Monitoring psk (#2)
Co-authored-by: DerLinkman <derlinkman@gmail.com> Reviewed-on: #2
This commit was merged in pull request #2.
This commit is contained in:
DerLinkman
+3
-1
@@ -2,4 +2,6 @@ hosts
|
||||
proxmox.*
|
||||
.vscode
|
||||
.vault_pass
|
||||
logs
|
||||
logs
|
||||
.zabbix-psk
|
||||
setenv.sh
|
||||
@@ -1 +1,20 @@
|
||||
monitoring_zabbix_passive_servers: ["10.13.37.1"]
|
||||
monitoring_zabbix_passive_servers: ["10.13.37.1"]
|
||||
monitoring_zabbix_active_servers: ["10.13.37.1"]
|
||||
|
||||
# Zabbix server API (password lives in vault.yml as monitoring_zabbix_api_password)
|
||||
monitoring_zabbix_api_url: "https://zabbix/api_jsonrpc.php"
|
||||
monitoring_zabbix_api_user: Admin
|
||||
monitoring_zabbix_api_validate_certs: true
|
||||
|
||||
# Host registration defaults for the home inventory
|
||||
monitoring_zabbix_host_groups: ["Linux servers"]
|
||||
monitoring_zabbix_templates: ["Linux by Zabbix agent", "Zabbix agent2"]
|
||||
monitoring_zabbix_docker_templates: ["Docker by Zabbix agent2"]
|
||||
|
||||
# --- Zabbix Proxy (optional) -------------------------------------------------
|
||||
# Leave empty to have agents talk to the Zabbix server directly.
|
||||
# Per-site override example (e.g. inventory/group_vars/standort-a.yml):
|
||||
# monitoring_zabbix_proxy: "fw-standort-a"
|
||||
# monitoring_zabbix_proxy_address: "10.20.30.1"
|
||||
monitoring_zabbix_proxy: ""
|
||||
monitoring_zabbix_proxy_address: ""
|
||||
@@ -0,0 +1,176 @@
|
||||
# Rolle `monitoring`
|
||||
|
||||
Installiert und konfiguriert den **Zabbix Agent 2** auf Debian-Hosts,
|
||||
generiert/verteilt pro Host eine TLS-PSK, konfiguriert das Docker-Plugin
|
||||
(bei vorhandenem Socket) und registriert den Host über die Zabbix-API
|
||||
einschließlich Template-Verlinkung.
|
||||
|
||||
> Siehe auch das Playbook `playbooks/monitoring.yml` sowie die
|
||||
> [Repo-README](../../README.md).
|
||||
|
||||
## Voraussetzungen
|
||||
|
||||
- Debian-Ziel-Host
|
||||
- Erreichbarer Zabbix-Server (API & Agent-Polling)
|
||||
- `community.zabbix` Collection
|
||||
- Vault-Secret `monitoring_zabbix_api_password` in `vault.yml`
|
||||
- OpenSSL auf dem Ansible-Controller (für PSK-Generierung)
|
||||
|
||||
## Einbindung
|
||||
|
||||
```yaml
|
||||
- hosts: all
|
||||
become: true
|
||||
user: admin
|
||||
roles:
|
||||
- role: monitoring
|
||||
```
|
||||
|
||||
```bash
|
||||
ansible-playbook -i inventory/dmc12.yml --vault-password-file .vault_password \
|
||||
playbooks/monitoring.yml
|
||||
```
|
||||
|
||||
## Funktionsweise
|
||||
|
||||
`tasks/main.yml` importiert die Subtasks in folgender Reihenfolge (alle mit
|
||||
Tag `monitoring`):
|
||||
|
||||
1. **`validate.yml`** – bricht bei Nicht-Debian ab, prüft dass
|
||||
`monitoring_zabbix_passive_servers` gesetzt ist und (bei aktivierter
|
||||
Registrierung) API-URL/-User/-Passwort vorliegen. Stellt sicher, dass
|
||||
bei gesetztem `monitoring_zabbix_proxy` auch eine Proxy-Adresse definiert ist.
|
||||
2. **`install-repository.yml`** – installiert `ca-certificates`, lädt das
|
||||
Zabbix-Release-Paket herunter, installiert es und aktualisiert den
|
||||
apt-Cache.
