115 lines
3.6 KiB
YAML
115 lines
3.6 KiB
YAML
---
|
|
|
|
- name: Enable icinga apt-key
|
|
apt_key: url="https://packages.icinga.com/icinga.key"
|
|
|
|
- name: Enable icinga repository
|
|
apt_repository:
|
|
repo: "deb https://packages.icinga.com/debian icinga-{{ ansible_distribution_release }} main"
|
|
filename: icinga
|
|
|
|
- name: Install icinga
|
|
apt:
|
|
name:
|
|
- php-fpm
|
|
- php-pgsql
|
|
- icinga2
|
|
- icinga2-ido-pgsql
|
|
- icingaweb2
|
|
|
|
- name: Install PostgreSQL
|
|
apt:
|
|
name:
|
|
- postgresql
|
|
- python3-psycopg2
|
|
|
|
- name: Configure icinga database
|
|
postgresql_db: name={{ icinga_dbname }}
|
|
become: true
|
|
become_user: postgres
|
|
register: icinga_ido_db
|
|
|
|
- name: Configure icinga database user
|
|
postgresql_user: db={{ icinga_dbname }} name={{ icinga_dbuser }} password={{ icinga_dbpass }} priv=ALL state=present
|
|
become: true
|
|
become_user: postgres
|
|
|
|
# FIXME it is not possible to use login_username and login_password here in order to change the role to icinga
|
|
# so as a workaround you have to insert "SET ROLE icinga;" manually at the top of the referred sql file
|
|
- name: Configure database schema
|
|
postgresql_db: name={{ icinga_dbname }} target=/usr/share/icinga2-ido-pgsql/schema/pgsql.sql state=restore
|
|
become: true
|
|
become_user: postgres
|
|
when: icinga_ido_db.changed
|
|
|
|
- name: Configure icingaweb database
|
|
postgresql_db: name={{ icingaweb_dbname }}
|
|
become: true
|
|
become_user: postgres
|
|
|
|
- name: Configure icingaweb database user
|
|
postgresql_user: db={{ icingaweb_dbname }} name={{ icingaweb_dbuser }} password={{ icingaweb_dbpass }} priv=ALL state=present
|
|
become: true
|
|
become_user: postgres
|
|
|
|
- name: Configure icinga ido pgsql
|
|
template: src=icinga2/features-available/ido-pgsql.conf.j2 dest=/etc/icinga2/features-available/ido-pgsql.conf owner={{ icinga_user }} group={{ icinga_group }}
|
|
notify: Restart icinga2
|
|
|
|
- name: Enable icinga ido PostgreSQL
|
|
command: "icinga2 feature enable ido-pgsql"
|
|
register: features_result
|
|
changed_when: "'for these changes to take effect' in features_result.stdout"
|
|
notify: Restart icinga2
|
|
|
|
- name: Ensure directory for host snippets exists
|
|
file:
|
|
path: /etc/icinga2/conf.d/hosts
|
|
state: directory
|
|
owner: "{{ icinga_user }}"
|
|
group: "{{ icinga_group }}"
|
|
|
|
- name: Prepare host snippets
|
|
template: src=icinga2/conf.d/hosts.header.j2 dest=/etc/icinga2/conf.d/hosts/{{ item }}.00_header owner={{ icinga_user }} group={{ icinga_group }}
|
|
loop: "{{ groups['all'] }}"
|
|
|
|
- name: Prepare host snippets
|
|
template: src=icinga2/conf.d/hosts.footer.j2 dest=/etc/icinga2/conf.d/hosts/{{ item }}.zz_footer owner={{ icinga_user }} group={{ icinga_group }}
|
|
loop: "{{ groups['all'] }}"
|
|
|
|
- name: Create group icingaweb2
|
|
group: name=icingaweb2 system=yes
|
|
|
|
- name: Add www-data to icingaweb2
|
|
user: name=www-data append=yes groups=icingaweb2
|
|
|
|
- name: Ensure certificates are available
|
|
command:
|
|
cmd: >
|
|
openssl req -x509 -nodes -newkey rsa:2048
|
|
-keyout /etc/nginx/ssl/{{ icinga_domain }}.key -out /etc/nginx/ssl/{{ icinga_domain }}.crt
|
|
-days 730 -subj "/CN={{ icinga_domain }}"
|
|
creates: /etc/nginx/ssl/{{ icinga_domain }}.crt
|
|
notify: Restart nginx
|
|
|
|
- name: Request nsupdate key for certificate
|
|
include_role: name=acme-dnskey-generate
|
|
vars:
|
|
acme_dnskey_san_domains:
|
|
- "{{ icinga_domain }}"
|
|
|
|
- name: Configure certificate manager for icinga
|
|
template: src=certs.j2 dest=/etc/acertmgr/{{ icinga_domain }}.conf
|
|
notify: Run acertmgr
|
|
|
|
- name: Configure vhost
|
|
template: src=vhost.j2 dest=/etc/nginx/sites-available/icinga
|
|
notify: Restart nginx
|
|
|
|
- name: Enable vhost
|
|
file: src=/etc/nginx/sites-available/icinga dest=/etc/nginx/sites-enabled/icinga state=link
|
|
notify: Restart nginx
|
|
|
|
- name: Start php8.2-fpm
|
|
service: name=php8.2-fpm state=started enabled=yes
|