diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 2ba6d5be..c76f6a46 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -5,13 +5,21 @@ Icinga.Icinga Release Notes .. contents:: Topics -v0.3.1 +v0.3.2 ====== Release Summary --------------- -This is a bugfix release +Bugfix Release + +Bugfixes +-------- + +- Role repos: Fix bug in variable search - thanks to @gianmarco-mameli #224 + +v0.3.1 +====== Major Changes ------------- diff --git a/changelogs/changelog.yaml b/changelogs/changelog.yaml index 98f3c3c8..cda5e461 100644 --- a/changelogs/changelog.yaml +++ b/changelogs/changelog.yaml @@ -110,3 +110,12 @@ releases: - trivial_naming_tasks.yml - trivial_wrong_variable_name.yml release_date: '2023-11-21' + 0.3.2: + changes: + bugfixes: + - 'Role repos: Fix bug in variable search - thanks to @gianmarco-mameli #224' + release_summary: Bugfix Release + fragments: + - bugfix_variable_search.yml + - release.yml + release_date: '2023-11-30' diff --git a/changelogs/fragments/feature-add-icingaweb2-users.yml b/changelogs/fragments/feature-add-icingaweb2-users.yml new file mode 100644 index 00000000..9e4b2174 --- /dev/null +++ b/changelogs/fragments/feature-add-icingaweb2-users.yml @@ -0,0 +1,3 @@ +--- +minor_changes: + - Added the ability to create additional Icinga Web 2 users \ No newline at end of file diff --git a/doc/getting-started.md b/doc/getting-started.md index 6fd1ce35..8a5b6767 100644 --- a/doc/getting-started.md +++ b/doc/getting-started.md @@ -1,11 +1,19 @@ ### Getting Started -The collection includes two roles in the current version. +The collection includes six roles in the current version. * icinga.repos: Role to manage repositories * [Documentation: doc/role-repos](role-repos/role-repos.md) * icinga.icinga2: Role to install and manage Icinga 2 instances. * [Documentation: doc/role-icinga2](role-icinga2/role-icinga2.md) +* icinga.icingadb: Role to install and manage IcingaDB, Icinga2's new data backend. + * [Documentation: doc/role-icingadb](role-icingadb/role-icingadb.md) +* icinga.icingadb_redis: Role to install and manage Redis, IcingaDB's cache backend. + * [Documentation: doc/role-icingadb_redis](role-icingadb_redis/role-icingadb_redis.md) +* icinga.icingaweb2: Role to install and manage Icinga Web 2. + * [Documentation: doc/role-icingaweb2](role-icingaweb2/role-icingaweb2.md) +* icinga.monitoring_plugins: Role to install and manage Icinga2 compatible monitoring plugins. + * [Documentation: doc/role-monitoring_plugins](role-monitoring_plugins/role-monitoring_plugins.md) --- @@ -39,6 +47,36 @@ ansible-galaxy collection build ansible-collection-icinga ansible-galaxy collection install icinga-icinga-0.3.0.tar.gz ``` +## Databases + +Icinga2 relies on relational databases for many parts of its functionality. **None** of those databases get installed by the roles. You need to install and configure them yourself. For doing so, there are many ways available, e.g. the Ansible role [geerlingguy.mysql](https://galaxy.ansible.com/geerlingguy/mysql) for MySQL flavours (both MySQL and MariaDB) or [geerlingguy.postgresql](https://galaxy.ansible.com/geerlingguy/postgresql) for PostGresQL: + +```yaml +- name: Configure databases for Icinga2 + hosts: database + vars: + mysql_databases: + - name: icingadb + - name: icingaweb + - name: vspheredb + encoding: utf8mb4 + collation: utf8mb4_unicode_ci + - name: director + mysql_users: + - name: icingadb-user + host: localhost + password: icingadb-password + priv: "icingadb.