|
||||
3. **`install-agent.yml`** – installiert `zabbix-agent2` und aktiviert/startet
|
||||
den Service.
|
||||
4. **`configure-docker.yml`** – prüft, ob der Docker-Socket existiert. Falls
|
||||
ja: Zabbix-User zur Docker-Gruppe hinzufügen, Plugin-Config-Verzeichnis
|
||||
anlegen, `docker.conf` aus Template ausliefern. Falls nein: Plugin-Config
|
||||
entfernen.
|
||||
5. **`configure-psk.yml`** – stellt PSK-Store auf dem Controller sicher
|
||||
(`<playbook_dir>/../.zabbix-psk`), generiert pro Host eine PSK mit
|
||||
`openssl rand -hex`, persistiert sie im Store und verteilt sie auf den
|
||||
Zielhost (`/etc/zabbix/zabbix_agent2.psk`, Mode `0600`).
|
||||
6. **`configure-agent.yml`** – schreibt `zabbix_agent2.conf` aus Template.
|
||||
7. **`register-host.yml`** – registriert bzw. aktualisiert den Host über die
|
||||
Zabbix-API (`community.zabbix.zabbix_host`). Verknüpft Standard-Templates
|
||||
und ggf. Docker-Templates. Unterscheidet zwischen Proxy- und
|
||||
Server-Modus (zwei Tasks, gegeneinander exklusiv). Delegiert an localhost.
|
||||
|
||||
## Variablen
|
||||
|
||||
### Zabbix-Agent
|
||||
|
||||
| Variable | Typ | Default | Beschreibung |
|
||||
|--------------------------------------------|--------|--------------------------------------|-----------------------------------------------------|
|
||||
| `monitoring_zabbix_version` | string | `7.0` | Zabbix-Hauptversion |
|
||||
| `monitoring_zabbix_release_package` | string | abgeleitet | Dateiname des Release-Pakets |
|
||||
| `monitoring_zabbix_release_url` | string | abgeleitet | Download-URL des Release-Pakets |
|
||||
| `monitoring_zabbix_release_path` | string | `/tmp/<package>` | lokaler Ablagepfad auf dem Zielhost |
|
||||
| `monitoring_zabbix_agent_package` | string | `zabbix-agent2` | Zu installierendes Agent-Paket |
|
||||
| `monitoring_zabbix_agent_service` | string | `zabbix-agent2` | systemd-Service-Name |
|
||||
| `monitoring_zabbix_config_file` | string | `/etc/zabbix/zabbix_agent2.conf` | Pfad zur Agent-Konfiguration |
|
||||
| `monitoring_zabbix_agent_user` | string | `zabbix` | Benutzer, unter dem der Agent läuft |
|
||||
| `monitoring_zabbix_passive_servers` | list | `["192.168.212.1"]` | Erlaubte Server für passive Checks (Server=) |
|
||||
| `monitoring_zabbix_active_servers` | list | `""` | Server für aktive Checks (ServerActive=) |
|
||||
| `monitoring_zabbix_listen_port` | int | `10050` | Listen-Port des Agents |
|
||||
|
||||
### Docker-Plugin
|
||||
|
||||
| Variable | Typ | Default | Beschreibung |
|
||||
|-----------------------------------------------------|--------|--------------------------------------|-----------------------------------------------|
|
||||
| `monitoring_zabbix_docker_group` | string | `docker` | Docker-Gruppe für Socket-Zugriff |
|
||||
| `monitoring_zabbix_docker_socket_path` | string | `/var/run/docker.sock` | Pfad zum Docker-Socket |
|
||||
| `monitoring_zabbix_docker_plugin_config_file` | string | `/etc/zabbix/zabbix_agent2.d/plugins.d/docker.conf` | Pfad zur Plugin-Config |
|
||||
| `monitoring_zabbix_docker_endpoint` | string | `unix://<socket>` | Docker-Endpoint für das Plugin |
|
||||
|
||||
### TLS / PSK
|
||||
|
||||
| Variable | Typ | Default | Beschreibung |
|
