Add Salt baseline states for Proxmox Mail Gateway.

Co-authored-by: Cursor <cursoragent@cursor.com>

pmg/security_agents.sls

@@ -0,0 +1,69 @@
+{% set wazuh_enabled = salt['pillar.get']('pmg:wazuh:enabled', True) %}
+{% set wazuh_version = salt['pillar.get']('pmg:wazuh:version', '4.14.0-1') %}
+{% set wazuh_manager = salt['pillar.get']('pmg:wazuh:manager', '10.80.120.205') %}
+{% set wazuh_group = salt['pillar.get']('pmg:wazuh:group', 'test_auditd_unix') %}
+{% set wazuh_pkg_name = 'wazuh-agent_' ~ wazuh_version ~ '_amd64.deb' %}
+{% set wazuh_pkg_url = 'https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/' ~ wazuh_pkg_name %}
+{% set wazuh_pkg_path = '/var/tmp/' ~ wazuh_pkg_name %}
+
+{% set qualys_enabled = salt['pillar.get']('pmg:qualys:enabled', True) %}
+{% set qualys_package_url = salt['pillar.get']('pmg:qualys:package_url', 'https://storage.yandexcloud.net/qualys-agent/QualysCloudAgent.deb') %}
+{% set qualys_package_path = salt['pillar.get']('pmg:qualys:package_path', '/opt/QualysCloudAgent.deb') %}
+{% set qualys_activation_id = salt['pillar.get']('pmg:qualys:activation_id', '') %}
+{% set qualys_customer_id = salt['pillar.get']('pmg:qualys:customer_id', '') %}
+{% set qualys_server_uri = salt['pillar.get']('pmg:qualys:server_uri', 'https://qagpublic.qg1.apps.qualys.eu/CloudAgent/') %}
+
+{% if wazuh_enabled %}
+pmg-wazuh-download:
+  cmd.run:
+    - name: wget -qO {{ wazuh_pkg_path }} {{ wazuh_pkg_url }}
+    - unless: test -f {{ wazuh_pkg_path }}
+
+pmg-wazuh-install:
+  cmd.run:
+    - name: WAZUH_MANAGER='{{ wazuh_manager }}' WAZUH_AGENT_GROUP='{{ wazuh_group }}' WAZUH_AGENT_NAME="$(hostname -f)" dpkg -i {{ wazuh_pkg_path }}
+    - unless: dpkg-query -W -f='${Status}' wazuh-agent 2>/dev/null | grep -q 'install ok installed'
+    - require:
+      - cmd: pmg-wazuh-download
+
+pmg-wazuh-service:
+  service.running:
+    - name: wazuh-agent
+    - enable: true
+    - require:
+      - cmd: pmg-wazuh-install
+{% endif %}
+
+{% if qualys_enabled and qualys_package_path and qualys_activation_id and qualys_customer_id %}
+pmg-qualys-download:
+  cmd.run:
+    - name: wget -qO {{ qualys_package_path }} {{ qualys_package_url }}
+    - unless: test -f {{ qualys_package_path }}
+
+pmg-qualys-install:
+  cmd.run:
+    - name: dpkg --install {{ qualys_package_path }}
+    - onlyif: test -f {{ qualys_package_path }}
+    - unless: dpkg-query -W -f='${Status}' qualys-cloud-agent 2>/dev/null | grep -q 'install ok installed'
+    - require:
+      - cmd: pmg-qualys-download
+
+pmg-qualys-activate:
+  cmd.run:
+    - name: /usr/local/qualys/cloud-agent/bin/qualys-cloud-agent.sh ActivationId={{ qualys_activation_id }} CustomerId={{ qualys_customer_id }} ServerUri={{ qualys_server_uri }}
+    - onchanges:
+      - cmd: pmg-qualys-install
+    - onlyif: test -x /usr/local/qualys/cloud-agent/bin/qualys-cloud-agent.sh
+
+pmg-qualys-service:
+  service.running:
+    - name: qualys-cloud-agent
+    - enable: true
+    - onlyif: test -f {{ qualys_package_path }}
+    - require:
+      - cmd: pmg-qualys-install
+{% elif qualys_enabled %}
+pmg-qualys-skipped:
+  test.show_notification:
+    - text: "Qualys agent skipped: set package_url + package_path + activation_id + customer_id in pillar."
+{% endif %}