feat(pfsense): add AW poller and host group sections

2026-04-27 04:41:32 +03:00
parent 70ffd1f3e8
commit e80ae5fbc3
13 changed files with 702 additions and 3 deletions
@@ -5,6 +5,7 @@
 - деплой на уже существующий Debian host/CT;
 - полный цикл с нуля в Proxmox: создание CT + bootstrap + установка ActivityWatch + RU patch.
 - централизованный деплой Windows phase-2 collectors по WinRM.
+- deployment внешнего pfSense poller'а на Debian/Ubuntu utility VM.

 ## Файлы

@@ -12,11 +13,13 @@
 - `/home/igor/tmp/AWatch-rus/ansible/provision_proxmox_ct_and_deploy_aw.yml` — full-stack playbook для Proxmox.
 - `/home/igor/tmp/AWatch-rus/ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml` — массовый full-stack playbook (несколько CT).
 - `/home/igor/tmp/AWatch-rus/ansible/deploy_aw_windows_phase2.yml` — WinRM playbook для развёртывания phase-2 Windows collector'ов.
+- `/home/igor/tmp/AWatch-rus/ansible/deploy_aw_pfsense_poller.yml` — deployment pfSense poller'а.
 - `/home/igor/tmp/AWatch-rus/ansible/inventory.example.ini` — шаблон inventory.
 - `/home/igor/tmp/AWatch-rus/ansible/group_vars/all.example.yml` — шаблон переменных.
 - `/home/igor/tmp/AWatch-rus/ansible/group_vars/proxmox.example.yml` — шаблон переменных CT в Proxmox.
 - `/home/igor/tmp/AWatch-rus/ansible/group_vars/proxmox-matrix.example.yml` — шаблон матрицы CT.
 - `/home/igor/tmp/AWatch-rus/ansible/group_vars/windows.example.yml` — шаблон переменных Windows phase-2.
+- `/home/igor/tmp/AWatch-rus/ansible/group_vars/pfsense-poller.example.yml` — шаблон переменных pfSense poller'а.

 ## Быстрый запуск

@@ -86,11 +89,31 @@ Playbook:
 - `aw_windows_incident_artifacts_root: 'C:\...\incident-artifacts'` — переопределить путь артефактов;
 - `aw_windows_skip_hardening: true` — пропустить `hardening-recovery.ps1` внутри ensemble-скрипта.

+## pfSense poller rollout
+
+1. Подготовьте vars:
+   - `cp /home/igor/tmp/AWatch-rus/ansible/group_vars/pfsense-poller.example.yml /home/igor/tmp/AWatch-rus/ansible/group_vars/pfsense-poller.yml`
+2. Добавьте inventory group `[aw_pfsense_pollers]`.
+3. Запустите:
+
+```bash
+cd /home/igor/tmp/AWatch-rus/ansible
+ansible-playbook -i inventory.ini deploy_aw_pfsense_poller.yml
+```
+
+Playbook:
+
+- ставит `python3`;
+- копирует `pfsense-aw-poller.py`;
+- пишет `/etc/aw-pfsense/poller.json`;
+- поднимает `aw-pfsense-poller.service`.
+
 ## Результат