||||
|-----------------------------------------|--------|--------------------------------------|---------------------------------------------------------|
|
||||
| `monitoring_zabbix_tls_connect` | string | `psk` | TLS-Modus für ausgehende Verbindungen |
|
||||
| `monitoring_zabbix_tls_accept` | string | `psk` | TLS-Modus für eingehende Verbindungen |
|
||||
| `monitoring_zabbix_psk_identity` | string | `{{ inventory_hostname }}` | PSK-Identity (hostname) |
|
||||
| `monitoring_zabbix_psk_file` | string | `/etc/zabbix/zabbix_agent2.psk` | Pfad zur PSK-Datei auf dem Zielhost |
|
||||
| `monitoring_zabbix_psk_bits` | int | `256` | PSK-Länge in Bits (32 Byte → 64 Hex-Chars) |
|
||||
| `monitoring_zabbix_psk_store` | string | `{{ playbook_dir }}/../.zabbix-psk` | PSK-Store-Verzeichnis auf dem Controller |
|
||||
| `monitoring_zabbix_psk_store_mode` | string | `0700` | Berechtigung des PSK-Stores |
|
||||
|
||||
### Zabbix Proxy (optional)
|
||||
|
||||
| Variable | Typ | Default | Beschreibung |
|
||||
|-------------------------------------|--------|---------|-----------------------------------------------------------|
|
||||
| `monitoring_zabbix_proxy` | string | `""` | Name des Proxys in Zabbix (leer = direkter Server-Modus) |
|
||||
| `monitoring_zabbix_proxy_address` | string | `""` | IP/DNS des Proxys, den der Agent kontaktiert |
|
||||
|
||||
### Zabbix API / Host-Registrierung
|
||||
|
||||
| Variable | Typ | Default | Beschreibung |
|
||||
|---------------------------------------------|--------|--------------------------------------|---------------------------------------------------------|
|
||||
| `monitoring_zabbix_api_url` | string | `https://zabbix/api_jsonrpc.php` | API-URL |
|
||||
| `monitoring_zabbix_api_user` | string | `Admin` | API-Benutzer |
|
||||
| `monitoring_zabbix_api_password` | string | (Vault) | API-Passwort – MUSS in `vault.yml` gesetzt werden |
|
||||
| `monitoring_zabbix_api_validate_certs` | bool | `true` | TLS-Zertifikate prüfen |
|
||||
| `monitoring_zabbix_register_host` | bool | `true` | Host automatisch registrieren |
|
||||
| `monitoring_zabbix_host_name` | string | `{{ inventory_hostname }}` | Hostname in Zabbix |
|
||||
| `monitoring_zabbix_host_groups` | list | `["Linux servers"]` | Zabbix-Host-Gruppen |
|
||||
| `monitoring_zabbix_host_interface_ip` | string | `{{ ansible_host }}` | Interface-IP |
|
||||
| `monitoring_zabbix_host_interface_port` | string | `{{ monitoring_zabbix_listen_port }}`| Interface-Port |
|
||||
| `monitoring_zabbix_host_inventory_mode` | string | `manual` | Inventory-Modus |
|
||||
| `monitoring_zabbix_templates` | list | `["Linux by Zabbix agent", "Zabbix agent2"]` | Standard-Templates |
|
||||
| `monitoring_zabbix_docker_templates` | list | `["Docker by Zabbix agent2"]` | Zusätzliche Templates bei vorhandenem Docker-Socket |
|
||||
|
||||
### Inventory-Overrides
|
||||
|
||||
In `inventory/group_vars/home.yml` werden u. a. überschrieben:
|
||||
`monitoring_zabbix_passive_servers`, `monitoring_zabbix_active_servers`,
|
||||
`monitoring_zabbix_api_url`, `monitoring_zabbix_host_groups`,
|
||||
`monitoring_zabbix_templates`, `monitoring_zabbix_docker_templates`,
|
||||
`monitoring_zabbix_proxy`, `monitoring_zabbix_proxy_address`.
