summaryrefslogtreecommitdiffstats
path: root/roles/bacula-dir/tasks/main.yml
blob: 8d182d2fffe559cf84099731cd4520526d6b4b2e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
- name: Create /etc/stunnel/certs
  file: path=/etc/stunnel/certs
        state=directory
        owner=root group=root
        mode=0755

- name: Generate a private key and a X.509 certificate for Bacula Dir
  command: genkeypair.sh x509
                         --pubkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-dir.pem
                         --privkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-dir.key
                         --ou=BaculaDir --cn={{ inventory_hostname }} --dns={{ inventory_hostname }}
                         -t rsa -b 4096 -h sha512
  register: r1
  changed_when: r1.rc == 0
  failed_when: r1.rc > 1
  notify:
    - Restart stunnel@bacula-dir
  tags:
    - genkey

- name: Fetch Bacula Dir X.509 certificate
  # Ensure we don't fetch private data
  become: False
  fetch_cmd: cmd="openssl x509"
             stdin=/etc/stunnel/certs/{{ inventory_hostname_short }}-dir.pem
             dest=certs/bacula/{{ inventory_hostname_short }}-dir.pem
  tags:
    - genkey

- name: Copy Bacula SD X.509 certificates
  copy: src=certs/bacula/{{ hostvars[item].inventory_hostname_short }}-sd.pem
        dest=/etc/stunnel/certs/
        owner=root group=root
        mode=0644
  with_items: "{{ groups['bacula-sd'] | difference([inventory_hostname]) | sort }}"
  register: r2
  notify:
    - Restart stunnel@bacula-dir

- name: Copy Bacula FD X.509 certificates
  copy: src=certs/bacula/{{ hostvars[item].inventory_hostname_short }}-fd.pem
        dest=/etc/stunnel/certs/
        owner=root group=root
        mode=0644
  with_items: "{{ groups.all | difference([inventory_hostname]) | sort }}"
  register: r3
  notify:
    - Restart stunnel@bacula-dir

- name: Configure stunnel
  template: src=etc/stunnel/bacula-dir.conf.j2
            dest=/etc/stunnel/bacula-dir.conf
            owner=root group=root
            mode=0644
  register: r4
  notify:
    - Restart stunnel@bacula-dir

- name: Enable stunnel@bacula-dir
  service: name=stunnel4@bacula-dir enabled=yes

- name: Start stunnel@bacula-dir
  service: name=stunnel4@bacula-dir state=started
  when: not (r1.changed or r2.changed or r3.changed or r4.changed)

- meta: flush_handlers



- name: Install bacula-director
  apt: pkg={{ item }}
  with_items:
    - bacula-console
    - bacula-director-mysql

- name: Create a 'bacula' SQL user
  mysql_user2: name=bacula password= auth_plugin=auth_socket
               state=present
  notify:
    - Restart bacula-director

# Create with:
#   echo bconsole $(pwgen -sn 64 1) | sudo tee -a /etc/bacula/passwords-dir
#   echo $sd-sd   $(pwgen -sn 64 1) | sudo tee -a /etc/bacula/passwords-dir
#   echo $fd-fd   $(pwgen -sn 64 1) | sudo tee -a /etc/bacula/passwords-dir
#
# then add the password for each FD / SD:
#   echo $director-dir $password | sudo tee /etc/bacula/passwords-sd
#   echo $director-dir $password | sudo tee /etc/bacula/passwords-fd
- name: Ensure /etc/bacula/passwords-dir exists
  file: path=/etc/bacula/passwords-dir
        state=file
        owner=bacula group=bacula
        mode=0600

- name: Configure bconsole
  template: src=etc/bacula/bconsole.conf.j2
            dest=/etc/bacula/bconsole.conf
            owner=root group=root
            mode=0644

- name: Configure bacula
  template: src=etc/bacula/bacula-dir.conf.j2
            dest=/etc/bacula/bacula-dir.conf
            owner=root group=root
            mode=0644
  register: r
  notify:
    - Restart bacula-director

- name: Copy bacula-director.service
  copy: src=lib/systemd/system/bacula-director.service
        dest=/lib/systemd/system/bacula-director.service
        owner=root group=root
        mode=0644
  notify:
    - systemctl daemon-reload
    - Restart bacula-director

- meta: flush_handlers

- name: Enable bacula-director
  service: name=bacula-director enabled=yes

- name: Start bacula-director
  service: name=bacula-director state=started