Ajout proxy postgresql

2026-07-29 03:14:39 +00:00
parent 3dcc57ff2c
commit 82cbb26838
13 changed files with 446 additions and 70 deletions
--- a/README.md
+++ b/README.md
@@ -76,6 +76,7 @@ Variable definies dans default/main.yml
 |db_name|Nom de la base de postgres des serveurs||
 |db_user|Nom de l'utilisateur de la base postgres serveurs||
 |db_passwd|Mot de passe l'utilisateur de la base postgres serveurs||
+|proxy_db_type|Type de base locale du proxy: mysql ou postgresql|Défaut: mysql. Sélectionnable par host via l'inventory ou host_vars|
 |proxy_db_name|Nom de la base des proxys||
 |proxy_db_user|Nom de l'utilisateur de la base des proxys||
 |proxy_db_passwd|Mot de passe de l'utilisateur de la base des proxys||
@@ -144,6 +145,7 @@ Exemple Inventory
          role: proxy
        proxy02.mondomain.com:
          role: proxy
+          proxy_db_type: postgresql

 Example Playbook
 -------------------
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -8,6 +8,7 @@ db_name: zabbix
 db_user: zabbix
 db_passwd: zabbix

+proxy_db_type: mysql
 proxy_db_name: zabbix_proxy
 proxy_db_user: zabbix_proxy
 proxy_db_passwd: zabbix_proxy
@@ -15,4 +16,5 @@ proxy_db_passwd: zabbix_proxy
 zabbix_ca: zabbix_ca
 zabbix_server: zabbix_server
 zabbix_proxy: zabbix_proxy
-zabbix_agent: zabbix_agent
+zabbix_agent: zabbix_agent
+zabbix_web: zabbix_web
--- a/tasks/Debian/instal-web.yml
+++ b/tasks/Debian/instal-web.yml
@@ -0,0 +1,7 @@
+- name: Web - Install packages
+  ansible.builtin.apt:
+    name: "{{ item }}"
+    state: latest
+  loop: "{{ web.packages }}"
+  tags:
+    - install_web
--- a/tasks/Debian/install-proxy.yml
+++ b/tasks/Debian/install-proxy.yml
@@ -1,37 +1,82 @@
- name: Proxy - Install Debian Proxy packages
+- name: Proxy - Install packages (mysql)
  ansible.builtin.apt:
    name: "{{ item }}"
    state: latest
-  loop: "{{ proxy.packages }}"
-  tags:
-    - install_proxy
-  when: ansible_os_family == "Debian" 
-
-
- name: Proxy - Enable and start service mariadb
-  ansible.builtin.service:
-    name: mariadb
-    state: started
-    enabled: yes
+  loop: "{{ proxy_mysql.packages }}"
+  when:
+    - ansible_os_family == "Debian"
+    - proxy_db_type == "mysql"
  tags:
    - install_proxy

- name: Proxy - Generate mariadb proxy creation script
-  ansible.builtin.template:
-    src: create_proxy_db.j2
-    dest: /tmp/create_proxy_db.sql
+- name: Proxy - Install packages (postgresql)
+  ansible.builtin.apt:
+    name: "{{ item }}"
+    state: latest
+  loop: "{{ proxy_postgresql.packages }}"
+  when:
+    - ansible_os_family == "Debian"
+    - proxy_db_type == "postgresql"
  tags:
    - install_proxy

- name: Proxy - Create mariadb proxy database
-  ansible.builtin.shell: mysql -uroot <  /tmp/create_proxy_db.sql
+- name: Proxy - Setup mysql proxy database
+  when: proxy_db_type == "mysql"
  tags:
-   - install_proxy
+    - install_proxy
+  block:
+    - name: Proxy - Enable and start service mariadb
+      ansible.builtin.service:
+        name: mariadb
+        state: started
+        enabled: yes