|
||||
|
||||
## Templates
|
||||
|
||||
| Template | Ziel |
|
||||
|-------------------------|------------------------------------------------|
|
||||
| `zabbix_agent2.conf.j2` | `/etc/zabbix/zabbix_agent2.conf` |
|
||||
| `docker.conf.j2` | `/etc/zabbix/zabbix_agent2.d/plugins.d/docker.conf` |
|
||||
|
||||
`zabbix_agent2.conf.j2` berücksichtigt Proxy-Konfiguration (vereinigt
|
||||
Passive-Servers mit Proxy-Adresse, setzt `ServerActive` auf Proxy).
|
||||
|
||||
## Handler
|
||||
|
||||
| Handler | Auslöser |
|
||||
|-----------------------|--------------------------------------------|
|
||||
| `Restart Zabbix Agent`| Änderungen an Config, PSK oder Docker-Plugin|
|
||||
|
||||
## Tags
|
||||
|
||||
`monitoring` – alle Subtasks sind mit diesem Tag versehen:
|
||||
|
||||
```bash
|
||||
ansible-playbook -i inventory/dmc12.yml playbooks/monitoring.yml -t monitoring
|
||||
```
|
||||
|
||||
## Abhängigkeiten
|
||||
|
||||
- `community.zabbix` Collection (`zabbix_host`-Modul)
|
||||
- `ansible.builtin` (Bordmittel)
|
||||
- OpenSSL auf dem Controller (für PSK-Generierung)
|
||||
|
||||
## Hinweise
|
||||
|
||||
- **PSK-Store**: Pro Host wird eine PSK unter
|
||||
`<playbook_dir>/../.zabbix-psk/<hostname>.psk` (git-ignored) gespeichert.
|
||||
Bei Host-Umbenennung PSK migrieren oder neu generieren – sonst stimmt die
|
||||
Zabbix-Registrierung nicht.
|
||||
- **API-Passwort** MUSS in `vault.yml` als `monitoring_zabbix_api_password`
|
||||
gesetzt sein; die Validate-Tasks brechen sonst ab.
|
||||
- **Docker-Plugin** wird nur konfiguriert, wenn der Socket existiert – sonst
|
||||
wird eine eventuell vorhandene Plugin-Config entfernt (Idempotenz).
|
||||
- Die Registrierung wird **delegiert an localhost** ausgeführt, da der
|
||||
Controller den API-Zugang besitzt.
|
||||
- Proxy- und Server-Modus schließen sich gegenseitig aus (zwei Tasks mit
|
||||
entgegengesetzten `when`-Bedingungen).
|
||||
@@ -1,15 +1,48 @@
|
||||
monitoring_zabbix_version: "7.0"
|
||||
monitoring_zabbix_release_package: "zabbix-release_latest_{{ monitoring_zabbix_version }}+debian{{ ansible_distribution_major_version }}_all.deb"
|
||||
monitoring_zabbix_release_url: "https://repo.zabbix.com/zabbix/{{ monitoring_zabbix_version }}/debian/pool/main/z/zabbix-release/{{ monitoring_zabbix_release_package }}"
|
||||
monitoring_zabbix_release_path: "/tmp/{{ monitoring_zabbix_release_package }}"
|
||||
monitoring_zabbix_agent_package: zabbix-agent2
|
||||
monitoring_zabbix_agent_service: zabbix-agent2
|
||||
monitoring_zabbix_config_file: /etc/zabbix/zabbix_agent2.conf
|
||||
monitoring_zabbix_agent_user: zabbix
|
||||
monitoring_zabbix_passive_servers: ["192.168.212.1"]
|
||||
monitoring_zabbix_active_servers: ""
|
||||
monitoring_zabbix_listen_port: 10050
|
||||
monitoring_zabbix_docker_group: docker
|
||||
monitoring_zabbix_docker_socket_path: /var/run/docker.sock
|
||||
monitoring_zabbix_docker_plugin_config_file: /etc/zabbix/zabbix_agent2.d/plugins.d/docker.conf
|
||||
monitoring_zabbix_docker_endpoint: "unix://{{ monitoring_zabbix_docker_socket_path }}"
|
||||
monitoring_zabbix_version: "7.0"
