Changes for proxy setup

ansible/playbooks/checkmk.yml

@@ -1,6 +1,6 @@
 ---
 - name: CheckMK Agent
-  hosts: "meta-win_project_{{ win_project }}"
+  hosts: "meta-win_project_{{ win_project }}:&meta-os_windows"
   collections:
     - checkmk.general
   vars_files:
@@ -16,7 +16,7 @@
         - checkmk_agent
 
 - name: CheckMK Hosts
-  hosts: "meta-win_project_{{ win_project }}"
+  hosts: "meta-win_project_{{ win_project }}:&meta-os_windows"
   gather_facts: false
   vars_files:
     - ../vars/checkmk.yml

ansible/playbooks/openstack-vms.yml

@@ -280,7 +280,7 @@
     - name: Create proxy
       tags: teardown
       os_server:
-        name: "{{ os_project }}-proxy"
+        name: "{{ os_project }}-{{ win_project }}-proxy"
         state: "{{ state }}"
         image: "{{ proxy_image }}"
         flavor: 3661211f-673a-4777-8857-fd243d6c407d

ansible/playbooks/wazuh.yml

@@ -1,6 +1,6 @@
 ---
 - name: Wazuh Agent
-  hosts: "meta-win_project_{{ win_project }}" # will need fixed when proxy is added (linux)
+  hosts: "meta-win_project_{{ win_project }}:&meta-os_windows"
   gather_facts: false
   vars_files:
     - ../vars/common.yml
@@ -17,12 +17,31 @@
         - wazuh_agent
       block:
         - name: Download agent
-          win_shell: 'Invoke-WebRequest -Uri "{{ wazuh_url }}/{{ wazuh_msi }}" -OutFile "$env:temp\{{ wazuh_msi }}"'
-          register: download_result
+          win_get_url:
+            url: "{{ wazuh_url }}/{{ wazuh_msi }}"
+            dest: "C:\\Users\\Administrator\\AppData\\Local\\Temp{{ wazuh_msi }}"
+          when: |
+            inventory_hostname not in groups['meta-type_client'] or
+            project_zone == 'standard'
+
+        - name: Download agent using proxy
+          vars:
+            proxy_ip: "{{ os_project }}-{{ win_project }}-proxy"
+          win_get_url:
+            url: "{{ wazuh_url }}/{{ wazuh_msi }}"
+            dest: "C:\\Users\\Administrator\\AppData\\Local\\Temp{{ wazuh_msi }}"
+          when: |
+            inventory_hostname in groups['meta-type_client'] and
+            project_zone == 'protected'
 
         - name: Install agent
-          win_shell: 'msiexec.exe /i $env:temp\{{ wazuh_msi }} /q WAZUH_MANAGER="{{ wazuh_server }}" WAZUH_REGISTRATION_SERVER="{{ wazuh_server }}"'
-          when: download_result.rc == 0
+          win_package:
+            path: "C:\\Users\\Administrator\\AppData\\Local\\Temp{{ wazuh_msi }}"
+            arguments: 
+              - /q
+              - WAZUH_MANAGER={{ wazuh_server }} 
+              - WAZUH_REGISTRATION_SERVER={{ wazuh_server }}
+            state: present
 
         - name: Start Service
           win_service:

ansible/playbooks/win_proxy.yml

@@ -0,0 +1,13 @@
+---
+
+- hosts: "meta-variant_web_proxy"
+  vars:
+    ansible_ssh_private_key_file: /etc/ansible/keys/proxy.key
+    ansible_user: ubuntu
+  vars_files:
+    - ../vars/common.yml
+  roles:
+    - role: win_proxy
+      become: yes
+      tags: win_proxy
+      when: project_zone == 'protected'

ansible/roles/win_initial/tasks/initial.yml

@@ -9,7 +9,7 @@
       set_fact:
         ansible_password: "{{ vm_initial_password }}"
       run_once: true
-      when: password_status == 'pending'or
+      when: password_status == 'pending' or
             password_status == 'change'
 
     - name: Check for finished or change password status
@@ -27,6 +27,18 @@
     start_mode: delayed
   tags: winrm_delayed
 
