Import the old role.

2020-08-20 18:25:25 +02:00 · 2020-08-20 18:25:25 +02:00 · 7505c4642d
parent 0b7ac4d820
commit 7505c4642d
18 changed files with 794 additions and 70 deletions
--- a/README.md
+++ b/README.md
@ -1,31 +1,75 @@
 Role Name
 =========

-A brief description of the role goes here.
-
-Requirements
------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+A role that installs the free components of Elasticsearch and, optionally, Kibana. <https://www.elastic.co>

 Role Variables
 --------------

-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+The most important variables are listed below:
+
+``` yaml
+elasticsearch_install: True
+elasticsearch_major_version: 7
+elasticsearch_minor_version: 9
+elasticsearch_patch_version: 0
+
+elasticsearch_kibana_install: False
+elasticsearch_kibana_enabled: True
+elasticsearch_kibana_proxy: False
+elasticsearch_kibana_nginx_proxy: True
+
+elasticsearch_kibana_http_port: 5601
+elasticsearch_kibana_bind_ip: 127.0.0.1
+elasticsearch_kibana_serverpath: ''
+elasticsearch_kibana_servername: '{{ ansible_fqdn }}'
+elasticsearch_kibana_elasticsearch_url: 'http://localhost:9200'
+elasticsearch_kibana_preserve_host: 'false'
+elasticsearch_kibana_ssl_enabled: False
+elasticsearch_kibana_rundir: /run/kibana
+
+elasticsearch_package_state: 'present'
+elasticsearch_cluster_name: 'Elasticsearch Cluster'
+elasticsearch_enabled: True
+elasticsearch_http_port: 9200
+elasticsearch_transport_min_port: 9300
+elasticsearch_transport_max_port: 9400
+elasticsearch_data_dir: /var/lib/elasticsearch
+elasticsearch_log_dir: /var/log/elasticsearch
+elasticsearch_bind_ip: 0.0.0.0
+elasticsearch_discovery_host_list: '["127.0.0.1", "[::1]"]'
+elasticsearch_define_majority_of_nodes: True
+elasticsearch_majority_of_nodes: 1
+elasticsearch_bootstrap_known_masters:
+  - '{{ ansible_fqdn }}'
+elasticsearch_real_cluster: False
+elasticsearch_recover_after_nodes: 3
+elasticsearch_max_local_storage_nodes: 1
+elasticsearch_destructive_requires_name: 'true'
+elasticsearch_define_heap_size: False
+elasticsearch_heap_size: 2g
+elasticsearch_additional_java_opts: '-server -Djava.awt.headless=true -Dfile.encoding=UTF-8'
+elasticsearch_additional_conf:
+  - { name: 'search.max_buckets', value: '65535'}
+
+elasticsearch_max_open_files: 65535
+elasticsearch_cluster_routing_allocation_disk_threshold_enabled: 'true'
+elasticsearch_cluster_routing_allocation_disk_watermark_low: '85%'
+elasticsearch_cluster_routing_allocation_disk_watermark_high: '90%'
+# Compatibility with kernels <= 3.5. Set to False if you are using a newer kernel
+elasticsearch_disable_bootstrap_syscall_filter: True
+
+# elasticsearch 5+ not supported yet, so set it to False when installing 5.x
+elasticsearch_hq_install: False
+elasticsearch_hq_plugin:
+  - { name: 'royrusso/elasticsearch-HQ', state: 'present' }
+```

 Dependencies
 ------------

-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
+* openjdk
+* nginx (as reverse proxy for Kibana)

 License
 -------
@ -35,4 +79,4 @@ EUPL-1.2
 Author Information
 ------------------

-An optional section for the role authors to include contact information, or a website (HTML is not allowed).
