feat(siem): agent fixes from fleet pass; IPv6 kill script [#335][#748]

deploy-agent.sh now self-heals the three postinst failure modes found on
PMG/PBS hosts (MANAGER_IP placeholder, missing wazuh user, root:root
ownership). scripts/disable-ipv6.sh: live sysctl + persisted conf, with
in-file rollback notes. Rollout state in #335/#748.
Meat: https://projects.knownelement.com/issues/335#note-4008

scripts/disable-ipv6.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+#
+# disable-ipv6.sh — kill IPv6 live + persist (no reboot) [#748]
+# Run as root. Idempotent. Charles ruling 2026-09-03: IPv6 off fleet-wide.
+# Rollback per host: delete /etc/sysctl.d/99-disable-ipv6.conf, then
+#   sysctl -w net.ipv6.conf.all.disable_ipv6=0 (and per-interface =0 as needed).
+#
+set -euo pipefail
+
+CONF=/etc/sysctl.d/99-disable-ipv6.conf
+cat > "$CONF" <<'EOF'
+# IPv6 disabled fleet-wide (Charles ruling 2026-09-03, [#748], follow-on to [#745])
+# Rollback: delete this file, then set net.ipv6.conf.{all,default,lo}.disable_ipv6=0
+net.ipv6.conf.all.disable_ipv6 = 1
+net.ipv6.conf.default.disable_ipv6 = 1
+net.ipv6.conf.lo.disable_ipv6 = 1
+EOF
+
+# Live apply: 'all' gates new traffic; per-interface flags disable existing ifs
+# (incl. lo, tailscale0, docker0 — fleet-wide consistent, v4 everywhere).
+sysctl -q -w net.ipv6.conf.all.disable_ipv6=1
+sysctl -q -w net.ipv6.conf.default.disable_ipv6=1
+sysctl -q -w net.ipv6.conf.lo.disable_ipv6=1
+for f in /proc/sys/net/ipv6/conf/*/disable_ipv6; do
+  echo 1 > "$f" 2>/dev/null || true
+done
+
+v=$(sysctl -n net.ipv6.conf.all.disable_ipv6)
+n=$(ip -6 addr show 2>/dev/null | grep -c inet6 || true)
+echo "host=$(hostname) ipv6_disabled=$v remaining_inet6_addrs=$n"

siem/deploy-agent.sh

@@ -27,6 +27,16 @@ if ! grep -q "<address>$MGR</address>" "$CONF"; then
   sed -i "s|<address>[^<]*</address>|<address>$MGR</address>|" "$CONF"
 fi
 
+# Package robustness (learned on PMG/PBS hosts 2026-09-03): postinst can
+# leave the MANAGER_IP placeholder, a missing wazuh user, and root:root
+# ownership — all three break startup with misleading errors.
+id wazuh >/dev/null 2>&1 || useradd -r -d /var/ossec -s /usr/sbin/nologin wazuh
+sed -i "s|<address>MANAGER_IP</address>|<address>$MGR</address>|" "$CONF"
+chown -R root:wazuh /var/ossec 2>/dev/null || true
+chown -R wazuh:wazuh /var/ossec/queue /var/ossec/logs /var/ossec/etc 2>/dev/null || true
+chown root:wazuh /var/ossec/var/run 2>/dev/null || true
+chmod 770 /var/ossec/queue/sockets /var/ossec/var/run /var/ossec/etc 2>/dev/null || true
+
 systemctl enable wazuh-agent >/dev/null 2>&1 || true
 systemctl restart wazuh-agent
 sleep 8