Monitoring psk (#2)
Co-authored-by: DerLinkman <derlinkman@gmail.com> Reviewed-on: #2
This commit was merged in pull request #2.
This commit is contained in:
DerLinkman
@@ -0,0 +1,55 @@
|
||||
---
|
||||
# Generate a per-host PSK on the Ansible controller and deploy it to the agent.
|
||||
# The PSK is persisted under monitoring_zabbix_psk_store so that re-runs keep
|
||||
# the same secret and the Zabbix server registration stays in sync.
|
||||
|
||||
- name: Ensure PSK store directory exists on controller
|
||||
ansible.builtin.file:
|
||||
path: "{{ monitoring_zabbix_psk_store }}"
|
||||
state: directory
|
||||
mode: "{{ monitoring_zabbix_psk_store_mode }}"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
run_once: false
|
||||
|
||||
- name: Check whether PSK already exists on controller
|
||||
ansible.builtin.stat:
|
||||
path: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: monitoring_psk_existing
|
||||
|
||||
- name: Generate per-host PSK when missing
|
||||
ansible.builtin.shell: |
|
||||
umask 077
|
||||
openssl rand -hex {{ (monitoring_zabbix_psk_bits / 8) | int }} \
|
||||
> "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
|
||||
args:
|
||||
creates: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: monitoring_psk_generated
|
||||
|
||||
- name: Slurp PSK from controller
|
||||
ansible.builtin.set_fact:
|
||||
monitoring_zabbix_psk_value: >-
|
||||
{{ lookup('ansible.builtin.file',
|
||||
monitoring_zabbix_psk_store ~ '/' ~ inventory_hostname ~ '.psk')
|
||||
| trim }}
|
||||
|
||||
- name: Ensure Zabbix agent runtime directory exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ monitoring_zabbix_psk_file | dirname | default('/etc/zabbix') }}"
|
||||
state: directory
|
||||
owner: root
|
||||
group: "{{ monitoring_zabbix_agent_user }}"
|
||||
mode: '0750'
|
||||
|
||||
- name: Deploy PSK file to agent host
|
||||
ansible.builtin.copy:
|
||||
content: "{{ monitoring_zabbix_psk_value }}\n"
|
||||
dest: "{{ monitoring_zabbix_psk_file }}"
|
||||
owner: "{{ monitoring_zabbix_agent_user }}"
|
||||
group: "{{ monitoring_zabbix_agent_user }}"
|
||||
mode: '0600'
|
||||
notify: Restart Zabbix Agent
|
||||
@@ -10,5 +10,11 @@
|
||||
- import_tasks: configure-docker.yml
|
||||
tags: monitoring
|
||||
|
||||
- import_tasks: configure-psk.yml
|
||||
tags: monitoring
|
||||
|
||||
- import_tasks: configure-agent.yml
|
||||
tags: monitoring
|
||||
|
||||
- import_tasks: register-host.yml
|
||||
tags: monitoring
|
||||
|
||||
@@ -0,0 +1,75 @@
|
||||
---
|
||||
# Register (or update) the host on the Zabbix server via the API,
|
||||
# using the per-host PSK that was deployed to the agent.
|
||||
|
||||
- name: Combine templates (add Docker templates when socket is present)
|
||||
ansible.builtin.set_fact:
|
||||
monitoring_zabbix_link_templates: >-
|
||||
{{
|
||||
monitoring_zabbix_templates
|
||||
| default([])
|
||||
| union(
|
||||
(monitoring_docker_socket.stat.exists | default(false))
|
||||
| ternary(monitoring_zabbix_docker_templates | default([]), [])
|
||||
)
|
||||
}}
|
||||
|
||||
- name: Build agent interface description
|
||||
ansible.builtin.set_fact:
|
||||
monitoring_zabbix_interfaces:
|
||||
- type: agent
|
||||
main: true
|
||||
useip: true
|
||||
ip: "{{ monitoring_zabbix_host_interface_ip }}"
|
||||
dns: "{{ inventory_hostname }}"
|
||||
port: "{{ monitoring_zabbix_host_interface_port }}"
|
||||
|
||||
- name: Register or update host in Zabbix (monitored by proxy)
|
||||
community.zabbix.zabbix_host:
|
||||
server_url: "{{ monitoring_zabbix_api_url }}"
|
||||
login_user: "{{ monitoring_zabbix_api_user }}"
|
||||
login_password: "{{ monitoring_zabbix_api_password }}"
|
||||
validate_certs: "{{ monitoring_zabbix_api_validate_certs }}"
|
||||
host_name: "{{ monitoring_zabbix_host_name }}"
|
||||
visible_name: "{{ monitoring_zabbix_host_name }}"
|
||||