+Andrea Dell'Amico, <andrea.dellamico@isti.cnr.it>
--- a/defaults/main.yml
+++ b/defaults/main.yml
@ -1,2 +1,55 @@
 ---
-# defaults file for ansible-role-template
+elasticsearch_install: True
+elasticsearch_major_version: 7
+elasticsearch_minor_version: 9
+elasticsearch_patch_version: 0
+
+elasticsearch_kibana_install: False
+elasticsearch_kibana_enabled: True
+elasticsearch_kibana_proxy: False
+elasticsearch_kibana_nginx_proxy: True
+
+elasticsearch_kibana_http_port: 5601
+elasticsearch_kibana_bind_ip: 127.0.0.1
+elasticsearch_kibana_serverpath: ''
+elasticsearch_kibana_servername: '{{ ansible_fqdn }}'
+elasticsearch_kibana_elasticsearch_url: 'http://localhost:9200'
+elasticsearch_kibana_preserve_host: 'false'
+elasticsearch_kibana_ssl_enabled: False
+elasticsearch_kibana_rundir: /run/kibana
+
+elasticsearch_package_state: 'present'
+elasticsearch_cluster_name: 'Elasticsearch Cluster'
+elasticsearch_enabled: True
+elasticsearch_http_port: 9200
+elasticsearch_transport_min_port: 9300
+elasticsearch_transport_max_port: 9400
+elasticsearch_data_dir: /var/lib/elasticsearch
+elasticsearch_log_dir: /var/log/elasticsearch
+elasticsearch_bind_ip: 0.0.0.0
+elasticsearch_discovery_host_list: '["127.0.0.1", "[::1]"]'
+elasticsearch_define_majority_of_nodes: True
+elasticsearch_majority_of_nodes: 1
+elasticsearch_bootstrap_known_masters:
+  - '{{ ansible_fqdn }}'
+elasticsearch_real_cluster: False
+elasticsearch_recover_after_nodes: 3
+elasticsearch_max_local_storage_nodes: 1
+elasticsearch_destructive_requires_name: 'true'
+elasticsearch_define_heap_size: False
+elasticsearch_heap_size: 2g
+elasticsearch_additional_java_opts: '-server -Djava.awt.headless=true -Dfile.encoding=UTF-8'
+elasticsearch_additional_conf:
+  - { name: 'search.max_buckets', value: '65535'}
+
+elasticsearch_max_open_files: 65535
+elasticsearch_cluster_routing_allocation_disk_threshold_enabled: 'true'
+elasticsearch_cluster_routing_allocation_disk_watermark_low: '85%'
+elasticsearch_cluster_routing_allocation_disk_watermark_high: '90%'
+# Compatibility with kernels <= 3.5. Set to False if you are using a newer kernel
+elasticsearch_disable_bootstrap_syscall_filter: True
+
+# elasticsearch 5+ not supported yet, so set it to False when installing 5.x
+elasticsearch_hq_install: False
+elasticsearch_hq_plugin:
+  - { name: 'royrusso/elasticsearch-HQ', state: 'present' }
--- a/handlers/main.yml
+++ b/handlers/main.yml
@ -1,2 +1,11 @@
 ---
-# handlers file for ansible-role-template
+- name: Restart elasticsearch
+  service: name=elasticsearch state=restarted enabled=yes
+  when: elasticsearch_enabled | bool
+  ignore_errors: True
+
+- name: Restart kibana
+  service: name=kibana state=restarted enabled=yes
+  when: elasticsearch_kibana_enabled | bool
+
+
--- a/meta/main.yml
+++ b/meta/main.yml
@ -1,61 +1,32 @@
 galaxy_info:
-  author: your name
-  description: your description
+  author: Andrea Dell'Amico
+  description: Systems Architect
  company: ISTI-CNR

-  # If the issue tracker for your role is not on github, uncomment the
-  # next line and provide a value
  issue_tracker_url: https://redmine-s2i2s.isti.cnr.it/projects/provisioning

-  # Some suggested licenses:
-  # - BSD (default)
-  # - MIT
-  # - GPLv2
-  # - GPLv3
-  # - Apache
-  # - CC-BY
-  license: EUPL-1.2
+  license: EUPL 1.2+

  min_ansible_version: 2.8

-  # If this a Container Enabled role, provide the minimum Ansible Container version.
-  # min_ansible_container_version:
-
-  # Optionally specify the branch Galaxy will use when accessing the GitHub
-  # repo for this role. During role install, if no tags are available,
-  # Galaxy will use this branch. During import Galaxy will access files on
-  # this branch. If Travis integration is configured, only notifications for this
-  # branch will be accepted. Otherwise, in all cases, the repo's default branch
-  # (usually master) will be used.
-  #github_branch:
-
-  #
-  # Provide a list of supported platforms, and for each platform a list of versions.
-  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
  # To view available platforms and versions (or releases), visit:
  # https://galaxy.ansible.com/api/v1/platforms/
  #
-  # platforms:
-  # - name: Fedora
-  #   versions:
-  #   - all
-  #   - 25
-  # - name: SomePlatform
-  #   versions:
-  #   - all
-  #   - 1.0
-  #   - 7
-  #   - 99.99
+  platforms:
+    - name: Ubuntu
+      versions:
+        - bionic

-  galaxy_tags: []
-    # List tags for your role here, one per line. A tag is a keyword that describes
-    # and categorizes the role. Users find roles by searching for tags. Be sure to
-    # remove the '[]' above, if you add tags to this list.
-    #
-    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
-    #       Maximum 20 tags per role.
-
-dependencies: []
-  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
-  # if you add dependencies to this list.
