From 1987dd29a7a7a9e37fa91314d727e061a2a4aa4a Mon Sep 17 00:00:00 2001
From: Thorsten Spille <thorsten@bashclub.org>
Date: Wed, 28 Jan 2026 19:15:22 +0000
Subject: [PATCH] add wazuh container

---
 src/wazuh/constants-service.conf | 31 +++++++++++++++++++++++++++++++
 src/wazuh/install-service.sh     | 13 +++++++++++++
 2 files changed, 44 insertions(+)
 create mode 100644 src/wazuh/constants-service.conf
 create mode 100644 src/wazuh/install-service.sh

diff --git a/src/wazuh/constants-service.conf b/src/wazuh/constants-service.conf
new file mode 100644
index 0000000..592299f
--- /dev/null
+++ b/src/wazuh/constants-service.conf
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+# Authors:
+# (C) 2024 Thorsten Spille <thorsten@spille-edv.de>
+
+# This file contains the project constants on service level
+
+# Debian Version, which will be installed
+LXC_TEMPLATE_VERSION="debian-13-standard"
+
+# Create sharefs mountpoint
+LXC_MP=0
+# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank)
+LXC_SHAREFS_MOUNTPOINT="var/lib/opensearch"
+# Defines the recordsize of mp0
+LXC_MP_RECORDSIZE="16K"
+
+# Create unprivileged container
+LXC_UNPRIVILEGED="1"
+
+# enable nesting feature
+LXC_NESTING="1"
+
+# enable keyctl feature
+LXC_KEYCTL="0"
+
+# Sets the minimum amount of RAM the service needs for operation
+LXC_MEM_MIN=8192
+
+# service dependent meta tags
+SERVICE_TAGS="opensearch"
\ No newline at end of file
diff --git a/src/wazuh/install-service.sh b/src/wazuh/install-service.sh
new file mode 100644
index 0000000..ff8af27
--- /dev/null
+++ b/src/wazuh/install-service.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# Author:
+# (C) 2024 Thorsten Spille <thorsten@spille-edv.de>
+
+set -euo pipefail
+
+source /root/functions.sh
+source /root/zamba.conf
+source /root/constants-service.conf
+
+WAZUH_VERSION=4.14
+curl -sO https://packages.wazuh.com/$WAZUH_VERSION/wazuh-install.sh && sudo bash ./wazuh-install.sh -a -i 2>/dev/null