blob: e0b1d8c6b68798410a50ddd685c8a3e69a4355f8 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
- name: Create /etc/stunnel/certs
file: path=/etc/stunnel/certs
state=directory
owner=root group=root
mode=0755
- name: Generate a private key and a X.509 certificate for munin-node
command: genkeypair.sh x509
--pubkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
--privkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.key
--ou=Munin --cn={{ inventory_hostname }} --dns={{ inventory_hostname }}
-t rsa -b 4096 -h sha512
register: r1
changed_when: r1.rc == 0
failed_when: r1.rc > 1
notify:
- Restart stunnel@munin-node
tags:
- genkey
- name: Fetch Munin X.509 certificate
# Ensure we don't fetch private data
become: False
fetch_cmd: cmd="openssl x509"
stdin=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
dest=certs/munin/{{ inventory_hostname }}.pem
tags:
- genkey
- name: Copy munin-master X.509 certificates
assemble: src=certs/munin regexp="{{ groups['munin-master'] | join('|') }}\.pem$" remote_src=no
dest=/etc/stunnel/certs/munin-master.pem
owner=root group=root
mode=0644
register: r2
when: "'munin-master' not in group_names"
notify:
- Restart stunnel@munin-node
- name: Configure stunnel
template: src=etc/stunnel/munin-node.conf.j2
dest=/etc/stunnel/munin-node.conf
owner=root group=root
mode=0644
register: r3
when: "'munin-master' not in group_names"
notify:
- Restart stunnel@munin-node
- name: Enable stunnel@munin-node
service: name=stunnel4@munin-node enabled=yes
- name: Start stunnel@munin-node
service: name=stunnel4@munin-node state=started
when: not (r1.changed or r2.changed or r3.changed)
- meta: flush_handlers
|
