From 82cbb26838a3cff143bb72457f8f9ffac1a2ce3a Mon Sep 17 00:00:00 2001 From: stef Date: Wed, 29 Jul 2026 03:14:39 +0000 Subject: [PATCH] Ajout proxy postgresql --- README.md | 2 + defaults/main.yml | 4 +- tasks/Debian/instal-web.yml | 7 ++ tasks/Debian/install-proxy.yml | 89 ++++++++++++----- tasks/RedHat/install-agent2.yml | 26 +++-- tasks/RedHat/install-proxy.yml | 112 ++++++++++++++------- tasks/RedHat/install-web.yml | 76 ++++++++++++++ tasks/main.yml | 13 ++- templates/create_proxy_db_pg.j2 | 6 ++ templates/zabbix_proxy.conf.j2 | 3 + templates/zabbix_web_service.conf.j2 | 143 +++++++++++++++++++++++++++ vars/Debian.yml | 18 +++- vars/RedHat.yml | 17 +++- 13 files changed, 446 insertions(+), 70 deletions(-) create mode 100644 tasks/Debian/instal-web.yml create mode 100644 tasks/RedHat/install-web.yml create mode 100644 templates/create_proxy_db_pg.j2 create mode 100644 templates/zabbix_web_service.conf.j2 diff --git a/README.md b/README.md index 8dd66d4..c7bd146 100644 --- a/README.md +++ b/README.md @@ -76,6 +76,7 @@ Variable definies dans default/main.yml |db_name|Nom de la base de postgres des serveurs|| |db_user|Nom de l'utilisateur de la base postgres serveurs|| |db_passwd|Mot de passe l'utilisateur de la base postgres serveurs|| +|proxy_db_type|Type de base locale du proxy: mysql ou postgresql|Défaut: mysql. Sélectionnable par host via l'inventory ou host_vars| |proxy_db_name|Nom de la base des proxys|| |proxy_db_user|Nom de l'utilisateur de la base des proxys|| |proxy_db_passwd|Mot de passe de l'utilisateur de la base des proxys|| @@ -144,6 +145,7 @@ Exemple Inventory role: proxy proxy02.mondomain.com: role: proxy + proxy_db_type: postgresql Example Playbook ------------------- diff --git a/defaults/main.yml b/defaults/main.yml index 6079d9a..af723f6 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -8,6 +8,7 @@ db_name: zabbix db_user: zabbix db_passwd: zabbix +proxy_db_type: mysql proxy_db_name: zabbix_proxy proxy_db_user: zabbix_proxy proxy_db_passwd: zabbix_proxy @@ -15,4 +16,5 @@ proxy_db_passwd: zabbix_proxy zabbix_ca: zabbix_ca zabbix_server: zabbix_server zabbix_proxy: zabbix_proxy -zabbix_agent: zabbix_agent \ No newline at end of file +zabbix_agent: zabbix_agent +zabbix_web: zabbix_web \ No newline at end of file diff --git a/tasks/Debian/instal-web.yml b/tasks/Debian/instal-web.yml new file mode 100644 index 0000000..6b3f822 --- /dev/null +++ b/tasks/Debian/instal-web.yml @@ -0,0 +1,7 @@ +- name: Web - Install packages + ansible.builtin.apt: + name: "{{ item }}" + state: latest + loop: "{{ web.packages }}" + tags: + - install_web \ No newline at end of file diff --git a/tasks/Debian/install-proxy.yml b/tasks/Debian/install-proxy.yml index 2417b0e..c9bb11b 100644 --- a/tasks/Debian/install-proxy.yml +++ b/tasks/Debian/install-proxy.yml @@ -1,37 +1,82 @@ -- name: Proxy - Install Debian Proxy packages +- name: Proxy - Install packages (mysql) ansible.builtin.apt: name: "{{ item }}" state: latest - loop: "{{ proxy.packages }}" - tags: - - install_proxy - when: ansible_os_family == "Debian" - - -- name: Proxy - Enable and start service mariadb - ansible.builtin.service: - name: mariadb - state: started - enabled: yes + loop: "{{ proxy_mysql.packages }}" + when: + - ansible_os_family == "Debian" + - proxy_db_type == "mysql" tags: - install_proxy -- name: Proxy - Generate mariadb proxy creation script - ansible.builtin.template: - src: create_proxy_db.j2 - dest: /tmp/create_proxy_db.sql +- name: Proxy - Install packages (postgresql) + ansible.builtin.apt: + name: "{{ item }}" + state: latest + loop: "{{ proxy_postgresql.packages }}" + when: + - ansible_os_family == "Debian" + - proxy_db_type == "postgresql" tags: - install_proxy -- name: Proxy - Create mariadb proxy database - ansible.builtin.shell: mysql -uroot < /tmp/create_proxy_db.sql +- name: Proxy - Setup mysql proxy database + when: proxy_db_type == "mysql" tags: - - install_proxy + - install_proxy + block: + - name: Proxy - Enable and start service mariadb + ansible.builtin.service: + name: mariadb + state: started + enabled: yes -- name: Proxy - Populate mariadb proxy database - ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/mysql/proxy.sql | mysql --default-character-set=utf8mb4 -u{{proxy_db_user}} --password={{proxy_db_passwd}} {{proxy_db_name}}' + - name: Proxy - Generate mariadb proxy creation script + ansible.builtin.template: + src: create_proxy_db.j2 + dest: /tmp/create_proxy_db.sql + + - name: Proxy - Create mariadb proxy database + ansible.builtin.shell: mysql -uroot < /tmp/create_proxy_db.sql + + - name: Proxy - Populate mariadb proxy database + ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/mysql/proxy.sql | mysql --default-character-set=utf8mb4 -u{{proxy_db_user}} --password={{proxy_db_passwd}} {{proxy_db_name}}' + +- name: Proxy - Setup postgresql proxy database + when: proxy_db_type == "postgresql" tags: - - install_proxy + - install_proxy + block: + - name: Proxy - Enable and start service postgresql + ansible.builtin.service: + name: postgresql + state: started + enabled: yes + + - name: Proxy - Generate postgresql proxy creation script + ansible.builtin.template: + src: create_proxy_db_pg.j2 + dest: /tmp/create_proxy_db_pg.sql + owner: postgres + + - name: Proxy - Create postgresql proxy database + ansible.builtin.shell: su - postgres -c 'psql -f /tmp/create_proxy_db_pg.sql' + + - name: Proxy - Add proxy user to pg_hba + ansible.builtin.lineinfile: + path: /etc/postgresql/{{ postgresql_version }}/main/pg_hba.conf + insertafter: '# Database administrative login by Unix domain socket' + line: "local {{ proxy_db_name }} {{ proxy_db_user }} trust" + firstmatch: yes + state: present + + - name: Proxy - Restart postgresql + ansible.builtin.service: + name: postgresql + state: restarted + + - name: Proxy - Populate postgresql proxy database + ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/postgresql/proxy.sql | psql -U{{ proxy_db_user }} {{ proxy_db_name }}' - name: Find Group set_fact: diff --git a/tasks/RedHat/install-agent2.yml b/tasks/RedHat/install-agent2.yml index 4b6dbd4..4167cac 100644 --- a/tasks/RedHat/install-agent2.yml +++ b/tasks/RedHat/install-agent2.yml @@ -1,8 +1,8 @@ - name: Agent2 - Install packages - ansible.builtin.apt: + ansible.builtin.dnf: name: "{{ item }}" - state: latest + state: present loop: "{{ agent.packages }}" tags: - install_agent @@ -10,7 +10,8 @@ - name: Agent2 - Find Group set_fact: my_group: "{{ group_names | first }}" - + tags: + - install_agent - name: Agent2 - Créer la liste des hôtes correspondant aux rôles cibles set_fact: hotes_filtres: >- @@ -19,15 +20,18 @@ selectattr('role', 'in', roles_cibles) | map(attribute='inventory_hostname') | list }} - + tags: + - install_agent - name: Agent2 - Generate Server List set_fact: Server: "{{ hotes_filtres | join(',') }}" - + tags: + - install_agent - name: Agent2 - Generate ActiveServer List set_fact: ServerActive: "{{ hotes_filtres | join(';') }}" - + tags: + - install_agent - name: Agent2 - Generate agent2 config ansible.builtin.template: src: zabbix_agent2.conf.j2 @@ -35,7 +39,8 @@ owner: zabbix group: zabbix mode: 0640 - + tags: + - install_agent - name: Agent2 - Create cert directory if zabbix_crypt=="tls" ansible.builtin.file: path: "/etc/zabbix/certs" @@ -44,7 +49,8 @@ owner: zabbix group: zabbix when: zabbix_crypt=="tls" - + tags: + - install_agent - name: Agent2 - Copy Certificats ansible.builtin.copy: src: "{{ item }}" @@ -56,6 +62,8 @@ - "{{ zabbix_agent }}.crt" - "{{ zabbix_agent }}.key" when: zabbix_crypt=="tls" + tags: + - install_agent - name: Enable and start service zabbix agent2 ansible.builtin.service: @@ -64,3 +72,5 @@ enabled: true loop: - zabbix-agent2 + tags: + - install_agent \ No newline at end of file diff --git a/tasks/RedHat/install-proxy.yml b/tasks/RedHat/install-proxy.yml index fe56edd..037f104 100644 --- a/tasks/RedHat/install-proxy.yml +++ b/tasks/RedHat/install-proxy.yml @@ -1,43 +1,89 @@ -- name: Proxy - Install Debian Proxy packages +- name: Proxy - Install packages (mysql) ansible.builtin.dnf: name: "{{ item }}" state: present - loop: "{{ proxy.packages }}" - tags: - - install_proxy - -- name: Proxy - Enable and start service mariadb - ansible.builtin.service: - name: mariadb - state: started - enabled: yes + loop: "{{ proxy_mysql.packages }}" + when: proxy_db_type == "mysql" tags: - install_proxy -- name: Proxy - Generate mariadb proxy creation script - ansible.builtin.template: - src: create_proxy_db.j2 - dest: /tmp/create_proxy_db.sql - tags: - - install_proxy - -- name: Proxy - Create mariadb proxy database - ansible.builtin.shell: mysql -uroot < /tmp/create_proxy_db.sql - tags: - - install_proxy - -- name: Proxy - Populate mariadb proxy database - ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/mysql/proxy.sql | mysql --default-character-set=utf8mb4 -u{{proxy_db_user}} --password={{proxy_db_passwd}} {{proxy_db_name}}' - tags: - - install_proxy - -- name: Proxy - Enable and restart mariadb - ansible.builtin.systemd_service: +- name: Proxy - Install packages (postgresql) + ansible.builtin.dnf: name: "{{ item }}" - state: started - enabled: true - loop: - - mariadb + state: present + loop: "{{ proxy_postgresql.packages }}" + when: proxy_db_type == "postgresql" + tags: + - install_proxy + +- name: Proxy - Setup mysql proxy database + when: proxy_db_type == "mysql" + tags: + - install_proxy + block: + - name: Proxy - Enable and start service mariadb + ansible.builtin.service: + name: mariadb + state: started + enabled: yes + + - name: Proxy - Generate mariadb proxy creation script + ansible.builtin.template: + src: create_proxy_db.j2 + dest: /tmp/create_proxy_db.sql + + - name: Proxy - Create mariadb proxy database + ansible.builtin.shell: mysql -uroot < /tmp/create_proxy_db.sql + + - name: Proxy - Populate mariadb proxy database + ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/mysql/proxy.sql | mysql --default-character-set=utf8mb4 -u{{proxy_db_user}} --password={{proxy_db_passwd}} {{proxy_db_name}}' + +- name: Proxy - Setup postgresql proxy database + when: proxy_db_type == "postgresql" + tags: + - install_proxy + block: + - name: Proxy - Check if postgresql is configured + ansible.builtin.stat: + path: /var/lib/pgsql/data/PG_VERSION + register: proxy_postgresqldata + + - name: Proxy - Init DB + ansible.builtin.shell: + cmd: postgresql-setup --initdb + when: proxy_postgresqldata.stat.exists == false + + - name: Proxy - Enable and start service postgresql + ansible.builtin.service: + name: postgresql + state: started + enabled: yes + + - name: Proxy - Generate postgresql proxy creation script + ansible.builtin.template: + src: create_proxy_db_pg.j2 + dest: /tmp/create_proxy_db_pg.sql + owner: postgres + + - name: Proxy - Create postgresql proxy database + ansible.builtin.shell: su - postgres -c 'psql -f /tmp/create_proxy_db_pg.sql' + + - name: Proxy - Add proxy user to pg_hba + ansible.builtin.lineinfile: + path: /var/lib/pgsql/data/pg_hba.conf + insertafter: '# "local" is for Unix domain socket connections only' + line: "local {{ proxy_db_name }} {{ proxy_db_user }} trust" + firstmatch: yes + state: present + + - name: Proxy - Restart postgresql + ansible.builtin.service: + name: postgresql + state: restarted + enabled: yes + + - name: Proxy - Populate postgresql proxy database + ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/postgresql/proxy.sql | psql -U{{ proxy_db_user }} {{ proxy_db_name }}' - name: Find Group set_fact: diff --git a/tasks/RedHat/install-web.yml b/tasks/RedHat/install-web.yml new file mode 100644 index 0000000..881228a --- /dev/null +++ b/tasks/RedHat/install-web.yml @@ -0,0 +1,76 @@ +# Web +- name: Web - Install packages + ansible.builtin.dnf: + name: "{{ item }}" + state: present + loop: "{{ web.packages }}" + tags: + - install_web + +- name: Web - Find Group + set_fact: + my_group: "{{ group_names | first }}" + tags: + - install_web +- name: Web - Créer la liste des hôtes correspondant aux rôles cibles + set_fact: + hotes_filtres: >- + {{ groups[my_group] | + map('extract', hostvars) | + selectattr('role', 'in', roles_cibles) | + map(attribute='inventory_hostname') | + list }} + tags: + - install_web +- name: Web - Generate Server List + set_fact: + Server: "{{ hotes_filtres | join(',') }}" + tags: + - install_web +- name: Web - Generate config + ansible.builtin.template: + src: zabbix_web_service.conf.j2 + dest: /etc/zabbix/zabbix_web_service.conf + owner: zabbix + group: zabbix + mode: 0640 + tags: + - install_web + +- name: Web - Create cert directory if zabbix_crypt=="tls" + ansible.builtin.file: + path: "/etc/zabbix/certs" + state: directory + recurse: yes + owner: zabbix + group: zabbix + when: zabbix_crypt=="tls" + tags: + - install_web + +- name: Web - Copy Certificats + ansible.builtin.copy: + src: "{{ item }}" + dest: "/etc/zabbix/certs/{{ item }}" + owner: zabbix + group: zabbix + loop: + - "{{ zabbix_ca }}.crt" + - "{{ zabbix_web }}.crt" + - "{{ zabbix_web }}.key" + - "{{ zabbix_agent }}.crt" + - "{{ zabbix_agent }}.key" + when: zabbix_crypt=="tls" + tags: + - install_web + +- name: Web -Enable and start service zabbix web + ansible.builtin.service: + name: "{{ item }}" + state: restarted + enabled: true + loop: + - zabbix-web-service + - zabbix-agent2 + tags: + - install_web \ No newline at end of file diff --git a/tasks/main.yml b/tasks/main.yml index c037e43..6584e19 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -2,7 +2,7 @@ # tasks file for zabbix - name: check OS version debug: var=ansible_os_family - + tags: always - name: include os variables include_vars: "{{ ansible_os_family }}.yml" tags: always @@ -27,6 +27,7 @@ ansible.builtin.dnf: name: "https://repo.zabbix.com/zabbix/{{ zabbix_version }}/release/alma/{{ ansible_distribution_major_version }}/noarch/zabbix-release-latest-{{ zabbix_version }}.el{{ ansible_distribution_major_version }}.noarch.rpm" state: present + tags: always - name: Prepare RH like when: ansible_os_family == "RedHat" @@ -50,6 +51,7 @@ - name: Reboot if necessary ansible.builtin.reboot: when: selinux.changed + tags: always - name: Prepare Debian when: ansible_os_family == "Debian" @@ -60,7 +62,8 @@ - name: Mise à jour le cache des paquets ansible.builtin.apt: update_cache: yes - + tags: always + - name: Database - Install when: role == "db" block: @@ -90,6 +93,12 @@ tags: - install_front +- name: Web - Install + ansible.builtin.include_tasks: "{{ansible_os_family}}/install-web.yml" + when: role == "web" + tags: + - install_web + - name: Install Agent ansible.builtin.include_tasks: "{{ansible_os_family}}/install-agent2.yml" tags: diff --git a/templates/create_proxy_db_pg.j2 b/templates/create_proxy_db_pg.j2 new file mode 100644 index 0000000..aef230d --- /dev/null +++ b/templates/create_proxy_db_pg.j2 @@ -0,0 +1,6 @@ +DROP DATABASE IF EXISTS {{ proxy_db_name }}; +DROP USER IF EXISTS {{ proxy_db_user }}; +CREATE DATABASE {{ proxy_db_name }}; +CREATE USER {{ proxy_db_user }} WITH ENCRYPTED PASSWORD '{{ proxy_db_passwd }}'; +GRANT ALL PRIVILEGES