+  galaxy_tags:
+    - users

+dependencies:
+  - src: git+https://gitea-s2i2s.isti.cnr.it/ISTI-ansible-roles/ansible-role-openjdk.git
+    version: master
+    name: openjdk
+    state: latest
+  - src: git+https://gitea-s2i2s.isti.cnr.it/ISTI-ansible-roles/ansible-role-nginx.git
+    version: master
+    name: nginx
+    state: latest
+    when: elasticsearch_kibana_nginx_proxy
--- a/tasks/elasticsearch.yml
+++ b/tasks/elasticsearch.yml
@ -0,0 +1,27 @@
+---
+- name: Elasticsearch installation
+  block:
+    - name: Install the elasticsearch deb packages
+      apt: name='{{ elasticsearch_packages }}' state={{ elasticsearch_package_state }} update_cache=yes cache_valid_time=1800
+  
+    - name: Install the elasticsearch startup default
+      template: src=elasticsearch-default.j2 dest=/etc/default/elasticsearch owner=root group=elasticsearch mode=0640
+      register: elasticsearch_default
+      notify: Restart elasticsearch
+
+  when: ansible_distribution_file_variety == "Debian"
+  tags: [ 'ELK', 'elasticsearch', 'elk' ]
+
+- name: Elasticsearch configuration
+  block:
+    - name: Install the elasticsearch JVM options
+      template: src=jvm.options.j2 dest=/etc/elasticsearch/jvm.options owner=root group=elasticsearch mode=0640
+      register: elasticsearch_jvm_opts
+      notify: Restart elasticsearch
+
+    - name: Install the elasticsearch configuration
+      template: src=elasticsearch.yml.j2 dest=/etc/elasticsearch/elasticsearch.yml owner=root group=elasticsearch mode=0640
+      register: elasticsearch_configuration
+      notify: Restart elasticsearch
+
+  tags: [ 'ELK', 'elasticsearch', 'elk', 'elasticsearch_conf' ]
--- a/tasks/elasticsearch_plugins.yml
+++ b/tasks/elasticsearch_plugins.yml
@ -0,0 +1,16 @@
+---
+- block:
+    - name: Manage a list of elasticsearch plugins
+      elasticsearch_plugin: name="{{ item.name }}" state={{ item.state }} plugin_bin={{ elasticsearch_plugin_bin }} url={{ item.url|default(omit) }} version={{ item.version|default(omit) }}
+      with_items: '{{ elasticsearch_plugins | default ([]) }}'
+
+    - name: Install the elasticsearch HQ plugin
+      elasticsearch_plugin: name="{{ item.name }}" state={{ item.state }} plugin_bin={{ elasticsearch_plugin_bin }} url={{ item.url|default(omit) }} version={{ item.version|default(omit) }}
+      with_items: '{{ elasticsearch_hq_plugin | default ([]) }}'
+      when:
+        - elasticsearch_major_version <= 2
+        - elasticsearch_hq_install
+
+  when: elasticsearch_plugins is defined
+  tags: [ 'elasticsearch', 'es_plugins' ]
+    
--- a/tasks/elasticsearch_service.yml
+++ b/tasks/elasticsearch_service.yml
@ -0,0 +1,11 @@
+---
+- name: Ensure that elasticsearch is enabled and running
+  service: name=elasticsearch state=started enabled=yes
+  when: elasticsearch_enabled | bool
+  tags: [ 'ELK', 'elasticsearch', 'elk' ]
+  
+- name: Ensure that elasticsearch is disabled and stopped
+  service: name=elasticsearch state=stopped enabled=no
+  when: not elasticsearch_enabled | bool
+  tags: [ 'ELK', 'elasticsearch', 'elk' ]
+  
--- a/tasks/elk_repo.yml
+++ b/tasks/elk_repo.yml
@ -0,0 +1,10 @@
+---
+- name: ELK repository
+  block:
+    - name: Install the elasticsearch repo key
+      apt_key: url={{ elasticsearch_repo_key }} state=present
+
+    - name: Install the elasticsearch deb repository
+      apt_repository: repo='{{ elasticsearch_repo }}' state=present update_cache=yes
+
+  tags: [ 'ELK', 'elasticsearch', 'elk' ]
--- a/tasks/kibana.yml
+++ b/tasks/kibana.yml
@ -0,0 +1,58 @@
+---
+- name: Kibana x509 certificate management
+  block:
+    - name: Create the acme hooks directory if it does not yet exist
+      file: dest={{ letsencrypt_acme_sh_services_scripts_dir }} state=directory owner=root group=root
+
+    - name: Create the kibana pki subdir
+      file: dest={{ pki_dir }}/kibana state=directory owner=root group=kibana mode=0750
+
+    - name: Check if the global certificate private key exists
+      stat: path={{ letsencrypt_acme_certs_dir }}/privkey
+      register: kibana_privkey
+
+    - name: Check if the kibana certificate private key exists under the pki directory
