Skip to content

Commit 5f2e504

Browse files
mocdanielmkayontour
mocdaniel
and
mkayontour
committed
add installation for x509 module (#214)
* add module x509 and mysql imports task * Add documentation for x509 module * Add documentation about database imports * Continues working on x509 module installation --------- Co-authored-by: Thilo W <[email protected]>
1 parent bd3dc25 commit 5f2e504

File tree

6 files changed

+212
-1
lines changed

6 files changed

+212
-1
lines changed

‎changelogs/fragments/feature_add_x509_module_installation.yml

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
major_changes:
3+
- Added Installation of x509 certificate monitoring model

‎doc/role-icingaweb2/module-x509.md

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
## Module x509
2+
3+
### Variables and Configuration
4+
5+
The general module parameter like `enabled` and `source` can be applied here.
6+
7+
| Variable | Value |
8+
|----------|------------|
9+
| enabled | true/false |
10+
| source | package |
11+
12+
#### Section configuration
13+
14+
The backend database for the module needs to be available and configured at the `icingaweb2_resources` variable.
15+
16+
```
17+
icingaweb2_modules:
18+
x509:
19+
source: package
20+
enabled: true
21+
config:
22+
backend:
23+
resource: x509
24+
```
25+
26+
#### Configure SNI Names.
27+
28+
To configure SNIs for a IP address, use the dictionary `sni`.
29+
30+
Example:
31+
32+
```
33+
icingaweb2_modules:
34+
x509:
35+
source: package
36+
enabled: true
37+
config:
38+
backend:
39+
resource: x509
40+
sni:
41+
192.168.56.213:
42+
hostnames:
43+
- icinga.com
44+
- test2.icinga.com
45+
```
46+
47+
#### Import Certificates
48+
49+
To import certificates use the **list** `certificate_files` all files need to be
50+
available locally beforehand.
51+
52+
```
53+
icingaweb2_modules:
54+
x509:
55+
source: package
56+
enabled: true
57+
config:
58+
backend:
59+
resource: x509
60+
certificate_files:
61+
- /etc/ssl/certs/ca-certificates.crt
62+
```
63+
64+
#### Database Schema Setup
65+
66+
To import the database schema use `database` dictionary with the following variables.
67+
68+
| Variable | Type | Description | Default |
69+
|----------|------|-------------|---------|
70+
| `import_schema` | `Boolean` | Defines wether the schema will be imported or not. | false |
71+
| `host` | `String` | Defines database address to connect to. | `localhost` |
72+
| `port` | `int` | Defines the database port to connect to. | `3306` or `5432` |
73+
| `user` | `string` | Defines database user | `x509` |
74+
| `name` | `String` | Defines the database to connect to. | `x509` |
75+
| `password` | `String` | Defines the database password to connect with. | OMITTED |
76+
| `ssl_mode` | `String` | Clients attempt to connect using encryption, falling back to an unencrypted connection if an encrypted connection cannot be established |**n/a** |
77+
|`ssl_ca`| `String`| Defines the path to the ca certificate for client authentication. | **n/a** |
78+
|`ssl_cert`|`String`| Defines the path to the certificate for client authentication. | **n/a** |
79+
|`ssl_key`| `String` | Defines the path to the certificate key for client key authentication. | **n/a** |
80+
|`ssl_cipher`|`String`| Ciphers for the client authentication. | **n/a** |
81+
|`ssl_extra_options`|`String`| Extra options for the client authentication. | **n/a** |
82+
83+
84+
```
85+
icingaweb2_modules:
86+
x509:
87+
source: package
88+
enabled: true
89+
database:
90+
import_schema: true
91+
host: localhost
92+
port: 3306
93+
user: x509
94+
password: secret
95+
```

‎roles/icingaweb2/tasks/main.yml

+8
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,11 @@
4343
force: yes
4444
when: icingaweb2_modules is defined
4545
loop: "{{ icingaweb2_modules | dict2items }}"
46+
47+
# Many daemons fail before e.g. the resource is set up or the schema hasn't been migrated. This is a workaround.
48+
- name: Manage enabled module daemons
49+
ansible.builtin.service:
50+
name: "icinga-{{ item.key }}"
51+
state: restarted
52+
when: icingaweb2_modules is defined and item.value.enabled|bool == true and item.key in ['vspheredb', 'x509']
53+
loop: "{{ icingaweb2_modules | dict2items }}"