host_groups: "{{ monitoring_zabbix_host_groups }}"
|
||||
link_templates: "{{ monitoring_zabbix_link_templates }}"
|
||||
interfaces: "{{ monitoring_zabbix_interfaces }}"
|
||||
inventory_mode: "{{ monitoring_zabbix_host_inventory_mode }}"
|
||||
monitored_by: proxy
|
||||
proxy: "{{ monitoring_zabbix_proxy }}"
|
||||
tls_connect: 2
|
||||
tls_accept: 2
|
||||
tls_psk_identity: "{{ monitoring_zabbix_psk_identity }}"
|
||||
tls_psk: "{{ monitoring_zabbix_psk_value }}"
|
||||
status: enabled
|
||||
state: present
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
when:
|
||||
- monitoring_zabbix_register_host | bool
|
||||
- monitoring_zabbix_proxy | length > 0
|
||||
|
||||
- name: Register or update host in Zabbix (monitored by server)
|
||||
community.zabbix.zabbix_host:
|
||||
server_url: "{{ monitoring_zabbix_api_url }}"
|
||||
login_user: "{{ monitoring_zabbix_api_user }}"
|
||||
login_password: "{{ monitoring_zabbix_api_password }}"
|
||||
validate_certs: "{{ monitoring_zabbix_api_validate_certs }}"
|
||||
host_name: "{{ monitoring_zabbix_host_name }}"
|
||||
visible_name: "{{ monitoring_zabbix_host_name }}"
|
||||
host_groups: "{{ monitoring_zabbix_host_groups }}"
|
||||
link_templates: "{{ monitoring_zabbix_link_templates }}"
|
||||
interfaces: "{{ monitoring_zabbix_interfaces }}"
|
||||
inventory_mode: "{{ monitoring_zabbix_host_inventory_mode }}"
|
||||
tls_connect: 2
|
||||
tls_accept: 2
|
||||
tls_psk_identity: "{{ monitoring_zabbix_psk_identity }}"
|
||||
tls_psk: "{{ monitoring_zabbix_psk_value }}"
|
||||
status: enabled
|
||||
state: present
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
when:
|
||||
- monitoring_zabbix_register_host | bool
|
||||
- monitoring_zabbix_proxy | length == 0
|
||||
@@ -1,11 +1,36 @@
|
||||
---
|
||||
- name: Stop playbook if system is not Debian
|
||||
ansible.builtin.fail:
|
||||
msg: "This role only supports Debian."
|
||||
when: ansible_facts['os_family'] != "Debian"
|
||||
|
||||
- name: Ensure Zabbix passive servers are defined
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- monitoring_zabbix_passive_servers | length > 0
|
||||
fail_msg: "Set monitoring_zabbix_passive_servers to the IPs, CIDRs or DNS names allowed to query the agent."
|
||||
---
|
||||
- name: Stop playbook if system is not Debian
|
||||
ansible.builtin.fail:
|
||||
msg: "This role only supports Debian."
|
||||
when: ansible_facts['os_family'] != "Debian"
|
||||
|
||||
- name: Ensure Zabbix passive servers are defined
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- monitoring_zabbix_passive_servers | length > 0
|
||||
fail_msg: "Set monitoring_zabbix_passive_servers to the IPs, CIDRs or DNS names allowed to query the agent."
|
||||
|
||||
- name: Ensure Zabbix API settings are defined when host registration is enabled
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- monitoring_zabbix_api_url is defined
|
||||
- monitoring_zabbix_api_url | length > 0
|
||||
- monitoring_zabbix_api_user is defined
|
||||
- monitoring_zabbix_api_user | length > 0
|
||||
- monitoring_zabbix_api_password is defined
|
||||
- monitoring_zabbix_api_password | length > 0
|
||||
fail_msg: >-
|
||||
monitoring_zabbix_api_url, monitoring_zabbix_api_user and
|
||||
monitoring_zabbix_api_password must be set (password lives in vault.yml)
|
||||
when monitoring_zabbix_register_host is true.
|
||||
when: monitoring_zabbix_register_host | bool
|
||||
|
||||
- name: Ensure proxy address is set when a proxy is configured
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- monitoring_zabbix_proxy_address is defined
|
||||
- monitoring_zabbix_proxy_address | length > 0
|
||||
fail_msg: >-
|
||||
monitoring_zabbix_proxy_address (IP/DNS of the proxy the agent contacts)
|
||||
must be set when monitoring_zabbix_proxy is defined.
|
||||
when: monitoring_zabbix_proxy | length > 0
|
||||
Reference in New Issue
Block a user