+      stat: path={{ pki_dir }}/kibana/privkey
+      register: kibana_pki_privkey
+
+    - name: Copy the private key into the expected place if it is not already there
+      copy: src={{ letsencrypt_acme_certs_dir }}/privkey dest={{ pki_dir }}/kibana/privkey remote_src=yes owner=root group=kibana mode=0440
+      when:
+        - kibana_privkey.stat.exists
+        - not kibana_pki_privkey.stat.exists
+
+    - name: Install the kibana hook for letsencrypt
+      template: src=kibana-letsencrypt-hook.sh.j2 dest=/usr/lib/acme/hooks/kibana owner=root group=root mode=0550
+
+  when:
+    - elasticsearch_kibana_ssl_enabled | bool
+    - letsencrypt_acme_install is defined and letsencrypt_acme_install | bool
+  tags: [ 'ELK', 'elasticsearch', 'elk', 'kibana' ]
+
+- name: Kibana installation
+  block:
+    - name: Install the Kibana packages
+      apt: name='{{ elasticsearch_kibana_packages }}' state={{ elasticsearch_package_state }} update_cache=yes cache_valid_time=1800
+
+  when: ansible_distribution_file_variety == "Debian"
+  tags: [ 'ELK', 'elasticsearch', 'elk', 'kibana' ]
+
+- name: Kibana service
+  block:
+    - name: Install the kibana systemd configuration to manage the rundir directory
+      template: src=kibana_rundir.conf.j2 dest=/usr/lib/tmpfiles.d/kibana.conf owner=root group=root mode=0644
+      register: reconfigure_systemd
+
+    - name: Reload the systemd configuration
+      systemd: daemon_reload=yes
+
+  tags: [ 'ELK', 'elasticsearch', 'elk', 'kibana', 'kibana_service' ]
+
+- name: Kibana configuration
+  block:
+    - name: Install the Kibana configuration
+      template: src=kibana.yml.j2 dest=/etc/kibana/kibana.yml owner=root group=kibana mode=0640
+      register: kibana_configuration
+      notify: Restart kibana
+  
+  tags: [ 'ELK', 'elasticsearch', 'elk', 'kibana', 'kibana_conf' ]
--- a/tasks/kibana_service.yml
+++ b/tasks/kibana_service.yml
@ -0,0 +1,11 @@
+---
+- name: Ensure that kibana is enabled and running
+  service: name=kibana state=started enabled=yes
+  when: elasticsearch_kibana_enabled | bool
+  tags: [ 'ELK', 'elasticsearch', 'elk', 'kibana' ]
+  
+- name: Ensure that kibana is disabled and stopped
+  service: name=kibana state=stopped enabled=no
+  when: not elasticsearch_kibana_enabled | bool
+  tags: [ 'ELK', 'elasticsearch', 'elk', 'kibana' ]
+  
--- a/tasks/main.yml
+++ b/tasks/main.yml
@ -1,2 +1,13 @@
 ---
-# tasks file for ansible-role-template
+- import_tasks: elk_repo.yml
+- import_tasks: elasticsearch.yml
+  when: elasticsearch_install | bool
+- import_tasks: elasticsearch_plugins.yml
+  when: elasticsearch_install | bool
+- import_tasks: elasticsearch_service.yml
+  when: elasticsearch_install | bool
+- import_tasks: kibana.yml
+  when: elasticsearch_kibana_install | bool
+- import_tasks: kibana_service.yml
+  when: elasticsearch_kibana_install | bool
+
--- a/templates/elasticsearch-default.j2
+++ b/templates/elasticsearch-default.j2
@ -0,0 +1,76 @@
+################################
+# Elasticsearch
+################################
+
+# Elasticsearch home directory
+#ES_HOME=/usr/share/elasticsearch
+
+# Elasticsearch configuration directory
+#CONF_DIR=/etc/elasticsearch
+
+# Elasticsearch data directory
+DATA_DIR={{ elasticsearch_data_dir }}
+
+# Elasticsearch logs directory
+LOG_DIR={{ elasticsearch_log_dir }}
+
+# Elasticsearch PID directory
+#PID_DIR=/var/run/elasticsearch
+
+{% if elasticsearch_major_version <= 2 %}
+# Set ES_HEAP_SIZE to 50% of available RAM, but no more than 31g
+ES_HEAP_SIZE={{ elasticsearch_heap_size }}
+# Heap new generation
+#ES_HEAP_NEWSIZE=
+
+# Maximum direct memory
+#ES_DIRECT_SIZE=
+
+# Additional Java OPTS
+ES_JAVA_OPTS="{{ elasticsearch_additional_java_opts }}"
+{% endif %}
+# Configure restart on package upgrade (true, every other setting will lead to not restarting)
+#ES_RESTART_ON_UPGRADE=true
+
+# Path to the GC log file
+#ES_GC_LOG_FILE=/var/log/elasticsearch/gc.log
+
+################################
+# Elasticsearch service
+################################
+
+# SysV init.d
+#
+# When executing the init script, this user will be used to run the elasticsearch service.
