Skip to content

Commit f92cd7e

Browse files
mfetimfeti
committed
feat: Add Ansible deployment automation
- Complete Ansible playbook for DFIR-IRIS deployment - Multi-role setup (common, docker, iris-app) - SSL certificate generation - Secrets management with Ansible Vault - Example configuration files only (no real credentials) - Comprehensive documentation and README
1 parent a4bfeda commit f92cd7e

File tree

38 files changed

+1626
-0
lines changed

38 files changed

+1626
-0
lines changed

‎.gitignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,9 @@ source/app/static/assets/img/graph/*
3030
run_nv_test.py
3131
!certificates/web_certificates/iris_dev_*
3232
certificates/web_certificates/*.pem
33+
34+
# Ansible sensitive files
35+
deploy/ansible/vars/secrets.yml
36+
deploy/ansible/ansible.log
37+
*.retry
38+
*.vault

‎deploy/ansible/README.md‎

Lines changed: 297 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,297 @@
1+
# DFIR-IRIS Ansible Deployment
2+
3+
Automated deployment of DFIR-IRIS using Ansible for traditional infrastructure management.
4+
5+
## 🚀 Quick Start
6+
7+
Deploy DFIR-IRIS to your infrastructure with a single command:
8+
9+
```bash
10+
ansible-playbook deploy/ansible/playbooks/site.yml --ask-vault-pass
11+
```
12+
13+
## 📋 Prerequisites
14+
15+
### Control Node (Your Machine)
16+
- Ansible Core 2.9+
17+
- Python 3.6+ with pip
18+
- SSH key access to target servers
19+
20+
### Target Servers
21+
- **OS**: Ubuntu 18.04+, CentOS 7+, or RHEL 7+
22+
- **Resources**: 4GB+ RAM, 2+ CPU cores, 20GB+ disk
23+
- **Access**: SSH access with sudo privileges
24+
- **Network**: Open ports 80, 443, 5432
25+
26+
## 🏗️ Architecture
27+
28+
This Ansible deployment:
29+
- Installs Docker and Docker Compose
30+
- Clones the DFIR-IRIS repository
31+
- Configures environment variables
32+
- Launches DFIR-IRIS containers
33+
- Sets up SSL certificates
34+
- Configures system services
35+
36+
## ⚙️ Configuration
37+
38+
### 1. Inventory Setup
39+
40+
Edit `inventory/hosts.yml`:
41+
42+
```yaml
43+
all:
44+
children:
45+
iris_servers:
46+
hosts:
47+
iris-prod:
48+
ansible_host: 192.168.1.100
49+
ansible_user: ubuntu
50+
ansible_ssh_private_key_file: ~/.ssh/id_rsa
51+
```
52+
53+
### 2. Variables Configuration
54+
55+
**Global settings** (`inventory/group_vars/all.yml`):
56+
```yaml
57+
iris_base_path: /opt/iris
58+
iris_https_port: 443
59+
docker_compose_version: "2.20.0"
60+
project_version: "v2.4.12"
61+
```
62+
63+
**IRIS-specific** (`inventory/group_vars/iris_servers.yml`):
64+
```yaml
65+
iris_server_name: iris.example.com
66+
postgres_user: iris
67+
postgres_admin_user: postgres
68+
iris_authentication_type: local
69+
```
70+
71+
### 3. Secrets Management
72+
73+
Create and encrypt sensitive data:
74+
75+
```bash
76+
# Create secrets file
77+
cp vars/secrets.yml.example vars/secrets.yml
78+
79+
# Edit with your values
80+
nano vars/secrets.yml
81+
82+
# Encrypt the file
83+
ansible-vault encrypt vars/secrets.yml
84+
```
85+
86+
Example `vars/secrets.yml`:
87+
```yaml
88+
# Database passwords
89+
postgres_password: "your-secure-db-password"
90+
postgres_admin_password: "your-admin-password"
91+
92+
# IRIS configuration
93+
iris_secret_key: "your-secret-key"
94+
iris_security_password_salt: "your-salt"
95+
96+
# Admin credentials
97+
iris_adm_username: admin
98+
iris_adm_password: "your-admin-password"
99+
iris_adm_email: admin@example.com
100+
```
101+
102+
## 🎯 Deployment Options
103+
104+
### Full Deployment
105+
```bash
106+
ansible-playbook deploy/ansible/playbooks/site.yml --ask-vault-pass
107+
```
108+
109+
### Selective Deployment
110+
```bash
111+
# Install only Docker
112+
ansible-playbook deploy/ansible/playbooks/site.yml --tags="docker" --ask-vault-pass
113+
114+
# Deploy only IRIS application
115+
ansible-playbook deploy/ansible/playbooks/site.yml --tags="iris-app" --ask-vault-pass
116+
117+
# Update configuration only
118+
ansible-playbook deploy/ansible/playbooks/site.yml --tags="config" --ask-vault-pass
119+
```
120+
121+
### Test Connectivity
122+
```bash
123+
ansible all -m ping -i deploy/ansible/inventory/hosts.yml
124+
```
125+
126+
## 📁 Directory Structure
127+
128+
```
129+
deploy/ansible/
130+
├── ansible.cfg # Ansible configuration
131+
├── inventory/ # Infrastructure definition
132+
│ ├── hosts.yml # Server inventory
133+
│ └── group_vars/
134+
│ ├── all.yml # Global variables
135+
│ └── iris_servers.yml # IRIS-specific variables
136+
├── playbooks/
137+
│ ├── site.yml # Main deployment playbook
138+
│ ├── setup-docker.yml # Docker installation only
139+
│ └── deploy-iris.yml # IRIS deployment only
140+
├── roles/
141+
│ ├── common/ # System preparation
142+
│ ├── docker/ # Docker installation