*:ALL" + [...] + roles: + - role: geerlingguy.mysql +``` + +> [!NOTE] +> Schema migrations needed for the respective Icinga components to work will be handled either by the respective roles or by the Icinga components themselves. + + + ## Example Playbooks This is an example on how to install an Icinga 2 server/master instance. diff --git a/doc/role-icingadb/role-icingadb.md b/doc/role-icingadb/role-icingadb.md index 5d66a32a..e30742ab 100644 --- a/doc/role-icingadb/role-icingadb.md +++ b/doc/role-icingadb/role-icingadb.md @@ -5,7 +5,12 @@ This role installs and configures the IcingaDB daemon. In addition it can also i It serves as the official, more performant successor to Icinga IDO. More information about its purpose and design can be found [in the official documentation](https://icinga.com/docs/icinga-db/latest/doc/01-About/). -> :information_source: In many scenarios you want to install the [icingadb_redis role](../role-icingadb_redis/) together with this role. It is part of this collection, too. +> [!TIP] +> In many scenarios you want to install the [icingadb_redis role](../role-icingadb_redis/) together with this role. It is part of this collection, too. + +## Database + +IcingaDB relies on a relational database to persist received data. This database **won't** be created by this role - you need to deploy and configure one in advance. For more information, see the [Databases](../getting-started.md#databases) section in the getting started guide. ## Variables diff --git a/doc/role-icingaweb2/module-x509.md b/doc/role-icingaweb2/module-x509.md new file mode 100644 index 00000000..684000fd --- /dev/null +++ b/doc/role-icingaweb2/module-x509.md @@ -0,0 +1,95 @@ +## Module x509 + +### Variables and Configuration + +The general module parameter like `enabled` and `source` can be applied here. + +| Variable | Value | +|----------|------------| +| enabled | true/false | +| source | package | + +#### Section configuration + +The backend database for the module needs to be available and configured at the `icingaweb2_resources` variable. + +``` +icingaweb2_modules: + x509: + source: package + enabled: true + config: + backend: + resource: x509 +``` + +#### Configure SNI Names. + +To configure SNIs for a IP address, use the dictionary `sni`. + +Example: + +``` +icingaweb2_modules: + x509: + source: package + enabled: true + config: + backend: + resource: x509 + sni: + 192.168.56.213: + hostnames: + - icinga.com + - test2.icinga.com +``` + +#### Import Certificates + +To import certificates use the **list** `certificate_files` all files need to be +available locally beforehand. + +``` +icingaweb2_modules: + x509: + source: package + enabled: true + config: + backend: + resource: x509 + certificate_files: + - /etc/ssl/certs/ca-certificates.crt +``` + +#### Database Schema Setup + +To import the database schema use `database` dictionary with the following variables. + +| Variable | Type | Description | Default | +|----------|------|-------------|---------| +| `import_schema` | `Boolean` | Defines wether the schema will be imported or not. | false | +| `host` | `String` | Defines database address to connect to. | `localhost` | +| `port` | `int` | Defines the database port to connect to. | `3306` or `5432` | +| `user` | `string` | Defines database user | `x509` | +| `name` | `String` | Defines the database to connect to. | `x509` | +| `password` | `String` | Defines the database password to connect with. | OMITTED | +| `ssl_mode` | `String` | Clients attempt to connect using encryption, falling back to an unencrypted connection if an encrypted connection cannot be established |**n/a** | +|`ssl_ca`| `String`| Defines the path to the ca certificate for client authentication. | **n/a** | +|`ssl_cert`|`String`| Defines the path to the certificate for client authentication. | **n/a** | +|`ssl_key`| `String` | Defines the path to the certificate key for client key authentication. | **n/a** | +|`ssl_cipher`|`String`| Ciphers for the client authentication. | **n/a** | +|`ssl_extra_options`|`String`| Extra options for the client authentication. | **n/a** | + + +``` +icingaweb2_modules: + x509: + source: package + enabled: true + database: + import_schema: true + host: localhost + port: 3306 + user: x509 + password: secret +``` diff --git a/doc/role-icingaweb2/role-icingaweb2.md b/doc/role-icingaweb2/role-icingaweb2.md index 4faf1ae7..8e74fe0e 100644 --- a/doc/role-icingaweb2/role-icingaweb2.md +++ b/doc/role-icingaweb2/role-icingaweb2.md @@ -7,6 +7,10 @@ The role icingaweb2 installs and configures Icinga Web 2 and its modules. * [IcingaDB](./module-icingadb.md) * [Monitoring](./module-monitoring.md) +## Databases + +Icingaweb2 and some of its modules rely on a relational database to persist data. These databases **won't** be created by this role - you need to deploy and configure them in advance. For more information, see the [Databases](../getting-started.md#databases) section in the getting started guide. + ## Variables ### Icinga Web 2 DB Configuration @@ -28,6 +32,20 @@ icingaweb2_db: * `icingaweb2_admin_: string` * Set the username and password for the first admin user for Icinga Web 2. +* `icingaweb2_admin_recreate: boolean` + * Recreate can be used to change password of admin. **Default:False** + +In addition to the Icinga Web 2 Admin, other users can be configured by defining `icingaweb2_users`. +The `recreate` parameter can be used to change passwords or to enable the user if he has been disabled. **Default: False** +``` + icingaweb2_users: + - username: 'foo' + password: 'bar' + recreate: true + - username: webadmin + [...] +``` + #### Resources Besides the standard Icinga Web 2 database you may configure additional resources for IcingaDB or automated imports. diff --git a/galaxy.yml b/galaxy.yml index 445591a3..d1d8d8fb 100644 --- a/galaxy.yml +++ b/galaxy.yml @@ -1,6 +1,6 @@ namespace: icinga name: icinga -version: 0.3.1 +version: 0.3.2 readme: README.md authors: - Lennart Betz diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml index d3b3194a..1f5a3574 100644 --- a/molecule/default/converge.yml +++ b/molecule/default/converge.yml @@ -9,7 +9,11 @@ host: 127.0.0.1 user: icingaweb password: icingaweb - icingaweb2_database_import_schema: false + icingaweb2_database_import_schema: true + icingaweb2_users: + - username: webadmin + password: webadmin + recreate: false icingadb_database_import_schema: false mysql_innodb_file_format: barracuda mysql_innodb_large_prefix: 1 @@ -83,8 +87,8 @@ pre_tasks: - ansible.builtin.include_role: name: repos - # - ansible.builtin.include_role: - # name: geerlingguy.mysql + - ansible.builtin.include_role: + name: geerlingguy.mysql - ansible.builtin.include_role: name: icinga2 - ansible.builtin.include_role: diff --git a/roles/icingaweb2/defaults/main.yml b/roles/icingaweb2/defaults/main.yml index 089e7256..8eb20b47 100644 --- a/roles/icingaweb2/defaults/main.yml +++ b/roles/icingaweb2/defaults/main.yml @@ -38,3 +38,5 @@ icingaweb2_config: themes: default: Icinga icingaweb2_cli: icingacli + +icingaweb2_users: [] diff --git a/roles/icingaweb2/tasks/main.yml b/roles/icingaweb2/tasks/main.yml index e6bd7b6b..f587a9a2 100644 --- a/roles/icingaweb2/tasks/main.yml +++ b/roles/icingaweb2/tasks/main.yml @@ -25,8 +25,8 @@ ansible.builtin.include_tasks: "manage_icingaweb_config.yml" - name: Manage Icinga Web 2 DB - ansible.builtin.include_tasks: "manage_icingaweb_{{ icingaweb2_db.type }}_db.yml" - when: icingaweb2_db is defined + ansible.builtin.include_tasks: "manage_db.yml" + when: icingaweb2_db is defined and (icingaweb2_db_import_schema | default(False) or icingaweb2_users is defined or icingaweb2_admin_username is defined) - name: Configure modules ansible.builtin.include_tasks: "modules/{{ item.key }}.yml" @@ -43,3 +43,11 @@ force: yes when: icingaweb2_modules is defined loop: "{{ icingaweb2_modules | dict2items }}" + +# Many daemons fail before