
 
+filebeat_module_package_name: wazuh-filebeat-0.1.tar.gz
+filebeat_module_package_path: /tmp/
+filebeat_module_destination: /usr/share/filebeat/module
+filebeat_module_folder: /usr/share/filebeat/module/wazuh
+
 # Xpack Security
 filebeat_xpack_security: false
 
@@ -35,16 +40,13 @@ elasticsearch_xpack_security_user: elastic
 elasticsearch_xpack_security_password: elastic_pass
 
 node_certs_generator : false
-node_certs_generator_ip: 172.16.0.161
 node_certs_source: /usr/share/elasticsearch
 node_certs_destination: /etc/filebeat/certs
 
-# Rsync
-rsync_path: /usr/bin/rsync
-rsync_user: vagrant
-rsync_extra_parameters: -avg -e 'ssh -o StrictHostKeyChecking=no' --rsync-path='sudo rsync'
 
-filebeat_module_package_name: wazuh-filebeat-0.1.tar.gz
-filebeat_module_package_path: /root/
-filebeat_module_destination: /usr/share/filebeat/module
-filebeat_module_folder: /usr/share/filebeat/module/wazuh
+# CA Generation
+master_certs_path: /es_certs
+generate_CA: true
+ca_cert_name: ""
+
+

roles/wazuh/ansible-filebeat/tasks/main.yml

@@ -26,65 +26,39 @@
   tags:
     - init
 
-- name: Check if certificate exists locally
-  stat:
-    path: "{{ node_certs_destination }}/{{ filebeat_node_name }}.crt"
-  register: certificate_file_exists
-  when:
-    - filebeat_xpack_security
-
-- name: Copy key & certificate files in generator node (locally)
-  synchronize:
-    src: "{{ node_certs_source }}/{{ filebeat_node_name }}/"
+- name: Copying node's certificate from master
+  copy:
+    src: "{{ item }}"
     dest: "{{ node_certs_destination }}/"
-  delegate_to: "{{ node_certs_generator_ip }}"
+  with_items:
+    - "{{ master_certs_path }}/{{ filebeat_node_name }}/{{ filebeat_node_name }}.key"
+    - "{{ master_certs_path }}/{{ filebeat_node_name }}/{{ filebeat_node_name }}.crt"
+    - "{{ master_certs_path }}/ca/ca.crt"
   when:
-    - node_certs_generator
+    - generate_CA
     - filebeat_xpack_security
-    - not certificate_file_exists.stat.exists
   tags: xpack-security
 
-- name: Copy ca certificate file in generator node (locally)
-  synchronize:
-    src: "{{ node_certs_source }}/ca/"
+- name: Copying node's certificate from master (Custom CA)
+  copy:
+    src: "{{ item }}"
     dest: "{{ node_certs_destination }}/"
-  delegate_to: "{{ node_certs_generator_ip }}"
+  with_items:
+    - "{{ master_certs_path }}/{{ filebeat_node_name }}/{{ filebeat_node_name }}.key"
+    - "{{ master_certs_path }}/{{ filebeat_node_name }}/{{ filebeat_node_name }}.crt"
+    - "{{ master_certs_path }}/ca/{{ ca_cert_name }}"
   when:
-    - node_certs_generator
+    - not generate_CA
     - filebeat_xpack_security
-    - not certificate_file_exists.stat.exists
-  register: check_certs_permissions
   tags: xpack-security
 
-- name: Importing key & certificate files from generator node
-  command: >-
-    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
-    {{ node_certs_source }}/{{ filebeat_node_name }}/ {{ node_certs_destination }}/
-  when:
-    - not node_certs_generator
-    - filebeat_xpack_security
-    - not certificate_file_exists.stat.exists
-  tags: xpack-security
-
-- name: Importing ca certificate file from generator node
-  command: >-
-    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
-    {{ node_certs_source }}/ca/ {{ node_certs_destination }}/
-  when:
-    - not node_certs_generator
-    - filebeat_xpack_security
-    - not certificate_file_exists.stat.exists
-  register: check_certs_permissions
-  tags: xpack-security
-
-- name: Ensuring certificates folder owner
+- name: Ensuring folder & certs permissions
   file:
     path: "{{ node_certs_destination }}/"
-    mode: '0770'
+    mode: '0774'
+    state: directory
     recurse: yes
-
   when:
-    - check_certs_permissions is defined
     - filebeat_xpack_security
   tags: xpack-security
 

roles/wazuh/ansible-filebeat/templates/filebeat.yml.j2

@@ -57,8 +57,14 @@ output.elasticsearch:
   username: {{ elasticsearch_xpack_security_user }}
   password: {{ elasticsearch_xpack_security_password }}
   protocol: https
+{% if generate_CA == true %}
   ssl.certificate_authorities: 
     - {{node_certs_destination}}/ca.crt
+{% elif generate_CA == false %}
+  ssl.certificate_authorities:
+    - {{node_certs_destination}}/{{ca_cert_name}}
+{% endif %}
+
   ssl.certificate: "{{node_certs_destination}}/{{ filebeat_node_name }}.crt" 
   ssl.key: "{{node_certs_destination}}/{{ filebeat_node_name }}.key"
 {% endif %}