Monitoring psk (#2)

Co-authored-by: DerLinkman <derlinkman@gmail.com> Reviewed-on: #2
2026-07-18 19:37:52 +00:00
parent cab59c1658
commit a31751af1d
10 changed files with 452 additions and 47 deletions
@@ -0,0 +1,55 @@
+---
+# Generate a per-host PSK on the Ansible controller and deploy it to the agent.
+# The PSK is persisted under monitoring_zabbix_psk_store so that re-runs keep
+# the same secret and the Zabbix server registration stays in sync.
+
+- name: Ensure PSK store directory exists on controller
+  ansible.builtin.file:
+    path: "{{ monitoring_zabbix_psk_store }}"
+    state: directory
+    mode: "{{ monitoring_zabbix_psk_store_mode }}"
+  delegate_to: localhost
+  become: false
+  run_once: false
+
+- name: Check whether PSK already exists on controller
+  ansible.builtin.stat:
+    path: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
+  delegate_to: localhost
+  become: false
+  register: monitoring_psk_existing
+
+- name: Generate per-host PSK when missing
+  ansible.builtin.shell: |
+    umask 077
+    openssl rand -hex {{ (monitoring_zabbix_psk_bits / 8) | int }} \
+      > "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
+  args:
+    creates: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
+  delegate_to: localhost
+  become: false
+  register: monitoring_psk_generated
+
+- name: Slurp PSK from controller
+  ansible.builtin.set_fact:
+    monitoring_zabbix_psk_value: >-
+      {{ lookup('ansible.builtin.file',
+                monitoring_zabbix_psk_store ~ '/' ~ inventory_hostname ~ '.psk')
+         | trim }}
+
+- name: Ensure Zabbix agent runtime directory exists
+  ansible.builtin.file:
+    path: "{{ monitoring_zabbix_psk_file | dirname | default('/etc/zabbix') }}"
+    state: directory
+    owner: root
+    group: "{{ monitoring_zabbix_agent_user }}"
+    mode: '0750'
+
+- name: Deploy PSK file to agent host
+  ansible.builtin.copy:
+    content: "{{ monitoring_zabbix_psk_value }}\n"
+    dest: "{{ monitoring_zabbix_psk_file }}"
+    owner: "{{ monitoring_zabbix_agent_user }}"
+    group: "{{ monitoring_zabbix_agent_user }}"
+    mode: '0600'
+  notify: Restart Zabbix Agent