|
||||
monitoring_zabbix_release_package: "zabbix-release_latest_{{ monitoring_zabbix_version }}+debian{{ ansible_distribution_major_version }}_all.deb"
|
||||
monitoring_zabbix_release_url: "https://repo.zabbix.com/zabbix/{{ monitoring_zabbix_version }}/debian/pool/main/z/zabbix-release/{{ monitoring_zabbix_release_package }}"
|
||||
monitoring_zabbix_release_path: "/tmp/{{ monitoring_zabbix_release_package }}"
|
||||
monitoring_zabbix_agent_package: zabbix-agent2
|
||||
monitoring_zabbix_agent_service: zabbix-agent2
|
||||
monitoring_zabbix_config_file: /etc/zabbix/zabbix_agent2.conf
|
||||
monitoring_zabbix_agent_user: zabbix
|
||||
monitoring_zabbix_passive_servers: ["192.168.212.1"]
|
||||
monitoring_zabbix_active_servers: ""
|
||||
monitoring_zabbix_listen_port: 10050
|
||||
monitoring_zabbix_docker_group: docker
|
||||
monitoring_zabbix_docker_socket_path: /var/run/docker.sock
|
||||
monitoring_zabbix_docker_plugin_config_file: /etc/zabbix/zabbix_agent2.d/plugins.d/docker.conf
|
||||
monitoring_zabbix_docker_endpoint: "unix://{{ monitoring_zabbix_docker_socket_path }}"
|
||||
|
||||
# --- TLS / PSK ----------------------------------------------------------------
|
||||
monitoring_zabbix_tls_connect: psk # outgoing connections from agent: psk
|
||||
monitoring_zabbix_tls_accept: psk # incoming connections to agent: psk
|
||||
monitoring_zabbix_psk_identity: "{{ inventory_hostname }}"
|
||||
monitoring_zabbix_psk_file: /etc/zabbix/zabbix_agent2.psk
|
||||
monitoring_zabbix_psk_bits: 256 # 32 bytes -> 64 hex chars
|
||||
# Directory on the Ansible controller used to persist per-host PSKs across runs.
|
||||
monitoring_zabbix_psk_store: "{{ playbook_dir }}/../.zabbix-psk"
|
||||
monitoring_zabbix_psk_store_mode: "0700"
|
||||
|
||||
# --- Zabbix Proxy (optional) --------------------------------------------------
|
||||
# Leave both empty to have the agent talk to the Zabbix server directly.
|
||||
# monitoring_zabbix_proxy: name of the proxy in Zabbix (for API assignment)
|
||||
# monitoring_zabbix_proxy_address: IP/DNS of the proxy the agent should contact
|
||||
monitoring_zabbix_proxy: ""
|
||||
monitoring_zabbix_proxy_address: ""
|
||||
|
||||
# --- Zabbix API / host registration ------------------------------------------
|
||||
monitoring_zabbix_api_url: "https://zabbix/api_jsonrpc.php"
|
||||
monitoring_zabbix_api_user: Admin
|
||||
# monitoring_zabbix_api_password: <set in vault.yml>
|
||||
monitoring_zabbix_api_validate_certs: true
|
||||
monitoring_zabbix_register_host: true
|
||||
monitoring_zabbix_host_name: "{{ inventory_hostname }}"
|
||||
monitoring_zabbix_host_groups: ["Linux servers"]
|
||||
monitoring_zabbix_host_interface_ip: "{{ ansible_host }}"
|
||||
monitoring_zabbix_host_interface_port: "{{ monitoring_zabbix_listen_port }}"
|
||||
monitoring_zabbix_host_inventory_mode: manual
|
||||
# Templates linked to every host
|
||||
monitoring_zabbix_templates: ["Linux by Zabbix agent", "Zabbix agent2"]
|
||||
# Templates added when a Docker socket is present on the host
|
||||
monitoring_zabbix_docker_templates: ["Docker by Zabbix agent2"]