- name: Proxy - Populate mariadb proxy database
-  ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/mysql/proxy.sql | mysql --default-character-set=utf8mb4 -u{{proxy_db_user}} --password={{proxy_db_passwd}} {{proxy_db_name}}'
+    - name: Proxy - Generate mariadb proxy creation script
+      ansible.builtin.template:
+        src: create_proxy_db.j2
+        dest: /tmp/create_proxy_db.sql
+
+    - name: Proxy - Create mariadb proxy database
+      ansible.builtin.shell: mysql -uroot <  /tmp/create_proxy_db.sql
+
+    - name: Proxy - Populate mariadb proxy database
+      ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/mysql/proxy.sql | mysql --default-character-set=utf8mb4 -u{{proxy_db_user}} --password={{proxy_db_passwd}} {{proxy_db_name}}'
+
+- name: Proxy - Setup postgresql proxy database
+  when: proxy_db_type == "postgresql"
  tags:
-   - install_proxy
+    - install_proxy
+  block:
+    - name: Proxy - Enable and start service postgresql
+      ansible.builtin.service:
+        name: postgresql
+        state: started
+        enabled: yes
+
+    - name: Proxy - Generate postgresql proxy creation script
+      ansible.builtin.template:
+        src: create_proxy_db_pg.j2
+        dest: /tmp/create_proxy_db_pg.sql
+        owner: postgres
+
+    - name: Proxy - Create postgresql proxy database
+      ansible.builtin.shell: su - postgres -c 'psql -f /tmp/create_proxy_db_pg.sql'
+
+    - name: Proxy - Add proxy user to pg_hba
+      ansible.builtin.lineinfile:
+        path: /etc/postgresql/{{ postgresql_version }}/main/pg_hba.conf
+        insertafter: '# Database administrative login by Unix domain socket'
+        line: "local   {{ proxy_db_name }}          {{ proxy_db_user }}           trust"
+        firstmatch: yes
+        state: present
+
+    - name: Proxy - Restart postgresql
+      ansible.builtin.service:
+        name: postgresql
+        state: restarted
+
+    - name: Proxy - Populate postgresql proxy database
+      ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/postgresql/proxy.sql | psql -U{{ proxy_db_user }} {{ proxy_db_name }}'

 - name: Find Group
  set_fact:
--- a/tasks/RedHat/install-agent2.yml
+++ b/tasks/RedHat/install-agent2.yml
@@ -1,8 +1,8 @@

 - name: Agent2 -  Install packages
-  ansible.builtin.apt:
+  ansible.builtin.dnf:
    name: "{{ item }}"
-    state: latest
+    state: present
  loop: "{{ agent.packages }}"
  tags:
    - install_agent
@@ -10,7 +10,8 @@
 - name: Agent2 - Find Group
  set_fact:
    my_group:  "{{ group_names | first }}"
-
+  tags:
+    - install_agent
 - name: Agent2 - Créer la liste des hôtes correspondant aux rôles cibles
  set_fact:
    hotes_filtres: >-
@@ -19,15 +20,18 @@
      selectattr('role', 'in', roles_cibles) |
      map(attribute='inventory_hostname') |
      list }}
-
+  tags:
+    - install_agent
 - name: Agent2 - Generate Server List
  set_fact:
    Server: "{{ hotes_filtres | join(',') }}"
-
+  tags:
+    - install_agent
 - name: Agent2 - Generate ActiveServer List
  set_fact:
    ServerActive: "{{ hotes_filtres | join(';') }}"
-
+  tags:
+    - install_agent
 - name: Agent2 - Generate agent2 config
  ansible.builtin.template:
      src: zabbix_agent2.conf.j2
@@ -35,7 +39,8 @@
      owner: zabbix
      group: zabbix
      mode: 0640
-
+  tags:
+    - install_agent
 - name: Agent2 - Create cert directory if zabbix_crypt=="tls"
  ansible.builtin.file:
    path:  "/etc/zabbix/certs"
@@ -44,7 +49,8 @@
    owner: zabbix
    group: zabbix
  when: zabbix_crypt=="tls"
-   
+  tags:
+    - install_agent
 - name: Agent2 - Copy Certificats
  ansible.builtin.copy:
    src: "{{ item }}"
@@ -56,6 +62,8 @@
    - "{{ zabbix_agent }}.crt"
    - "{{ zabbix_agent }}.key"
  when: zabbix_crypt=="tls"
+  tags:
+    - install_agent

