Skip to content

Encrypt wazuh-secrets.yml once templated #1171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jul 22, 2024
Merged

Encrypt wazuh-secrets.yml once templated #1171

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
65029a2
Generate Wazuh password and encrypt the file at the end.
MaxBed4d Jul 18, 2024
0d10560
Update password generation method.
MaxBed4d Jul 19, 2024
4b84af2
Merge branch 'stackhpc/2023.1' into Hide-Wazuh-Secrets
dougszumski Jul 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions etc/kayobe/ansible/wazuh-secrets.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,13 +15,15 @@
state: directory

- name: Template new secrets
no_log: True
template:
src: wazuh-secrets.yml.j2
dest: "{{ wazuh_secrets_path }}"
notify: Please encrypt keys

handlers:
- name: Please encrypt keys
debug:
msg: >-
Please encrypt the keys using Ansible Vault.
- name: In-place encrypt wazuh-secrets
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The downside of this no longer being a handler is that it will reencrypt the content each time you run the playbook, even if there are no plain text changes.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would something like this work?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, or going back to a handler.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oops, good spot.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@MaxBed4d please could you also update the doc for the modified process: https://github.com/stackhpc/stackhpc-kayobe-config/blob/Wazuh-Docs-TLS/doc/source/configuration/wazuh.rst#the-short-version

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dougszumski Of course! On it!

copy:
content: "{{ lookup('ansible.builtin.file', wazuh_secrets_path) | ansible.builtin.vault(ansible_vault_password) }}"
dest: "{{ wazuh_secrets_path }}"
decrypt: false
vars:
ansible_vault_password: "{{ lookup('ansible.builtin.env', 'KAYOBE_VAULT_PASSWORD') }}"