|
||||
@@ -0,0 +1,55 @@
|
||||
---
|
||||
# Generate a per-host PSK on the Ansible controller and deploy it to the agent.
|
||||
# The PSK is persisted under monitoring_zabbix_psk_store so that re-runs keep
|
||||
# the same secret and the Zabbix server registration stays in sync.
|
||||
|
||||
- name: Ensure PSK store directory exists on controller
|
||||
ansible.builtin.file:
|
||||
path: "{{ monitoring_zabbix_psk_store }}"
|
||||
state: directory
|
||||
mode: "{{ monitoring_zabbix_psk_store_mode }}"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
run_once: false
|
||||
|
||||
- name: Check whether PSK already exists on controller
|
||||
ansible.builtin.stat:
|
||||
path: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: monitoring_psk_existing
|
||||
|
||||
- name: Generate per-host PSK when missing
|
||||
ansible.builtin.shell: |
|
||||
umask 077
|
||||
openssl rand -hex {{ (monitoring_zabbix_psk_bits / 8) | int }} \
|
||||
> "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
|
||||
args:
|
||||
creates: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: monitoring_psk_generated
|
||||
|
||||
- name: Slurp PSK from controller
|
||||
ansible.builtin.set_fact:
|
||||
monitoring_zabbix_psk_value: >-
|
||||
{{ lookup('ansible.builtin.file',
|
||||
monitoring_zabbix_psk_store ~ '/' ~ inventory_hostname ~ '.psk')
|
||||
| trim }}
|
||||
|
||||
- name: Ensure Zabbix agent runtime directory exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ monitoring_zabbix_psk_file | dirname | default('/etc/zabbix') }}"
|
||||
state: directory
|
||||
owner: root
|
||||
group: "{{ monitoring_zabbix_agent_user }}"
|
||||
mode: '0750'
|
||||
|
||||
- name: Deploy PSK file to agent host
|
||||
ansible.builtin.copy:
|
||||
content: "{{ monitoring_zabbix_psk_value }}\n"
|
||||
dest: "{{ monitoring_zabbix_psk_file }}"
|
||||
owner: "{{ monitoring_zabbix_agent_user }}"
|
||||
group: "{{ monitoring_zabbix_agent_user }}"
|
||||
mode: '0600'
|
||||
notify: Restart Zabbix Agent
|
||||
@@ -10,5 +10,11 @@
|
||||
- import_tasks: configure-docker.yml
|
||||
tags: monitoring
|
||||
|
||||
- import_tasks: configure-psk.yml
|
||||
tags: monitoring
|
||||
|
||||
- import_tasks: configure-agent.yml
|
||||
tags: monitoring
|
||||
|
||||
- import_tasks: register-host.yml
|
||||
tags: monitoring
|
||||
|
||||
@@ -0,0 +1,75 @@
|
||||
---
|
||||
# Register (or update) the host on the Zabbix server via the API,
|
||||
# using the per-host PSK that was deployed to the agent.
|
||||
|
||||
- name: Combine templates (add Docker templates when socket is present)
|
||||
ansible.builtin.set_fact:
|
||||
monitoring_zabbix_link_templates: >-
|
||||
{{
|
||||
monitoring_zabbix_templates
|
||||
| default([])
|
||||
| union(
|
||||
(monitoring_docker_socket.stat.exists | default(false))
|
||||
| ternary(monitoring_zabbix_docker_templates | default([]), [])
|
||||
)
|
||||
}}
|
||||
|
||||
- name: Build agent interface description
|
||||
ansible.builtin.set_fact:
|
||||
monitoring_zabbix_interfaces:
|
||||
- type: agent
|
||||
main: true
|
||||
useip: true
|
||||
ip: "{{ monitoring_zabbix_host_interface_ip }}"
|
||||
dns: "{{ inventory_hostname }}"
|
||||
port: "{{ monitoring_zabbix_host_interface_port }}"
|
||||
|
||||
- name: Register or update host in Zabbix (monitored by proxy)
|
||||
community.zabbix.zabbix_host:
|
||||
server_url: "{{ monitoring_zabbix_api_url }}"
|
||||
login_user: "{{ monitoring_zabbix_api_user }}"
|
||||
login_password: "{{ monitoring_zabbix_api_password }}"
|
||||