 - name: Enable and start service zabbix agent2
  ansible.builtin.service:
@@ -64,3 +72,5 @@
    enabled: true
  loop: 
    - zabbix-agent2
+  tags:
+    - install_agent
--- a/tasks/RedHat/install-proxy.yml
+++ b/tasks/RedHat/install-proxy.yml
@@ -1,43 +1,89 @@
- name: Proxy - Install Debian Proxy packages
+- name: Proxy - Install packages (mysql)
  ansible.builtin.dnf:
    name: "{{ item }}"
    state: present
-  loop: "{{ proxy.packages }}"
-  tags:
-    - install_proxy
-    
- name: Proxy - Enable and start service mariadb
-  ansible.builtin.service:
-    name: mariadb
-    state: started
-    enabled: yes
+  loop: "{{ proxy_mysql.packages }}"
+  when: proxy_db_type == "mysql"
  tags:
    - install_proxy

- name: Proxy - Generate mariadb proxy creation script
-  ansible.builtin.template:
-    src: create_proxy_db.j2
-    dest: /tmp/create_proxy_db.sql
-  tags:
-    - install_proxy
-
- name: Proxy - Create mariadb proxy database
-  ansible.builtin.shell: mysql -uroot <  /tmp/create_proxy_db.sql
-  tags:
-   - install_proxy
-
- name: Proxy - Populate mariadb proxy database
-  ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/mysql/proxy.sql | mysql --default-character-set=utf8mb4 -u{{proxy_db_user}} --password={{proxy_db_passwd}} {{proxy_db_name}}'
-  tags:
-   - install_proxy
-
- name: Proxy - Enable and restart mariadb
-  ansible.builtin.systemd_service:
+- name: Proxy - Install packages (postgresql)
+  ansible.builtin.dnf:
    name: "{{ item }}"
-    state: started
-    enabled: true
-  loop: 
-    - mariadb
+    state: present
+  loop: "{{ proxy_postgresql.packages }}"
+  when: proxy_db_type == "postgresql"
+  tags:
+    - install_proxy
+
+- name: Proxy - Setup mysql proxy database
+  when: proxy_db_type == "mysql"
+  tags:
+    - install_proxy
+  block:
+    - name: Proxy - Enable and start service mariadb
+      ansible.builtin.service:
+        name: mariadb
+        state: started
+        enabled: yes
+
+    - name: Proxy - Generate mariadb proxy creation script
+      ansible.builtin.template:
+        src: create_proxy_db.j2
+        dest: /tmp/create_proxy_db.sql
+
+    - name: Proxy - Create mariadb proxy database
+      ansible.builtin.shell: mysql -uroot <  /tmp/create_proxy_db.sql
+
+    - name: Proxy - Populate mariadb proxy database
+      ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/mysql/proxy.sql | mysql --default-character-set=utf8mb4 -u{{proxy_db_user}} --password={{proxy_db_passwd}} {{proxy_db_name}}'
+
+- name: Proxy - Setup postgresql proxy database
+  when: proxy_db_type == "postgresql"
+  tags:
+    - install_proxy
+  block:
+    - name: Proxy - Check if postgresql is configured
+      ansible.builtin.stat:
+        path: /var/lib/pgsql/data/PG_VERSION
+      register: proxy_postgresqldata
+
+    - name: Proxy - Init DB
+      ansible.builtin.shell:
+        cmd: postgresql-setup --initdb
+      when: proxy_postgresqldata.stat.exists == false
+
+    - name: Proxy - Enable and start service postgresql
+      ansible.builtin.service:
+        name: postgresql
+        state: started
+        enabled: yes
+
+    - name: Proxy - Generate postgresql proxy creation script
+      ansible.builtin.template:
+        src: create_proxy_db_pg.j2
+        dest: /tmp/create_proxy_db_pg.sql
+        owner: postgres
+
+    - name: Proxy - Create postgresql proxy database
+      ansible.builtin.shell: su - postgres -c 'psql -f /tmp/create_proxy_db_pg.sql'
+
+    - name: Proxy - Add proxy user to pg_hba
+      ansible.builtin.lineinfile:
+        path: /var/lib/pgsql/data/pg_hba.conf
+        insertafter: '# "local" is for Unix domain socket connections only'
+        line: "local   {{ proxy_db_name }}          {{ proxy_db_user }}           trust"
+        firstmatch: yes
+        state: present
+
+    - name: Proxy - Restart postgresql
+      ansible.builtin.service:
+        name: postgresql
+        state: restarted
+        enabled: yes
+
+    - name: Proxy - Populate postgresql proxy database
+      ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/postgresql/proxy.sql | psql -U{{ proxy_db_user }} {{ proxy_db_name }}'

