151 lines
4.3 KiB
YAML
151 lines
4.3 KiB
YAML
---
|
|
- import_tasks: RedHat.yml
|
|
when: ansible_os_family == 'RedHat'
|
|
|
|
- import_tasks: Debian.yml
|
|
when: ansible_os_family == 'Debian'
|
|
|
|
- name: Reload systemd
|
|
systemd:
|
|
daemon_reload: true
|
|
ignore_errors: true
|
|
when:
|
|
- not (ansible_distribution == "Amazon" and ansible_distribution_version == "(Karoo)")
|
|
- not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<'))
|
|
- not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
|
|
- not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))
|
|
|
|
- name: Check if certificate exists locally
|
|
stat:
|
|
path: "{{ node_certs_destination }}/{{ kibana_node_name }}.crt"
|
|
register: certificate_file_exists
|
|
when:
|
|
- kibana_xpack_security
|
|
|
|
- name: Copy key & certificate files in generator node (locally)
|
|
synchronize:
|
|
src: "{{ node_certs_source }}/{{ kibana_node_name }}/"
|
|
dest: "{{ node_certs_destination }}/"
|
|
delegate_to: "{{ node_certs_generator_ip }}"
|
|
when:
|
|
- node_certs_generator
|
|
- kibana_xpack_security
|
|
- not certificate_file_exists.stat.exists
|
|
tags: xpack-security
|
|
|
|
- name: Copy ca certificate file in generator node (locally)
|
|
synchronize:
|
|
src: "{{ node_certs_source }}/ca/"
|
|
dest: "{{ node_certs_destination }}/"
|
|
delegate_to: "{{ node_certs_generator_ip }}"
|
|
when:
|
|
- node_certs_generator
|
|
- kibana_xpack_security
|
|
- not certificate_file_exists.stat.exists
|
|
tags: xpack-security
|
|
|
|
- name: Importing key & certificate files from generator node
|
|
command: >-
|
|
{{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
|
|
{{ node_certs_source }}/{{ kibana_node_name }}/ {{ node_certs_destination }}/
|
|
when:
|
|
- not node_certs_generator
|
|
- kibana_xpack_security
|
|
- not certificate_file_exists.stat.exists
|
|
tags: xpack-security
|
|
|
|
- name: Importing ca certificate file from generator node
|
|
command: >-
|
|
{{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
|
|
{{ node_certs_source }}/ca/ {{ node_certs_destination }}/
|
|
when:
|
|
- not node_certs_generator
|
|
- kibana_xpack_security
|
|
- not certificate_file_exists.stat.exists
|
|
register: check_certs_permissions
|
|
tags: xpack-security
|
|
|
|
- name: Ensuring certificates folder owner
|
|
file:
|
|
path: "{{ node_certs_destination }}/"
|
|
state: directory
|
|
recurse: yes
|
|
owner: kibana
|
|
group: kibana
|
|
when:
|
|
- check_certs_permissions is defined
|
|
- kibana_xpack_security
|
|
tags: xpack-security
|
|
|
|
- name: Ensuring certificates folder owner
|
|
file:
|
|
path: "{{ node_certs_destination }}/"
|
|
mode: '0770'
|
|
recurse: yes
|
|
when:
|
|
- check_certs_permissions is defined
|
|
- kibana_xpack_security
|
|
notify: restart kibana
|
|
tags: xpack-security
|
|
|
|
- name: Kibana configuration
|
|
template:
|
|
src: kibana.yml.j2
|
|
dest: /etc/kibana/kibana.yml
|
|
owner: root
|
|
group: root
|
|
mode: 0664
|
|
notify: restart kibana
|
|
tags: configure
|
|
|
|
- name: Checking Wazuh-APP version
|
|
shell: |
|
|
set -o pipefail
|
|
grep -c -E 'version.*{{ elastic_stack_version }}' /usr/share/kibana/plugins/wazuh/package.json | xargs echo
|
|
args:
|
|
executable: /bin/bash
|
|
removes: /usr/share/kibana/plugins/wazuh/package.json
|
|
register: wazuh_app_verify
|
|
changed_when: false
|
|
tags: install
|
|
|
|
- name: Removing old Wazuh-APP
|
|
command: /usr/share/kibana/bin/kibana-plugin remove wazuh
|
|
when: wazuh_app_verify.stdout == "0"
|
|
tags: install
|
|
|
|
- name: Removing bundles
|
|
file: path=/usr/share/kibana/optimize/bundles state=absent
|
|
when: wazuh_app_verify.stdout == "0"
|
|
tags: install
|
|
|
|
- name: Install Wazuh-APP (can take a while)
|
|
shell: "/usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-{{ wazuh_version }}_{{ elastic_stack_version }}.zip"
|
|
environment:
|
|
NODE_OPTIONS: "--max-old-space-size=3072"
|
|
args:
|
|
executable: /bin/bash
|
|
creates: /usr/share/kibana/plugins/wazuh/package.json
|
|
become: yes
|
|
become_user: kibana
|
|
notify: restart kibana
|
|
tags:
|
|
- install
|
|
- skip_ansible_lint
|
|
|
|
- name: Reload systemd configuration
|
|
systemd:
|
|
daemon_reload: true
|
|
|
|
- name: Ensure Kibana is started and enabled
|
|
service:
|
|
name: kibana
|
|
enabled: true
|
|
state: started
|
|
|
|
- import_tasks: RMRedHat.yml
|
|
when: ansible_os_family == 'RedHat'
|
|
|
|
- import_tasks: RMDebian.yml
|
|
when: ansible_os_family == 'Debian'
|