‎roles/icingaweb2/tasks/manage_mysql_imports.yml

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
- name: Check Database Credentials
3+
ansible.builtin.assert:
4+
that:
5+
- _db['user'] is defined
6+
- _db['password'] is defined
7+
fail_msg: "No database credentials defined."
8+
9+
- name: Build mysql command
10+
ansible.builtin.set_fact:
11+
_tmp_mysqlcmd: >-
12+
mysql {% if _db['host'] | default('localhost') != 'localhost' %} -h "{{ _db['host'] }}" {%- endif %}
13+
{% if _db['port'] is defined %} -P "{{ _db['port'] }}" {%- endif %}
14+
{% if _db['ssl_mode'] is defined %} --ssl-mode "{{ _db['ssl_mode'] }}" {%- endif %}
15+
{% if _db['ssl_ca'] is defined %} --ssl-ca "{{ _db['ssl_ca'] }}" {%- endif %}
16+
{% if _db['ssl_cert'] is defined %} --ssl-cert "{{ _db['ssl_cert'] }}" {%- endif %}
17+
{% if _db['ssl_key'] is defined %} --ssl-key "{{ _db['ssl_key'] }}" {%- endif %}
18+
{% if _db['ssl_cipher'] is defined %} --ssl-cipher "{{ _db['ssl_cipher'] }}" {%- endif %}
19+
{% if _db['ssl_extra_options'] is defined %} {{ _db['ssl_extra_options'] }} {%- endif %}
20+
-u "{{ _db['user'] }}"
21+
-p"{{ _db['password'] }}"
22+
"{{ _db['name'] }}"
23+
24+
- name: MySQL check for db schema
25+
ansible.builtin.shell: >
26+
{{ _tmp_mysqlcmd }}
27+
-Ns -e "{{ _db['select_query'] }}"
28+
failed_when: false
29+
changed_when: false
30+
check_mode: false
31+
register: _db_schema
32+
33+
- name: MySQL import db schema
34+
ansible.builtin.shell: >
35+
{{ _tmp_mysqlcmd }}
36+
< {{ _db['schema_path'] }}
37+
when: _db_schema.rc != 0
38+
run_once: yes

‎roles/icingaweb2/tasks/modules/x509.yml

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
- name: Module x509 | Ensure config directory
2+
ansible.builtin.file:
3+
state: directory
4+
dest: "{{ icingaweb2_modules_config_dir }}/{{ _module }}"
5+
owner: "{{ icingaweb2_httpd_user }}"
6+
group: "{{ icingaweb2_group }}"
7+
mode: "2770"
8+
vars:
9+
_module: "{{ item.key }}"
10+
11+
- name: Module x509 | Manage config files
12+
ansible.builtin.include_tasks: manage_module_config.yml
13+
loop: "{{ _files }}"
14+
loop_control:
15+
loop_var: _file
16+
when: vars['icingaweb2_modules'][_module][_file] is defined
17+
vars:
18+
_module: "{{ item.key }}"
19+
_files:
20+
- config
21+
- sni
22+
23+
- name: Module x509 | Manage Schema
24+
block:
25+
- name: Module x509 | Prepare _db informations
26+
ansible.builtin.set_fact:
27+
_db:
28+
host: "{{ vars['icingaweb2_modules'][_module]['database']['host'] | default('localhost') }}"
29+
port: "{{ vars['icingaweb2_modules'][_module]['database']['port'] | default('3306') }}"
30+
user: "{{ vars['icingaweb2_modules'][_module]['database']['user'] | default('x509') }}"
31+
password: "{{ vars['icingaweb2_modules'][_module]['database']['password'] | default(omit) }}"
32+
name: "{{ vars['icingaweb2_modules'][_module]['database']['name'] | default('x509') }}"
33+
ssl_mode: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_mode'] | default(omit) }}"
34+
ssl_ca: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_ca'] | default(omit) }}"
35+
ssl_cert: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_cert'] | default(omit) }}"
36+
ssl_key: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_key'] | default(omit) }}"
37+
ssl_cipher: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_cipher'] | default(omit) }}"
38+
ssl_extra_options: "{{ vars['icingaweb2_modules'][_module]['database']['ssl_extra_options'] | default(omit) }}"
39+
schema_path: /usr/share/icingaweb2/modules/x509/schema/mysql.schema.sql
40+
select_query: "select * from x509_certificate"
41+
when: vars['icingaweb2_modules'][_module]['database']['type'] | default('mysql') == 'mysql'
42+
43+
- ansible.builtin.fail:
44+
fail_msg: "The Database type select is not supported, {{ vars['icingaweb2_modules'][_module]['database']['type'] }} [Supported=mysql]"
45+
when: vars['icingaweb2_modules'][_module]['database']['type'] is defined and vars['icingaweb2_modules'][_module]['database']['type'] != 'mysql'
46+
47+
- name: Module x509 | Import Schema
48+
ansible.builtin.include_tasks: ../manage_mysql_imports.yml
49+
50+
- name: Module x509 | empty _db var
51+
ansible.builtin.set_fact:
52+
_db: {}
53+
when: vars['icingaweb2_modules'][_module]['database']['import_schema'] | default(false)
54+
vars:
55+
_module: "{{ item.key }}"
56+
57+
- name: Module x509 | Import Certificates
58+
ansible.builtin.shell: >
59+
icingacli {{ _module }} import --file {{ _file }}
60+
loop: "{{ vars['icingaweb2_modules'][_module]['certificate_files'] }}"
61+
loop_control:
62+
loop_var: _file
63+
vars:
64+
_module: "{{ item.key }}"
65+
when: vars['icingaweb2_modules'][_module]['certificate_files'] is defined
66+
changed_when: false

‎roles/icingaweb2/vars/main.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,5 @@
22
icingaweb2_module_packages:
33
icingadb: icingadb-web
44
director: icinga-director
5-
businessprocess: icinga-businessprocess
5+
x509: icinga-x509
6+
businessprocess: icinga-businessprocess

0 commit comments

Comments
 (0)