126 lines
3.9 KiB
YAML
126 lines
3.9 KiB
YAML
- name: Install icinga2
|
|
apt:
|
|
pkg:
|
|
- icinga2
|
|
- monitoring-plugins
|
|
- nagios-plugins-contrib
|
|
update_cache: true
|
|
state: latest
|
|
cache_valid_time: 3600
|
|
when: "'monitoring_servers' in group_names"
|
|
register: icinga2_install
|
|
tags:
|
|
- icinga2_install
|
|
|
|
- name: Uninstall icinga2
|
|
apt:
|
|
pkg:
|
|
- icinga2
|
|
- monitoring-plugins
|
|
- nagios-plugins-contrib
|
|
state: absent
|
|
when: "'monitoring_servers' not in group_names"
|
|
register: icinga2_uninstall
|
|
tags:
|
|
- icinga2_install
|
|
|
|
- name: ensure certificate directory exists
|
|
file:
|
|
path: "{{ base.monitoring.cert_dir }}"
|
|
state: directory
|
|
owner: 'nagios'
|
|
group: 'nagios'
|
|
mode: '0700'
|
|
when: '"monitoring_servers" in group_names'
|
|
tags:
|
|
- icinga2_cert_dir
|
|
|
|
- name: install icinga2 CA certificate
|
|
copy:
|
|
src: var/lib/icinga2/certs/ca.crt
|
|
dest: "{{ base.monitoring.cert_dir }}/ca.crt"
|
|
owner: 'nagios'
|
|
group: 'nagios'
|
|
when: '"monitoring_servers" in group_names'
|
|
|
|
- name: check for trusted master certificate
|
|
stat:
|
|
path: "{{ base.monitoring.cert_dir }}/trusted-master.crt }}"
|
|
register: trusted_master_cert
|
|
when: '"monitoring_servers" in group_names'
|
|
|
|
- name: check trusted master certificate hash
|
|
shell:
|
|
cmd: "openssl x509 -in {{ base.monitoring.cert_dir }}/trusted-master.crt -noout -hash"
|
|
register: trusted_master_cert_hash
|
|
when: '"monitoring_servers" in group_names and trusted_master_cert.stat.exists'
|
|
|
|
- name: delete old certificates
|
|
file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
when: "'monitoring_servers' in group_names and trusted_master_cert.stat.exists and trusted_master_cert_hash.stdout != trusted_master_hash"
|
|
loop:
|
|
- "{{ base.monitoring.cert_dir }}/trusted-master.crt"
|
|
- "{{ base.monitoring.cert_dir }}/{{ inventory_hostname }}.crt"
|
|
- "{{ base.monitoring.cert_dir }}/{{ inventory_hostname }}.key"
|
|
|
|
- name: get trusted master certificate
|
|
shell:
|
|
cmd: "icinga2 pki save-cert --trustedcert {{ base.monitoring.cert_dir }}/trusted-master.crt --host {{ base.monitoring.server }}"
|
|
when: "'monitoring_servers' in group_names and (not trusted_master_cert.stat.exists or trusted_master_cert_hash.stdout != trusted_master_hash)"
|
|
|
|
- name: check for client certificate
|
|
stat:
|
|
path: "/var/lib/icinga2/certs/{{ inventory_hostname }}.crt"
|
|
register: client_certificate
|
|
when: '"monitoring_servers" in group_names'
|
|
|
|
- name: icinga2 setup
|
|
shell:
|
|
cmd: "icinga2 node setup --zone {{ inventory_hostname }} --endpoint {{ base.monitoring.server }} --parent_host {{ base.monitoring.server }} --parent_zone master --cn {{ inventory_hostname }} --accept-config --accept-commands --disable-confd --trustedcert {{ base.monitoring.cert_dir }}/trusted-master.crt"
|
|
when: "'monitoring_servers' in group_names and not client_certificate.stat.exists"
|
|
register: setup
|
|
|
|
- name: zones.conf
|
|
template:
|
|
src: templates/etc/icinga2/zones.conf.j2
|
|
dest: /etc/icinga2/zones.conf
|
|
owner: nagios
|
|
group: nagios
|
|
mode: "0644"
|
|
register: zones_config
|
|
when: '"monitoring_servers" in group_names'
|
|
|
|
- name: icinga2.conf
|
|
template:
|
|
src: templates/etc/icinga2/icinga2.conf.j2
|
|
dest: /etc/icinga2/icinga2.conf
|
|
owner: nagios
|
|
group: nagios
|
|
mode: "0644"
|
|
register: icinga2_config
|
|
when: '"monitoring_servers" in group_names'
|
|
|
|
- name: checks.conf
|
|
template:
|
|
src: templates/etc/icinga2/conf.d/checks.conf.j2
|
|
dest: /etc/icinga2/conf.d/checks.conf
|
|
owner: nagios
|
|
group: nagios
|
|
mode: "0644"
|
|
register: checks_config
|
|
when: '"monitoring_servers" in group_names'
|
|
|
|
- name: check if certificate has been signed
|
|
shell:
|
|
cmd: "openssl x509 -in {{ base.monitoring.cert_dir }}/{{ inventory_hostname }}.crt -noout -issuer_hash -hash | uniq -d | wc -l"
|
|
register: signed
|
|
when: '"monitoring_servers" in group_names'
|
|
|
|
- name: restart icinga2
|
|
service:
|
|
name: icinga2
|
|
state: reloaded
|
|
enabled: true
|
|
when: '"monitoring_servers" in group_names'
|