e.g. the resource is set up or the schema hasn't been migrated. This is a workaround. +- name: Manage enabled module daemons + ansible.builtin.service: + name: "icinga-{{ item.key }}" + state: restarted + when: icingaweb2_modules is defined and item.value.enabled|bool == true and item.key in ['vspheredb', 'x509'] + loop: "{{ icingaweb2_modules | dict2items }}" diff --git a/roles/icingaweb2/tasks/manage_db.yml b/roles/icingaweb2/tasks/manage_db.yml new file mode 100644 index 00000000..13a00269 --- /dev/null +++ b/roles/icingaweb2/tasks/manage_db.yml @@ -0,0 +1,21 @@ +--- + +- name: Prepare database + ansible.builtin.include_tasks: "{{ icingaweb2_db.type }}/prepare_db.yml" + when: icingaweb2_db is defined + +- name: Import database schema + ansible.builtin.include_tasks: "{{ icingaweb2_db.type }}/import_db.yml" + when: icingaweb2_db_import_schema | default(False) + +- name: Add admin to users list + ansible.builtin.set_fact: + icingaweb2_users: '{{ icingaweb2_users + [{"username": "{{ icingaweb2_admin_username }}", "password": "{{ icingaweb2_admin_password }}", "recreate": "{{ icingaweb2_admin_recreate | default(False) }}" }]}}' + when: icingaweb2_admin_username is defined and icingaweb2_admin_password is defined + +- name: Add Icinga web 2 users + ansible.builtin.include_tasks: "{{ icingaweb2_db.type }}/users_db.yml" + loop: "{{ icingaweb2_users }}" + loop_control: + loop_var: _users + when: icingaweb2_users | length > 0 diff --git a/roles/icingaweb2/tasks/manage_icingaweb_mysql_db.yml b/roles/icingaweb2/tasks/manage_icingaweb_mysql_db.yml deleted file mode 100644 index 89d992c4..00000000 --- a/roles/icingaweb2/tasks/manage_icingaweb_mysql_db.yml +++ /dev/null @@ -1,70 +0,0 @@ ---- - -- name: Check Database Credentials - ansible.builtin.assert: - that: - - icingaweb2_db['user'] is defined - - icingaweb2_db['password'] is defined - fail_msg: "No database credentials defined. Please set icingaweb2_db. or a privileged user with icingaweb2_priv_db_" - when: icingaweb2_priv_db_password is undefined and icingaweb2_priv_db_user is undefined - -- name: Set db user with admin privileges - ansible.builtin.set_fact: - _priv_db_user: "{{ icingaweb2_priv_db_user }}" - _priv_db_pass: "{{ icingaweb2_priv_db_password }}" - when: icingaweb2_priv_db_password is defined and icingaweb2_priv_db_user is defined - -- name: Ensure Icinga Web - block: - - name: Build mysql command - ansible.builtin.set_fact: - _tmp_mysqlcmd: >- - mysql {% if icingaweb2_db['host'] | default('localhost') != 'localhost' %} -h "{{ icingaweb2_db['host'] }}" {%- endif %} - {% if icingaweb2_db['port'] is defined %} -P "{{ icingaweb2_db['port'] }}" {%- endif %} - {% if icingaweb2_db['ssl_mode'] is defined %} --ssl-mode "{{ icingaweb2_db['ssl_mode'] }}" {%- endif %} - {% if icingaweb2_db['ssl_ca'] is defined %} --ssl-ca "{{ icingaweb2_db['ssl_ca'] }}" {%- endif %} - {% if icingaweb2_db['ssl_cert'] is defined %} --ssl-cert "{{ icingaweb2_db['ssl_cert'] }}" {%- endif %} - {% if icingaweb2_db['ssl_key'] is defined %} --ssl-key "{{ icingaweb2_db['ssl_key'] }}" {%- endif %} - {% if icingaweb2_db['ssl_cipher'] is defined %} --ssl-cipher "{{ icingaweb2_db['ssl_cipher'] }}" {%- endif %} - {% if icingaweb2_db['ssl_extra_options'] is defined %} {{ icingaweb2_db['ssl_extra_options'] }} {%- endif %} - -u "{{ icingaweb2_priv_db_user | default(icingaweb2_db['user']) }}" - -p"{{ icingaweb2_priv_db_password | default(icingaweb2_db['password']) }}" - "{{ icingaweb2_db['name'] }}" - - - name: MySQL check for icingaweb db schema - ansible.builtin.shell: > - {{ _tmp_mysqlcmd }} - -Ns -e "select * from icingaweb_user" - failed_when: false - changed_when: false - check_mode: false - register: _icingaweb2_db_schema - - - name: MySQL import icingaweb db schema - ansible.builtin.shell: > - {{ _tmp_mysqlcmd }} - < /usr/share/icingaweb2/schema/mysql.schema.sql - when: _icingaweb2_db_schema.rc != 0 - run_once: yes - when: icingaweb2_db_import_schema | default(False) - -- name: Ensure Icinga Web User - block: - - name: MySQL check for icingaweb db schema - ansible.builtin.shell: > - {{ _tmp_mysqlcmd }} - -Ns -e "select name from icingaweb_user where name like '{{ icingaweb2_admin_username }}'" - failed_when: false - changed_when: false - check_mode: false - register: _icingaweb2_db_user - - - name: Ensure admin user exists - ansible.builtin.shell: >- - echo "INSERT INTO icingaweb_user (name, active, password_hash) VALUES ('{{ icingaweb2_admin_username }}', 1, - '"`php -r 'echo password_hash("{{ icingaweb2_admin_password }}", PASSWORD_DEFAULT);'`"')" | {{ _tmp_mysqlcmd }} -Ns - when: _icingaweb2_db_user.stdout_lines | length <= 0 - run_once: yes - when: - - icingaweb2_admin_username is defined - - icingaweb2_admin_password is defined diff --git a/roles/icingaweb2/tasks/manage_icingaweb_pgsql_db.yml b/roles/icingaweb2/tasks/manage_icingaweb_pgsql_db.yml deleted file mode 100644 index 44c7252f..00000000 --- a/roles/icingaweb2/tasks/manage_icingaweb_pgsql_db.yml +++ /dev/null @@ -1,63 +0,0 @@ ---- - -- name: Check Database Credentials - ansible.builtin.assert: - that: - - icingaweb2_db['user'] is defined - - icingaweb2_db['password'] is defined - fail_msg: "No database credentials defined. Please set icingaweb2_db. or a privileged user with icingaweb2_priv_db_" - when: icingaweb2_priv_db_password is undefined and icingaweb2_priv_db_user is undefined - -- name: PostgreSQL import IDO schema - block: - - name: Build psql command - ansible.builtin.set_fact: - _tmp_pgsqlcmd: >- - PGPASSWORD="{{ icingaweb2_priv_db_password | default(icingaweb2_db['password']) }}" - psql - "host={{ icingaweb2_db['host'] }} - {% if icingaweb2_db['port'] is defined %} port={{ icingaweb2_db['port'] }} {%- endif %} - user={{ icingaweb2_priv_db_user | default(icingaweb2_db['user']) }} - dbname={{ icingaweb2_db['name'] }} - {% if icingaweb2_db['ssl_mode'] is defined %} sslmode={{ icingaweb2_db['ssl_mode'] | default('require') }} {%- endif %} - {% if icingaweb2_db['ssl_cert'] is defined %} sslcert={{ icingaweb2_db['ssl_cert'] }} {%- endif %} - {% if icingaweb2_db['ssl_key'] is defined %} sslkey={{ icingaweb2_db['ssl_key'] }} {%- endif %} - {% if icingaweb2_db['ssl_extra_options'] is defined %} {{ icingaweb2_db['ssl_extra_options'] }} {%- endif %}" - - - name: PostgreSQL check for IDO schema - ansible.builtin.shell: > - {{ _tmp_pgsqlcmd }} - -w -c "select * from icingaweb_user" - failed_when: false - changed_when: false - check_mode: false - register: _icingaweb2_db_schema - - - name: PostgreSQL import IDO schema - ansible.builtin.shell: > - {{ _tmp_pgsqlcmd }} - -w -f /usr/share/icingaweb2/schema/pgsql.schema.sql - when: _icingaweb2_db_schema.rc != 0 - run_once: yes - when: icingaweb2_db_import_schema | default(False) - -- name: Ensure Icinga Web User - block: - - name: PostgreSQL check for icingaweb admin user - ansible.builtin.shell: > - {{ _tmp_pgsqlcmd }} - -w -c "select name from icingaweb_user where name like '{{ icingaweb2_admin_username }}'" - failed_when: false - changed_when: false - check_mode: false - register: _icingaweb2_db_user - - - name: Ensure admin user exists - ansible.builtin.shell: >- - echo "INSERT INTO icingaweb_user (name, active, password_hash) VALUES ('{{ icingaweb2_admin_username }}', 1, - '"`php -r 'echo password_hash("{{ icingaweb2_admin_password }}", PASSWORD_DEFAULT);'`"')" | {{ _tmp_pgsqlcmd }} -w - when: '"(0 rows)" in _icingaweb2_db_user.stdout_lines' - run_once: yes - when: - - icingaweb2_admin_username is defined - - icingaweb2_admin_password is defined diff --git a/roles/icingaweb2/tasks/modules/x509.yml b/roles/icingaweb2/tasks/modules/x509.yml