143+
│ └── iris-app/ # IRIS application deployment
144+
├── vars/
145+
│ └── secrets.yml # Encrypted sensitive variables
146+
├── templates/ # Configuration templates
147+
└── files/ # Static files
148+
```
149+
150+
## 🏷️ Available Tags
151+
152+
Use tags for targeted deployments:
153+
154+
| Tag | Description |
155+
|-----|-------------|
156+
| `system` | System setup and package installation |
157+
| `docker` | Docker and Docker Compose installation |
158+
| `iris-app` | IRIS application deployment |
159+
| `config` | Configuration files and environment |
160+
| `certificates` | SSL certificate generation |
161+
| `services` | System service configuration |
162+
163+
## 🔐 Security Features
164+
165+
### SSL/TLS
166+
- Automatic self-signed certificate generation
167+
- Production certificate support
168+
- NGINX reverse proxy with SSL termination
169+
170+
### Secrets Management
171+
- Ansible Vault encryption for sensitive data
172+
- Secure environment variable injection
173+
- Database credential rotation support
174+
175+
### System Security
176+
- Firewall configuration
177+
- Service hardening
178+
- User permission management
179+
180+
## 🐳 Docker Services
181+
182+
The deployment creates these services:
183+
184+
| Service | Description | Port |
185+
|---------|-------------|------|
186+
| `app` | IRIS web application | 8000 |
187+
| `db` | PostgreSQL database | 5432 |
188+
| `rabbitmq` | Message broker | 5672/15672 |
189+
| `worker` | Background task processor | - |
190+
| `nginx` | Reverse proxy + SSL | 80/443 |
191+
192+
## 🔍 Troubleshooting
193+
194+
### Service Status
195+
```bash
196+
# Check IRIS system service
197+
sudo systemctl status iris
198+
199+
# Check Docker containers
200+
docker-compose -f /opt/iris/iris-web/docker-compose.yml ps
201+
```
202+
203+
### View Logs
204+
```bash
205+
# IRIS application logs
206+
docker-compose -f /opt/iris/iris-web/docker-compose.yml logs app
207+
208+
# All service logs
209+
docker-compose -f /opt/iris/iris-web/docker-compose.yml logs
210+
```
211+
212+
### Common Issues
213+
214+
**Connection Refused (Port 443)**:
215+
```bash
216+
# Check if NGINX is running
217+
docker-compose ps nginx
218+
sudo netstat -tlnp | grep :443
219+
```
220+
221+
**Database Connection Failed**:
222+
```bash
223+
# Test database connectivity
224+
docker exec -it iris-web_db psql -U postgres -d iris_db -c "SELECT version();"
225+
```
226+
227+
**Permission Denied**:
228+
```bash
229+
# Verify SSH access
230+
ssh -i ~/.ssh/id_rsa user@your-server
231+
sudo -l # Check sudo privileges
232+
```
233+
234+
## 📊 Monitoring & Health Checks
235+
236+
### Application Health
237+
```bash
238+
# Test web interface
239+
curl -k https://your-server-ip
240+
241+
# API health check
242+
curl -k https://your-server-ip/manage/health
243+
```
244+
245+
### Database Health
246+
```bash
247+
# Database connection test
248+
docker exec iris-web_db pg_isready -U postgres
249+
```
250+
251+
## 🔄 Updates & Maintenance
252+
253+
### Update IRIS Version
254+
1. Update `project_version` in `inventory/group_vars/all.yml`
255+
2. Run deployment: `ansible-playbook deploy/ansible/playbooks/site.yml --ask-vault-pass`
256+
257+
### Backup Database
258+
```bash
259+
# Create backup
260+
docker exec iris-web_db pg_dump -U postgres iris_db > iris_backup_$(date +%Y%m%d).sql
261+
262+
# Restore backup (if needed)
263+
docker exec -i iris-web_db psql -U postgres iris_db < iris_backup.sql
264+
```
265+
266+
### Certificate Renewal
267+
```bash
268+
# Regenerate self-signed certificates
269+
ansible-playbook deploy/ansible/playbooks/site.yml --tags="certificates" --ask-vault-pass
270+
```
271+
272+
## 🆚 Deployment Comparison
273+
274+
| Method | Use Case | Complexity | Scalability |
275+
|--------|----------|------------|-------------|
276+
| **Ansible** | Traditional VMs, existing Ansible infrastructure | Medium | High |
277+
| **Docker Compose** | Single server, development | Low | Low |
278+
| **Kubernetes** | Container orchestration, cloud-native | High | Very High |
279+
280+
## 🤝 Contributing
281+
282+
To improve this Ansible deployment:
283+
284+
1. Fork the repository
285+
2. Create a feature branch: `git checkout -b feature/ansible-improvement`
286+
3. Test your changes
287+
4. Submit a pull request
288+
289+
## 📝 License
290+
291+
This Ansible deployment follows the same license as DFIR-IRIS. See [LICENSE.txt](../../LICENSE.txt) for details.
292+
293+
## 🆘 Support
294+
295+
- **Documentation**: [DFIR-IRIS Docs](https://docs.dfir-iris.org/)
296+
- **Issues**: [GitHub Issues](https://github.com/dfir-iris/iris-web/issues)
297+
- **Community**: [DFIR-IRIS Discord](https://discord.gg/76DUSsKfBt)