 - name: Find Group
  set_fact:
--- a/tasks/RedHat/install-web.yml
+++ b/tasks/RedHat/install-web.yml
@@ -0,0 +1,76 @@
+# Web
+- name: Web - Install packages
+  ansible.builtin.dnf:
+    name: "{{ item }}"
+    state: present
+  loop: "{{ web.packages }}"
+  tags:
+    - install_web
+
+- name: Web - Find Group
+  set_fact:
+    my_group:  "{{ group_names | first }}"
+  tags:
+    - install_web
+- name: Web - Créer la liste des hôtes correspondant aux rôles cibles
+  set_fact:
+    hotes_filtres: >-
+      {{ groups[my_group] |
+      map('extract', hostvars) |
+      selectattr('role', 'in', roles_cibles) |
+      map(attribute='inventory_hostname') |
+      list }}
+  tags:
+    - install_web
+- name: Web - Generate Server List
+  set_fact:
+    Server: "{{ hotes_filtres | join(',') }}"
+  tags:
+    - install_web
+- name: Web - Generate config
+  ansible.builtin.template:
+      src: zabbix_web_service.conf.j2
+      dest: /etc/zabbix/zabbix_web_service.conf
+      owner: zabbix
+      group: zabbix
+      mode: 0640
+  tags:
+    - install_web
+
+- name: Web - Create cert directory if zabbix_crypt=="tls"
+  ansible.builtin.file:
+    path:  "/etc/zabbix/certs"
+    state: directory
+    recurse: yes
+    owner: zabbix
+    group: zabbix
+  when: zabbix_crypt=="tls"
+  tags:
+    - install_web 
+
+- name: Web - Copy Certificats
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/etc/zabbix/certs/{{ item }}"
+    owner: zabbix
+    group: zabbix
+  loop:
+    - "{{ zabbix_ca }}.crt"
+    - "{{ zabbix_web }}.crt"
+    - "{{ zabbix_web }}.key"
+    - "{{ zabbix_agent }}.crt"
+    - "{{ zabbix_agent }}.key"
+  when: zabbix_crypt=="tls"
+  tags:
+    - install_web
+    
+- name: Web -Enable and start service zabbix web
+  ansible.builtin.service:
+    name: "{{ item }}"
+    state: restarted
+    enabled: true
+  loop: 
+    - zabbix-web-service
+    - zabbix-agent2
+  tags:
+    - install_web
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -2,7 +2,7 @@
 # tasks file for zabbix
 - name: check OS version
  debug: var=ansible_os_family
-
+  tags: always
 - name: include os variables
  include_vars: "{{ ansible_os_family }}.yml"
  tags: always
@@ -27,6 +27,7 @@
      ansible.builtin.dnf:
        name: "https://repo.zabbix.com/zabbix/{{ zabbix_version }}/release/alma/{{ ansible_distribution_major_version }}/noarch/zabbix-release-latest-{{ zabbix_version }}.el{{ ansible_distribution_major_version }}.noarch.rpm"
        state: present
+  tags: always

 - name: Prepare RH like
  when: ansible_os_family == "RedHat"
@@ -50,6 +51,7 @@
    - name: Reboot if necessary
      ansible.builtin.reboot:
      when: selinux.changed
+  tags: always

 - name: Prepare Debian
  when: ansible_os_family == "Debian"
@@ -60,7 +62,8 @@
    - name: Mise à jour le cache des paquets
      ansible.builtin.apt:
        update_cache: yes
-
+  tags: always
+  
 - name: Database - Install
  when: role == "db"
  block:
@@ -90,6 +93,12 @@
  tags:
    - install_front

+- name: Web - Install
+  ansible.builtin.include_tasks: "{{ansible_os_family}}/install-web.yml"
+  when: role == "web" 
+  tags:
+    - install_web
+
 - name: Install Agent
  ansible.builtin.include_tasks: "{{ansible_os_family}}/install-agent2.yml"
  tags:
--- a/templates/create_proxy_db_pg.j2
+++ b/templates/create_proxy_db_pg.j2
@@ -0,0 +1,6 @@
+DROP DATABASE IF EXISTS {{ proxy_db_name }};
+DROP USER IF EXISTS {{ proxy_db_user }};
+CREATE DATABASE {{ proxy_db_name }};
+CREATE USER {{ proxy_db_user }} WITH ENCRYPTED PASSWORD '{{ proxy_db_passwd }}';
+GRANT ALL PRIVILEGES ON {{ proxy_db_name }} TO {{ proxy_db_user }};
+ALTER DATABASE {{ proxy_db_name }}  OWNER TO {{ proxy_db_user }};
--- a/templates/zabbix_proxy.conf.j2
+++ b/templates/zabbix_proxy.conf.j2
@@ -152,6 +152,9 @@ SocketDir=/run/zabbix
 # Mandatory: no
 # Default:
 # DBHost=localhost
+{% if proxy_db_type == "postgresql" %}
+DBHost=
+{% endif %}