 - Установлен ActivityWatch Server.
 - Создан systemd-unit `activitywatch-server.service`.
 - Установлен RU Web UI patch.
 - Для Web UI используется checksum-based cache-bust для `ru-patch-v5.js` и `sw-cleanup.js`, чтобы браузер не держал старую DLP/русскую статику после деплоя.
+- На `#/home` Web UI делит хосты на `Windows RDP` и `Virtual servers + Proxmox`.
 - Выполнена валидация API `http://127.0.0.1:5600/api/0/info`.
 - Для full-stack сценария CT создаётся автоматически через `pct create`.
@@ -0,0 +1,66 @@
+---
+- name: Deploy pfSense ActivityWatch poller
+  hosts: aw_pfsense_pollers
+  become: true
+  gather_facts: true
+
+  vars:
+    aw_pfsense_install_root: "/opt/aw-pfsense"
+    aw_pfsense_config_dir: "/etc/aw-pfsense"
+    aw_pfsense_service_name: "aw-pfsense-poller.service"
+
+  tasks:
+    - name: Install required packages
+      ansible.builtin.apt:
+        name:
+          - python3
+        state: present
+        update_cache: true
+
+    - name: Ensure directories exist
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: directory
+        mode: "0755"
+      loop:
+        - "{{ aw_pfsense_install_root }}"
+        - "{{ aw_pfsense_config_dir }}"
+
+    - name: Install pfSense poller script
+      ansible.builtin.copy:
+        src: "{{ aw_repo_root }}/pfsense/pfsense-aw-poller.py"
+        dest: "{{ aw_pfsense_install_root }}/pfsense-aw-poller.py"
+        mode: "0755"
+
+    - name: Install systemd service
+      ansible.builtin.copy:
+        src: "{{ aw_repo_root }}/pfsense/pfsense-aw-poller.service"
+        dest: "/etc/systemd/system/{{ aw_pfsense_service_name }}"
+        mode: "0644"
+      notify:
+        - Reload systemd
+
+    - name: Write pfSense poller config
+      ansible.builtin.copy:
+        dest: "{{ aw_pfsense_config_dir }}/poller.json"
+        mode: "0600"
+        content: "{{ aw_pfsense_poller_config | to_nice_json }}"
+      notify:
+        - Restart pfSense poller
+
+    - name: Enable and start pfSense poller
+      ansible.builtin.systemd:
+        name: "{{ aw_pfsense_service_name }}"
+        enabled: true
+        state: restarted
+        daemon_reload: true
+
+  handlers:
+    - name: Reload systemd
+      ansible.builtin.systemd:
+        daemon_reload: true
+
+    - name: Restart pfSense poller
+      ansible.builtin.systemd:
+        name: "{{ aw_pfsense_service_name }}"
+        state: restarted
@@ -11,6 +11,7 @@
    aw_bootstrap_dir: "/tmp/aw-rus-bootstrap"
    aw_ru_patch_cache_bust: "{{ lookup('file', aw_repo_root + '/aw-server/aw-ru-patch.js') | hash('sha1') | truncate(12, true, '') }}"
    aw_sw_cleanup_cache_bust: "{{ lookup('file', aw_repo_root + '/aw-server/aw-sw-cleanup.js') | hash('sha1') | truncate(12, true, '') }}"
+    aw_host_groups_cache_bust: "{{ lookup('file', aw_repo_root + '/aw-server/aw-host-groups.json') | hash('sha1') | truncate(12, true, '') }}"
    aw_worktime_classes: "{{ lookup('file', aw_repo_root + '/aw-server/settings/classes-worktime.json') | from_json }}"
    aw_default_views: "{{ lookup('file', aw_repo_root + '/aw-server/settings/views-default.json') | from_json }}"

@@ -92,6 +93,7 @@
        - { src: "{{ aw_repo_root }}/aw-server/activitywatch-server.service", dest: "/etc/systemd/system/activitywatch-server.service", mode: "0644" }
        - { src: "{{ aw_repo_root }}/aw-server/aw-ru-patch.js", dest: "{{ aw_server_webui_dir }}/js/ru-patch-v5.js", mode: "0644" }
        - { src: "{{ aw_repo_root }}/aw-server/aw-sw-cleanup.js", dest: "{{ aw_server_webui_dir }}/js/sw-cleanup.js", mode: "0644" }
+        - { src: "{{ aw_repo_root }}/aw-server/aw-host-groups.json", dest: "{{ aw_server_webui_dir }}/js/aw-host-groups.json", mode: "0644" }
      notify:
        - Reload systemd
        - Restart activitywatch
@@ -0,0 +1,30 @@
+aw_pfsense_poller_config:
+  poll_interval_seconds: 60
+  aw:
+    server_host: "10.10.10.13"
+    server_port: 5600
+    hostname: "PFSENSE-EDGE01"
+    pulse_time_seconds: 120
+    timeout_seconds: 15
+  pfsense:
+    name: "pfSense Edge 01"
+    host: "10.10.10.1"
+    scheme: "https"
+    verify_tls: false
+    timeout_seconds: 15
+    headers:
+      X-API-Key: "replace-me"
+      X-API-Secret: "replace-me"
+  endpoints:
+    - name: "system-status"
+      path: "/api/v2/status/system"
+      bucket_prefix: "aw-pfsense-health"
+      bucket_type: "aw.pfsense.health"
+    - name: "interfaces"
+      path: "/api/v2/interface"
+      bucket_prefix: "aw-pfsense-interfaces"
+      bucket_type: "aw.pfsense.interfaces"
+    - name: "gateways"
+      path: "/api/v2/status/gateways"
+      bucket_prefix: "aw-pfsense-gateways"
+      bucket_type: "aw.pfsense.gateways"