132 lines
5.0 KiB
YAML
132 lines
5.0 KiB
YAML
---
|
|
- name: Manage the rsyslog packages and service
|
|
block:
|
|
- name: Ensure that the rsyslog package is installed. deb/ubuntu
|
|
apt: pkg=rsyslog state=present cache_valid_time=1800
|
|
when: ansible_distribution_file_variety == "Debian"
|
|
|
|
- name: Ensure that the rsyslog package is installed. centos/rhel
|
|
yum: pkg=rsyslog state=present
|
|
when: ansible_distribution_file_variety == "RedHat"
|
|
|
|
- name: Create the target logs rsyslog directory
|
|
file: dest={{ rsyslog_remote_path }} state=directory owner=syslog group=adm
|
|
|
|
- name: Ensure that rsyslog is running and enabled
|
|
service: name=rsyslog state=started enabled=yes
|
|
|
|
when: rsyslog_enable_remote_socket or rsyslog_enable_send_to_remote
|
|
tags: [ 'syslog', 'rsyslog', 'remote_syslog' ]
|
|
|
|
- name: Install the rsyslog TLS package on deb/ubuntu
|
|
block:
|
|
- name: Install the rsyslog TLS support
|
|
apt: pkg={{ rsyslog_tls_deb_pkgs }} state=present cache_valid_time=1800
|
|
notify: Restart rsyslog
|
|
|
|
when:
|
|
- rsyslog_enable_remote_socket or rsyslog_enable_send_to_remote
|
|
- rsyslog_tls_status == 'enabled'
|
|
- ansible_distribution_file_variety == "Debian"
|
|
tags: [ 'syslog', 'rsyslog', 'remote_syslog' ]
|
|
|
|
- name: Install the rsyslog TLS package on RHEL/CentOS
|
|
block:
|
|
- name: Install the rsyslog TLS support
|
|
yum: pkg={{ rsyslog_tls_rh_pkgs }} state=present
|
|
notify: Restart rsyslog
|
|
|
|
when:
|
|
- rsyslog_enable_remote_socket or rsyslog_enable_send_to_remote
|
|
- rsyslog_tls_status == 'enabled'
|
|
- ansible_distribution_file_variety == "RedHat"
|
|
tags: [ 'syslog', 'rsyslog', 'remote_syslog' ]
|
|
|
|
- name: Install the rsyslog RELP package on deb/ubuntu
|
|
block:
|
|
- name: Install the rsyslog RELP support
|
|
apt: pkg={{ rsyslog_relp_deb_pkgs }} state=present cache_valid_time=1800
|
|
notify: Restart rsyslog
|
|
|
|
when:
|
|
- rsyslog_enable_remote_socket or rsyslog_enable_send_to_remote
|
|
- ansible_distribution_file_variety == "Debian"
|
|
tags: [ 'syslog', 'rsyslog', 'remote_syslog' ]
|
|
|
|
- name: Install the rsyslog RELP package on RHEL/CentOS
|
|
block:
|
|
- name: Install the rsyslog RELP support
|
|
yum: pkg={{ rsyslog_relp_rh_pkgs }} state=present
|
|
notify: Restart rsyslog
|
|
|
|
when:
|
|
- rsyslog_enable_remote_socket or rsyslog_enable_send_to_remote
|
|
- ansible_distribution_file_variety == "RedHat"
|
|
tags: [ 'syslog', 'rsyslog', 'remote_syslog' ]
|
|
|
|
- name: Initialize the TLS configuration
|
|
block:
|
|
- name: Create the PKI directory
|
|
file: dest={{ rsyslog_tls_certs_dir }} state=directory owner=root group=root mode='0700'
|
|
|
|
- name: Download the remote CA file if required
|
|
get_url: url={{ rsyslog_remote_ca_url }} dest={{ rsyslog_tls_ca }} owner=root group=root mode='0644'
|
|
when: rsyslog_ca_is_remote
|
|
|
|
- name: Check if a private key for the certificate is present
|
|
stat:
|
|
path: '{{ rsyslog_tls_key }}'
|
|
get_checksum: no
|
|
register: cert_key_presence
|
|
|
|
- name: Create a certificate private key
|
|
openssl_privatekey:
|
|
path: '{{ rsyslog_tls_key }}'
|
|
when: not cert_key_presence.stat.exists
|
|
|
|
- name: Create a certificate request
|
|
openssl_csr:
|
|
path: '{{ rsyslog_tls_certs_dir }}/cert.csr'
|
|
privatekey_path: '{{ rsyslog_tls_key }}'
|
|
common_name: '{{ ansible_fqdn }}'
|
|
when: not cert_key_presence.stat.exists
|
|
|
|
- name: Create a self signed certificate is one is not present
|
|
openssl_certificate:
|
|
path: '{{ rsyslog_tls_cert }}'
|
|
privatekey_path: '{{ rsyslog_tls_key }}'
|
|
csr_path: '{{ rsyslog_tls_certs_dir }}/cert.csr'
|
|
provider: selfsigned
|
|
when: not cert_key_presence.stat.exists
|
|
|
|
when:
|
|
- rsyslog_tls_status == 'enabled'
|
|
tags: [ 'syslog', 'rsyslog', 'remote_syslog' ]
|
|
|
|
- name: Configure SELinux and firewalld on RHEL/CentOS
|
|
block:
|
|
- name: SELinux udp port
|
|
seport: ignore_selinux_state=yes ports={{ rsyslog_udp_port }} proto=udp setype=syslogd_port_t state=present
|
|
when: rsyslog_enable_remote_udp == 'enabled'
|
|
|
|
- name: SELinux tcp port
|
|
seport: ignore_selinux_state=yes ports={{ rsyslog_udp_port }} proto=tcp setype=syslogd_port_t state=present
|
|
when: rsyslog_enable_remote_tcp == 'enabled'
|
|
|
|
- name: SELinux RELP port
|
|
seport: ignore_selinux_state=yes ports={{ rsyslog_relp_port }} proto=tcp setype=syslogd_port_t state=present
|
|
when: rsyslog_tls_status == 'enabled'
|
|
|
|
- name: rsyslog firewalld services
|
|
firewalld: service={{ item.service }} zone={{ item.zone }} permanent={{ item.permanent | default(True) }} state={{ item.state }} immediate=True
|
|
with_items: '{{ rsyslog_firewalld_services }}'
|
|
|
|
- name: rsyslog firewalld ports
|
|
firewalld: port={{ item.port }}/{{ item.protocol }} zone={{ item.zone }} permanent={{ item.permanent | default(False) }} state={{ item.state }} immediate=True
|
|
with_items: '{{ rsyslog_firewalld_ports }}'
|
|
|
|
when:
|
|
- rsyslog_enable_remote_socket
|
|
- ansible_distribution_file_variety == "RedHat"
|
|
tags: [ 'syslog', 'rsyslog', 'remote_syslog', 'selinux', 'firewalld' ]
|