From 90d498034b891123350785a134402172de477f4f Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Wed, 11 May 2016 18:07:09 +0200 Subject: Use systemd unit files for stunnel4. --- roles/common/tasks/bacula.yml | 29 +++++++-------- roles/common/tasks/main.yml | 8 +++++ roles/common/tasks/munin-node-ssl.yml | 58 ++++++++++++++++++++++++++++++ roles/common/tasks/munin-node.yml | 68 ----------------------------------- roles/common/tasks/stunnel.yml | 20 +++++++++++ 5 files changed, 98 insertions(+), 85 deletions(-) create mode 100644 roles/common/tasks/munin-node-ssl.yml create mode 100644 roles/common/tasks/stunnel.yml (limited to 'roles/common/tasks') diff --git a/roles/common/tasks/bacula.yml b/roles/common/tasks/bacula.yml index e29f01c..f0919e4 100644 --- a/roles/common/tasks/bacula.yml +++ b/roles/common/tasks/bacula.yml @@ -1,13 +1,3 @@ -- name: Install stunnel - apt: pkg=stunnel4 - -- name: Auto-enable stunnel - lineinfile: dest=/etc/default/stunnel4 - regexp='^(\s*#)?\s*ENABLED=' - line='ENABLED=1' - owner=root group=root - mode=0644 - - name: Create /etc/stunnel/certs file: path=/etc/stunnel/certs state=directory @@ -24,7 +14,7 @@ changed_when: r1.rc == 0 failed_when: r1.rc > 1 notify: - - Restart stunnel + - Restart stunnel@bacula-fd tags: - genkey @@ -46,7 +36,7 @@ register: r2 when: "'bacula-dir' not in group_names" notify: - - Restart stunnel + - Restart stunnel@bacula-fd - name: Copy Bacula SD X.509 certificates copy: src=certs/bacula/{{ hostvars[item].inventory_hostname_short }}-sd.pem @@ -56,7 +46,7 @@ register: r3 with_items: "{{ groups['bacula-sd'] | difference([inventory_hostname]) }}" notify: - - Restart stunnel + - Restart stunnel@bacula-fd - name: Configure stunnel template: src=etc/stunnel/bacula-fd.conf.j2 @@ -66,11 +56,16 @@ register: r4 when: "'bacula-dir' not in group_names or 'bacula-sd' not in group_names" notify: - - Restart stunnel + - Restart stunnel@bacula-fd + +- name: Enable stunnel@bacula-fd + when: "'bacula-dir' not in group_names or 'bacula-sd' not in group_names" + service: name=stunnel4@bacula-fd enabled=yes -- name: Start stunnel - service: name=stunnel4 pattern=/usr/bin/stunnel4 state=started - when: not (r1.changed or r2.changed or r3.changed or r4.changed) +- name: Start stunnel@bacula-fd + service: name=stunnel4@bacula-fd state=started + when: ('bacula-dir' not in group_names or 'bacula-sd' not in group_names) and + not (r1.changed or r2.changed or r3.changed or r4.changed) - meta: flush_handlers diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml index 3e6a4a8..14cb7ae 100644 --- a/roles/common/tasks/main.yml +++ b/roles/common/tasks/main.yml @@ -12,6 +12,9 @@ tags: - firewall - iptables + +- include: stunnel.yml + tags: stunnel - include: samhain.yml tags: samhain - include: auditd.yml @@ -59,6 +62,11 @@ tags: - munin-node - munin +- include: munin-node-ssl.yml + when: "'munin-master' not in group_names" + tags: + - munin-node + - munin - name: Install common packages apt: pkg={{ item }} diff --git a/roles/common/tasks/munin-node-ssl.yml b/roles/common/tasks/munin-node-ssl.yml new file mode 100644 index 0000000..59ed7d7 --- /dev/null +++ b/roles/common/tasks/munin-node-ssl.yml @@ -0,0 +1,58 @@ +- name: Create /etc/stunnel/certs + file: path=/etc/stunnel/certs + state=directory + owner=root group=root + mode=0755 + +- name: Generate a private key and a X.509 certificate for munin-node + command: genkeypair.sh x509 + --pubkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem + --privkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.key + --ou=Munin --cn={{ inventory_hostname }} --dns={{ inventory_hostname }} + -t rsa -b 4096 -h sha512 + register: r1 + changed_when: r1.rc == 0 + failed_when: r1.rc > 1 + notify: + - Restart stunnel@munin-node + tags: + - genkey + +- name: Fetch Munin X.509 certificate + # Ensure we don't fetch private data + become: False + fetch: src=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem + dest=certs/munin/{{ inventory_hostname }}.pem + fail_on_missing=yes + flat=yes + tags: + - genkey + +- name: Copy munin-master X.509 certificates + assemble: src=certs/munin regexp="{{ groups['munin-master'] | join('|') }}\.pem$" remote_src=no + dest=/etc/stunnel/certs/munin-master.pem + owner=root group=root + mode=0644 + register: r2 + when: "'munin-master' not in group_names" + notify: + - Restart stunnel@munin-node + +- name: Configure stunnel + template: src=etc/stunnel/munin-node.conf.j2 + dest=/etc/stunnel/munin-node.conf + owner=root group=root + mode=0644 + register: r3 + when: "'munin-master' not in group_names" + notify: + - Restart stunnel@munin-node + +- name: Enable stunnel@munin-node + service: name=stunnel4@munin-node enabled=yes + +- name: Start stunnel@munin-node + service: name=stunnel4@munin-node state=started + when: not (r1.changed or r2.changed or r3.changed) + +- meta: flush_handlers diff --git a/roles/common/tasks/munin-node.yml b/roles/common/tasks/munin-node.yml index c585d60..e1a931a 100644 --- a/roles/common/tasks/munin-node.yml +++ b/roles/common/tasks/munin-node.yml @@ -137,71 +137,3 @@ when: not (r1.changed or r2.changed or r3.changed or r4.changed or r5.changed or r6.changed or r7.changed) - meta: flush_handlers - - - -- name: Install stunnel - apt: pkg=stunnel4 - -- name: Auto-enable stunnel - lineinfile: dest=/etc/default/stunnel4 - regexp='^(\s*#)?\s*ENABLED=' - line='ENABLED=1' - owner=root group=root - mode=0644 - -- name: Create /etc/stunnel/certs - file: path=/etc/stunnel/certs - state=directory - owner=root group=root - mode=0755 - -- name: Generate a private key and a X.509 certificate for munin-node - command: genkeypair.sh x509 - --pubkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem - --privkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.key - --ou=Munin --cn={{ inventory_hostname }} --dns={{ inventory_hostname }} - -t rsa -b 4096 -h sha512 - register: r1 - changed_when: r1.rc == 0 - failed_when: r1.rc > 1 - notify: - - Restart stunnel - tags: - - genkey - -- name: Fetch Munin X.509 certificate - # Ensure we don't fetch private data - become: False - fetch: src=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem - dest=certs/munin/{{ inventory_hostname }}.pem - fail_on_missing=yes - flat=yes - tags: - - genkey - -- name: Copy munin-master X.509 certificates - assemble: src=certs/munin regexp="{{ groups['munin-master'] | join('|') }}\.pem$" remote_src=no - dest=/etc/stunnel/certs/munin-master.pem - owner=root group=root - mode=0644 - register: r2 - when: "'munin-master' not in group_names" - notify: - - Restart stunnel - -- name: Configure stunnel - template: src=etc/stunnel/munin-node.conf.j2 - dest=/etc/stunnel/munin-node.conf - owner=root group=root - mode=0644 - register: r3 - when: "'munin-master' not in group_names" - notify: - - Restart stunnel - -- name: Start stunnel - service: name=stunnel4 pattern=/usr/bin/stunnel4 state=started - when: not (r1.changed or r2.changed or r3.changed) - -- meta: flush_handlers diff --git a/roles/common/tasks/stunnel.yml b/roles/common/tasks/stunnel.yml new file mode 100644 index 0000000..68469cd --- /dev/null +++ b/roles/common/tasks/stunnel.yml @@ -0,0 +1,20 @@ +- name: Install stunnel4 + apt: pkg=stunnel4 + +- name: Set 'ENABLED=0' in /etc/default/stunnel4 + lineinfile: dest=/etc/default/stunnel4 + regexp='^(\s*#)?\s*ENABLED=' + line='ENABLED=0' + owner=root group=root + mode=0644 + +- name: Copy stunnel4 service file + copy: src=lib/systemd/system/{{ item }} + dest=/lib/systemd/system/{{ item }} + owner=root group=root + mode=0644 + notify: + - systemctl daemon-reload + with_items: + - stunnel4.service + - stunnel4@.service -- cgit v1.2.3