DerLinkmanandDerLinkman
a31751af1d
Co-authored-by: DerLinkman <derlinkman@gmail.com> Reviewed-on: #2
55 lines
1.9 KiB
YAML
55 lines
1.9 KiB
YAML
---
|
|
# Generate a per-host PSK on the Ansible controller and deploy it to the agent.
|
|
# The PSK is persisted under monitoring_zabbix_psk_store so that re-runs keep
|
|
# the same secret and the Zabbix server registration stays in sync.
|
|
|
|
- name: Ensure PSK store directory exists on controller
|
|
ansible.builtin.file:
|
|
path: "{{ monitoring_zabbix_psk_store }}"
|
|
state: directory
|
|
mode: "{{ monitoring_zabbix_psk_store_mode }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
run_once: false
|
|
|
|
- name: Check whether PSK already exists on controller
|
|
ansible.builtin.stat:
|
|
path: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
|
|
delegate_to: localhost
|
|
become: false
|
|
register: monitoring_psk_existing
|
|
|
|
- name: Generate per-host PSK when missing
|
|
ansible.builtin.shell: |
|
|
umask 077
|
|
openssl rand -hex {{ (monitoring_zabbix_psk_bits / 8) | int }} \
|
|
> "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
|
|
args:
|
|
creates: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
|
|
delegate_to: localhost
|
|
become: false
|
|
register: monitoring_psk_generated
|
|
|
|
- name: Slurp PSK from controller
|
|
ansible.builtin.set_fact:
|
|
monitoring_zabbix_psk_value: >-
|
|
{{ lookup('ansible.builtin.file',
|
|
monitoring_zabbix_psk_store ~ '/' ~ inventory_hostname ~ '.psk')
|
|
| trim }}
|
|
|
|
- name: Ensure Zabbix agent runtime directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ monitoring_zabbix_psk_file | dirname | default('/etc/zabbix') }}"
|
|
state: directory
|
|
owner: root
|
|
group: "{{ monitoring_zabbix_agent_user }}"
|
|
mode: '0750'
|
|
|
|
- name: Deploy PSK file to agent host
|
|
ansible.builtin.copy:
|
|
content: "{{ monitoring_zabbix_psk_value }}\n"
|
|
dest: "{{ monitoring_zabbix_psk_file }}"
|
|
owner: "{{ monitoring_zabbix_agent_user }}"
|
|
group: "{{ monitoring_zabbix_agent_user }}"
|
|
mode: '0600'
|
|
notify: Restart Zabbix Agent |