Skip to content

[WIP] Complete rework of the role to simplify distributed site setup #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 34 commits into
base: master
Choose a base branch
from
Open

[WIP] Complete rework of the role to simplify distributed site setup #53

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
34 commits
Select commit Hold shift + click to select a range
5075df2
Remove unneeded variables
ganto Feb 13, 2017
66259aa
Add current status of site creation
ganto Mar 29, 2017
ee665af
Fix 'multisite_password', set required 'multisite_alias'
ganto Mar 30, 2017
7b8dbc2
Set credential paths related to the inventory name instead of fqdn
ganto Mar 30, 2017
821688e
Convert user setup to run for distributed sites in 'checkmk_servers__…
ganto Mar 30, 2017
21a2bfa
Iterate user setup tasks over all distributed sites
ganto Mar 30, 2017
2954cc2
Make distributed site login and config work with new site definition
ganto Mar 31, 2017
231d06e
Remove unused variables
ganto Apr 3, 2017
9128633
Create new env sub-role for site setup, write site facts
ganto Apr 10, 2017
3ea7723
Adjust home that it matches the user created by 'omd'
ganto Apr 10, 2017
333b001
Use user__dependent_accounts and etc_services__dependent_list from facts
ganto Apr 10, 2017
6b8fd58
Make sure the checkmk_server/env tasks are run by all play hosts
ganto Apr 11, 2017
1737762
Leverage ssh key setup from debops.users role, set public key local fact
ganto Apr 11, 2017
81f078a
Read correct facts after changes, add SSH authorized_keys setup
ganto Apr 12, 2017
a726abf
Add users to 'sshusers' group which allows SSH login
ganto Apr 12, 2017
81810fd
Run config synchronization to slave site via rsync
ganto Apr 12, 2017
e51f79f
Update playbook to use the 'checkmk_server/env' and 'debops.users' roles
ganto Apr 13, 2017
0d0a2fb
Rename 'checkmk_server__hostname' to 'checkmk_server__fqdn' for consi…
ganto Apr 20, 2017
5b01f6c
Fix applying custom patches, remove env role debugging
ganto Apr 20, 2017
bae1222
Leverage 'debops.apache' role for local reverse proxy configuration
ganto Apr 21, 2017
53c1e53
Explicitly define Apache configuration includes provided by Check_MK
ganto Apr 26, 2017
97aceb8
Remove HTTP-related ferm rules now handled by 'apache__ferm__dependen…
ganto Apr 21, 2017
1924a7a
Generate ferm rules for livestatus according to the configured sites
ganto May 2, 2017
5635218
Fix 'apache__dependent_snippets' configuration
ganto May 4, 2017
b2c4951
Remove some debugging code
ganto May 5, 2017
af9d305
Define dependent vars in defaults, don't fail with no facts
ganto May 5, 2017
cdfb4e3
Run tests on Ubuntu trusty as precise is EOL
ganto May 5, 2017
c5717d4
Create master site if 'checkmk_server__site' is defined
ganto May 5, 2017
35bc317
Don't fail if 'mod_headers' is not (yet) enabled
ganto May 8, 2017
e641ae7
Properly set and update local facts from the correct context
ganto May 15, 2017
5bc3e41
Adjust the fact that local facts are stored as dict not lists
ganto May 16, 2017
5c0a5da
Adjust SSH public key lookup to new facts layout
ganto May 16, 2017
6a5c4f5
Update dependency to Ansible >=2.3.0
ganto May 18, 2017
4d0e8ca
Clarify comments in the local facts template
ganto May 19, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 7 additions & 55 deletions defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -598,63 +598,15 @@ checkmk_server__site_cfg_netif_description:
checkmk_server__site_packages: []
# ]]]
# ]]]
# PKI Configuration [[[
# ---------------------
# Configuration for other Ansible roles [[[
# -----------------------------------------

# .. envvar:: checkmk_server__pki [[[
# .. envvar:: checkmk_server__apache__dependent_vhosts [[[
#
# Enable or disable support for HTTPS in Check_MK server (using
# debops.pki_).
checkmk_server__pki: '{{ (True
if (ansible_local|d() and ansible_local.pki|d() and
ansible_local.pki.enabled|d() | bool)
else False) | bool }}'

# ]]]
# .. envvar:: checkmk_server__pki_path [[[
#
# Base path for PKI directory.
checkmk_server__pki_path: '{{ ansible_local.pki.path
if (ansible_local|d() and ansible_local.pki|d() and
ansible_local.pki.path|d())
else "/etc/pki/realms" }}'

# ]]]
# .. envvar:: checkmk_server__pki_realm [[[
#
# Default PKI realm used by Check_MK server.
checkmk_server__pki_realm: '{{ ansible_local.pki.realm
if (ansible_local|d() and ansible_local.pki|d() and
ansible_local.pki.realm|d())
else "domain" }}'

# ]]]
# .. envvar:: checkmk_server__pki_ca [[[
#
# Root CA certificate, relative to :envvar:`checkmk_server__pki_realm`.
checkmk_server__pki_ca: 'CA.crt'

# ]]]
# .. envvar:: checkmk_server__pki_crt [[[
#
# Host certificate, relative to :envvar:`checkmk_server__pki_realm`.
checkmk_server__pki_crt: 'default.crt'

# ]]]
# .. envvar:: checkmk_server__pki_key [[[
#
# Host private key, relative to :envvar:`checkmk_server__pki_realm`.
checkmk_server__pki_key: 'default.key'

# ]]]
# .. envvar:: checkmk_server__tls_options [[[
#
# Additional Apache mod_ssl options. Valid configuration keys:
# ``SSLCipherSuite``, ``SSLHonorCipherOrder``, ``SSLProtocols``,
# ``SSLStrictSNIVHostCheck``
checkmk_server__tls_options:
SSLHonorCipherOrder: 'On'
SSLCipherSuite: 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS'
# Configuration for debops.apache_ Ansible role.
checkmk_server__apache__dependent_vhosts:
- name: '{{ checkmk_server__fqdn }}'
by_role: 'debops-contrib.checkmk_server'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NIce work! I guess the Apache omd snippet could be disabled and instead be included in checkmk_server__apache__dependent_vhosts to ensure that omd is only available for this vhost.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ya, I thought about that, but I wasn't sure how to properly do this. To add the snipped to the vhost I guess I have to define include: '/omd/apache/*.conf' but how do I get rid of the conf-enabled/zzz_omd.conf?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Something like:

checkmk_server__apache__dependent_snippets:                                                                                                                                                                        
  'zzz_omd':
    enabled: False

should do.

