The manager and indexer nofile limits now live next to their other resource settings in services.yml and the compose template reads them from there, as requested in review. The values are unchanged.
The indexer entrypoint is now only our CA-import block followed by exec of the image's own /entrypoint.sh, mounted at /infinito-entrypoint.sh with an explicit command. The certs entrypoint is our own script: it downloads the cert tool only from packages.wazuh.com and fails if that download fails, so there is no silent fallback to the dev bucket. The manager node name is passed in as WAZUH_MANAGER_NODE for both compose and swarm.
Tor: use the shared tor block (bond 0.5, enabled when svc-net-tor is in the node's groups, tor pinned on in both variants) so a node serves one network, onion on a Tor node and clearnet otherwise.
SPOT and sizing: WAZUH_INDEXER_URL replaces four hand-built copies of the indexer URL, and the indexer heap is half of mem_limit instead of a hardcoded 1g (unchanged for the current 2g limit).
Fixes: bcrypt_hash rejects secrets over 72 bytes; the Keycloak group-removal helper uses the same resolver as the add helper and checks every response (the realm is no longer URL-encoded, matching the add helper), and a failed cleanup fails an otherwise passing test; the swarm certs generator removes a stale container before each attempt; vm.max_map_count is set before the early handler flush; securityadmin failed_when now needs rc 0 and the success marker.
The regenerated role README also picks up generator drift (mailu to stalwart).
web-app-stalwart, merged on main, claims local.http 8095 (stalwart) and 8094 (webmail), the same ports the Wazuh indexer and dashboard held. Both new ports come from cli.contributing.network.ports.suggest against the rebased tree.
Per Kevin's review: replaced hardcoded usernames (wazuh-wui, kibanaserver,
admin) across wazuh.yml.j2, compose.yml.j2, internal_users.yml.j2,
roles_mapping.yml.j2, config.yml.j2 and 00_core.yml with
lookup('users', ...) references, following the same pattern already
used by web-svc-coturn and web-app-semaphore. New meta/users.yml
declares web-app-wazuh-dashboard (kibanaserver) and web-app-wazuh-api
(wazuh-wui) as service accounts, and references the existing shared
admin key as a dependency (admin: {}), matching the same pattern used
by openbao, pgadmin, checkmk, semaphore and openldap.
Per CodeRabbit's security finding (CWE-269): scoped readonly_auditor's
index_patterns from '*' to 'wazuh-*', matching the role's own stated
'all Wazuh indices' description. The wildcard previously granted read
access to every index on the cluster, including other users' saved
objects and plugin state, beyond what the role needs or describes.
Wazuh is a SIEM console and should never be served as an onion
service. Following web-app-peertube's established pattern for a
clearnet-only role:
- meta/services.yml: tor block set to enabled: false / shared: false,
with # nocheck: sso-variant-tor documenting why (the SIEM console is
never served over onion); bond and variants-coverage nocheck removed
since they no longer apply.
- meta/variants.yml: removed both tor: enabled: true entries.
- README.md and the root README index regenerated via make docs to
match (tor dependency removed from the diagram and index row).
Wazuh carries no network-specific code any more: the onion front-proxy include, WAZUH_DASHBOARD_ONION_DOMAIN, the forked templates/proxy.conf.j2 vhost and the tor exclusive/primary overrides are gone. The role follows the Tor provider default like every other role with a Tor bond; serving one role on several networks returns generically in the multi-network change.
Without the forked vhost nothing forwards X-Forwarded-Host, so the dashboard OIDC redirect base is the static canonical url.base instead of trust_dynamic_headers.
Also: the dashboard port is read from one variable, the Playwright specs share wazuhLoginViaOidc and withBiberInGroup and assert worker-src blob:, PR-added explanatory comments are removed, and the root README lists the role.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
roles/web-app-openbao (merged into main since our last sync) also
claims 8093 for its local.http port. Moved Wazuh's indexer to 8095,
confirmed free via the port-suggestion tool and a repo-wide check for
existing users. Nothing else in the role hardcodes the port number -
everything reads it from vars/main.yml's WAZUH_INDEXER_HTTP_PORT.
Seven real, branch-caused failures surfaced after rebasing onto main
(v14.0.0, ~900 commits):
- opensearch_dashboards_yml volume: type: config -> type: secret
(renders a live OIDC client secret; was world-readable at 0444 in a
volume type the platform treats as non-sensitive, same fix pattern
as web-app-gitlab's rails_secrets_yml)
- meta/networks.yml: local.subnet collided with web-app-litellm
- meta/services.yml: indexer/console ports collided with
svc-ai-litellm and web-app-openclaw (both added during the gap)
- compose.yml.j2: healthcheck interval/timeout/start_period now go
through the SPOT lookup instead of hardcoded values
- README.md: regenerated Quick Setup section, fixed credits link
formatting
- docs/requirements/035-mcp-proxy-expansion.md: added web-app-wazuh
to the adapter_candidate list (has a real, currently-unpublished
API surface - manager :55000, indexer :9200 - not yet evaluated
for an MCP adapter, same bucket web-app-checkmk/prometheus sat in
before promotion)
Two regressions caught by re-verification and fixed in the same pass:
meta/services.yml briefly reached into a role var directly (fixed to
use the lookup('config', ...) pattern already used elsewhere), and the
credits-link fix dropped required bold markdown.
