summaryrefslogtreecommitdiffstats
path: root/roles/common/tasks
diff options
context:
space:
mode:
Diffstat (limited to 'roles/common/tasks')
-rw-r--r--roles/common/tasks/bacula.yml29
-rw-r--r--roles/common/tasks/main.yml8
-rw-r--r--roles/common/tasks/munin-node-ssl.yml58
-rw-r--r--roles/common/tasks/munin-node.yml68
-rw-r--r--roles/common/tasks/stunnel.yml20
5 files changed, 98 insertions, 85 deletions
diff --git a/roles/common/tasks/bacula.yml b/roles/common/tasks/bacula.yml
index e29f01c..f0919e4 100644
--- a/roles/common/tasks/bacula.yml
+++ b/roles/common/tasks/bacula.yml
@@ -1,93 +1,88 @@
-- name: Install stunnel
- apt: pkg=stunnel4
-
-- name: Auto-enable stunnel
- lineinfile: dest=/etc/default/stunnel4
- regexp='^(\s*#)?\s*ENABLED='
- line='ENABLED=1'
- owner=root group=root
- mode=0644
-
- name: Create /etc/stunnel/certs
file: path=/etc/stunnel/certs
state=directory
owner=root group=root
mode=0755
- name: Generate a private key and a X.509 certificate for Bacula FD
command: genkeypair.sh x509
--pubkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem
--privkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.key
--ou=BaculaFD --cn={{ inventory_hostname }} --dns={{ inventory_hostname }}
-t rsa -b 4096 -h sha512
register: r1
changed_when: r1.rc == 0
failed_when: r1.rc > 1
notify:
- - Restart stunnel
+ - Restart stunnel@bacula-fd
tags:
- genkey
- name: Fetch Bacula FD X.509 certificate
# Ensure we don't fetch private data
become: False
fetch: src=/etc/stunnel/certs/{{ inventory_hostname_short }}-fd.pem
dest=certs/bacula/
fail_on_missing=yes
flat=yes
tags:
- genkey
- name: Copy Bacula Dir X.509 certificates
assemble: src=certs/bacula regexp="-dir\.pem$" remote_src=no
dest=/etc/stunnel/certs/bacula-dirs.pem
owner=root group=root
mode=0644
register: r2
when: "'bacula-dir' not in group_names"
notify:
- - Restart stunnel
+ - Restart stunnel@bacula-fd
- name: Copy Bacula SD X.509 certificates
copy: src=certs/bacula/{{ hostvars[item].inventory_hostname_short }}-sd.pem
dest=/etc/stunnel/certs/
owner=root group=root
mode=0644
register: r3
with_items: "{{ groups['bacula-sd'] | difference([inventory_hostname]) }}"
notify:
- - Restart stunnel
+ - Restart stunnel@bacula-fd
- name: Configure stunnel
template: src=etc/stunnel/bacula-fd.conf.j2
dest=/etc/stunnel/bacula-fd.conf
owner=root group=root
mode=0644
register: r4
when: "'bacula-dir' not in group_names or 'bacula-sd' not in group_names"
notify:
- - Restart stunnel
+ - Restart stunnel@bacula-fd
+
+- name: Enable stunnel@bacula-fd
+ when: "'bacula-dir' not in group_names or 'bacula-sd' not in group_names"
+ service: name=stunnel4@bacula-fd enabled=yes
-- name: Start stunnel
- service: name=stunnel4 pattern=/usr/bin/stunnel4 state=started
- when: not (r1.changed or r2.changed or r3.changed or r4.changed)
+- name: Start stunnel@bacula-fd
+ service: name=stunnel4@bacula-fd state=started
+ when: ('bacula-dir' not in group_names or 'bacula-sd' not in group_names) and
+ not (r1.changed or r2.changed or r3.changed or r4.changed)
- meta: flush_handlers
- name: Install bacula-fd
apt: pkg=bacula-fd
- name: Create /var/lib/bacula/tmp
file: path=/var/lib/bacula/tmp
state=directory
owner=root group=root
mode=0700
- name: Delete /etc/bacula/common_default_passwords
file: path=/etc/bacula/common_default_passwords state=absent
# Create with:
# echo $director-dir $(pwgen -sn 64 1) | sudo tee -a /etc/bacula/passwords-fd
- name: Ensure /etc/bacula/passwords-fd exists
diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
index 3e6a4a8..14cb7ae 100644
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -1,34 +1,37 @@
---
- include: sysctl.yml
tags: sysctl
- include: hosts.yml
- include: apt.yml
tags: apt
- name: Install intel-microcode
apt: pkg=intel-microcode
when: "ansible_processor[0] | search('^(Genuine)?Intel.*') and not (ansible_virtualization_role == 'guest' and ansible_virtualization_type == 'xen')"
tags: intel
- include: firewall.yml
tags:
- firewall
- iptables
+
+- include: stunnel.yml
+ tags: stunnel
- include: samhain.yml
tags: samhain
- include: auditd.yml
tags: auditd
- include: rkhunter.yml
tags: rkhunter
- include: clamav.yml
tags: clamav
- include: fail2ban.yml
tags: fail2ban
- include: smart.yml
tags:
- smartmontools
- smart
when: "not ((ansible_virtualization_role == 'guest' and ansible_virtualization_type == 'xen') or ansible_system_vendor == 'QEMU')"
- include: haveged.yml
tags:
- haveged
- entropy
- name: Copy genkeypair.sh and gendhparam.sh
@@ -42,33 +45,38 @@
- gendhparam.sh
- name: Generate DH parameters
command: gendhparam.sh /etc/ssl/private/dhparams.pem creates=/etc/ssl/private/dhparams.pem
tags: genkey
- include: logging.yml
tags: logging
- include: ntp.yml
tags: ntp
- include: mail.yml
tags:
- mail
- postfix
- include: bacula.yml
tags:
- bacula-fd
- bacula
- include: munin-node.yml
tags:
- munin-node
- munin
+- include: munin-node-ssl.yml
+ when: "'munin-master' not in group_names"
+ tags:
+ - munin-node
+ - munin
- name: Install common packages
apt: pkg={{ item }}
with_items:
- ca-certificates
- etckeeper
- ethtool
- git
- htop
- molly-guard
- rsync
- screen
- telnet-ssl
diff --git a/roles/common/tasks/munin-node-ssl.yml b/roles/common/tasks/munin-node-ssl.yml
new file mode 100644
index 0000000..59ed7d7
--- /dev/null
+++ b/roles/common/tasks/munin-node-ssl.yml
@@ -0,0 +1,58 @@
+- name: Create /etc/stunnel/certs
+ file: path=/etc/stunnel/certs
+ state=directory
+ owner=root group=root
+ mode=0755
+
+- name: Generate a private key and a X.509 certificate for munin-node
+ command: genkeypair.sh x509
+ --pubkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
+ --privkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.key
+ --ou=Munin --cn={{ inventory_hostname }} --dns={{ inventory_hostname }}
+ -t rsa -b 4096 -h sha512
+ register: r1
+ changed_when: r1.rc == 0
+ failed_when: r1.rc > 1
+ notify:
+ - Restart stunnel@munin-node
+ tags:
+ - genkey
+
+- name: Fetch Munin X.509 certificate
+ # Ensure we don't fetch private data
+ become: False
+ fetch: src=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
+ dest=certs/munin/{{ inventory_hostname }}.pem
+ fail_on_missing=yes
+ flat=yes
+ tags:
+ - genkey
+
+- name: Copy munin-master X.509 certificates
+ assemble: src=certs/munin regexp="{{ groups['munin-master'] | join('|') }}\.pem$" remote_src=no
+ dest=/etc/stunnel/certs/munin-master.pem
+ owner=root group=root
+ mode=0644
+ register: r2
+ when: "'munin-master' not in group_names"
+ notify:
+ - Restart stunnel@munin-node
+
+- name: Configure stunnel
+ template: src=etc/stunnel/munin-node.conf.j2
+ dest=/etc/stunnel/munin-node.conf
+ owner=root group=root
+ mode=0644
+ register: r3
+ when: "'munin-master' not in group_names"
+ notify:
+ - Restart stunnel@munin-node
+
+- name: Enable stunnel@munin-node
+ service: name=stunnel4@munin-node enabled=yes
+
+- name: Start stunnel@munin-node
+ service: name=stunnel4@munin-node state=started
+ when: not (r1.changed or r2.changed or r3.changed)
+
+- meta: flush_handlers
diff --git a/roles/common/tasks/munin-node.yml b/roles/common/tasks/munin-node.yml
index c585d60..e1a931a 100644
--- a/roles/common/tasks/munin-node.yml
+++ b/roles/common/tasks/munin-node.yml
@@ -120,88 +120,20 @@
- Restart munin-node
- name: Install 'postfix_stats_' Munin wildcard plugin
file: src=/usr/local/share/munin/plugins/postfix_stats_
dest=/etc/munin/plugins/postfix_stats_{{ item }}_postfix
owner=root group=root
state=link force=yes
register: r7
with_items:
- smtpd
- qmgr
- smtp
notify:
- Restart munin-node
- name: Start munin-node
service: name=munin-node state=started
when: not (r1.changed or r2.changed or r3.changed or r4.changed or r5.changed or r6.changed or r7.changed)
- meta: flush_handlers
-
-
-
-- name: Install stunnel
- apt: pkg=stunnel4
-
-- name: Auto-enable stunnel
- lineinfile: dest=/etc/default/stunnel4
- regexp='^(\s*#)?\s*ENABLED='
- line='ENABLED=1'
- owner=root group=root
- mode=0644
-
-- name: Create /etc/stunnel/certs
- file: path=/etc/stunnel/certs
- state=directory
- owner=root group=root
- mode=0755
-
-- name: Generate a private key and a X.509 certificate for munin-node
- command: genkeypair.sh x509
- --pubkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
- --privkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.key
- --ou=Munin --cn={{ inventory_hostname }} --dns={{ inventory_hostname }}
- -t rsa -b 4096 -h sha512
- register: r1
- changed_when: r1.rc == 0
- failed_when: r1.rc > 1
- notify:
- - Restart stunnel
- tags:
- - genkey
-
-- name: Fetch Munin X.509 certificate
- # Ensure we don't fetch private data
- become: False
- fetch: src=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
- dest=certs/munin/{{ inventory_hostname }}.pem
- fail_on_missing=yes
- flat=yes
- tags:
- - genkey
-
-- name: Copy munin-master X.509 certificates
- assemble: src=certs/munin regexp="{{ groups['munin-master'] | join('|') }}\.pem$" remote_src=no
- dest=/etc/stunnel/certs/munin-master.pem
- owner=root group=root
- mode=0644
- register: r2
- when: "'munin-master' not in group_names"
- notify:
- - Restart stunnel
-
-- name: Configure stunnel
- template: src=etc/stunnel/munin-node.conf.j2
- dest=/etc/stunnel/munin-node.conf
- owner=root group=root
- mode=0644
- register: r3
- when: "'munin-master' not in group_names"
- notify:
- - Restart stunnel
-
-- name: Start stunnel
- service: name=stunnel4 pattern=/usr/bin/stunnel4 state=started
- when: not (r1.changed or r2.changed or r3.changed)
-
-- meta: flush_handlers
diff --git a/roles/common/tasks/stunnel.yml b/roles/common/tasks/stunnel.yml
new file mode 100644
index 0000000..68469cd
--- /dev/null
+++ b/roles/common/tasks/stunnel.yml
@@ -0,0 +1,20 @@
+- name: Install stunnel4
+ apt: pkg=stunnel4
+
+- name: Set 'ENABLED=0' in /etc/default/stunnel4
+ lineinfile: dest=/etc/default/stunnel4
+ regexp='^(\s*#)?\s*ENABLED='
+ line='ENABLED=0'
+ owner=root group=root
+ mode=0644
+
+- name: Copy stunnel4 service file
+ copy: src=lib/systemd/system/{{ item }}
+ dest=/lib/systemd/system/{{ item }}
+ owner=root group=root
+ mode=0644
+ notify:
+ - systemctl daemon-reload
+ with_items:
+ - stunnel4.service
+ - stunnel4@.service
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-01 15:27:56 +0000