feat: deploy Wazuh SIEM for security monitoring

deployments/media/transmission/deployment.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: transmission
-  namespace: media
+  namespace: apps
   labels:
     app: transmission
 spec:
@@ -10,6 +10,8 @@ spec:
   selector:
     matchLabels:
       app: transmission
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:
@@ -17,40 +19,49 @@ spec:
     spec:
       containers:
         - name: transmission
-          image: linuxserver/transmission:latest
+          image: lscr.io/linuxserver/transmission:latest
+          ports:
+            - name: web
+              containerPort: 9091
+              protocol: TCP
+            - name: peer
+              containerPort: 51413
+              protocol: TCP
+            - name: peer-udp
+              containerPort: 51413
+              protocol: UDP
           env:
             - name: PUID
               value: "1000"
             - name: PGID
               value: "1000"
             - name: TZ
-              value: "UTC"
-          ports:
-            - name: http
-              containerPort: 9091
-              protocol: TCP
-            - name: peer-tcp
-              containerPort: 51413
-              protocol: TCP
-            - name: peer-udp
-              containerPort: 51413
-              protocol: UDP
+              value: "Etc/UTC"
+            - name: TRANSMISSION_WEB_HOME
+              value: "/web/":"
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: data
+              mountPath: /data
+        - name: gluetun
+          image: qmcgaw/gluetun:latest
+          env:
+            - name: VPN_SERVICE_PROVIDER
+              value: "protonvpn"
+            - name: VPN_TYPE
+              value: "wireguard"
+          ports:
+            - name: https
+              containerPort: 443
+              protocol: TCP
           volumeMounts:
             - name: config
               mountPath: /config
-            - name: downloads
-              mountPath: /downloads
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: 1000m
-              memory: 1Gi
       volumes:
         - name: config
           persistentVolumeClaim:
-            claimName: transmission-config
-        - name: downloads
+            claimName: transmission-config-claim
+        - name: data
           persistentVolumeClaim:
-            claimName: media-data
+            claimName: transmission-data-claim

deployments/media/transmission/pvc.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: transmission-config
-  namespace: media
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 2Gi

deployments/security-monitoring/wazuh-app.yaml

@@ -0,0 +1,74 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: wazuh
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://wazuh.github.io/wazuh-certified-helm-charts
+    chart: wazuh
+    targetRevision: 0.3.0
+    helm:
+      releaseName: wazuh
+      values: |
+        ## Global settings
+        global:
+          email: "admin@khalisio.com"
+          secretKey: "wazuh-secret-key-change-me"
+          basicAuthentication: true
+          basicAuthenticationPassword: "wazuh"
+          basicAuthenticationToken: ""
+          workerReplicas: 0
+
+        ## Wazuh Manager
+        wazuh.manager:
+          replicas: 1
+          persistence:
+            enabled: true
+            storageClass: longhorn
+            size: 10Gi
+
+        ## Wazuh Dashboard (Kibana with Wazuh plugin)
+        wazuh.dashboard:
+          replicas: 1
+          ingress:
+            enabled: true
+            host: wazuh.khalisio.com
+            annotations:
+              traefik.ingress.kubernetes.io/router.entrypoints: websecure
+              traefik.ingress.kubernetes.io/router.tls: "true"
+              traefik.ingress.kubernetes.io/middlewares: "crowdsec,khalis-authentik"
+            tls: true
+
+        ## Filebeat
+        wazuh.filebeat:
+          replicas: 1
+
+        ## Elasticsearch (Wazuh Certified)
+        wazuh.certified:
+          replicas: 1
+          persistence:
+            enabled: true
+            storageClass: longhorn
+            size: 10Gi
+          resources:
+            requests:
+              cpu: "500m"
+              memory: "1Gi"
+            limits:
+              cpu: "2"
+              memory: "4Gi"
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: wazuh
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true