+- name: Set a proxy
+  vars:
+    proxy_ip: "{{ os_project }}-{{ win_project }}-proxy"
+  tags: proxy
+  win_inet_proxy:
+    proxy: "{{ hostvars[proxy_ip].ansible_host }}:3128"
+    bypass:
+    - <local>
+  when: |
+    inventory_hostname in groups['meta-type_client'] and
+    project_zone == 'protected'
+
 - name: Remove Local Admin
   tags: remove_admin
   block:

ansible/roles/win_proxy/defaults/main.yml

@@ -0,0 +1,11 @@
+---
+# defaults file for squid
+
+# The port squid is listening on.
+squid_port: 3128
+
+# The directory where (and how) to cache.
+squid_cache_dir: ufs /var/spool/squid 100 16 256
+
+# Location of squid's log file
+squid_access_log: /var/log/squid/access.log

ansible/roles/win_proxy/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+
+- name: Restart squid
+  ansible.builtin.service:
+    name: "{{ squid_service }}"
+    state: restarted

ansible/roles/win_proxy/tasks/assert.yml

@@ -0,0 +1,93 @@
+---
+
+- name: assert | Test squid_port
+  ansible.builtin.assert:
+    that:
+      - squid_port is defined
+      - squid_port is number
+      - squid_port > 0
+      - squid_port < 65536
+    quiet: true
+
+- name: assert | Test squid_cache_dir
+  ansible.builtin.assert:
+    that:
+      - squid_cache_dir is defined
+      - squid_cache_dir is string
+      - squid_cache_dir.split(" ")[0] in [ "ufs", "aufs", "diskd", "rock", "null" ]
+    quiet: true
+
+- name: assert | Test squid_acls
+  ansible.builtin.assert:
+    that:
+      - squid_acls is iterable
+    quiet: true
+  when:
+    - squid_acls is defined
+
+- name: assert | Test item in squid_acls
+  ansible.builtin.assert:
+    that:
+      - item.name is defined
+      - item.name is string
+      - item.name is not none
+      - item.classifier is defined
+      - item.classifier is string
+      - item.classifier is not none
+      - item.value is defined
+      - item.value is string
+      - item.value is not none
+    quiet: true
+  loop: "{{ squid_acls }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when:
+    - squid_acls is defined
+
+- name: assert | Test item in squid_http_access
+  ansible.builtin.assert:
+    that:
+      - item.state is defined
+      - item.state is string
+      - item.state is not none
+      - item.acls is defined
+      - item.acls is iterable
+    quiet: true
+  loop: "{{ squid_http_access }}"
+  loop_control:
+    label: "{{ item.state }}"
+  when:
+    - squid_http_access is defined
+
+- name: assert | Test squid_rules
+  ansible.builtin.assert:
+    that:
+      - squid_rules is iterable
+    quiet: true
+  when:
+    - squid_rules is defined
+
+- name: assert | Test item in squid_rules
+  ansible.builtin.assert:
+    that:
+      - item.acl is defined
+      - item.acl is string
+      - item.acl is not none
+      - item.decision is defined
+      - item.decision is string
+      - item.decision in [ "allow", "deny" ]
+    quiet: true
+  loop: "{{ squid_rules }}"
+  loop_control:
+    label: "{{ item.acl }}"
+  when:
+    - squid_rules is defined
+
+- name: assert | Test squid_logformat
+  ansible.builtin.assert:
+    that:
+      - squid_logformat is string
+      - squid_logformat.split(" ") | length > 1
+    quiet: true
+  when:
+    - squid_logformat is defined