validate_certs: "{{ monitoring_zabbix_api_validate_certs }}"
|
||||
host_name: "{{ monitoring_zabbix_host_name }}"
|
||||
visible_name: "{{ monitoring_zabbix_host_name }}"
|
||||
host_groups: "{{ monitoring_zabbix_host_groups }}"
|
||||
link_templates: "{{ monitoring_zabbix_link_templates }}"
|
||||
interfaces: "{{ monitoring_zabbix_interfaces }}"
|
||||
inventory_mode: "{{ monitoring_zabbix_host_inventory_mode }}"
|
||||
monitored_by: proxy
|
||||
proxy: "{{ monitoring_zabbix_proxy }}"
|
||||
tls_connect: 2
|
||||
tls_accept: 2
|
||||
tls_psk_identity: "{{ monitoring_zabbix_psk_identity }}"
|
||||
tls_psk: "{{ monitoring_zabbix_psk_value }}"
|
||||
status: enabled
|
||||
state: present
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
when:
|
||||
- monitoring_zabbix_register_host | bool
|
||||
- monitoring_zabbix_proxy | length > 0
|
||||
|
||||
- name: Register or update host in Zabbix (monitored by server)
|
||||
community.zabbix.zabbix_host:
|
||||
server_url: "{{ monitoring_zabbix_api_url }}"
|
||||
login_user: "{{ monitoring_zabbix_api_user }}"
|
||||
login_password: "{{ monitoring_zabbix_api_password }}"
|
||||
validate_certs: "{{ monitoring_zabbix_api_validate_certs }}"
|
||||
host_name: "{{ monitoring_zabbix_host_name }}"
|
||||
visible_name: "{{ monitoring_zabbix_host_name }}"
|
||||
host_groups: "{{ monitoring_zabbix_host_groups }}"
|
||||
link_templates: "{{ monitoring_zabbix_link_templates }}"
|
||||
interfaces: "{{ monitoring_zabbix_interfaces }}"
|
||||
inventory_mode: "{{ monitoring_zabbix_host_inventory_mode }}"
|
||||
tls_connect: 2
|
||||
tls_accept: 2
|
||||
tls_psk_identity: "{{ monitoring_zabbix_psk_identity }}"
|
||||
tls_psk: "{{ monitoring_zabbix_psk_value }}"
|
||||
status: enabled
|
||||
state: present
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
when:
|
||||
- monitoring_zabbix_register_host | bool
|
||||
- monitoring_zabbix_proxy | length == 0
|
||||
@@ -1,11 +1,36 @@
|
||||
---
|
||||
- name: Stop playbook if system is not Debian
|
||||
ansible.builtin.fail:
|
||||
msg: "This role only supports Debian."
|
||||
when: ansible_facts['os_family'] != "Debian"
|
||||
|
||||
- name: Ensure Zabbix passive servers are defined
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- monitoring_zabbix_passive_servers | length > 0
|
||||
fail_msg: "Set monitoring_zabbix_passive_servers to the IPs, CIDRs or DNS names allowed to query the agent."
|
||||
---
|
||||
- name: Stop playbook if system is not Debian
|
||||
ansible.builtin.fail:
|
||||
msg: "This role only supports Debian."
|
||||
when: ansible_facts['os_family'] != "Debian"
|
||||
|
||||
- name: Ensure Zabbix passive servers are defined
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- monitoring_zabbix_passive_servers | length > 0
|
||||
fail_msg: "Set monitoring_zabbix_passive_servers to the IPs, CIDRs or DNS names allowed to query the agent."
|
||||
|
||||
- name: Ensure Zabbix API settings are defined when host registration is enabled
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- monitoring_zabbix_api_url is defined
|
||||
- monitoring_zabbix_api_url | length > 0
|
||||
- monitoring_zabbix_api_user is defined
|
||||
- monitoring_zabbix_api_user | length > 0
|
||||
- monitoring_zabbix_api_password is defined
|
||||
- monitoring_zabbix_api_password | length > 0
|
||||
fail_msg: >-
|
||||
monitoring_zabbix_api_url, monitoring_zabbix_api_user and
|
||||
monitoring_zabbix_api_password must be set (password lives in vault.yml)
|
||||
when monitoring_zabbix_register_host is true.
