make bootstrap role usable with user variable to easily toggle on first run

bootstrap.yml

@@ -1,6 +1,6 @@
 - hosts: all
   become: true
-  remote_user: "{{ ansible_user|default('admin') }}"
+  remote_user: "{{ user|default('admin') }}"
   tasks:
     - name: Verify if system is Debian
       debug:

playbooks/monitoring.yml

@@ -0,0 +1,18 @@
+- hosts: all
+  user: admin
+  become: true
+  tasks:
+    - name: Verify if system is Debian
+      debug:
+        msg: "This playbook is running on a Debian system."
+      when: ansible_facts['os_family'] == "Debian"
+
+    - name: Stop playbook if system is not Debian
+      fail:
+        msg: "This playbook only supports Debian."
+      when: ansible_facts['os_family'] != "Debian"
+
+    - name: Include monitoring role
+      import_role:
+        name: monitoring
+      when: ansible_facts['os_family'] == "Debian"

roles/docker/defaults/main.yml

@@ -1,5 +1,5 @@
 docker_mirror: https://download.docker.com/linux/debian
-os_version_codename: "{{ ansible_lsb.codename }}"
+os_version_codename: "{{ ansible_facts['distribution_release'] | lower }}"
 docker_packages:
   - docker-ce
   - docker-ce-cli

roles/docker/tasks/main.yml

@@ -1,2 +1,6 @@
 - name: Include Docker installation tasks
   ansible.builtin.include_tasks: install-docker.yml
+  when: docker_check is failed
+
+- name: Include Docker APT migration tasks
+  ansible.builtin.include_tasks: migrate-apt.yml

roles/docker/tasks/migrate-apt.yml

@@ -0,0 +1,23 @@
+- name: Remove old Docker APT repo list files (legacy deb format)
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - /etc/apt/sources.list.d/docker.list
+    - /etc/apt/sources.list.d/docker-ce.list
+    - /etc/apt/sources.list.d/download_docker_com_linux_ubuntu.list
+  register: docker_apt_sources_cleanup
+  failed_when: false
+
+- name: Remove legacy Docker repo entries from /etc/apt/sources.list
+  ansible.builtin.lineinfile:
+    path: /etc/apt/sources.list
+    regexp: '^deb\s+.*download\.docker\.com/linux/.*$'
+    state: absent
+  register: docker_sources_list_cleanup
+  failed_when: false
+
+- name: Update apt cache after legacy Docker repo cleanup
+  ansible.builtin.apt:
+    update_cache: true
+  when: docker_apt_sources_cleanup is changed or docker_sources_list_cleanup is changed

roles/monitoring/defaults/main.yml

@@ -0,0 +1,15 @@
+monitoring_zabbix_version: "7.0"
+monitoring_zabbix_release_package: "zabbix-release_latest_{{ monitoring_zabbix_version }}+debian{{ ansible_distribution_major_version }}_all.deb"
+monitoring_zabbix_release_url: "https://repo.zabbix.com/zabbix/{{ monitoring_zabbix_version }}/debian/pool/main/z/zabbix-release/{{ monitoring_zabbix_release_package }}"
+monitoring_zabbix_release_path: "/tmp/{{ monitoring_zabbix_release_package }}"
+monitoring_zabbix_agent_package: zabbix-agent2
+monitoring_zabbix_agent_service: zabbix-agent2
+monitoring_zabbix_config_file: /etc/zabbix/zabbix_agent2.conf
+monitoring_zabbix_agent_user: zabbix
+monitoring_zabbix_passive_servers: ["192.168.212.1"]
+monitoring_zabbix_active_servers: ""
+monitoring_zabbix_listen_port: 10050
+monitoring_zabbix_docker_group: docker
+monitoring_zabbix_docker_socket_path: /var/run/docker.sock
+monitoring_zabbix_docker_plugin_config_file: /etc/zabbix/zabbix_agent2.d/plugins.d/docker.conf
+monitoring_zabbix_docker_endpoint: "unix://{{ monitoring_zabbix_docker_socket_path }}"

roles/monitoring/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart Zabbix Agent
+  ansible.builtin.systemd:
+    name: "{{ monitoring_zabbix_agent_service }}"
+    state: restarted
+    daemon_reload: yes

roles/monitoring/tasks/configure-agent.yml

@@ -0,0 +1,9 @@
+---
+- name: Configure Zabbix agent
+  ansible.builtin.template:
+    src: zabbix_agent2.conf.j2
+    dest: "{{ monitoring_zabbix_config_file }}"
+    owner: root
+    group: root
+    mode: '0644'
+  notify: Restart Zabbix Agent