‎deploy/ansible/ansible.cfg‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
[defaults]
2+
# Basic Configuration
3+
inventory = inventory/hosts.yml
4+
host_key_checking = False
5+
retry_files_enabled = False
6+
gathering = smart
7+
fact_caching = memory
8+
9+
# Roles and Collections
10+
roles_path = roles
11+
collections_paths = ~/.ansible/collections:/usr/share/ansible/collections
12+
13+
# Output Configuration
14+
stdout_callback = default
15+
bin_ansible_callbacks = True
16+
17+
# Performance
18+
forks = 10
19+
poll_interval = 2
20+
timeout = 30
21+
22+
# Logging
23+
log_path = ./ansible.log
24+
25+
# SSH Configuration
26+
[ssh_connection]
27+
ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no
28+
pipelining = True
29+
control_path = /tmp/ansible-ssh-%%h-%%p-%%r
30+
31+
# Privilege Escalation
32+
[privilege_escalation]
33+
become = True
34+
become_method = sudo
35+
become_user = root
36+
become_ask_pass = False
37+
38+
deprecation_warnings=False

‎deploy/ansible/inventory/group_vars/all.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
# Global Variables for NISIR-IRIS Deployment
3+
4+
# Project Configuration
5+
project_name: "NISIR-iris-web"
6+
project_version: "v1.2.0"
7+
8+
# Deployment Paths
9+
iris_base_path: "/opt/NISIR-iris"
10+
iris_project_path: "{{ iris_base_path }}/NISIR-iris-web"
11+
iris_backup_path: "{{ iris_base_path }}/backups"
12+
13+
# Docker Configuration
14+
docker_compose_version: "2.20.0"
15+
docker_service_restart_policy: "always"
16+
17+
# System Configuration
18+
system_timezone: "UTC"
19+
system_locale: "en_US.UTF-8"
20+
21+
# Network Configuration
22+
iris_https_port: 443
23+
iris_http_port: 80
24+
postgres_port: 5432
25+
26+
# User Configuration
27+
iris_user: "iris"
28+
iris_group: "iris"
29+
30+
# Security Configuration
31+
generate_ssl_certificates: true
32+
ssl_cert_days: 365
33+
ssl_key_size: 2048
34+
35+
# Backup Configuration
36+
enable_backups: true
37+
backup_retention_days: 30

0 commit comments

Comments
 (0)