+# The default value is 'elasticsearch' and is declared in the init.d file.
+# Note that this setting is only used by the init script. If changed, make sure that
+# the configured user can read and write into the data, work, plugins and log directories.
+# For systemd service, the user is usually configured in file /usr/lib/systemd/system/elasticsearch.service
+{% if elasticsearch_major_version < 6 %}
+ES_USER=elasticsearch
+ES_GROUP=elasticsearch
+{% endif %}
+
+# The number of seconds to wait before checking if Elasticsearch started successfully as a daemon process
+ES_STARTUP_SLEEP_TIME=5
+
+################################
+# System properties
+################################
+
+# Specifies the maximum file descriptor number that can be opened by this process
+# When using Systemd, this setting is ignored and the LimitNOFILE defined in
+# /usr/lib/systemd/system/elasticsearch.service takes precedence
+MAX_OPEN_FILES={{ elasticsearch_max_open_files }}
+
+# The maximum number of bytes of memory that may be locked into RAM
+# Set to "unlimited" if you use the 'bootstrap.mlockall: true' option
+# in elasticsearch.yml (ES_HEAP_SIZE  must also be set).
+# When using Systemd, the LimitMEMLOCK property must be set
+# in /usr/lib/systemd/system/elasticsearch.service
+MAX_LOCKED_MEMORY=unlimited
+
+# Maximum number of VMA (Virtual Memory Areas) a process can own
+# When using Systemd, this setting is ignored and the 'vm.max_map_count'
+# property is set at boot time in /usr/lib/sysctl.d/elasticsearch.conf
+#MAX_MAP_COUNT=262144
--- a/templates/elasticsearch.yml.j2
+++ b/templates/elasticsearch.yml.j2
@ -0,0 +1,140 @@
+# ======================== Elasticsearch Configuration =========================
+#
+# NOTE: Elasticsearch comes with reasonable defaults for most settings.
+#       Before you set out to tweak and tune the configuration, make sure you
+#       understand what are you trying to accomplish and the consequences.
+#
+# The primary way of configuring a node is via this file. This template lists
+# the most important settings you may want to configure for a production cluster.
+#
+# Please see the documentation for further information on configuration options:
+# <http://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration.html>
+#
+# ---------------------------------- Cluster -----------------------------------
+#
+# Use a descriptive name for your cluster:
+#
+cluster.name: {{ elasticsearch_cluster_name }}
+#
+# ------------------------------------ Node ------------------------------------
+#
+# Use a descriptive name for the node:
+#
+node.name: {{ ansible_fqdn }}
+
+{% if elasticsearch_kibana_proxy %}
+# This node is bein used by kibana as proxy to a cluster
+node.master: false
+node.data: false
+node.ingest: false
+{% endif %}
+
+{% if elasticsearch_major_version >= 7 %}
+cluster.initial_master_nodes:
+{% for n in elasticsearch_bootstrap_known_masters %}
+  - {{ n }}
+{% endfor %}
+{% endif %}
+#
+# Add custom attributes to the node:
+#
+# node.rack: r1
+#
+# ----------------------------------- Paths ------------------------------------
+#
+# Path to directory where to store the data (separate multiple locations by comma):
+#
+path.data: {{ elasticsearch_data_dir }}
+#
+# Path to log files:
+#
+path.logs: {{ elasticsearch_log_dir }}
+#
+{% if elasticsearch_major_version <= 2 %}
+# ----------------------------------- Memory -----------------------------------
+#
+# Lock the memory on startup:
+#
+bootstrap.mlockall: true
+#
+# Make sure that the `ES_HEAP_SIZE` environment variable is set to about half the memory
+# available on the system and that the owner of the process is allowed to use this limit.
+#
+# Elasticsearch performs poorly when the system is swapping the memory.