new file mode 100644 index 00000000..a0bc7e25 --- /dev/null +++ b/roles/icingaweb2/tasks/modules/x509.yml @@ -0,0 +1,66 @@ +- name: Module x509 | Ensure config directory + ansible.builtin.file: + state: directory + dest: "{{ icingaweb2_modules_config_dir }}/{{ _module }}" + owner: "{{ icingaweb2_httpd_user }}" + group: "{{ icingaweb2_group }}" + mode: "2770" + vars: + _module: "{{ item.key }}" + +- name: Module x509 | Manage config files + ansible.builtin.include_tasks: manage_module_config.yml + loop: "{{ _files }}" + loop_control: + loop_var: _file + when: vars['icingaweb2_modules'][_module][_file] is defined + vars: + _module: "{{ item.key }}" + _files: + - config + - sni + +- name: Module x509 | Manage Schema + block: + - name: Module x509 | Prepare _db informations + ansible.builtin.set_fact: + _db: + host: "{{ vars['icingaweb2_modules'][_module]['database']['host'] | default('localhost') }}" + port: "{{ vars['icingaweb2_modules'][_module]['database']['port'] | default('3306') }}" + user: "{{ vars['icingaweb2_modules'][_module]['database']['user'] | default('x509') }}" + password: "{{ vars['icingaweb2_modules'][_module]['database']['password'] | default(omit) }}" + name: "{{ vars['icingaweb2_modules'][_module]['database']['name'] | default('x509') }}" + ssl_mode: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_mode'] | default(omit) }}" + ssl_ca: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_ca'] | default(omit) }}" + ssl_cert: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_cert'] | default(omit) }}" + ssl_key: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_key'] | default(omit) }}" + ssl_cipher: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_cipher'] | default(omit) }}" + ssl_extra_options: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_extra_options'] | default(omit) }}" + schema_path: /usr/share/icingaweb2/modules/x509/schema/mysql.schema.sql + select_query: "select * from x509_certificate" + when: vars['icingaweb2_modules'][_module]['database']['type'] | default('mysql') == 'mysql' + + - ansible.builtin.fail: + fail_msg: "The Database type select is not supported, {{ vars['icingaweb2_modules'][_module]['database']['type'] }} [Supported=mysql]" + when: vars['icingaweb2_modules'][_module]['database']['type'] is defined and vars['icingaweb2_modules'][_module]['database']['type'] != 'mysql' + + - name: Module x509 | Import Schema + ansible.builtin.include_tasks: ../manage_mysql_imports.yml + + - name: Module x509 | empty _db var + ansible.builtin.set_fact: + _db: {} + when: vars['icingaweb2_modules'][_module]['database']['import_schema'] | default(false) + vars: + _module: "{{ item.key }}" + +- name: Module x509 | Import Certificates + ansible.builtin.shell: > + icingacli {{ _module }} import --file {{ _file }} + loop: "{{ vars['icingaweb2_modules'][_module]['certificate_files'] }}" + loop_control: + loop_var: _file + vars: + _module: "{{ item.key }}" + when: vars['icingaweb2_modules'][_module]['certificate_files'] is defined + changed_when: false diff --git a/roles/icingaweb2/tasks/mysql/import_db.yml b/roles/icingaweb2/tasks/mysql/import_db.yml new file mode 100644 index 00000000..a647cb82 --- /dev/null +++ b/roles/icingaweb2/tasks/mysql/import_db.yml @@ -0,0 +1,17 @@ +--- + +- name: MySQL check for icingaweb db schema + ansible.builtin.shell: > + {{ _tmp_mysqlcmd }} + -Ns -e "select * from icingaweb_user" + failed_when: false + changed_when: false + check_mode: false + register: _icingaweb2_db_schema + +- name: MySQL import icingaweb db schema + ansible.builtin.shell: > + {{ _tmp_mysqlcmd }} + < /usr/share/icingaweb2/schema/mysql.schema.sql + when: _icingaweb2_db_schema.rc != 0 + run_once: yes \ No newline at end of file diff --git a/roles/icingaweb2/tasks/mysql/prepare_db.yml