blob: 8d182d2fffe559cf84099731cd4520526d6b4b2e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
- name: Create /etc/stunnel/certs
file: path=/etc/stunnel/certs
state=directory
owner=root group=root
mode=0755
- name: Generate a private key and a X.509 certificate for Bacula Dir
command: genkeypair.sh x509
--pubkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-dir.pem
--privkey=/etc/stunnel/certs/{{ inventory_hostname_short }}-dir.key
--ou=BaculaDir --cn={{ inventory_hostname }} --dns={{ inventory_hostname }}
-t rsa -b 4096 -h sha512
register: r1
changed_when: r1.rc == 0
failed_when: r1.rc > 1
notify:
- Restart stunnel@bacula-dir
tags:
- genkey
- name: Fetch Bacula Dir X.509 certificate
# Ensure we don't fetch private data
become: False
fetch_cmd: cmd="openssl x509"
stdin=/etc/stunnel/certs/{{ inventory_hostname_short }}-dir.pem
dest=certs/bacula/{{ inventory_hostname_short }}-dir.pem
tags:
- genkey
- name: Copy Bacula SD X.509 certificates
copy: src=certs/bacula/{{ hostvars[item].inventory_hostname_short }}-sd.pem
dest=/etc/stunnel/certs/
owner=root group=root
mode=0644
with_items: "{{ groups['bacula-sd'] | difference([inventory_hostname]) | sort }}"
register: r2
notify:
- Restart stunnel@bacula-dir
- name: Copy Bacula FD X.509 certificates
copy: src=certs/bacula/{{ hostvars[item].inventory_hostname_short }}-fd.pem
dest=/etc/stunnel/certs/
owner=root group=root
mode=0644
with_items: "{{ groups.all | difference([inventory_hostname]) | sort }}"
register: r3
notify:
- Restart stunnel@bacula-dir
- name: Configure stunnel
template: src=etc/stunnel/bacula-dir.conf.j2
dest=/etc/stunnel/bacula-dir.conf
owner=root group=root
mode=0644
register: r4
notify:
- Restart stunnel@bacula-dir
- name: Enable stunnel@bacula-dir
service: name=stunnel4@bacula-dir enabled=yes
- name: Start stunnel@bacula-dir
service: name=stunnel4@bacula-dir state=started
when: not (r1.changed or r2.changed or r3.changed or r4.changed)
- meta: flush_handlers
- name: Install bacula-director
apt: pkg={{ item }}
with_items:
- bacula-console
- bacula-director-mysql
- name: Create a 'bacula' SQL user
mysql_user2: name=bacula password= auth_plugin=auth_socket
state=present
notify:
- Restart bacula-director
# Create with:
# echo bconsole $(pwgen -sn 64 1) | sudo tee -a /etc/bacula/passwords-dir
# echo $sd-sd $(pwgen -sn 64 1) | sudo tee -a /etc/bacula/passwords-dir
# echo $fd-fd $(pwgen -sn 64 1) | sudo tee -a /etc/bacula/passwords-dir
#
# then add the password for each FD / SD:
# echo $director-dir $password | sudo tee /etc/bacula/passwords-sd
# echo $director-dir $password | sudo tee /etc/bacula/passwords-fd
- name: Ensure /etc/bacula/passwords-dir exists
file: path=/etc/bacula/passwords-dir
state=file
owner=bacula group=bacula
mode=0600
- name: Configure bconsole
template: src=etc/bacula/bconsole.conf.j2
dest=/etc/bacula/bconsole.conf
owner=root group=root
mode=0644
- name: Configure bacula
template: src=etc/bacula/bacula-dir.conf.j2
dest=/etc/bacula/bacula-dir.conf
owner=root group=root
mode=0644
register: r
notify:
- Restart bacula-director
- name: Copy bacula-director.service
copy: src=lib/systemd/system/bacula-director.service
dest=/lib/systemd/system/bacula-director.service
owner=root group=root
mode=0644
notify:
- systemctl daemon-reload
- Restart bacula-director
- meta: flush_handlers
- name: Enable bacula-director
service: name=bacula-director enabled=yes
- name: Start bacula-director
service: name=bacula-director state=started
|