+{% endif %}
+#
+# ---------------------------------- Network -----------------------------------
+#
+# Set the bind address to a specific IP (IPv4 or IPv6):
+#
+{% if elasticsearch_kibana_proxy %}
+network.host: localhost
+{% else %}
+network.host: {{ elasticsearch_bind_ip }}
+{% endif %}
+#
+# Set a custom port for HTTP:
+#
+http.port: {{ elasticsearch_http_port }}
+
+# by default transport.host refers to network.host
+transport.host: {{ elasticsearch_bind_ip }}
+{% if elasticsearch_major_version >= 6 %}
+transport.tcp.port: {{ elasticsearch_transport_min_port }}-{{ elasticsearch_transport_max_port }}
+{% endif %}
+#
+# For more information, see the documentation at:
+# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html>
+#
+# --------------------------------- Discovery ----------------------------------
+#
+# Pass an initial list of hosts to perform discovery when new node is started:
+# The default list of hosts is ["127.0.0.1", "[::1]"]
+#
+discovery.zen.ping.unicast.hosts: {{ elasticsearch_discovery_host_list }}
+#
+{% if elasticsearch_define_majority_of_nodes %}
+# Prevent the "split brain" by configuring the majority of nodes (total number of nodes / 2 + 1):
+#
+discovery.zen.minimum_master_nodes: {{ elasticsearch_majority_of_nodes }}
+#
+# For more information, see the documentation at:
+# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-discovery.html>
+#
+{% if elasticsearch_real_cluster %}
+# ---------------------------------- Gateway -----------------------------------
+#
+# Block initial recovery after a full cluster restart until N nodes are started:
+#
+gateway.recover_after_nodes: {{ elasticsearch_recover_after_nodes }}
+#
+# For more information, see the documentation at:
+# <http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-gateway.html>
+#
+{% endif %}
+{% endif %}
+# ---------------------------------- Various -----------------------------------
+#
+# Disable starting multiple nodes on a single system:
+#
+node.max_local_storage_nodes: {{ elasticsearch_max_local_storage_nodes }}
+#
+# Require explicit names when deleting indices:
+#
+action.destructive_requires_name: {{ elasticsearch_destructive_requires_name }}
+
+#
+cluster.routing.allocation.disk.threshold_enabled: {{ elasticsearch_cluster_routing_allocation_disk_threshold_enabled }}
+cluster.routing.allocation.disk.watermark.low: {{ elasticsearch_cluster_routing_allocation_disk_watermark_low }}
+cluster.routing.allocation.disk.watermark.high: {{ elasticsearch_cluster_routing_allocation_disk_watermark_high }}
+
+{% for conf in elasticsearch_additional_conf %}
+{{ conf.name }}: {{ conf.value }}
+{% endfor %}
+
+{% if elasticsearch_disable_bootstrap_syscall_filter %}
+# When using an old kernel
+bootstrap.system_call_filter: false
+{% endif %}
+
+
--- a/templates/jvm.options.j2
+++ b/templates/jvm.options.j2
@ -0,0 +1,129 @@
+## JVM configuration
+
+################################################################
+## IMPORTANT: JVM heap size
+################################################################
+##
+## You should always set the min and max JVM heap
+## size to the same value. For example, to set
+## the heap to 4 GB, set:
+##
+## -Xms4g
+## -Xmx4g
+##
+## See https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html
+## for more information
+##
+################################################################
+
+# Xms represents the initial size of total heap space
+# Xmx represents the maximum size of total heap space
+
+-Xms{{ elasticsearch_heap_size }}
+-Xmx{{ elasticsearch_heap_size }}
+
+################################################################
+## Expert settings
+################################################################
+##
+## All settings below this section are considered
+## expert settings. Don't tamper with them unless
+## you understand what you are doing
+##
+################################################################
+
+## GC configuration
+-XX:+UseConcMarkSweepGC
+-XX:CMSInitiatingOccupancyFraction=75
+-XX:+UseCMSInitiatingOccupancyOnly
+
+## optimizations
+
+# disable calls to System#gc
+-XX:+DisableExplicitGC
+
+# pre-touch memory pages used by the JVM during initialization
+-XX:+AlwaysPreTouch
+
+## basic
+
+# force the server VM
+-server
+
+# set to headless, just in case
+-Djava.awt.headless=true
+
+# ensure UTF-8 encoding by default (e.g. filenames)
+-Dfile.encoding=UTF-8
+
+# use our provided JNA always versus the system one
+-Djna.nosys=true
+
+# turn off a JDK optimization that throws away stack traces for common
+# exceptions because stack traces are important for debugging
+-XX:-OmitStackTraceInFastThrow
+
+# flag to explicitly tell Netty to not use unsafe
+-Dio.netty.noUnsafe=true
+-Dio.netty.noKeySetOptimization=true
+-Dio.netty.recycler.maxCapacityPerThread=0
+
+-Dlog4j.shutdownHookEnabled=false
+-Dlog4j2.disable.jmx=true
+
+{% if elasticsearch_major_version >= 6 %}
+-Djava.io.tmpdir=${ES_TMPDIR}
+{% endif %}
+
+## heap dumps
+
+# generate a heap dump when an allocation from the Java heap fails
+# heap dumps are created in the working directory of the JVM
+-XX:+HeapDumpOnOutOfMemoryError
+
+# specify an alternative path for heap dumps
+# ensure the directory exists and has sufficient space
+#-XX:HeapDumpPath=${heap.dump.path}
+
+## GC logging
+
+#-XX:+PrintGCDetails
+#-XX:+PrintGCTimeStamps
+
+#-XX:+PrintGCDateStamps
+#-XX:+PrintClassHistogram
+#-XX:+PrintTenuringDistribution
+#-XX:+PrintGCApplicationStoppedTime
+
+# log GC status to a file with time stamps
+# ensure the directory exists
+#-Xloggc:${loggc}
+
+# Elasticsearch 5.0.0 will throw an exception on unquoted field names in JSON.