For the vhost, item.include: [ '/omd/apache/*.conf' ] can be tried.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added the snippet configuration as you suggested. However, it fails with:

TASK [debops.apache : Create conf-available snippets] ********************************************************************************************
[...]
failed: [cmk01] (item={'key': u'zzz_omd', 'value': {u'enabled': False}}) => {
    "failed": true, 
    "item": {
        "key": "zzz_omd", 
        "value": {
            "enabled": false
        }
    }, 
    "msg": "Unable to find 'etc/apache2/conf-available/zzz_omd.conf.j2' in expected paths."
}

I didn't find a successful way to tell the role that this configuration is provided externally. Any suggestion?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My mistake, excuse me. Try:

checkmk_server__apache__dependent_snippets:                                                                                                                                                                        
  'zzz_omd':
    enabled: False
    type: 'dont-create'

type: 'dont-create' is there specifically for your usecase, as documented 😉
Have you seen the nice documenteion of the role btw? Ref: https://docs.debops.org/en/latest/ansible/roles/ansible-apache/docs/

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack, my bad. I read the documentation, but not far enough 😉 I had in mind there is only raw and divert. I guess I was a bit confused by the following sentence:

Type: raw

Available when ``item.type`` is set to ``raw`` or ``divert``.

# ]]]
# ]]]
# ]]]
16 changes: 12 additions & 4 deletions docs/playbooks/checkmk_server.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,21 +6,29 @@

roles:

- role: debops.apache/env
tags: [ 'role::apache', 'role::apache:env' ]

- role: debops-contrib.checkmk_server/env
tags: [ 'role::checkmk_server', 'role::checkmk_server:env' ]

- role: debops.users
tags: [ 'role::users' ]
users__dependent_accounts: '{{ ansible_local.checkmk_server | map(attribute="dependent_vars.users__dependent_accounts") | list }}'

- role: debops.etc_services
tags: [ 'role::etc_services' ]
etc_services__dependent_list: '{{ ansible_local.checkmk_server | map(attribute="dependent_vars.etc_services__dependent_list") | list }}'

- role: debops.ferm
tags: [ 'role::ferm' ]
ferm__dependent_rules:
- '{{ apache__ferm__dependent_rules }}'
- '{{ checkmk_server__ferm_dependent_rules }}'

- role: debops.apache
tags: [ 'role::apache' ]
apache__dependent_vhosts: '{{ checkmk_server__apache__dependent_vhosts }}'

- role: debops.users
tags: [ 'role::users' ]
users__dependent_accounts: '{{ ansible_local.checkmk_server | map(attribute="dependent_vars.users__dependent_accounts") | list }}'

- role: debops-contrib.checkmk_server
tags: [ 'role::checkmk_server' ]
55 changes: 4 additions & 51 deletions tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,60 +1,10 @@
---
# vim: foldmarker=[[[,]]]:foldmethod=marker

#- debug:
# var: checkmk_server__sites
#- fail:
# msg: 'bla'

- name: Set TLS options
template:
src: 'etc/apache2/mods-available/ssl.conf.j2'
dest: '/etc/apache2/mods-available/ssl.conf'
owner: 'root'
group: 'root'
mode: '0644'
when: checkmk_server__pki|d(False)
notify: [ 'Reload apache2' ]

- name: Check apache2 mod_headers status
stat:
path: '/etc/apache2/mods-enabled/headers.load'
register: checkmk_server_register_mod_headers
changed_when: False
always_run: True

- name: Enable apache2 mod_headers
command: 'a2enmod headers'
when: not checkmk_server_register_mod_headers.stat.exists
notify: [ 'Reload apache2' ]

- name: Check apache2 mod_ssl status
stat:
path: '/etc/apache2/mods-enabled/ssl.load'
register: checkmk_server_register_mod_ssl
changed_when: False
always_run: True

- name: Enable apache2 mod_ssl
command: '{{ item }}'
with_items:
- 'a2enmod ssl'
- 'a2ensite default-ssl'
when: checkmk_server__pki|d(False) and not checkmk_server_register_mod_ssl.stat.exists
notify: [ 'Reload apache2' ]

- name: Disable apache2 mod_ssl
command: '{{ item }}'
with_items:
- 'a2dismod ssl'
- 'a2dissite default-ssl'
when: not checkmk_server__pki|d(False) and checkmk_server_register_mod_ssl.stat.exists
notify: [ 'Reload apache2' ]

- name: Manage SSH keys for monitoring and site synchronization
include: ssh.yml

- name: Manage Check_MK site
- name: Manage Check_MK sites
include: site.yml
with_items: '{{ checkmk_server__sites }}'
loop_control:
Expand All @@ -69,6 +19,9 @@
- 'role::checkmk_server:multisite'
- 'role::checkmk_server:users'

- name: Trigger reload/restart handlers
meta: flush_handlers

- name: Login on distributed sites
include: login.yml
when: (checkmk_server__sites | length) > 1
Expand Down