roles/monitoring/tasks/configure-docker.yml

@@ -0,0 +1,47 @@
+---
+- name: Gather Docker group entries
+  ansible.builtin.getent:
+    database: group
+    key: "{{ monitoring_zabbix_docker_group }}"
+  failed_when: false
+
+- name: Check whether Docker socket exists
+  ansible.builtin.stat:
+    path: "{{ monitoring_zabbix_docker_socket_path }}"
+  register: monitoring_docker_socket
+
+- name: Ensure Zabbix agent can access Docker socket
+  ansible.builtin.user:
+    name: "{{ monitoring_zabbix_agent_user }}"
+    groups: "{{ monitoring_zabbix_docker_group }}"
+    append: yes
+  when:
+    - monitoring_docker_socket.stat.exists
+    - monitoring_zabbix_docker_group in (ansible_facts.getent_group | default({}))
+  notify: Restart Zabbix Agent
+
+- name: Ensure Docker plugin configuration directory exists
+  ansible.builtin.file:
+    path: "{{ monitoring_zabbix_docker_plugin_config_file | dirname }}"
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  when: monitoring_docker_socket.stat.exists
+
+- name: Configure Docker plugin endpoint
+  ansible.builtin.template:
+    src: docker.conf.j2
+    dest: "{{ monitoring_zabbix_docker_plugin_config_file }}"
+    owner: root
+    group: root
+    mode: '0644'
+  when: monitoring_docker_socket.stat.exists
+  notify: Restart Zabbix Agent
+
+- name: Remove Docker plugin configuration when Docker socket is absent
+  ansible.builtin.file:
+    path: "{{ monitoring_zabbix_docker_plugin_config_file }}"
+    state: absent
+  when: not monitoring_docker_socket.stat.exists
+  notify: Restart Zabbix Agent

roles/monitoring/tasks/install-agent.yml

@@ -0,0 +1,11 @@
+---
+- name: Install Zabbix agent package
+  ansible.builtin.apt:
+    name: "{{ monitoring_zabbix_agent_package }}"
+    state: present
+
+- name: Ensure Zabbix agent service is enabled and started
+  ansible.builtin.systemd:
+    name: "{{ monitoring_zabbix_agent_service }}"
+    state: started
+    enabled: yes

roles/monitoring/tasks/install-repository.yml

@@ -0,0 +1,22 @@
+---
+- name: Install repository prerequisites
+  ansible.builtin.apt:
+    name:
+      - ca-certificates
+    state: present
+    update_cache: yes
+    cache_valid_time: 3600
+
+- name: Download Zabbix release package
+  ansible.builtin.get_url:
+    url: "{{ monitoring_zabbix_release_url }}"
+    dest: "{{ monitoring_zabbix_release_path }}"
+    mode: '0644'
+
+- name: Install Zabbix release package
+  ansible.builtin.apt:
+    deb: "{{ monitoring_zabbix_release_path }}"
+
+- name: Update apt cache after Zabbix repository setup
+  ansible.builtin.apt:
+    update_cache: yes

roles/monitoring/tasks/main.yml

@@ -0,0 +1,14 @@
+- import_tasks: validate.yml
+  tags: monitoring
+
+- import_tasks: install-repository.yml
+  tags: monitoring
+
+- import_tasks: install-agent.yml
+  tags: monitoring
+
+- import_tasks: configure-docker.yml
+  tags: monitoring
+
+- import_tasks: configure-agent.yml
+  tags: monitoring

roles/monitoring/tasks/validate.yml

@@ -0,0 +1,11 @@
+---
+- name: Stop playbook if system is not Debian
+  ansible.builtin.fail:
+    msg: "This role only supports Debian."
+  when: ansible_facts['os_family'] != "Debian"
+
+- name: Ensure Zabbix passive servers are defined
+  ansible.builtin.assert:
+    that:
+      - monitoring_zabbix_passive_servers | length > 0
+    fail_msg: "Set monitoring_zabbix_passive_servers to the IPs, CIDRs or DNS names allowed to query the agent."

roles/monitoring/templates/docker.conf.j2

@@ -0,0 +1,2 @@
+# {{ ansible_managed }}
+Plugins.Docker.Endpoint={{ monitoring_zabbix_docker_endpoint }}

roles/monitoring/templates/zabbix_agent2.conf.j2

@@ -0,0 +1,11 @@
+# {{ ansible_managed }}
+PidFile=/run/zabbix/zabbix_agent2.pid
+LogFile=/var/log/zabbix/zabbix_agent2.log
+LogFileSize=0
+Server={{ monitoring_zabbix_passive_servers | join(',') }}
+{% if monitoring_zabbix_active_servers | length > 0 %}
+ServerActive={{ monitoring_zabbix_active_servers | join(',') }}
+{% endif %}
+HostnameItem=system.hostname
+ListenPort={{ monitoring_zabbix_listen_port }}
+Include=/etc/zabbix/zabbix_agent2.d/*.conf