+# If documents were already indexed with unquoted fields in a previous version
+# of Elasticsearch, some operations may throw errors.
+#
+# WARNING: This option will be removed in Elasticsearch 6.0.0 and is provided
+# only for migration purposes.
+#-Delasticsearch.json.allow_unquoted_field_names=true
+# specify an alternative path for heap dumps
+# ensure the directory exists and has sufficient space
+-XX:HeapDumpPath={{ elasticsearch_data_dir }}
+
+## JDK 8 GC logging
+
+8:-XX:+PrintGCDetails
+8:-XX:+PrintGCDateStamps
+8:-XX:+PrintTenuringDistribution
+8:-XX:+PrintGCApplicationStoppedTime
+8:-Xloggc:/var/log/elasticsearch/gc.log
+8:-XX:+UseGCLogFileRotation
+8:-XX:NumberOfGCLogFiles=32
+8:-XX:GCLogFileSize=64m
+
+# JDK 9+ GC logging
+9-:-Xlog:gc*,gc+age=trace,safepoint:file=/var/log/elasticsearch/gc.log:utctime,pid,tags:filecount=32,filesize=64m
+# due to internationalization enhancements in JDK 9 Elasticsearch need to set the provider to COMPAT otherwise
+# time/date parsing will break in an incompatible way for some date patterns and locals
+9-:-Djava.locale.providers=COMPAT
+
--- a/templates/kibana-letsencrypt-hook.sh.j2
+++ b/templates/kibana-letsencrypt-hook.sh.j2
@ -0,0 +1,38 @@
+#!/bin/bash
+
+H_NAME=$( hostname -f )
+LE_SERVICES_SCRIPT_DIR=/usr/lib/acme/hooks
+LE_CERTS_DIR="/var/lib/acme/live/$H_NAME"
+LE_LOG_DIR=/var/log/letsencrypt
+KIBANA_CERTDIR=/etc/pki/kibana
+KIBANA_KEYFILE="$KIBANA_CERTDIR/privkey"
+DATE=$( date )
+
+[ ! -d $KIBANA_CERTDIR ] && mkdir -p $KIBANA_CERTDIR
+[ ! -d $LE_LOG_DIR ] && mkdir $LE_LOG_DIR
+echo "$DATE" >> $LE_LOG_DIR/kibana.log
+
+{% if letsencrypt_acme_install %}
+LE_ENV_FILE=/etc/default/letsencrypt
+{% endif %}
+{% if letsencrypt_acme_sh_install %}
+LE_ENV_FILE=/etc/default/acme_sh_request_env
+{% endif %}
+if [ -f "$LE_ENV_FILE" ] ; then
+    . "$LE_ENV_FILE"
+else
+    echo "No letsencrypt default file" >> $LE_LOG_DIR/kibana.log
+fi
+
+echo "Building the new certificate file" >> $LE_LOG_DIR/kibana.log
+cp -f ${LE_CERTS_DIR}/privkey ${KIBANA_KEYFILE}
+chmod 440 ${KIBANA_KEYFILE}
+chgrp kibana ${KIBANA_KEYFILE}
+
+echo "Reload the kibana service" >> $LE_LOG_DIR/kibana.log
+systemctl restart kibana >> $LE_LOG_DIR/kibana.log 2>&1
+
+
+echo "Done." >> $LE_LOG_DIR/kibana.log
+
+exit 0
--- a/templates/kibana.yml.j2
+++ b/templates/kibana.yml.j2
@ -0,0 +1,108 @@
+# Kibana is served by a back end server. This setting specifies the port to use.
+server.port: {{ elasticsearch_kibana_http_port }}
+
+# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
+# The default is 'localhost', which usually means remote machines will not be able to connect.
+# To allow connections from remote users, set this parameter to a non-loopback address.
+server.host: "{{ elasticsearch_kibana_bind_ip }}"
+
+# Enables you to specify a path to mount Kibana at if you are running behind a proxy. This only affects
+# the URLs generated by Kibana, your proxy is expected to remove the basePath value before forwarding requests
+# to Kibana. This setting cannot end in a slash.
+server.basePath: "{{ elasticsearch_kibana_serverpath }}"
+
+# The maximum payload size in bytes for incoming server requests.
+#server.maxPayloadBytes: 1048576
+
+# The Kibana server's name.  This is used for display purposes.
+server.name: "{{ elasticsearch_kibana_servername }}"
+
+# The URL of the Elasticsearch instance to use for all your queries.
+elasticsearch.url: "{{ elasticsearch_kibana_elasticsearch_url }}"
+
+# When this setting's value is true Kibana uses the hostname specified in the server.host
+# setting. When the value of this setting is false, Kibana uses the hostname of the host
+# that connects to this Kibana instance.
