GitHub actions remake

.github/playbooks/aio-wazuh.yml

@@ -0,0 +1,72 @@
+- name: Generate certificates prior to converging
+  hosts: localhost
+  become: true
+  become_user: root
+  roles:
+    - role: ../../roles/wazuh/wazuh-indexer
+      vars:
+        generate_certs: true
+        perform_installation: false
+        instances:
+          node1:
+            name: wazuh-es01       # Important: must be equal to indexer_node_name.
+            ip: "127.0.0.1"   # When unzipping, the node will search for its node name folder to get the cert.
+            role: indexer
+          node3:
+            name: wazuh-mgr01
+            ip: "127.0.0.1"
+            role: wazuh
+          node5:
+            name: wazuh-dash01
+            ip: "127.0.0.1"
+            role: dashboard
+  pre_tasks:
+    - name: overview of cert configuration
+      debug:
+        var: wazuh_endpoint_list
+
+- name: Converge
+  hosts: localhost
+  become: true
+  become_user: root
+  roles:
+    # 1. Check packages
+    - role: ../../roles/wazuh/check-packages
+      become: no
+      delegate_to: localhost
+      run_once: true
+    # 2. Wazuh indexer
+    - role: ../../roles/wazuh/wazuh-indexer
+      vars:
+        indexer_node_name: "wazuh-es01"
+        single_node: true
+    # 3. Managers
+    - role: ../../roles/wazuh/ansible-wazuh-manager
+    - role: ../../roles/wazuh/ansible-filebeat-oss
+      vars:
+        filebeat_node_name: "wazuh-mgr01"
+        filebeat_output_indexer_hosts:
+        - "localhost:9200"
+    # 4. Wazuh dashboard
+    - role: ../../roles/wazuh/wazuh-dashboard
+      vars:
+        dashboard_node_name: "wazuh-dash01"
+    # 5. Agents:
+#    - role: ../../roles/wazuh/ansible-wazuh-agent
+#      vars:
+#        wazuh_managers: '{{ wazuh_managers_list }}'
+#      when: inventory_hostname in groups['agents']
+  vars:
+    instances:
+      node1:
+        name: wazuh-es01       # Important: must be equal to indexer_node_name.
+        ip: "127.0.0.1"  # When unzipping, the node will search for its node name folder to get the cert.
+        role: indexer
+      node3:
+        name: wazuh-mgr01
+        ip: "127.0.0.1"
+        role: wazuh
+      node5:
+        name: wazuh-dash01
+        ip: "127.0.0.1"
+        role: dashboard

.github/playbooks/single-wazuh.yml

@@ -0,0 +1,38 @@
+---
+- name: ConvergeCerts
+  hosts: localhost
+  roles:
+    - role: ../../roles/wazuh/wazuh-indexer
+      perform_installation: false
+  vars:
+    instances:
+      node1:
+        name: node-1       # Important: must be equal to indexer_node_name.
+        ip: 127.0.0.1
+        role: indexer
+  tags:
+        - generate-certs
+- name: ConvergeInstall
+  hosts: localhost
+  roles:
+    # 1. Check packages
+    - role: ../../roles/wazuh/check-packages
+      become: no
+      delegate_to: localhost
+      run_once: true
+    # 2. Managers
+    - role: ../../roles/wazuh/ansible-wazuh-manager
+      vars:
+    - role: ../../roles/wazuh/ansible-filebeat-oss
+      vars:
+      - filebeat_output_indexer_hosts:
+        - "indexer_centos7:9200"
+  pre_tasks:
+    - name: (converge) fix missing packages in cloud images
+      apt:
+        name:
+          - unzip
+          - gpg-agent
+        state: present
+        update_cache: yes
+      when: ansible_distribution == "Ubuntu"

.github/workflows/al_aio.yml

@@ -0,0 +1,67 @@
+---
+name: AIO-AL-Single-Instance
+on: [pull_request, workflow_dispatch, release]
+jobs:
+  start-runner:
+    name: Start self-hosted EC2 runner
+    runs-on: ubuntu-latest
+    outputs:
+      label: ${{ steps.start-ec2-runner.outputs.label }}
+      ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id }}
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+      - name: Start EC2 runner
+        id: start-ec2-runner
+        uses: machulav/ec2-github-runner@v2
+        with:
+          mode: start
+          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+          ec2-image-id: ${{ secrets.AL2_AMI_ID }}
+          ec2-instance-type: t3a.large
+          subnet-id: ${{ secrets.SUBNET_ID }}
+          security-group-id: ${{ secrets.SG_ID }}
+          aws-resource-tags: > # optional, requires additional permissions
+            [
+              {"Key": "Name", "Value": "wazuh-ansible-gh-runner-aio"},
+              {"Key": "GitHubRepository", "Value": "${{ github.repository }}"},
+              {"Key": "team", "Value": "CICD"},
+              {"Key": "termination_Date", "Value": "N/A"}
+            ]
+  install-aio-single-instance:
+    name: Installs AIO single instance
+    needs: start-runner # required to start the main job when the runner is ready
+    runs-on: ${{ needs.start-runner.outputs.label }} # run the job on the newly created runner
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v2
+      - name: Ansible Playbook run Wazuh AIO Single instance
+        run: ansible-playbook ./.github/playbooks/aio-wazuh.yml
+        env:
+          PY_COLORS: '1'
+          ANSIBLE_FORCE_COLOR: '1'
+  stop-runner:
+    name: Stop self-hosted EC2 runner
+    needs:
+      - start-runner # required to get output from the start-runner job
+      - install-aio-single-instance # required to wait when the main job is done
+    runs-on: ubuntu-latest
+    if: ${{ always() }} # required to stop the runner even if the error happened in the previous jobs
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+      - name: Stop EC2 runner
+        uses: machulav/ec2-github-runner@v2
+        with:
+          mode: stop
+          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+          label: ${{ needs.start-runner.outputs.label }}
+          ec2-instance-id: ${{ needs.start-runner.outputs.ec2-instance-id }}