b/roles/icingaweb2/tasks/mysql/prepare_db.yml new file mode 100644 index 00000000..840182ad --- /dev/null +++ b/roles/icingaweb2/tasks/mysql/prepare_db.yml @@ -0,0 +1,32 @@ +--- + +- name: Check for admin user + block: + - name: Check Database Credentials + ansible.builtin.assert: + that: + - icingaweb2_db['user'] is defined + - icingaweb2_db['password'] is defined + fail_msg: "No database credentials defined. Please set icingaweb2_db. or a privileged user with icingaweb2_priv_db_" + when: icingaweb2_priv_db_password is undefined and icingaweb2_priv_db_user is undefined + + - name: Set db user with admin privileges + ansible.builtin.set_fact: + _priv_db_user: "{{ icingaweb2_priv_db_user }}" + _priv_db_pass: "{{ icingaweb2_priv_db_password }}" + when: icingaweb2_priv_db_password is defined and icingaweb2_priv_db_user is defined + +- name: Prepare mysql command + ansible.builtin.set_fact: + _tmp_mysqlcmd: >- + mysql {% if icingaweb2_db['host'] | default('localhost') != 'localhost' %} -h "{{ icingaweb2_db['host'] }}" {%- endif %} + {% if icingaweb2_db['port'] is defined %} -P "{{ icingaweb2_db['port'] }}" {%- endif %} + {% if icingaweb2_db['ssl_mode'] is defined %} --ssl-mode "{{ icingaweb2_db['ssl_mode'] }}" {%- endif %} + {% if icingaweb2_db['ssl_ca'] is defined %} --ssl-ca "{{ icingaweb2_db['ssl_ca'] }}" {%- endif %} + {% if icingaweb2_db['ssl_cert'] is defined %} --ssl-cert "{{ icingaweb2_db['ssl_cert'] }}" {%- endif %} + {% if icingaweb2_db['ssl_key'] is defined %} --ssl-key "{{ icingaweb2_db['ssl_key'] }}" {%- endif %} + {% if icingaweb2_db['ssl_cipher'] is defined %} --ssl-cipher "{{ icingaweb2_db['ssl_cipher'] }}" {%- endif %} + {% if icingaweb2_db['ssl_extra_options'] is defined %} {{ icingaweb2_db['ssl_extra_options'] }} {%- endif %} + -u "{{ icingaweb2_priv_db_user | default(icingaweb2_db['user']) }}" + -p"{{ icingaweb2_priv_db_password | default(icingaweb2_db['password']) }}" + "{{ icingaweb2_db['name'] }}" \ No newline at end of file diff --git a/roles/icingaweb2/tasks/mysql/users_db.yml b/roles/icingaweb2/tasks/mysql/users_db.yml new file mode 100644 index 00000000..87a03567 --- /dev/null +++ b/roles/icingaweb2/tasks/mysql/users_db.yml @@ -0,0 +1,21 @@ +--- + +- name: Check for user in icingaweb_user + ansible.builtin.shell: > + {{ _tmp_mysqlcmd }} + -Ns -e "select name from icingaweb_user where name='{{ _users.username }}'" + failed_when: false + changed_when: false + check_mode: false + register: _icingaweb2_db_user + +- name: Create user in icingaweb or reset status to active or reset password + ansible.builtin.shell: > + echo "INSERT INTO icingaweb_user + (name, active, password_hash) + VALUES ('{{ _users.username }}', 1, '"`php -r 'echo password_hash("{{ _users.password }}", PASSWORD_DEFAULT);'`"') + ON DUPLICATE KEY UPDATE active = 1, password_hash = '"`php -r 'echo password_hash("{{ _users.password }}", PASSWORD_DEFAULT);'`"'" + | {{ _tmp_mysqlcmd }} -Ns + when: _icingaweb2_db_user.stdout_lines | length <= 0 or _users.recreate is true + run_once: true + register: user_deleted diff --git a/roles/icingaweb2/tasks/pgsql/import_db.yml b/roles/icingaweb2/tasks/pgsql/import_db.yml new file mode 100644 index 00000000..1d5aa10f --- /dev/null +++ b/roles/icingaweb2/tasks/pgsql/import_db.yml @@ -0,0 +1,17 @@ +--- + +- name: PostgreSQL check for icingaweb db schema + ansible.builtin.shell: > + {{ _tmp_pgsqlcmd }} + -w -c "select * from icingaweb_user" + failed_when: false + changed_when: false + check_mode: false + register: _icingaweb2_db_schema + +- name: PostgreSQL import icingaweb db schema + ansible.builtin.shell: > + {{ _tmp_pgsqlcmd }} + -w -f /usr/share/icingaweb2/schema/pgsql.schema.sql + when: _icingaweb2_db_schema.rc != 0 + run_once: yes \ No newline at end of file diff --git a/roles/icingaweb2/tasks/pgsql/prepare_db.yml b/roles/icingaweb2/tasks/pgsql/prepare_db.yml new file mode 100644 index 00000000..6d4cef75 --- /dev/null +++ b/roles/icingaweb2/tasks/pgsql/prepare_db.yml @@ -0,0 +1,31 @@ +--- + +- name: Check for admin user + block: + - name: Check Database Credentials + ansible.builtin.assert: + that: + - icingaweb2_db['user'] is defined + - icingaweb2_db['password'] is defined + fail_msg: "No database credentials defined. Please set icingaweb2_db. or a privileged user with icingaweb2_priv_db_" + when: icingaweb2_priv_db_password is undefined and icingaweb2_priv_db_user is undefined + + - name: Set db user with admin privileges + ansible.builtin.set_fact: + _priv_db_user: "{{ icingaweb2_priv_db_user }}" + _priv_db_pass: "{{ icingaweb2_priv_db_password }}" + when: icingaweb2_priv_db_password is defined and icingaweb2_priv_db_user is defined + +- name: Prepare psql command + ansible.builtin.set_fact: + _tmp_pgsqlcmd: >- + PGPASSWORD="{{ icingaweb2_priv_db_password | default(icingaweb2_db['password']) }}" + psql + "host={{ icingaweb2_db['host'] }} + {% if icingaweb2_db['port'] is defined %} port={{ icingaweb2_db['port'] }} {%- endif %} + user={{ icingaweb2_priv_db_user | default(icingaweb2_db['user']) }} + dbname={{ icingaweb2_db['name'] }} + {% if icingaweb2_db['ssl_mode'] is defined %} sslmode={{ icingaweb2_db['ssl_mode'] | default('require') }} {%- endif %} + {% if icingaweb2_db['ssl_cert'] is defined %} sslcert={{ icingaweb2_db['ssl_cert'] }} {%- endif %} + {% if icingaweb2_db['ssl_key'] is defined %} sslkey={{ icingaweb2_db['ssl_key'] }} {%- endif %} + {% if icingaweb2_db['ssl_extra_options'] is defined %} {{ icingaweb2_db['ssl_extra_options'] }} {%- endif %}" diff --git a/roles/icingaweb2/tasks/pgsql/users_db.yml b/roles/icingaweb2/tasks/pgsql/users_db.yml new file mode 100644 index 00000000..dfd4e2f6 --- /dev/null +++ b/roles/icingaweb2/tasks/pgsql/users_db.yml @@ -0,0 +1,22 @@ +--- + +- name: PostgreSQL check for icingaweb admin user + ansible.builtin.shell: > + {{ _tmp_pgsqlcmd }} + -w -c "select name from icingaweb_user where name like '{{ _users.username }}'" + failed_when: false + changed_when: false + check_mode: false + register: _icingaweb2_db_user + +- name: Create user in icingaweb or reset status to active or reset password + ansible.builtin.shell: > + echo "INSERT INTO icingaweb_user + (name, active, password_hash) + VALUES ('{{ _users.username }}', 1, '"`php -r 'echo password_hash("{{ _users.password }}", PASSWORD_DEFAULT);'`"') + ON CONFLICT (name) DO UPDATE + SET active = 1, password_hash = '"`php -r 'echo password_hash("{{ _users.password }}", PASSWORD_DEFAULT);'`"'" + | {{ _tmp_pgsqlcmd }} -w + when: _icingaweb2_db_user.stdout == " name \n------\n(0 rows)" or _users.recreate is true + run_once: true + register: user_deleted diff --git a/roles/icingaweb2/vars/main.yml b/roles/icingaweb2/vars/main.yml index 8092fd97..588f0d6d 100644 --- a/roles/icingaweb2/vars/main.yml +++ b/roles/icingaweb2/vars/main.yml @@ -2,4 +2,5 @@ icingaweb2_module_packages: icingadb: icingadb-web director: icinga-director - businessprocess: icinga-businessprocess \ No newline at end of file + x509: icinga-x509 + businessprocess: icinga-businessprocess diff --git a/roles/repos/tasks/main.yml b/roles/repos/tasks/main.yml index d0bd32d8..2cee1fe1 100644 --- a/roles/repos/tasks/main.yml +++ b/roles/repos/tasks/main.yml @@ -7,7 +7,7 @@ - "{{ ansible_os_family }}-{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml" - "{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml" - "{{ ansible_os_family }}-{{ ansible_distribution }}.yml" - - "{{ ansible_os_family }}-{{ ansible_lsb.id }}.yml" + - "{{ ansible_os_family }}-{{ ansible_lsb.id if ansible_lsb.id is defined else ansible_distribution }}.yml" - "{{ ansible_os_family }}.yml" - default.yml paths: