infra/ansible/roles/opensearch/tasks/main.yml

---
# Installs OpenSearch from the upstream tarball (bundled JDK) and runs it
# under systemd in single-node mode for logs.vntx.net.

- name: Set vm.max_map_count for OpenSearch
  ansible.posix.sysctl:
    name: vm.max_map_count
    value: "{{ opensearch_vm_max_map_count }}"
    state: present
    reload: true

- name: Create opensearch group
  ansible.builtin.group:
    name: "{{ opensearch_group }}"
    system: true
    state: present

- name: Create opensearch user
  ansible.builtin.user:
    name: "{{ opensearch_user }}"
    group: "{{ opensearch_group }}"
    system: true
    shell: /usr/sbin/nologin
    home: "{{ opensearch_data_dir }}"
    create_home: false
    state: present

- name: Create opensearch directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: "{{ opensearch_user }}"
    group: "{{ opensearch_group }}"
    mode: "0750"
  loop:
    - "{{ opensearch_install_dir }}"
    - "{{ opensearch_config_dir }}"
    - "{{ opensearch_data_dir }}"
    - "{{ opensearch_log_dir }}"

- name: Check installed opensearch version
  ansible.builtin.command: "{{ opensearch_install_dir }}/bin/opensearch --version"
  register: opensearch_installed
  changed_when: false
  failed_when: false

- name: Decide whether opensearch needs (re)install
  ansible.builtin.set_fact:
    opensearch_needs_install: >-
      {{
        opensearch_installed.rc != 0
        or opensearch_version not in (opensearch_installed.stdout | default(''))
        and opensearch_version not in (opensearch_installed.stderr | default(''))
      }}

- name: Download opensearch tarball
  ansible.builtin.get_url:
    url: "https://artifacts.opensearch.org/releases/bundle/opensearch/{{ opensearch_version }}/opensearch-{{ opensearch_version }}-linux-{{ opensearch_arch }}.tar.gz"
    dest: "/tmp/opensearch-{{ opensearch_version }}-linux-{{ opensearch_arch }}.tar.gz"
    mode: "0644"
  when: opensearch_needs_install

- name: Extract opensearch tarball to install dir
  ansible.builtin.unarchive:
    src: "/tmp/opensearch-{{ opensearch_version }}-linux-{{ opensearch_arch }}.tar.gz"
    dest: "{{ opensearch_install_dir }}"
    remote_src: true
    extra_opts:
      - --strip-components=1
    owner: "{{ opensearch_user }}"
    group: "{{ opensearch_group }}"
  when: opensearch_needs_install
  notify: Restart opensearch

- name: Render opensearch.yml
  ansible.builtin.template:
    src: opensearch.yml.j2
    dest: "{{ opensearch_config_dir }}/opensearch.yml"
    owner: "{{ opensearch_user }}"
    group: "{{ opensearch_group }}"
    mode: "0640"
  notify: Restart opensearch

- name: Check if demo TLS certs exist
  ansible.builtin.stat:
    path: "{{ opensearch_config_dir }}/{{ item }}"
  loop:
    - esnode.pem
    - esnode-key.pem
    - root-ca.pem
  register: opensearch_demo_certs
  when: opensearch_security_enabled | default(true)

- name: Generate self-signed TLS certs for OpenSearch
  ansible.builtin.shell:
    cmd: |
      set -e
      openssl req -x509 -newkey rsa:4096 \
        -keyout {{ opensearch_config_dir }}/esnode-key.pem \
        -out {{ opensearch_config_dir }}/esnode.pem \
        -days 3650 -nodes \
        -subj "/CN={{ opensearch_node_name }}" \
        -addext "subjectAltName=DNS:localhost,DNS:{{ inventory_hostname }},IP:127.0.0.1"
      cp {{ opensearch_config_dir }}/esnode.pem {{ opensearch_config_dir }}/root-ca.pem
      chown {{ opensearch_user }}:{{ opensearch_group }} {{ opensearch_config_dir }}/esnode.pem {{ opensearch_config_dir }}/esnode-key.pem {{ opensearch_config_dir }}/root-ca.pem
      chmod 600 {{ opensearch_config_dir }}/esnode-key.pem
    creates: "{{ opensearch_config_dir }}/esnode.pem"
  when:
    - opensearch_security_enabled | default(true)
    - (opensearch_demo_certs.results | selectattr('stat.exists', 'equalto', false) | list | length) > 0
  notify: Restart opensearch