.github/workflows/al_wazuh.yml

@@ -0,0 +1,67 @@
+---
+name: Wazuh-AL-Single-Instance
+on: [pull_request, workflow_dispatch, release]
+jobs:
+  start-runner:
+    name: Start self-hosted EC2 runner
+    runs-on: ubuntu-latest
+    outputs:
+      label: ${{ steps.start-ec2-runner.outputs.label }}
+      ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id }}
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+      - name: Start EC2 runner
+        id: start-ec2-runner
+        uses: machulav/ec2-github-runner@v2
+        with:
+          mode: start
+          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+          ec2-image-id: ${{ secrets.AL2_AMI_ID }}
+          ec2-instance-type: t3.small
+          subnet-id: ${{ secrets.SUBNET_ID }}
+          security-group-id: ${{ secrets.SG_ID }}
+          aws-resource-tags: > # optional, requires additional permissions
+            [
+              {"Key": "Name", "Value": "wazuh-ansible-gh-runner-wazuh"},
+              {"Key": "GitHubRepository", "Value": "${{ github.repository }}"},
+              {"Key": "team", "Value": "CICD"},
+              {"Key": "termination_Date", "Value": "N/A"}
+            ]
+  install-wazuh-single-instance:
+    name: Installs Wazuh server single instance
+    needs: start-runner # required to start the main job when the runner is ready
+    runs-on: ${{ needs.start-runner.outputs.label }} # run the job on the newly created runner
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v2
+      - name: Ansible Playbook run Wazuh Single instance
+        run: ansible-playbook ./.github/playbooks/single-wazuh.yml
+        env:
+          PY_COLORS: '1'
+          ANSIBLE_FORCE_COLOR: '1'
+  stop-runner:
+    name: Stop self-hosted EC2 runner
+    needs:
+      - start-runner # required to get output from the start-runner job
+      - install-wazuh-single-instance # required to wait when the main job is done
+    runs-on: ubuntu-latest
+    if: ${{ always() }} # required to stop the runner even if the error happened in the previous jobs
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+      - name: Stop EC2 runner
+        uses: machulav/ec2-github-runner@v2
+        with:
+          mode: stop
+          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+          label: ${{ needs.start-runner.outputs.label }}
+          ec2-instance-id: ${{ needs.start-runner.outputs.ec2-instance-id }}

.github/workflows/centos_aio.yml

@@ -0,0 +1,76 @@
+---
+name: AIO-CentOS-Single-Instance
+on: [pull_request, workflow_dispatch, release]
+jobs:
+  start-runner:
+    name: Start self-hosted EC2 runner
+    runs-on: ubuntu-latest
+    outputs:
+      label: ${{ steps.start-ec2-runner.outputs.label }}
+      ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id }}
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+      - name: Start EC2 runner
+        id: start-ec2-runner
+        uses: machulav/ec2-github-runner@v2
+        with:
+          mode: start
+          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+          ec2-image-id: ${{ secrets.CENTOS8_AMI_ID }}
+          ec2-instance-type: t3a.large
+          subnet-id: ${{ secrets.SUBNET_ID }}
+          security-group-id: ${{ secrets.SG_ID }}
+          aws-resource-tags: > # optional, requires additional permissions
+            [
+              {"Key": "Name", "Value": "wazuh-ansible-gh-runner-aio"},
+              {"Key": "GitHubRepository", "Value": "${{ github.repository }}"},
+              {"Key": "team", "Value": "CICD"},
+              {"Key": "termination_Date", "Value": "N/A"}
+            ]
+  install-aio-single-instance:
+    name: Installs AIO single instance
+    needs: start-runner # required to start the main job when the runner is ready
+    runs-on: ${{ needs.start-runner.outputs.label }} # run the job on the newly created runner
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v2
+      - name: Hack to get setup-python to work on act. See act issue 251
+        run: |
+          if [ ! -f "/etc/lsb-release" ] ; then
+            echo "DISTRIB_RELEASE=18.04" > /etc/lsb-release
+          fi
+      - name: Set up Python 3.
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.x'
+      - name: Ansible Playbook run Wazuh AIO Single instance
+        run: ansible-playbook ./.github/playbooks/aio-wazuh.yml
+        env:
+          PY_COLORS: '1'
+          ANSIBLE_FORCE_COLOR: '1'
+  stop-runner:
+    name: Stop self-hosted EC2 runner
+    needs:
+      - start-runner # required to get output from the start-runner job
+      - install-aio-single-instance # required to wait when the main job is done
+    runs-on: ubuntu-latest
+    if: ${{ always() }} # required to stop the runner even if the error happened in the previous jobs
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+      - name: Stop EC2 runner
+        uses: machulav/ec2-github-runner@v2
+        with:
+          mode: stop
+          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+          label: ${{ needs.start-runner.outputs.label }}
+          ec2-instance-id: ${{ needs.start-runner.outputs.ec2-instance-id }}