summaryrefslogtreecommitdiffstats
path: root/roles/common/tasks/munin-node-ssl.yml
blob: 59ed7d7a2972c165ab71d6d41cd3b9b3882470c1 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
- name: Create /etc/stunnel/certs
  file: path=/etc/stunnel/certs
        state=directory
        owner=root group=root
        mode=0755

- name: Generate a private key and a X.509 certificate for munin-node
  command: genkeypair.sh x509
                         --pubkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
                         --privkey=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.key
                         --ou=Munin --cn={{ inventory_hostname }} --dns={{ inventory_hostname }}
                         -t rsa -b 4096 -h sha512
  register: r1
  changed_when: r1.rc == 0
  failed_when: r1.rc > 1
  notify:
    - Restart stunnel@munin-node
  tags:
    - genkey

- name: Fetch Munin X.509 certificate
  # Ensure we don't fetch private data
  become: False
  fetch: src=/etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
         dest=certs/munin/{{ inventory_hostname }}.pem
         fail_on_missing=yes
         flat=yes
  tags:
    - genkey

- name: Copy munin-master X.509 certificates
  assemble: src=certs/munin regexp="{{ groups['munin-master'] | join('|') }}\.pem$" remote_src=no
            dest=/etc/stunnel/certs/munin-master.pem
            owner=root group=root
            mode=0644
  register: r2
  when: "'munin-master' not in group_names"
  notify:
    - Restart stunnel@munin-node

- name: Configure stunnel
  template: src=etc/stunnel/munin-node.conf.j2
            dest=/etc/stunnel/munin-node.conf
            owner=root group=root
            mode=0644
  register: r3
  when: "'munin-master' not in group_names"
  notify:
    - Restart stunnel@munin-node

- name: Enable stunnel@munin-node
  service: name=stunnel4@munin-node enabled=yes

- name: Start stunnel@munin-node
  service: name=stunnel4@munin-node state=started
  when: not (r1.changed or r2.changed or r3.changed)

- meta: flush_handlers