+elasticsearch.preserveHost: {{ elasticsearch_kibana_preserve_host }}
+
+# Kibana uses an index in Elasticsearch to store saved searches, visualizations and
+# dashboards. Kibana creates a new index if the index doesn't already exist.
+#kibana.index: ".kibana"
+
+# The default application to load.
+#kibana.defaultAppId: "discover"
+
+# If your Elasticsearch is protected with basic authentication, these settings provide
+# the username and password that the Kibana server uses to perform maintenance on the Kibana
+# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
+# is proxied through the Kibana server.
+#elasticsearch.username: "user"
+#elasticsearch.password: "pass"
+
+{% if letsencrypt_acme_install is defined and letsencrypt_acme_install %}
+{% if elasticsearch_kibana_ssl_enabled %}
+# Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.
+# These settings enable SSL for outgoing requests from the Kibana server to the browser.
+server.ssl.enabled: true
+server.ssl.certificate: {{ letsencrypt_acme_certs_dir }}/fullchain
+server.ssl.key: {{ pki_dir }}/kibana/privkey
+{% endif %}
+{% endif %}
+
+# Optional settings that provide the paths to the PEM-format SSL certificate and key files.
+# These files validate that your Elasticsearch backend uses the same key files.
+#elasticsearch.ssl.certificate: /path/to/your/client.crt
+#elasticsearch.ssl.key: /path/to/your/client.key
+
+# Optional setting that enables you to specify a path to the PEM file for the certificate
+# authority for your Elasticsearch instance.
+#elasticsearch.ssl.certificateAuthorities: [ "/path/to/your/CA.pem" ]
+
+# To disregard the validity of SSL certificates, change this setting's value to 'none'.
+#elasticsearch.ssl.verificationMode: full
+
+# Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of
+# the elasticsearch.requestTimeout setting.
+#elasticsearch.pingTimeout: 1500
+
+# Time in milliseconds to wait for responses from the back end or Elasticsearch. This value
+# must be a positive integer.
+#elasticsearch.requestTimeout: 30000
+
+# List of Kibana client-side headers to send to Elasticsearch. To send *no* client-side
+# headers, set this value to [] (an empty list).
+#elasticsearch.requestHeadersWhitelist: [ authorization ]
+
+# Header names and values that are sent to Elasticsearch. Any custom headers cannot be overwritten
+# by client-side headers, regardless of the elasticsearch.requestHeadersWhitelist configuration.
+#elasticsearch.customHeaders: {}
+
+# Time in milliseconds for Elasticsearch to wait for responses from shards. Set to 0 to disable.
+#elasticsearch.shardTimeout: 0
+
+# Time in milliseconds to wait for Elasticsearch at Kibana startup before retrying.
+#elasticsearch.startupTimeout: 5000
+
+# Specifies the path where Kibana creates the process ID file.
+pid.file: {{ elasticsearch_kibana_rundir }}/kibana.pid
+
+# Enables you specify a file where Kibana stores log output.
+#logging.dest: stdout
+
+# Set the value of this setting to true to suppress all logging output.
+#logging.silent: false
+
+# Set the value of this setting to true to suppress all logging output other than error messages.
+#logging.quiet: false
+
+# Set the value of this setting to true to log all events, including system usage information
+# and all requests.
+#logging.verbose: false
+
+# Set the interval in milliseconds to sample system and process performance
+# metrics. Minimum is 100ms. Defaults to 5000.
+#ops.interval: 5000
+
+# The default locale. This locale can be used in certain circumstances to substitute any missing
+# translations.
+#i18n.defaultLocale: "en"
--- a/templates/kibana_rundir.conf.j2
+++ b/templates/kibana_rundir.conf.j2
@ -0,0 +1 @@
+d {{ elasticsearch_kibana_rundir }} 0775 kibana kibana
--- a/vars/main.yml
+++ b/vars/main.yml
@ -1,2 +1,13 @@
 ---
-# vars file for ansible-role-template
+elasticsearch_repo_key: https://packages.elastic.co/GPG-KEY-elasticsearch
+elasticsearch_repo_version: '{{ elasticsearch_major_version }}.x'
+elasticsearch_version: '{{ elasticsearch_major_version }}.{{ elasticsearch_minor_version }}.{{ elasticsearch_patch_version }}'
+elasticsearch_repo: 'deb https://artifacts.elastic.co/packages/{{ elasticsearch_repo_version }}/apt stable main'
+elasticsearch_packages:
+  - elasticsearch
+
+elasticsearch_plugin_bin: /usr/share/elasticsearch/bin/elasticsearch-plugin
+
+elasticsearch_kibana_packages:
+  - kibana
+
				`@ -0,0 +1 @@`
				`d {{ elasticsearch_kibana_rundir }} 0775 kibana kibana`