From 2fbcd14169a5cc36c9bc1967147b87fcc9d5f69d Mon Sep 17 00:00:00 2001 From: DerLinkman Date: Sat, 18 Jul 2026 21:36:00 +0200 Subject: [PATCH] added zabbix psk options + api host add --- .gitignore | 4 +- inventory/group_vars/home.yml | 21 ++- roles/monitoring/README.md | 176 ++++++++++++++++++ roles/monitoring/defaults/main.yml | 63 +++++-- roles/monitoring/tasks/configure-psk.yml | 55 ++++++ roles/monitoring/tasks/main.yml | 6 + roles/monitoring/tasks/register-host.yml | 75 ++++++++ roles/monitoring/tasks/validate.yml | 47 +++-- .../templates/zabbix_agent2.conf.j2 | 34 ++-- vault.yml | 18 +- 10 files changed, 452 insertions(+), 47 deletions(-) create mode 100644 roles/monitoring/README.md create mode 100644 roles/monitoring/tasks/configure-psk.yml create mode 100644 roles/monitoring/tasks/register-host.yml diff --git a/.gitignore b/.gitignore index 6390927..bfceb24 100644 --- a/.gitignore +++ b/.gitignore @@ -2,4 +2,6 @@ hosts proxmox.* .vscode .vault_pass -logs \ No newline at end of file +logs +.zabbix-psk +setenv.sh \ No newline at end of file diff --git a/inventory/group_vars/home.yml b/inventory/group_vars/home.yml index 69d6cb5..d8b2c9a 100644 --- a/inventory/group_vars/home.yml +++ b/inventory/group_vars/home.yml @@ -1 +1,20 @@ -monitoring_zabbix_passive_servers: ["10.13.37.1"] \ No newline at end of file +monitoring_zabbix_passive_servers: ["10.13.37.1"] +monitoring_zabbix_active_servers: ["10.13.37.1"] + +# Zabbix server API (password lives in vault.yml as monitoring_zabbix_api_password) +monitoring_zabbix_api_url: "https://zabbix/api_jsonrpc.php" +monitoring_zabbix_api_user: Admin +monitoring_zabbix_api_validate_certs: true + +# Host registration defaults for the home inventory +monitoring_zabbix_host_groups: ["Linux servers"] +monitoring_zabbix_templates: ["Linux by Zabbix agent", "Zabbix agent2"] +monitoring_zabbix_docker_templates: ["Docker by Zabbix agent2"] + +# --- Zabbix Proxy (optional) ------------------------------------------------- +# Leave empty to have agents talk to the Zabbix server directly. +# Per-site override example (e.g. inventory/group_vars/standort-a.yml): +# monitoring_zabbix_proxy: "fw-standort-a" +# monitoring_zabbix_proxy_address: "10.20.30.1" +monitoring_zabbix_proxy: "" +monitoring_zabbix_proxy_address: "" \ No newline at end of file diff --git a/roles/monitoring/README.md b/roles/monitoring/README.md new file mode 100644 index 0000000..81bcf62 --- /dev/null +++ b/roles/monitoring/README.md @@ -0,0 +1,176 @@ +# Rolle `monitoring` + +Installiert und konfiguriert den **Zabbix Agent 2** auf Debian-Hosts, +generiert/verteilt pro Host eine TLS-PSK, konfiguriert das Docker-Plugin +(bei vorhandenem Socket) und registriert den Host über die Zabbix-API +einschließlich Template-Verlinkung. + +> Siehe auch das Playbook `playbooks/monitoring.yml` sowie die +> [Repo-README](../../README.md). + +## Voraussetzungen + +- Debian-Ziel-Host +- Erreichbarer Zabbix-Server (API & Agent-Polling) +- `community.zabbix` Collection +- Vault-Secret `monitoring_zabbix_api_password` in `vault.yml` +- OpenSSL auf dem Ansible-Controller (für PSK-Generierung) + +## Einbindung + +```yaml +- hosts: all + become: true + user: admin + roles: + - role: monitoring +``` + +```bash +ansible-playbook -i inventory/dmc12.yml --vault-password-file .vault_password \ + playbooks/monitoring.yml +``` + +## Funktionsweise + +`tasks/main.yml` importiert die Subtasks in folgender Reihenfolge (alle mit +Tag `monitoring`): + +1. **`validate.yml`** – bricht bei Nicht-Debian ab, prüft dass + `monitoring_zabbix_passive_servers` gesetzt ist und (bei aktivierter + Registrierung) API-URL/-User/-Passwort vorliegen. Stellt sicher, dass + bei gesetztem `monitoring_zabbix_proxy` auch eine Proxy-Adresse definiert ist. +2. **`install-repository.yml`** – installiert `ca-certificates`, lädt das + Zabbix-Release-Paket herunter, installiert es und aktualisiert den + apt-Cache. +3. **`install-agent.yml`** – installiert `zabbix-agent2` und aktiviert/startet + den Service. +4. **`configure-docker.yml`** – prüft, ob der Docker-Socket existiert. Falls + ja: Zabbix-User zur Docker-Gruppe hinzufügen, Plugin-Config-Verzeichnis + anlegen, `docker.conf` aus Template ausliefern. Falls nein: Plugin-Config + entfernen. +5. **`configure-psk.yml`** – stellt PSK-Store auf dem Controller sicher + (`/../.zabbix-psk`), generiert pro Host eine PSK mit + `openssl rand -hex`, persistiert sie im Store und verteilt sie auf den + Zielhost (`/etc/zabbix/zabbix_agent2.psk`, Mode `0600`). +6. **`configure-agent.yml`** – schreibt `zabbix_agent2.conf` aus Template. +7. **`register-host.yml`** – registriert bzw. aktualisiert den Host über die + Zabbix-API (`community.zabbix.zabbix_host`). Verknüpft Standard-Templates + und ggf. Docker-Templates. Unterscheidet zwischen Proxy- und + Server-Modus (zwei Tasks, gegeneinander exklusiv). Delegiert an localhost. + +## Variablen + +### Zabbix-Agent + +| Variable | Typ | Default | Beschreibung | +|--------------------------------------------|--------|--------------------------------------|-----------------------------------------------------| +| `monitoring_zabbix_version` | string | `7.0` | Zabbix-Hauptversion | +| `monitoring_zabbix_release_package` | string | abgeleitet | Dateiname des Release-Pakets | +| `monitoring_zabbix_release_url` | string | abgeleitet | Download-URL des Release-Pakets | +| `monitoring_zabbix_release_path` | string | `/tmp/` | lokaler Ablagepfad auf dem Zielhost | +| `monitoring_zabbix_agent_package` | string | `zabbix-agent2` | Zu installierendes Agent-Paket | +| `monitoring_zabbix_agent_service` | string | `zabbix-agent2` | systemd-Service-Name | +| `monitoring_zabbix_config_file` | string | `/etc/zabbix/zabbix_agent2.conf` | Pfad zur Agent-Konfiguration | +| `monitoring_zabbix_agent_user` | string | `zabbix` | Benutzer, unter dem der Agent läuft | +| `monitoring_zabbix_passive_servers` | list | `["192.168.212.1"]` | Erlaubte Server für passive Checks (Server=) | +| `monitoring_zabbix_active_servers` | list | `""` | Server für aktive Checks (ServerActive=) | +| `monitoring_zabbix_listen_port` | int | `10050` | Listen-Port des Agents | + +### Docker-Plugin + +| Variable | Typ | Default | Beschreibung | +|-----------------------------------------------------|--------|--------------------------------------|-----------------------------------------------| +| `monitoring_zabbix_docker_group` | string | `docker` | Docker-Gruppe für Socket-Zugriff | +| `monitoring_zabbix_docker_socket_path` | string | `/var/run/docker.sock` | Pfad zum Docker-Socket | +| `monitoring_zabbix_docker_plugin_config_file` | string | `/etc/zabbix/zabbix_agent2.d/plugins.d/docker.conf` | Pfad zur Plugin-Config | +| `monitoring_zabbix_docker_endpoint` | string | `unix://` | Docker-Endpoint für das Plugin | + +### TLS / PSK + +| Variable | Typ | Default | Beschreibung | +|-----------------------------------------|--------|--------------------------------------|---------------------------------------------------------| +| `monitoring_zabbix_tls_connect` | string | `psk` | TLS-Modus für ausgehende Verbindungen | +| `monitoring_zabbix_tls_accept` | string | `psk` | TLS-Modus für eingehende Verbindungen | +| `monitoring_zabbix_psk_identity` | string | `{{ inventory_hostname }}` | PSK-Identity (hostname) | +| `monitoring_zabbix_psk_file` | string | `/etc/zabbix/zabbix_agent2.psk` | Pfad zur PSK-Datei auf dem Zielhost | +| `monitoring_zabbix_psk_bits` | int | `256` | PSK-Länge in Bits (32 Byte → 64 Hex-Chars) | +| `monitoring_zabbix_psk_store` | string | `{{ playbook_dir }}/../.zabbix-psk` | PSK-Store-Verzeichnis auf dem Controller | +| `monitoring_zabbix_psk_store_mode` | string | `0700` | Berechtigung des PSK-Stores | + +### Zabbix Proxy (optional) + +| Variable | Typ | Default | Beschreibung | +|-------------------------------------|--------|---------|-----------------------------------------------------------| +| `monitoring_zabbix_proxy` | string | `""` | Name des Proxys in Zabbix (leer = direkter Server-Modus) | +| `monitoring_zabbix_proxy_address` | string | `""` | IP/DNS des Proxys, den der Agent kontaktiert | + +### Zabbix API / Host-Registrierung + +| Variable | Typ | Default | Beschreibung | +|---------------------------------------------|--------|--------------------------------------|---------------------------------------------------------| +| `monitoring_zabbix_api_url` | string | `https://zabbix/api_jsonrpc.php` | API-URL | +| `monitoring_zabbix_api_user` | string | `Admin` | API-Benutzer | +| `monitoring_zabbix_api_password` | string | (Vault) | API-Passwort – MUSS in `vault.yml` gesetzt werden | +| `monitoring_zabbix_api_validate_certs` | bool | `true` | TLS-Zertifikate prüfen | +| `monitoring_zabbix_register_host` | bool | `true` | Host automatisch registrieren | +| `monitoring_zabbix_host_name` | string | `{{ inventory_hostname }}` | Hostname in Zabbix | +| `monitoring_zabbix_host_groups` | list | `["Linux servers"]` | Zabbix-Host-Gruppen | +| `monitoring_zabbix_host_interface_ip` | string | `{{ ansible_host }}` | Interface-IP | +| `monitoring_zabbix_host_interface_port` | string | `{{ monitoring_zabbix_listen_port }}`| Interface-Port | +| `monitoring_zabbix_host_inventory_mode` | string | `manual` | Inventory-Modus | +| `monitoring_zabbix_templates` | list | `["Linux by Zabbix agent", "Zabbix agent2"]` | Standard-Templates | +| `monitoring_zabbix_docker_templates` | list | `["Docker by Zabbix agent2"]` | Zusätzliche Templates bei vorhandenem Docker-Socket | + +### Inventory-Overrides + +In `inventory/group_vars/home.yml` werden u. a. überschrieben: +`monitoring_zabbix_passive_servers`, `monitoring_zabbix_active_servers`, +`monitoring_zabbix_api_url`, `monitoring_zabbix_host_groups`, +`monitoring_zabbix_templates`, `monitoring_zabbix_docker_templates`, +`monitoring_zabbix_proxy`, `monitoring_zabbix_proxy_address`. + +## Templates + +| Template | Ziel | +|-------------------------|------------------------------------------------| +| `zabbix_agent2.conf.j2` | `/etc/zabbix/zabbix_agent2.conf` | +| `docker.conf.j2` | `/etc/zabbix/zabbix_agent2.d/plugins.d/docker.conf` | + +`zabbix_agent2.conf.j2` berücksichtigt Proxy-Konfiguration (vereinigt +Passive-Servers mit Proxy-Adresse, setzt `ServerActive` auf Proxy). + +## Handler + +| Handler | Auslöser | +|-----------------------|--------------------------------------------| +| `Restart Zabbix Agent`| Änderungen an Config, PSK oder Docker-Plugin| + +## Tags + +`monitoring` – alle Subtasks sind mit diesem Tag versehen: + +```bash +ansible-playbook -i inventory/dmc12.yml playbooks/monitoring.yml -t monitoring +``` + +## Abhängigkeiten + +- `community.zabbix` Collection (`zabbix_host`-Modul) +- `ansible.builtin` (Bordmittel) +- OpenSSL auf dem Controller (für PSK-Generierung) + +## Hinweise + +- **PSK-Store**: Pro Host wird eine PSK unter + `/../.zabbix-psk/.psk` (git-ignored) gespeichert. + Bei Host-Umbenennung PSK migrieren oder neu generieren – sonst stimmt die + Zabbix-Registrierung nicht. +- **API-Passwort** MUSS in `vault.yml` als `monitoring_zabbix_api_password` + gesetzt sein; die Validate-Tasks brechen sonst ab. +- **Docker-Plugin** wird nur konfiguriert, wenn der Socket existiert – sonst + wird eine eventuell vorhandene Plugin-Config entfernt (Idempotenz). +- Die Registrierung wird **delegiert an localhost** ausgeführt, da der + Controller den API-Zugang besitzt. +- Proxy- und Server-Modus schließen sich gegenseitig aus (zwei Tasks mit + entgegengesetzten `when`-Bedingungen). \ No newline at end of file diff --git a/roles/monitoring/defaults/main.yml b/roles/monitoring/defaults/main.yml index c4e84c1..8b790f6 100644 --- a/roles/monitoring/defaults/main.yml +++ b/roles/monitoring/defaults/main.yml @@ -1,15 +1,48 @@ -monitoring_zabbix_version: "7.0" -monitoring_zabbix_release_package: "zabbix-release_latest_{{ monitoring_zabbix_version }}+debian{{ ansible_distribution_major_version }}_all.deb" -monitoring_zabbix_release_url: "https://repo.zabbix.com/zabbix/{{ monitoring_zabbix_version }}/debian/pool/main/z/zabbix-release/{{ monitoring_zabbix_release_package }}" -monitoring_zabbix_release_path: "/tmp/{{ monitoring_zabbix_release_package }}" -monitoring_zabbix_agent_package: zabbix-agent2 -monitoring_zabbix_agent_service: zabbix-agent2 -monitoring_zabbix_config_file: /etc/zabbix/zabbix_agent2.conf -monitoring_zabbix_agent_user: zabbix -monitoring_zabbix_passive_servers: ["192.168.212.1"] -monitoring_zabbix_active_servers: "" -monitoring_zabbix_listen_port: 10050 -monitoring_zabbix_docker_group: docker -monitoring_zabbix_docker_socket_path: /var/run/docker.sock -monitoring_zabbix_docker_plugin_config_file: /etc/zabbix/zabbix_agent2.d/plugins.d/docker.conf -monitoring_zabbix_docker_endpoint: "unix://{{ monitoring_zabbix_docker_socket_path }}" +monitoring_zabbix_version: "7.0" +monitoring_zabbix_release_package: "zabbix-release_latest_{{ monitoring_zabbix_version }}+debian{{ ansible_distribution_major_version }}_all.deb" +monitoring_zabbix_release_url: "https://repo.zabbix.com/zabbix/{{ monitoring_zabbix_version }}/debian/pool/main/z/zabbix-release/{{ monitoring_zabbix_release_package }}" +monitoring_zabbix_release_path: "/tmp/{{ monitoring_zabbix_release_package }}" +monitoring_zabbix_agent_package: zabbix-agent2 +monitoring_zabbix_agent_service: zabbix-agent2 +monitoring_zabbix_config_file: /etc/zabbix/zabbix_agent2.conf +monitoring_zabbix_agent_user: zabbix +monitoring_zabbix_passive_servers: ["192.168.212.1"] +monitoring_zabbix_active_servers: "" +monitoring_zabbix_listen_port: 10050 +monitoring_zabbix_docker_group: docker +monitoring_zabbix_docker_socket_path: /var/run/docker.sock +monitoring_zabbix_docker_plugin_config_file: /etc/zabbix/zabbix_agent2.d/plugins.d/docker.conf +monitoring_zabbix_docker_endpoint: "unix://{{ monitoring_zabbix_docker_socket_path }}" + +# --- TLS / PSK ---------------------------------------------------------------- +monitoring_zabbix_tls_connect: psk # outgoing connections from agent: psk +monitoring_zabbix_tls_accept: psk # incoming connections to agent: psk +monitoring_zabbix_psk_identity: "{{ inventory_hostname }}" +monitoring_zabbix_psk_file: /etc/zabbix/zabbix_agent2.psk +monitoring_zabbix_psk_bits: 256 # 32 bytes -> 64 hex chars +# Directory on the Ansible controller used to persist per-host PSKs across runs. +monitoring_zabbix_psk_store: "{{ playbook_dir }}/../.zabbix-psk" +monitoring_zabbix_psk_store_mode: "0700" + +# --- Zabbix Proxy (optional) -------------------------------------------------- +# Leave both empty to have the agent talk to the Zabbix server directly. +# monitoring_zabbix_proxy: name of the proxy in Zabbix (for API assignment) +# monitoring_zabbix_proxy_address: IP/DNS of the proxy the agent should contact +monitoring_zabbix_proxy: "" +monitoring_zabbix_proxy_address: "" + +# --- Zabbix API / host registration ------------------------------------------ +monitoring_zabbix_api_url: "https://zabbix/api_jsonrpc.php" +monitoring_zabbix_api_user: Admin +# monitoring_zabbix_api_password: +monitoring_zabbix_api_validate_certs: true +monitoring_zabbix_register_host: true +monitoring_zabbix_host_name: "{{ inventory_hostname }}" +monitoring_zabbix_host_groups: ["Linux servers"] +monitoring_zabbix_host_interface_ip: "{{ ansible_host }}" +monitoring_zabbix_host_interface_port: "{{ monitoring_zabbix_listen_port }}" +monitoring_zabbix_host_inventory_mode: manual +# Templates linked to every host +monitoring_zabbix_templates: ["Linux by Zabbix agent", "Zabbix agent2"] +# Templates added when a Docker socket is present on the host +monitoring_zabbix_docker_templates: ["Docker by Zabbix agent2"] \ No newline at end of file diff --git a/roles/monitoring/tasks/configure-psk.yml b/roles/monitoring/tasks/configure-psk.yml new file mode 100644 index 0000000..e7f6126 --- /dev/null +++ b/roles/monitoring/tasks/configure-psk.yml @@ -0,0 +1,55 @@ +--- +# Generate a per-host PSK on the Ansible controller and deploy it to the agent. +# The PSK is persisted under monitoring_zabbix_psk_store so that re-runs keep +# the same secret and the Zabbix server registration stays in sync. + +- name: Ensure PSK store directory exists on controller + ansible.builtin.file: + path: "{{ monitoring_zabbix_psk_store }}" + state: directory + mode: "{{ monitoring_zabbix_psk_store_mode }}" + delegate_to: localhost + become: false + run_once: false + +- name: Check whether PSK already exists on controller + ansible.builtin.stat: + path: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk" + delegate_to: localhost + become: false + register: monitoring_psk_existing + +- name: Generate per-host PSK when missing + ansible.builtin.shell: | + umask 077 + openssl rand -hex {{ (monitoring_zabbix_psk_bits / 8) | int }} \ + > "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk" + args: + creates: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk" + delegate_to: localhost + become: false + register: monitoring_psk_generated + +- name: Slurp PSK from controller + ansible.builtin.set_fact: + monitoring_zabbix_psk_value: >- + {{ lookup('ansible.builtin.file', + monitoring_zabbix_psk_store ~ '/' ~ inventory_hostname ~ '.psk') + | trim }} + +- name: Ensure Zabbix agent runtime directory exists + ansible.builtin.file: + path: "{{ monitoring_zabbix_psk_file | dirname | default('/etc/zabbix') }}" + state: directory + owner: root + group: "{{ monitoring_zabbix_agent_user }}" + mode: '0750' + +- name: Deploy PSK file to agent host + ansible.builtin.copy: + content: "{{ monitoring_zabbix_psk_value }}\n" + dest: "{{ monitoring_zabbix_psk_file }}" + owner: "{{ monitoring_zabbix_agent_user }}" + group: "{{ monitoring_zabbix_agent_user }}" + mode: '0600' + notify: Restart Zabbix Agent \ No newline at end of file diff --git a/roles/monitoring/tasks/main.yml b/roles/monitoring/tasks/main.yml index cd681d3..8bf7dea 100644 --- a/roles/monitoring/tasks/main.yml +++ b/roles/monitoring/tasks/main.yml @@ -10,5 +10,11 @@ - import_tasks: configure-docker.yml tags: monitoring +- import_tasks: configure-psk.yml + tags: monitoring + - import_tasks: configure-agent.yml tags: monitoring + +- import_tasks: register-host.yml + tags: monitoring diff --git a/roles/monitoring/tasks/register-host.yml b/roles/monitoring/tasks/register-host.yml new file mode 100644 index 0000000..77e24a7 --- /dev/null +++ b/roles/monitoring/tasks/register-host.yml @@ -0,0 +1,75 @@ +--- +# Register (or update) the host on the Zabbix server via the API, +# using the per-host PSK that was deployed to the agent. + +- name: Combine templates (add Docker templates when socket is present) + ansible.builtin.set_fact: + monitoring_zabbix_link_templates: >- + {{ + monitoring_zabbix_templates + | default([]) + | union( + (monitoring_docker_socket.stat.exists | default(false)) + | ternary(monitoring_zabbix_docker_templates | default([]), []) + ) + }} + +- name: Build agent interface description + ansible.builtin.set_fact: + monitoring_zabbix_interfaces: + - type: agent + main: true + useip: true + ip: "{{ monitoring_zabbix_host_interface_ip }}" + dns: "{{ inventory_hostname }}" + port: "{{ monitoring_zabbix_host_interface_port }}" + +- name: Register or update host in Zabbix (monitored by proxy) + community.zabbix.zabbix_host: + server_url: "{{ monitoring_zabbix_api_url }}" + login_user: "{{ monitoring_zabbix_api_user }}" + login_password: "{{ monitoring_zabbix_api_password }}" + validate_certs: "{{ monitoring_zabbix_api_validate_certs }}" + host_name: "{{ monitoring_zabbix_host_name }}" + visible_name: "{{ monitoring_zabbix_host_name }}" + host_groups: "{{ monitoring_zabbix_host_groups }}" + link_templates: "{{ monitoring_zabbix_link_templates }}" + interfaces: "{{ monitoring_zabbix_interfaces }}" + inventory_mode: "{{ monitoring_zabbix_host_inventory_mode }}" + monitored_by: proxy + proxy: "{{ monitoring_zabbix_proxy }}" + tls_connect: 