|
||||
when: monitoring_zabbix_register_host | bool
|
||||
|
||||
- name: Ensure proxy address is set when a proxy is configured
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- monitoring_zabbix_proxy_address is defined
|
||||
- monitoring_zabbix_proxy_address | length > 0
|
||||
fail_msg: >-
|
||||
monitoring_zabbix_proxy_address (IP/DNS of the proxy the agent contacts)
|
||||
must be set when monitoring_zabbix_proxy is defined.
|
||||
when: monitoring_zabbix_proxy | length > 0
|
||||
@@ -1,11 +1,23 @@
|
||||
# {{ ansible_managed }}
|
||||
PidFile=/run/zabbix/zabbix_agent2.pid
|
||||
LogFile=/var/log/zabbix/zabbix_agent2.log
|
||||
LogFileSize=0
|
||||
Server={{ monitoring_zabbix_passive_servers | join(',') }}
|
||||
{% if monitoring_zabbix_active_servers | length > 0 %}
|
||||
ServerActive={{ monitoring_zabbix_active_servers | join(',') }}
|
||||
{% endif %}
|
||||
HostnameItem=system.hostname
|
||||
ListenPort={{ monitoring_zabbix_listen_port }}
|
||||
Include=/etc/zabbix/zabbix_agent2.d/*.conf
|
||||
# {{ ansible_managed }}
|
||||
PidFile=/run/zabbix/zabbix_agent2.pid
|
||||
LogFile=/var/log/zabbix/zabbix_agent2.log
|
||||
LogFileSize=0
|
||||
{% if monitoring_zabbix_proxy_address | length > 0 %}
|
||||
Server={{ (monitoring_zabbix_passive_servers | union([monitoring_zabbix_proxy_address])) | unique | join(',') }}
|
||||
ServerActive={{ monitoring_zabbix_proxy_address }}
|
||||
{% else %}
|
||||
Server={{ monitoring_zabbix_passive_servers | join(',') }}
|
||||
{% if monitoring_zabbix_active_servers | length > 0 %}
|
||||
ServerActive={{ monitoring_zabbix_active_servers | join(',') }}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
Hostname={{ monitoring_zabbix_host_name }}
|
||||
HostnameItem=system.hostname
|
||||
ListenPort={{ monitoring_zabbix_listen_port }}
|
||||
Include=/etc/zabbix/zabbix_agent2.d/*.conf
|
||||
|
||||
# --- TLS (PSK) ----------------------------------------------------------------
|
||||
TLSConnect={{ monitoring_zabbix_tls_connect }}
|
||||
TLSAccept={{ monitoring_zabbix_tls_accept }}
|
||||
TLSPSKIdentity={{ monitoring_zabbix_psk_identity }}
|
||||
TLSPSKFile={{ monitoring_zabbix_psk_file }}
|
||||
@@ -1,9 +1,11 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
34323331303232653139313063663566323064373330346237653366363965303235376230396534
|
||||
3364383031333064336239653661313066383534626565320a666433333038303938333163363030
|
||||
65623133356566313263616564626166396635343863353065646538343333383066333839666239
|
||||
3739643861393534360a353837636662303065623735373063313937633731636338643631623435
|
||||
65613634316432373837393638636165326231616563353765376533313336373165313436353566
|
||||
65346536316533343966323531333866626162363837653762383265366632323330646665643635
|
||||
62653238353738613937393632336132646364633962646637353331613061363564346234333439
|
||||
63356431373962343737
|
||||
31306438393238643764333164633738323833656131303331396336346461623633623531303563
|
||||
3261353763303939633537356239633937633536336530340a353462653030306433613062323861
|
||||
38313631613134646231346632653366346637316639343764313161303937656535323739636235
|
||||
3933646232616635350a383165613538613264343264633466326266646463356463643565336238
|
||||
31633237386565653635366164383962386338313739646466636564653338613635653636376665
|
||||
65376631373166303438663565623061333133373630626137636266333865363433653666646135
|
||||
34396630633265343036623436626439636534656438303265343537353661646335316665303664
|
||||
61356135386138633433373466396530373839326664623562373066303039303235386139613065
|
||||
39373864333638643862386232313437376631343133353966633130623834633764643838656361
|
||||
6538623334323266313139326466326633643363313563333039
|
||||
|
||||
Reference in New Issue
Block a user