Remaining test failures after this fix are confirmed pre-existing and
unrelated: svc-net-tor's nftables guard rule (kernel EOPNOTSUPP), an
INFINITO_SWARM_STEP_TIMEOUT_MINUTES Makefile/default.env drift, and a
CI chunk-budget drift.
meta/volumes.yml's config-mount source: for certs-entrypoint.sh and
indexer-entrypoint.sh resolved via abs_role_path_by_application_id - a
controller-local checkout path. docker stack deploy runs delegate_to:
STACK_HOST (roles/sys-svc-compose/handlers/swarm.yml), so under swarm
mode that path doesn't exist on the remote host, and docker stack
deploy failed with 'no such file or directory' once the earlier
healthcheck himBHsescaping fix let it get that far.
Mirrors the existing 'Copy static Wazuh indexer roles.yml' pattern
already in this file: a new copy task ships both static, non-templated
scripts to WAZUH_INSTANCE_DIR on the actual deploy target, gated on
IS_STACK_HOST, before docker stack deploy/config ever runs. volumes.yml
now points source: at that instance-dir path instead.
Verified on a live swarm cluster (make swarm-zombie app=web-app-wazuh):
the copy task ran and succeeded, and the full stack came up healthy
(manager, indexer, dashboard all Up; certs_generator exited 0 as
expected for a one-shot init container; front proxy served a real
301 redirect through OpenResty).
Add single-node Wazuh stack (manager, indexer, dashboard) as a new
Ansible role, integrated with the platform's Keycloak realm via native
OIDC and secondary LDAP authorization, with three-tier RBAC.
- Pins wazuh/wazuh-{manager,indexer,dashboard}:4.14.6 and
wazuh-certs-generator:0.0.4 (one-shot cert bootstrap job)
- No external database: wazuh.indexer (OpenSearch) is self-contained
- Auth: native OIDC against Keycloak, working end-to-end after two
infra fixes (JVM cacerts trust for the indexer's outbound calls to
Keycloak, front-proxy vhost wiring)
- LDAP wired as a secondary, authentication-independent authorization
backend (group-based backend_roles enrichment only)
- RBAC: three roles (administrator, security-analyst, readonly-auditor)
via the platform's standard meta/rbac.yml + rbac_group_path pipeline
- Documents a genuine upstream Wazuh bug: wz-home as the default
landing route throws an uncaught client exception for any
non-all_access role; default route moved to OpenSearch Dashboards'
own /app/home
Addressed two full rounds of review feedback (Kevin, Alejandro):
WEB_PROTOCOL usage, service-account naming, comment cleanup, shared
Keycloak-admin-helper extraction, a real TOCTOU race in RBAC test
setup, a Mermaid auth-flow diagram, meta/services.yml placement for
the certs-generator, CA-trust-path SPOT usage, CSP tightening
(including a genuine worker-src: blob: requirement found via live
testing), and a loud (non-silent) dev-bucket fallback warning.
Rebased onto main after a 3-month gap; brought the role in line with
~30 platform-convention changes introduced in that window (swarm
compose-template rules, Tor/onion contract, Playwright timeout/goto
wrappers, file layout, task numbering, comment policy, and more).
Live-deploy verification (9 iterations) found and fixed 6 further
real bugs invisible to lint/unit tests alone:
- credentials.* / meta/schema.yml -> secrets.credentials.* /
meta/secrets.yml (another platform-drift casualty)
- notify: "compose up" -> "compose-up" (day-one handler-name typo)
- local.subnet collision with web-app-mailu's /24
- missing primary: false alongside tor.exclusive: false, which let
the onion domain shadow the clearnet vhost entirely
- a second front-proxy include for the onion domain, later reverted
(see below)
- shared sys-stk-front-proxy/sys-front-tls TLS-lookup keying bug
(app-id-keyed vs. domain-keyed), which silently applied TLS to
Wazuh's onion vhost
The last two are related: enabling genuine dual-stack (clearnet +
onion) reachability for tor.exclusive: false surfaced a real bug in
two shared platform roles. That fix was verified safe against all 103
apps currently in the repo, but is deliberately NOT included here -
shared-role changes deserve their own PR and review, not to ride in
on a single app's feature branch. Wazuh's second front-proxy include
was reverted accordingly; the resulting onion-reachability gap is
documented in the README as a known, platform-scoped limitation.
make test: 5508 passed, 3 failed (all three trace to untracked local
scratch files - Dockerfile.bak, scripts/lab-*.sh - not present in any
CI checkout).
infinito-nexus-updater[bot]
kevinveenbirkenbach
Prageeth Panicker