- name: Render internal_users.yml
  ansible.builtin.template:
    src: internal_users.yml.j2
    dest: "{{ opensearch_config_dir }}/opensearch-security/internal_users.yml"
    owner: "{{ opensearch_user }}"
    group: "{{ opensearch_group }}"
    mode: "0640"
  when: opensearch_security_enabled | default(true)
  notify: Restart opensearch

- name: Render roles_mapping.yml
  ansible.builtin.template:
    src: roles_mapping.yml.j2
    dest: "{{ opensearch_config_dir }}/opensearch-security/roles_mapping.yml"
    owner: "{{ opensearch_user }}"
    group: "{{ opensearch_group }}"
    mode: "0640"
  when: opensearch_security_enabled | default(true)
  notify: Restart opensearch

- name: Render jvm.options
  ansible.builtin.template:
    src: jvm.options.j2
    dest: "{{ opensearch_config_dir }}/jvm.options"
    owner: "{{ opensearch_user }}"
    group: "{{ opensearch_group }}"
    mode: "0640"
  notify: Restart opensearch

- name: Install opensearch systemd unit
  ansible.builtin.template:
    src: opensearch.service.j2
    dest: /etc/systemd/system/opensearch.service
    owner: root
    group: root
    mode: "0644"
  notify: Restart opensearch

- name: Enable and start opensearch
  ansible.builtin.systemd:
    name: opensearch
    enabled: true
    state: started
    daemon_reload: true

- name: Create syslog index template
  ansible.builtin.uri:
    url: "https://127.0.0.1:{{ opensearch_http_port }}/_index_template/syslog"
    method: PUT
    user: "{{ opensearch_admin_username }}"
    password: "{{ opensearch_admin_password }}"
    force_basic_auth: true
    validate_certs: false
    body_format: json
    body:
      index_patterns: ["syslog-*"]
      template:
        settings:
          number_of_shards: 1
          number_of_replicas: 0
      priority: 100
    status_code: [200, 201]
  when: opensearch_security_enabled | default(true)

# --- OpenSearch Dashboards ---

- name: Create opensearch-dashboards directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: "{{ opensearch_user }}"
    group: "{{ opensearch_group }}"
    mode: "0750"
  loop:
    - "{{ opensearch_dashboards_install_dir }}"
    - "{{ opensearch_dashboards_config_dir }}"

- name: Check installed opensearch-dashboards version
  ansible.builtin.command: "{{ opensearch_dashboards_install_dir }}/bin/opensearch-dashboards --version"
  register: dashboards_installed
  changed_when: false
  failed_when: false

- name: Decide whether dashboards needs (re)install
  ansible.builtin.set_fact:
    dashboards_needs_install: >-
      {{
        dashboards_installed.rc != 0
        or opensearch_dashboards_version not in (dashboards_installed.stdout | default(''))
        and opensearch_dashboards_version not in (dashboards_installed.stderr | default(''))
      }}

- name: Download opensearch-dashboards tarball
  ansible.builtin.get_url:
    url: "https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/{{ opensearch_dashboards_version }}/opensearch-dashboards-{{ opensearch_dashboards_version }}-linux-{{ opensearch_arch }}.tar.gz"
    dest: "/tmp/opensearch-dashboards-{{ opensearch_dashboards_version }}-linux-{{ opensearch_arch }}.tar.gz"
    mode: "0644"
  when: dashboards_needs_install

- name: Extract opensearch-dashboards tarball to install dir
  ansible.builtin.unarchive:
    src: "/tmp/opensearch-dashboards-{{ opensearch_dashboards_version }}-linux-{{ opensearch_arch }}.tar.gz"
    dest: "{{ opensearch_dashboards_install_dir }}"
    remote_src: true
    extra_opts:
      - --strip-components=1
    owner: "{{ opensearch_user }}"
    group: "{{ opensearch_group }}"
  when: dashboards_needs_install
  notify: Restart opensearch-dashboards

- name: Render opensearch-dashboards.yml
  ansible.builtin.template:
    src: opensearch-dashboards.yml.j2
    dest: "{{ opensearch_dashboards_config_dir }}/opensearch_dashboards.yml"
    owner: "{{ opensearch_user }}"
    group: "{{ opensearch_group }}"
    mode: "0640"
  notify: Restart opensearch-dashboards

- name: Install opensearch-dashboards systemd unit
  ansible.builtin.template:
    src: opensearch-dashboards.service.j2
    dest: /etc/systemd/system/opensearch-dashboards.service
    owner: root
    group: root
    mode: "0644"
  notify: Restart opensearch-dashboards

- name: Enable and start opensearch-dashboards
  ansible.builtin.systemd:
    name: opensearch-dashboards
    enabled: true
    state: started
    daemon_reload: true