 ### Option: DBName
 #       Database name.
--- a/templates/zabbix_web_service.conf.j2
+++ b/templates/zabbix_web_service.conf.j2
@@ -0,0 +1,143 @@
+# This is a configuration file for Zabbix web_service
+# To get more information about Zabbix, visit https://www.zabbix.com
+
+############ GENERAL PARAMETERS #################
+
+### Option: LogType
+#       Specifies where log messages are written to:
+#               system  - syslog
+#               file    - file specified with LogFile parameter
+#               console - standard output
+#
+# Mandatory: no
+# Default:
+# LogType=file
+
+### Option: LogFile
+#       Log file name for LogType 'file' parameter.
+#
+# Mandatory: yes, if LogType is set to file, otherwise no
+# Default:
+# LogFile=/tmp/zabbix_web_service.log
+
+LogFile=/var/log/zabbix/zabbix_web_service.log
+
+### Option: LogFileSize
+#       Maximum size of log file in MB.
+#       0 - disable automatic log rotation.
+#
+# Mandatory: no
+# Range: 0-1024
+# Default:
+# LogFileSize=1
+
+LogFileSize=0
+
+### Option: DebugLevel
+#       Specifies debug level:
+#       0 - basic information about starting and stopping of Zabbix processes
+#       1 - critical information
+#       2 - error information
+#       3 - warnings
+#       4 - for debugging (produces lots of information)
+#       5 - extended debugging (produces even more information)
+#
+# Mandatory: no
+# Range: 0-5
+# Default:
+# DebugLevel=3
+
+### Option: AllowedIP
+#       List of comma delimited IP addresses, optionally in CIDR notation, or DNS names of Zabbix servers and Zabbix proxies.
+#       Incoming connections will be accepted only from the hosts listed here.
+#       If IPv6 support is enabled then '127.0.0.1', '::127.0.0.1', '::ffff:127.0.0.1' are treated equally
+#       and '::/0' will allow any IPv4 or IPv6 address.
+#       '0.0.0.0/0' can be used to allow any IPv4 address.
+#       Example: AllowedIP=127.0.0.1,192.168.1.0/24,::1,2001:db8::/32,zabbix.example.com
+#
+# Mandatory: yes
+# Default:
+# AllowedIP=
+
+AllowedIP={{Server}}
+
+### Option: ListenPort
+#       Service will listen on this port for connections from the server.
+#
+# Mandatory: no
+# Range: 1024-32767
+# Default:
+# ListenPort=10053
+
+### Option: Timeout
+#       Spend no more than Timeout seconds on formatting dashboard as PDF
+#
+# Mandatory: no
+# Range: 1-30
+# Default:
+# Timeout=10
+
+### Option: TLSAccept
+#       What incoming connections to accept.
+#       Specifies what type of connection to use:
+#               unencrypted - accept connections without encryption
+#               cert        - accept connections secured with TLS and a certificate
+#
+# Mandatory: no
+# Default:
+{% if zabbix_crypt=="tls" %}
+TLSAccept=cert
+{% else %}
+TLSAccept=unencrypted
+{% endif %}
+
+### Option: TLSCAFile
+#       Full pathname of a file containing the top-level CA(s) certificates for
+#       peer certificate verification.
+#
+# Mandatory: no
+# Default:
+{% if zabbix_crypt=="tls" %}
+TLSCAFile=/etc/zabbix/certs/{{zabbix_ca}}.crt
+{% else %}
+# TLSCAFile=
+{% endif %}
+
+### Option: TLSCertFile
+#       Full pathname of a file containing the service certificate or certificate chain.
+#
+# Mandatory: no
+# Default:
+{% if zabbix_crypt=="tls" %}
+TLSCertFile=/etc/zabbix/certs/{{zabbix_web}}.crt
+{% else %}
+# TLSCertFile=
+{% endif %}
+
+### Option: TLSKeyFile
+#       Full pathname of a file containing the service private key.
+#
+# Mandatory: no
+# Default:
+{% if zabbix_crypt=="tls" %}
+TLSKeyFile=/etc/zabbix/certs/{{zabbix_web}}.key
+{% else %}
+# TLSKeyFile=
+{% endif %}
+
+### Option: IgnoreURLCertErrors
+#       Ignore TLS certificate errors when accessing Frontend URL
+#               0 - do not ignore
+#               1 - ignore
+#
+# Mandatory: no
+# Default:
+IgnoreURLCertErrors=1
+
+### Option: Include
+#       You may include individual files or all files in a directory in the configuration file.
+#
+# Mandatory: no
+# Include=
+
+
--- a/vars/Debian.yml
+++ b/vars/Debian.yml
@@ -20,12 +20,26 @@ front:
    - nginx
    - zabbix-agent2
    - keepalived
-proxy:
+proxy_mysql:
  packages:
    - mariadb-server
-    - zabbix-proxy-mysql 
+    - zabbix-proxy-mysql
    - zabbix-sql-scripts
    - zabbix-agent2
+
+proxy_postgresql:
+  packages:
+    - postgresql
+    - postgresql-contrib
+    - python3-psycopg2
+    - zabbix-proxy-pgsql
+    - zabbix-sql-scripts
+    - zabbix-agent2
+web:
+  packages: 
+    - zabbix-web-service
+    - zabbix-agent2
+
 agent:
  packages: 
    - zabbix-agent2
--- a/vars/RedHat.yml
+++ b/vars/RedHat.yml
@@ -24,10 +24,23 @@ front:
    - zabbix-agent2
    - zabbix-selinux-policy
    - php-fpm
-proxy:
+proxy_mysql:
  packages:
    - mariadb-server
    - mariadb
-    - zabbix-proxy-mysql 
+    - zabbix-proxy-mysql
    - zabbix-sql-scripts
    - zabbix-agent2
+
+proxy_postgresql:
+  packages:
+    - postgresql-server
+    - postgresql-contrib
+    - postgresql
+    - zabbix-proxy-pgsql
+    - zabbix-sql-scripts
+    - zabbix-agent2
+web:
+  packages: 
+    - zabbix-web-service
+    - zabbix-agent2