DerLinkman
30f3e9a4c6
- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update all README/AGENTS call examples and the inventory table - move admin_password hash into encrypted vault.yml; remove plaintext copies from roles/bootstrap/defaults and group_vars/external.yml - bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring) - monitoring: PSK config/registration updates, docker role defaults, os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks - add .project-wiki knowledge base and .github agent instructions
74 lines
2.4 KiB
YAML
74 lines
2.4 KiB
YAML
---
|
|
# Generate a per-host PSK on the Ansible controller and deploy it to the agent.
|
|
# The PSK is persisted under monitoring_zabbix_psk_store so that re-runs keep
|
|
# the same secret and the Zabbix server registration stays in sync.
|
|
|
|
- name: Ensure PSK store directory exists on controller
|
|
ansible.builtin.file:
|
|
path: "{{ monitoring_zabbix_psk_store }}"
|
|
state: directory
|
|
mode: "{{ monitoring_zabbix_psk_store_mode }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: false
|
|
|
|
- name: Show PSK store path
|
|
ansible.builtin.debug:
|
|
msg: "Persisting PSKs on the controller in {{ monitoring_zabbix_psk_store }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
changed_when: false
|
|
|
|
- name: Check whether PSK already exists on controller
|
|
ansible.builtin.stat:
|
|
path: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
|
|
delegate_to: localhost
|
|
become: false
|
|
register: monitoring_psk_existing
|
|
|
|
- name: Generate per-host PSK when missing
|
|
ansible.builtin.shell: |
|
|
umask 077
|
|
openssl rand -hex {{ (monitoring_zabbix_psk_bits / 8) | int }} \
|
|
> "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
|
|
args:
|
|
creates: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
|
|
delegate_to: localhost
|
|
become: false
|
|
register: monitoring_psk_generated
|
|
|
|
- name: Slurp PSK from controller
|
|
ansible.builtin.set_fact:
|
|
monitoring_zabbix_psk_value: >-
|
|
{{ lookup('ansible.builtin.file',
|
|
monitoring_zabbix_psk_store ~ '/' ~ inventory_hostname ~ '.psk')
|
|
| trim }}
|
|
|
|
- name: Validate PSK format
|
|
ansible.builtin.assert:
|
|
that:
|
|
- monitoring_zabbix_psk_value is match('^[0-9a-fA-F]+$')
|
|
- monitoring_zabbix_psk_value | length == (monitoring_zabbix_psk_bits / 4) | int
|
|
fail_msg: >-
|
|
The PSK must contain exactly {{ (monitoring_zabbix_psk_bits / 4) | int }}
|
|
hexadecimal characters.
|
|
delegate_to: localhost
|
|
become: false
|
|
|
|
- name: Ensure Zabbix agent runtime directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ monitoring_zabbix_psk_file | dirname | default('/etc/zabbix') }}"
|
|
state: directory
|
|
owner: root
|
|
group: "{{ monitoring_zabbix_agent_user }}"
|
|
mode: '0750'
|
|
|
|
- name: Deploy PSK file to agent host
|
|
ansible.builtin.copy:
|
|
content: "{{ monitoring_zabbix_psk_value }}\n"
|
|
dest: "{{ monitoring_zabbix_psk_file }}"
|
|
owner: "{{ monitoring_zabbix_agent_user }}"
|
|
group: "{{ monitoring_zabbix_agent_user }}"
|
|
mode: '0600'
|
|
notify: Restart Zabbix Agent
|