ansible/roles/win_proxy/tasks/main.yml

@@ -0,0 +1,60 @@
+---
+
+- name: Import assert.yml
+  import_tasks:
+    file: assert.yml
+  run_once: true
+  delegate_to: localhost
+
+- name: Create group
+  ansible.builtin.group:
+    name: "{{ squid_group }}"
+    system: true
+    state: present
+
+- name: Create user
+  ansible.builtin.user:
+    name: "{{ squid_user }}"
+    group: "{{ squid_group }}"
+    create_home: false
+    state: present
+    home: /var/spool/squid
+    shell: /sbin/nologin
+    system: true
+
+- name: Install squid
+  ansible.builtin.package:
+    name: "{{ squid_packages }}"
+    state: present
+    update_cache: true
+
+- name: Include variables
+  include_vars: rules.yml
+
+- name: Configure squid
+  ansible.builtin.template:
+    src: "{{ squid_config_file }}.j2"
+    dest: "{{ squid_config_directory }}/{{ squid_config_file }}"
+    mode: "0644"
+    validate: squid -k parse -f %s
+  notify:
+    - Restart squid
+
+- name: Create cache directory
+  ansible.builtin.file:
+    path: /var/spool/squid
+    state: directory
+    owner: "{{ squid_user }}"
+    group: "{{ squid_group }}"
+    mode: "0750"
+
+- name: Flush_handlers
+  ansible.builtin.meta: flush_handlers
+
+- name: Start and enable squid
+  ansible.builtin.service:
+    name: "{{ squid_service }}"
+    state: started
+    enabled: true
+  when:
+    - not ansible_check_mode

ansible/roles/win_proxy/templates/squid.conf.j2

@@ -0,0 +1,49 @@
+{{ ansible_managed | comment }}
+
+http_port {{ squid_port }}
+
+cache_effective_user {{ squid_user }}
+cache_effective_group {{ squid_group }}
+
+{% if squid_acls is defined %}
+{% for acl in squid_acls %}
+acl {{ acl.name }} {{ acl.classifier }} {{ acl.value }}
+{% endfor %}
+{% endif %}
+
+{% if squid_rules is defined %}
+{% for rule in squid_rules %}
+http_access {{ rule.decision }} {{ rule.acl }}
+{% endfor %}
+{% endif %}
+
+{% if squid_http_access is defined %}
+{% for http_access in squid_http_access %}
+http_access {{ http_access.state }} {{ http_access.acls | join(' ') }}
+{% endfor %}
+{% endif %}
+
+cache_dir {{ squid_cache_dir }}
+
+coredump_dir /var/spool/squid
+
+refresh_pattern ^ftp:		1440	20%	10080
+refresh_pattern ^gopher:	1440	0%	1440
+refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
+refresh_pattern .		0	20%	4320
+
+{% if squid_cache_replacement_policy is defined %}
+cache_replacement_policy {{ squid_cache_replacement_policy }}
+{% endif %}
+
+{% if squid_maximum_object_size_mb is defined %}
+maximum_object_size {{ squid_maximum_object_size_mb }} MB
+{% endif %}
+
+{% if squid_logformat is defined %}
+logformat {{ squid_logformat }}
+{% endif %}
+
+{% if squid_access_log is defined %}
+access_log {{ squid_access_log }}
+{% endif %}

ansible/roles/win_proxy/vars/main.yml

@@ -0,0 +1,22 @@
+---
+
+squid_packages:
+  - squid
+
+_squid_user:
+  default: squid
+  Debian: proxy
+
+squid_user: "{{ _squid_user[ansible_os_family] | default(_squid_user['default']) }}"
+
+_squid_group:
+  default: squid
+  Debian: proxy
+
+squid_group: "{{ _squid_group[ansible_os_family] | default(_squid_group['default']) }}"
+
+squid_config_directory: /etc/squid
+
+squid_config_file: squid.conf
+
+squid_service: squid

ansible/roles/win_proxy/vars/rules.yml

@@ -0,0 +1,14 @@
+squid_acls:
+  - name: os_external
+    classifier: src
+    value: "10.24.0.0/16"
+
+squid_rules:
+  - acl: to_localhost
+    decision: deny
+  - acl: os_external
+    decision: allow
+  - acl: localhost
+    decision: allow
+  - acl: all
+    decision: deny

ansible/roles/win_transfer/tasks/unmount.yml

@@ -9,8 +9,6 @@
         opts: "credentials={{ credentials_path }},iocharset=utf8"
         state: absent
         fstype: cifs
-      register: mount_status
-      failed_when: mount_status.changed == false
 
     - name: Remove smb-credential template
       file: