Skip to content

Commit 0892966

Browse files
mkayontourmkayontour
committed
Merge branch 'main' of github.com:Icinga/ansible-collection-icinga into main
2 parents b9bb015 + 3baa41d commit 0892966

File tree

9 files changed

+261
-3
lines changed

9 files changed

+261
-3
lines changed

‎changelogs/fragments/feature_add_x509_module_installation.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
major_changes:
3+
- Added Installation of x509 certificate monitoring model

‎doc/getting-started.md‎

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,19 @@
11
### Getting Started
22

3-
The collection includes two roles in the current version.
3+
The collection includes six roles in the current version.
44

55
* icinga.repos: Role to manage repositories
66
* [Documentation: doc/role-repos](role-repos/role-repos.md)
77
* icinga.icinga2: Role to install and manage Icinga 2 instances.
88
* [Documentation: doc/role-icinga2](role-icinga2/role-icinga2.md)
9+
* icinga.icingadb: Role to install and manage IcingaDB, Icinga2's new data backend.
10+
* [Documentation: doc/role-icingadb](role-icingadb/role-icingadb.md)
11+
* icinga.icingadb_redis: Role to install and manage Redis, IcingaDB's cache backend.
12+
* [Documentation: doc/role-icingadb_redis](role-icingadb_redis/role-icingadb_redis.md)
13+
* icinga.icingaweb2: Role to install and manage Icinga Web 2.
14+
* [Documentation: doc/role-icingaweb2](role-icingaweb2/role-icingaweb2.md)
15+
* icinga.monitoring_plugins: Role to install and manage Icinga2 compatible monitoring plugins.
16+
* [Documentation: doc/role-monitoring_plugins](role-monitoring_plugins/role-monitoring_plugins.md)
917

1018

1119
---
@@ -39,6 +47,36 @@ ansible-galaxy collection build ansible-collection-icinga
3947
ansible-galaxy collection install icinga-icinga-0.3.0.tar.gz
4048
```
4149

50+
## Databases
51+
52+
Icinga2 relies on relational databases for many parts of its functionality. **None** of those databases get installed by the roles. You need to install and configure them yourself. For doing so, there are many ways available, e.g. the Ansible role [geerlingguy.mysql](https://galaxy.ansible.com/geerlingguy/mysql) for MySQL flavours (both MySQL and MariaDB) or [geerlingguy.postgresql](https://galaxy.ansible.com/geerlingguy/postgresql) for PostGresQL:
53+
54+
```yaml
55+
- name: Configure databases for Icinga2
56+
hosts: database
57+
vars:
58+
mysql_databases:
59+
- name: icingadb
60+
- name: icingaweb
61+
- name: vspheredb
62+
encoding: utf8mb4
63+
collation: utf8mb4_unicode_ci
64+
- name: director
65+
mysql_users:
66+
- name: icingadb-user
67+
host: localhost
68+
password: icingadb-password
69+
priv: "icingadb.*:ALL"
70+
[...]
71+
roles:
72+
- role: geerlingguy.mysql
73+
```
74+
75+
> [!NOTE]
76+
> Schema migrations needed for the respective Icinga components to work will be handled either by the respective roles or by the Icinga components themselves.
77+
78+
79+
4280
## Example Playbooks
4381
4482
This is an example on how to install an Icinga 2 server/master instance.

‎doc/role-icingadb/role-icingadb.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,12 @@ This role installs and configures the IcingaDB daemon. In addition it can also i
55
It serves as the official, more performant successor to Icinga IDO. More information about its purpose and design can be found [in the official documentation](https://icinga.com/docs/icinga-db/latest/doc/01-About/).
66

77

8-
> :information_source: In many scenarios you want to install the [icingadb_redis role](../role-icingadb_redis/) together with this role. It is part of this collection, too.
8+
> [!TIP]
9+
> In many scenarios you want to install the [icingadb_redis role](../role-icingadb_redis/) together with this role. It is part of this collection, too.
10+
11+
## Database
12+
13+
IcingaDB relies on a relational database to persist received data. This database **won't** be created by this role - you need to deploy and configure one in advance. For more information, see the [Databases](../getting-started.md#databases) section in the getting started guide.
914

1015
## Variables
1116

‎doc/role-icingaweb2/module-x509.md‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
## Module x509
2+
3+
### Variables and Configuration
4+
5+
The general module parameter like `enabled` and `source` can be applied here.
6+
7+
| Variable | Value |
8+
|----------|------------|
9+
| enabled | true/false |
10+
| source | package |
11+
12+
#### Section configuration
13+
14+
The backend database for the module needs to be available and configured at the `icingaweb2_resources` variable.
15+
16+
```
17+
icingaweb2_modules:
18+
x509:
19+
source: package
20+
enabled: true
21+
config:
22+
backend:
23+
resource: x509
24+
```
25+
26+
#### Configure SNI Names.
27+
28+
To configure SNIs for a IP address, use the dictionary `sni`.
29+
30+
Example:
31+
32+
```
33+
icingaweb2_modules:
34+
x509:
35+
source: package
36+
enabled: true
37+
config:
38+
backend:
39+
resource: x509
40+
sni:
41+
192.168.56.213:
42+
hostnames:
43+
- icinga.com
44+
- test2.icinga.com
45+
```
46+
47+
#### Import Certificates
48+
49+
To import certificates use the **list** `certificate_files` all files need to be
50+
available locally beforehand.
51+
52+
```
53+
icingaweb2_modules:
54+
x509:
55+
source: package
56+
enabled: true
57+
config:
58+
backend:
59+
resource: x509
60+
certificate_files:
61+
- /etc/ssl/certs/ca-certificates.crt
62+
```
63+
64+
#### Database Schema Setup
65+
66+
To import the database schema use `database` dictionary with the following variables.
67+
68+
| Variable | Type | Description | Default |
69+
|----------|------|-------------|---------|
70+
| `import_schema` | `Boolean` | Defines wether the schema will be imported or not. | false |
71+
| `host` | `String` | Defines database address to connect to. | `localhost` |
72+
| `port` | `int` | Defines the database port to connect to. | `3306` or `5432` |
73+
| `user` | `string` | Defines database user | `x509` |
74+
| `name` | `String` | Defines the database to connect to. | `x509` |
75+
| `password` | `String` | Defines the database password to connect with. | OMITTED |
76+
| `ssl_mode` | `String` | Clients attempt to connect using encryption, falling back to an unencrypted connection if an encrypted connection cannot be established |**n/a** |
77+
|`ssl_ca`| `String`| Defines the path to the ca certificate for client authentication. | **n/a** |
78+
|`ssl_cert`|`String`| Defines the path to the certificate for client authentication. | **n/a** |
79+
|`ssl_key`| `String` | Defines the path to the certificate key for client key authentication. | **n/a** |
80+
|`ssl_cipher`|`String`| Ciphers for the client authentication. | **n/a** |
81+
|`ssl_extra_options`|`String`| Extra options for the client authentication. | **n/a** |
82+
83+
84+
```
85+
icingaweb2_modules:
86+
x509:
87+
source: package
88+
enabled: true
89+
database:
90+
import_schema: true
91+
host: localhost
92+
port: 3306
93+
user: x509
94+
password: secret
95+
```

‎doc/role-icingaweb2/role-icingaweb2.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ The role icingaweb2 installs and configures Icinga Web 2 and its modules.
77
* [IcingaDB](./module-icingadb.md)
88
* [Monitoring](./module-monitoring.md)
99

10+
## Databases
11+
12+
Icingaweb2 and some of its modules rely on a relational database to persist data. These databases **won't** be created by this role - you need to deploy and configure them in advance. For more information, see the [Databases](../getting-started.md#databases) section in the getting started guide.
13+
1014
## Variables
1115

1216
### Icinga Web 2 DB Configuration

‎roles/icingaweb2/tasks/main.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,11 @@
4343
force: yes
4444
when: icingaweb2_modules is defined
4545
loop: "{{ icingaweb2_modules | dict2items }}"
46+
47+
# Many daemons fail before e.g. the resource is set up or the schema hasn't been migrated. This is a workaround.
48+
- name: Manage enabled module daemons
49+
ansible.builtin.service:
50+
name: "icinga-{{ item.key }}"
51+
state: restarted
52+
when: icingaweb2_modules is defined and item.value.enabled|bool == true and item.key in ['vspheredb', 'x509']
53+
loop: "{{ icingaweb2_modules | dict2items }}"

‎roles/icingaweb2/tasks/manage_mysql_imports.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
- name: Check Database Credentials
3+
ansible.builtin.assert:
4+
that:
5+
- _db['user'] is defined
6+
- _db['password'] is defined
7+
fail_msg: "No database credentials defined."
8+
9+
- name: Build mysql command
10+
ansible.builtin.set_fact:
11+
_tmp_mysqlcmd: >-
12+
mysql {% if _db['host'] | default('localhost') != 'localhost' %} -h "{{ _db['host'] }}" {%- endif %}
13+
{% if _db['port'] is defined %} -P "{{ _db['port'] }}" {%- endif %}
14+
{% if _db['ssl_mode'] is defined %} --ssl-mode "{{ _db['ssl_mode'] }}" {%- endif %}
15+
{% if _db['ssl_ca'] is defined %} --ssl-ca "{{ _db['ssl_ca'] }}" {%- endif %}
16+
{% if _db['ssl_cert'] is defined %} --ssl-cert "{{ _db['ssl_cert'] }}" {%- endif %}
17+
{% if _db['ssl_key'] is defined %} --ssl-key "{{ _db['ssl_key'] }}" {%- endif %}
18+
{% if _db['ssl_cipher'] is defined %} --ssl-cipher "{{ _db['ssl_cipher'] }}" {%- endif %}
19+
{% if _db['ssl_extra_options'] is defined %} {{ _db['ssl_extra_options'] }} {%- endif %}
20+
-u "{{ _db['user'] }}"
21+
-p"{{ _db['password'] }}"
22+
"{{ _db['name'] }}"
23+
24+
- name: MySQL check for db schema
25+
ansible.builtin.shell: >
26+
{{ _tmp_mysqlcmd }}
27+
-Ns -e "{{ _db['select_query'] }}"
28+
failed_when: false
29+
changed_when: false
30+
check_mode: false
31+
register: _db_schema
32+
33+
- name: MySQL import db schema
34+
ansible.builtin.shell: >
35+
{{ _tmp_mysqlcmd }}
36+
< {{ _db['schema_path'] }}
37+
when: _db_schema.rc != 0
38+
run_once: yes

‎roles/icingaweb2/tasks/modules/x509.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
- name: Module x509 | Ensure config directory
2+
ansible.builtin.file:
3+
state: directory
4+
dest: "{{ icingaweb2_modules_config_dir }}/{{ _module }}"
5+
owner: "{{ icingaweb2_httpd_user }}"
6+
group: "{{ icingaweb2_group }}"
7+
mode: "2770"
8+
vars:
9+
_module: "{{ item.key }}"
10+
11+
- name: Module x509 | Manage config files
12+
ansible.builtin.include_tasks: manage_module_config.yml
13+
loop: "{{ _files }}"
14+
loop_control:
15+
loop_var: _file
16+
when: vars['icingaweb2_modules'][_module][_file] is defined
17+
vars:
18+
_module: "{{ item.key }}"
19+
_files:
20+
- config
21+
- sni
22+
23+
- name: Module x509 | Manage Schema
24+
block:
25+
- name: Module x509 | Prepare _db informations
26+
ansible.builtin.set_fact:
27+
_db:
28+
host: "{{ vars['icingaweb2_modules'][_module]['database']['host'] | default('localhost') }}"
29+
port: "{{ vars['icingaweb2_modules'][_module]['database']['port'] | default('3306') }}"
30+
user: "{{ vars['icingaweb2_modules'][_module]['database']['user'] | default('x509') }}"
31+
password: "{{ vars['icingaweb2_modules'][_module]['database']['password'] | default(omit) }}"
32+
name: "{{ vars['icingaweb2_modules'][_module]['database']['name'] | default('x509') }}"
33+
ssl_mode: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_mode'] | default(omit) }}"
34+
ssl_ca: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_ca'] | default(omit) }}"
35+
ssl_cert: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_cert'] | default(omit) }}"
36+
ssl_key: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_key'] | default(omit) }}"
37+
ssl_cipher: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_cipher'] | default(omit) }}"
38+
ssl_extra_options: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_extra_options'] | default(omit) }}"
39+
schema_path: /usr/share/icingaweb2/modules/x509/schema/mysql.schema.sql
40+
select_query: "select * from x509_certificate"
41+
when: vars['icingaweb2_modules'][_module]['database']['type'] | default('mysql') == 'mysql'
42+
43+
- ansible.builtin.fail:
44+
fail_msg: "The Database type select is not supported, {{ vars['icingaweb2_modules'][_module]['database']['type'] }} [Supported=mysql]"
45+
when: vars['icingaweb2_modules'][_module]['database']['type'] is defined and vars['icingaweb2_modules'][_module]['database']['type'] != 'mysql'
46+
47+
- name: Module x509 | Import Schema
48+
ansible.builtin.include_tasks: ../manage_mysql_imports.yml
49+
50+
- name: Module x509 | empty _db var
51+
ansible.builtin.set_fact:
52+
_db: {}
53+
when: vars['icingaweb2_modules'][_module]['database']['import_schema'] | default(false)
54+
vars:
55+
_module: "{{ item.key }}"
56+
57+
- name: Module x509 | Import Certificates
58+
ansible.builtin.shell: >
59+
icingacli {{ _module }} import --file {{ _file }}
60+
loop: "{{ vars['icingaweb2_modules'][_module]['certificate_files'] }}"
61+
loop_control:
62+
loop_var: _file
63+
vars:
64+
_module: "{{ item.key }}"
65+
when: vars['icingaweb2_modules'][_module]['certificate_files'] is defined
66+
changed_when: false

‎roles/icingaweb2/vars/main.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,5 @@
22
icingaweb2_module_packages:
33
icingadb: icingadb-web
44
director: icinga-director
5-
businessprocess: icinga-businessprocess
5+
x509: icinga-x509
6+
businessprocess: icinga-businessprocess

0 commit comments

Comments
 (0)