feat: deploy Wazuh SIEM for security monitoring

deployments/backups/longhorn-recurring-jobs.yaml

@@ -1,25 +0,0 @@
-apiVersion: longhorn.io/v1beta2
-kind: RecurringJob
-metadata:
-  name: daily-snapshot
-  namespace: longhorn-system
-spec:
-  cron: "0 1 * * *"
-  task: snapshot
-  retain: 7
-  concurrency: 2
-  labels:
-    backup-tier: daily
----
-apiVersion: longhorn.io/v1beta2
-kind: RecurringJob
-metadata:
-  name: weekly-backup
-  namespace: longhorn-system
-spec:
-  cron: "0 3 * * 0"
-  task: backup
-  retain: 4
-  concurrency: 1
-  labels:
-    backup-tier: weekly

deployments/backups/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: backups
-  labels:
-    app.kubernetes.io/managed-by: argocd

deployments/backups/pelican-pg-backup-cronjob.yaml

@@ -1,59 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: pelican-pg-backup
-  namespace: backups
-spec:
-  schedule: "0 2 * * *"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      template:
-        spec:
-          restartPolicy: OnFailure
-          containers:
-            - name: pg-dump
-              image: postgres:16-alpine
-              env:
-                - name: PGPASSWORD
-                  valueFrom:
-                    secretKeyRef:
-                      name: pelican-pg-backup-credentials
-                      key: password
-                - name: PGHOST
-                  value: postgresql.pelican.svc.cluster.local
-                - name: PGUSER
-                  valueFrom:
-                    secretKeyRef:
-                      name: pelican-pg-backup-credentials
-                      key: username
-                - name: PGDATABASE
-                  value: panel
-              command:
-                - /bin/sh
-                - -c
-                - |
-                  set -e
-                  BACKUP_DIR=/backups/pelican
-                  mkdir -p "$BACKUP_DIR"
-                  FILENAME="$BACKUP_DIR/pelican-$(date +%Y%m%d-%H%M%S).sql.gz"
-                  pg_dump -h "$PGHOST" -U "$PGUSER" -d "$PGDATABASE" | gzip > "$FILENAME"
-                  echo "Backup written: $FILENAME"
-                  find "$BACKUP_DIR" -name '*.sql.gz' -mtime +7 -delete
-                  echo "Retention cleanup done (keeping 7 days)"
-              resources:
-                requests:
-                  cpu: 100m
-                  memory: 128Mi
-                limits:
-                  cpu: 500m
-                  memory: 512Mi
-              volumeMounts:
-                - name: backup-storage
-                  mountPath: /backups
-          volumes:
-            - name: backup-storage
-              persistentVolumeClaim:
-                claimName: backup-storage

deployments/backups/pelican-pg-externalsecret.yaml

@@ -1,22 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: pelican-pg-backup-credentials
-  namespace: backups
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: vault-backend
-    kind: ClusterSecretStore
-  target:
-    name: pelican-pg-backup-credentials
-    creationPolicy: Owner
-  data:
-    - secretKey: username
-      remoteRef:
-        key: Talos Cluster/pelican/panel/db
-        property: DB_USER
-    - secretKey: password
-      remoteRef:
-        key: Talos Cluster/pelican/panel/db
-        property: DB_PASSWORD

deployments/backups/pvc.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: backup-storage
-  namespace: backups
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 50Gi

deployments/security-monitoring/wazuh-app.yaml

@@ -0,0 +1,74 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: wazuh
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://wazuh.github.io/wazuh-certified-helm-charts
+    chart: wazuh
+    targetRevision: 0.3.0
+    helm:
+      releaseName: wazuh
+      values: |
+        ## Global settings
+        global:
+          email: "admin@khalisio.com"
+          secretKey: "wazuh-secret-key-change-me"
+          basicAuthentication: true
+          basicAuthenticationPassword: "wazuh"
+          basicAuthenticationToken: ""
+          workerReplicas: 0
+
+        ## Wazuh Manager
+        wazuh.manager:
+          replicas: 1
+          persistence:
+            enabled: true
+            storageClass: longhorn
+            size: 10Gi
+
+        ## Wazuh Dashboard (Kibana with Wazuh plugin)
+        wazuh.dashboard:
+          replicas: 1
+          ingress:
+            enabled: true
+            host: wazuh.khalisio.com
+            annotations:
+              traefik.ingress.kubernetes.io/router.entrypoints: websecure
+              traefik.ingress.kubernetes.io/router.tls: "true"
+              traefik.ingress.kubernetes.io/middlewares: "crowdsec,khalis-authentik"
+            tls: true
+
+        ## Filebeat
+        wazuh.filebeat:
+          replicas: 1
+
+        ## Elasticsearch (Wazuh Certified)
+        wazuh.certified:
+          replicas: 1
+          persistence:
+            enabled: true
+            storageClass: longhorn
+            size: 10Gi
+          resources:
+            requests:
+              cpu: "500m"
+              memory: "1Gi"
+            limits:
+              cpu: "2"
+              memory: "4Gi"
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: wazuh
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true