Wrapper roles let you use upstream Ansible roles without forking everything

Problem

Forking upstream Ansible roles makes upgrades and maintenance harder.

Why it happens

Custom logic is mixed directly into third-party roles, making future upstream updates risky.

Fix / Approach

Keep upstream roles pinned and wrap them with local roles for inventory, files, pre-tasks, post-tasks, restart logic, and documentation.

Command / Config

Example structure:

roles/
  upstream/wazuh-ansible
  local/wazuh_manager_config
  local/wazuh_custom_rules
  local/wazuh_agent_deploy

When to use

• Large community roles
• Internal standards
• Wrapper playbooks
• Maintainable automation

When not to use

• When the upstream role is too limited, unmaintained, or does not match the architecture at all