2 + tls_accept: 2 + tls_psk_identity: "{{ monitoring_zabbix_psk_identity }}" + tls_psk: "{{ monitoring_zabbix_psk_value }}" + status: enabled + state: present + delegate_to: localhost + become: false + when: + - monitoring_zabbix_register_host | bool + - monitoring_zabbix_proxy | length > 0 + +- name: Register or update host in Zabbix (monitored by server) + community.zabbix.zabbix_host: + server_url: "{{ monitoring_zabbix_api_url }}" + login_user: "{{ monitoring_zabbix_api_user }}" + login_password: "{{ monitoring_zabbix_api_password }}" + validate_certs: "{{ monitoring_zabbix_api_validate_certs }}" + host_name: "{{ monitoring_zabbix_host_name }}" + visible_name: "{{ monitoring_zabbix_host_name }}" + host_groups: "{{ monitoring_zabbix_host_groups }}" + link_templates: "{{ monitoring_zabbix_link_templates }}" + interfaces: "{{ monitoring_zabbix_interfaces }}" + inventory_mode: "{{ monitoring_zabbix_host_inventory_mode }}" + tls_connect: 2 + tls_accept: 2 + tls_psk_identity: "{{ monitoring_zabbix_psk_identity }}" + tls_psk: "{{ monitoring_zabbix_psk_value }}" + status: enabled + state: present + delegate_to: localhost + become: false + when: + - monitoring_zabbix_register_host | bool + - monitoring_zabbix_proxy | length == 0 \ No newline at end of file diff --git a/roles/monitoring/tasks/validate.yml b/roles/monitoring/tasks/validate.yml index 2039021..ca22e72 100644 --- a/roles/monitoring/tasks/validate.yml +++ b/roles/monitoring/tasks/validate.yml @@ -1,11 +1,36 @@ ---- -- name: Stop playbook if system is not Debian - ansible.builtin.fail: - msg: "This role only supports Debian." - when: ansible_facts['os_family'] != "Debian" - -- name: Ensure Zabbix passive servers are defined - ansible.builtin.assert: - that: - - monitoring_zabbix_passive_servers | length > 0 - fail_msg: "Set monitoring_zabbix_passive_servers to the IPs, CIDRs or DNS names allowed to query the agent." +--- +- name: Stop playbook if system is not Debian + ansible.builtin.fail: + msg: "This role only supports Debian." + when: ansible_facts['os_family'] != "Debian" + +- name: Ensure Zabbix passive servers are defined + ansible.builtin.assert: + that: + - monitoring_zabbix_passive_servers | length > 0 + fail_msg: "Set monitoring_zabbix_passive_servers to the IPs, CIDRs or DNS names allowed to query the agent." + +- name: Ensure Zabbix API settings are defined when host registration is enabled + ansible.builtin.assert: + that: + - monitoring_zabbix_api_url is defined + - monitoring_zabbix_api_url | length > 0 + - monitoring_zabbix_api_user is defined + - monitoring_zabbix_api_user | length > 0 + - monitoring_zabbix_api_password is defined + - monitoring_zabbix_api_password | length > 0 + fail_msg: >- + monitoring_zabbix_api_url, monitoring_zabbix_api_user and + monitoring_zabbix_api_password must be set (password lives in vault.yml) + when monitoring_zabbix_register_host is true. + when: monitoring_zabbix_register_host | bool + +- name: Ensure proxy address is set when a proxy is configured + ansible.builtin.assert: + that: + - monitoring_zabbix_proxy_address is defined + - monitoring_zabbix_proxy_address | length > 0 + fail_msg: >- + monitoring_zabbix_proxy_address (IP/DNS of the proxy the agent contacts) + must be set when monitoring_zabbix_proxy is defined. + when: monitoring_zabbix_proxy | length > 0 \ No newline at end of file diff --git a/roles/monitoring/templates/zabbix_agent2.conf.j2 b/roles/monitoring/templates/zabbix_agent2.conf.j2 index 76dd452..1fd0256 100644 --- a/roles/monitoring/templates/zabbix_agent2.conf.j2 +++ b/roles/monitoring/templates/zabbix_agent2.conf.j2 @@ -1,11 +1,23 @@ -# {{ ansible_managed }} -PidFile=/run/zabbix/zabbix_agent2.pid -LogFile=/var/log/zabbix/zabbix_agent2.log -LogFileSize=0 -Server={{ monitoring_zabbix_passive_servers | join(',') }} -{% if monitoring_zabbix_active_servers | length > 0 %} -ServerActive={{ monitoring_zabbix_active_servers | join(',') }} -{% endif %} -HostnameItem=system.hostname -ListenPort={{ monitoring_zabbix_listen_port }} -Include=/etc/zabbix/zabbix_agent2.d/*.conf +# {{ ansible_managed }} +PidFile=/run/zabbix/zabbix_agent2.pid +LogFile=/var/log/zabbix/zabbix_agent2.log +LogFileSize=0 +{% if monitoring_zabbix_proxy_address | length > 0 %} +Server={{ (monitoring_zabbix_passive_servers | union([monitoring_zabbix_proxy_address])) | unique | join(',') }} +ServerActive={{ monitoring_zabbix_proxy_address }} +{% else %} +Server={{ monitoring_zabbix_passive_servers | join(',') }} +{% if monitoring_zabbix_active_servers | length > 0 %} +ServerActive={{ monitoring_zabbix_active_servers | join(',') }} +{% endif %} +{% endif %} +Hostname={{ monitoring_zabbix_host_name }} +HostnameItem=system.hostname +ListenPort={{ monitoring_zabbix_listen_port }} +Include=/etc/zabbix/zabbix_agent2.d/*.conf + +# --- TLS (PSK) ---------------------------------------------------------------- +TLSConnect={{ monitoring_zabbix_tls_connect }} +TLSAccept={{ monitoring_zabbix_tls_accept }} +TLSPSKIdentity={{ monitoring_zabbix_psk_identity }} +TLSPSKFile={{ monitoring_zabbix_psk_file }} \ No newline at end of file diff --git a/vault.yml b/vault.yml index 23dede5..27725a9 100644 --- a/vault.yml +++ b/vault.yml @@ -1,9 +1,11 @@ $ANSIBLE_VAULT;1.1;AES256 -34323331303232653139313063663566323064373330346237653366363965303235376230396534 -3364383031333064336239653661313066383534626565320a666433333038303938333163363030 -65623133356566313263616564626166396635343863353065646538343333383066333839666239 -3739643861393534360a353837636662303065623735373063313937633731636338643631623435 -65613634316432373837393638636165326231616563353765376533313336373165313436353566 -65346536316533343966323531333866626162363837653762383265366632323330646665643635 -62653238353738613937393632336132646364633962646637353331613061363564346234333439 -63356431373962343737 +31306438393238643764333164633738323833656131303331396336346461623633623531303563 +3261353763303939633537356239633937633536336530340a353462653030306433613062323861 +38313631613134646231346632653366346637316639343764313161303937656535323739636235 +3933646232616635350a383165613538613264343264633466326266646463356463643565336238 +31633237386565653635366164383962386338313739646466636564653338613635653636376665 +65376631373166303438663565623061333133373630626137636266333865363433653666646135 +34396630633265343036623436626439636534656438303265343537353661646335316665303664 +61356135386138633433373466396530373839326664623562373066303039303235386139613065 +39373864333638643862386232313437376631343133353966633130623834633764643838656361 +6538623334323266313139326466326633643363313563333039