ON {{ proxy_db_name }} TO {{ proxy_db_user }}; +ALTER DATABASE {{ proxy_db_name }} OWNER TO {{ proxy_db_user }}; diff --git a/templates/zabbix_proxy.conf.j2 b/templates/zabbix_proxy.conf.j2 index 5a33db4..93bdc07 100644 --- a/templates/zabbix_proxy.conf.j2 +++ b/templates/zabbix_proxy.conf.j2 @@ -152,6 +152,9 @@ SocketDir=/run/zabbix # Mandatory: no # Default: # DBHost=localhost +{% if proxy_db_type == "postgresql" %} +DBHost= +{% endif %} ### Option: DBName # Database name. diff --git a/templates/zabbix_web_service.conf.j2 b/templates/zabbix_web_service.conf.j2 new file mode 100644 index 0000000..0797a55 --- /dev/null +++ b/templates/zabbix_web_service.conf.j2 @@ -0,0 +1,143 @@ +# This is a configuration file for Zabbix web_service +# To get more information about Zabbix, visit https://www.zabbix.com + +############ GENERAL PARAMETERS ################# + +### Option: LogType +# Specifies where log messages are written to: +# system - syslog +# file - file specified with LogFile parameter +# console - standard output +# +# Mandatory: no +# Default: +# LogType=file + +### Option: LogFile +# Log file name for LogType 'file' parameter. +# +# Mandatory: yes, if LogType is set to file, otherwise no +# Default: +# LogFile=/tmp/zabbix_web_service.log + +LogFile=/var/log/zabbix/zabbix_web_service.log + +### Option: LogFileSize +# Maximum size of log file in MB. +# 0 - disable automatic log rotation. +# +# Mandatory: no +# Range: 0-1024 +# Default: +# LogFileSize=1 + +LogFileSize=0 + +### Option: DebugLevel +# Specifies debug level: +# 0 - basic information about starting and stopping of Zabbix processes +# 1 - critical information +# 2 - error information +# 3 - warnings +# 4 - for debugging (produces lots of information) +# 5 - extended debugging (produces even more information) +# +# Mandatory: no +# Range: 0-5 +# Default: +# DebugLevel=3 + +### Option: AllowedIP +# List of comma delimited IP addresses, optionally in CIDR notation, or DNS names of Zabbix servers and Zabbix proxies. +# Incoming connections will be accepted only from the hosts listed here. +# If IPv6 support is enabled then '127.0.0.1', '::127.0.0.1', '::ffff:127.0.0.1' are treated equally +# and '::/0' will allow any IPv4 or IPv6 address. +# '0.0.0.0/0' can be used to allow any IPv4 address. +# Example: AllowedIP=127.0.0.1,192.168.1.0/24,::1,2001:db8::/32,zabbix.example.com +# +# Mandatory: yes +# Default: +# AllowedIP= + +AllowedIP={{Server}} + +### Option: ListenPort +# Service will listen on this port for connections from the server. +# +# Mandatory: no +# Range: 1024-32767 +# Default: +# ListenPort=10053 + +### Option: Timeout +# Spend no more than Timeout seconds on formatting dashboard as PDF +# +# Mandatory: no +# Range: 1-30 +# Default: +# Timeout=10 + +### Option: TLSAccept +# What incoming connections to accept. +# Specifies what type of connection to use: +# unencrypted - accept connections without encryption +# cert - accept connections secured with TLS and a certificate +# +# Mandatory: no +# Default: +{% if zabbix_crypt=="tls" %} +TLSAccept=cert +{% else %} +TLSAccept=unencrypted +{% endif %} + +### Option: TLSCAFile +# Full pathname of a file containing the top-level CA(s) certificates for +# peer certificate verification. +# +# Mandatory: no +# Default: +{% if zabbix_crypt=="tls" %} +TLSCAFile=/etc/zabbix/certs/{{zabbix_ca}}.crt +{% else %} +# TLSCAFile= +{% endif %} + +### Option: TLSCertFile +# Full pathname of a file containing the service certificate or certificate chain. +# +# Mandatory: no +# Default: +{% if zabbix_crypt=="tls" %} +TLSCertFile=/etc/zabbix/certs/{{zabbix_web}}.crt +{% else %} +# TLSCertFile= +{% endif %} + +### Option: TLSKeyFile +# Full pathname of a file containing the service private key. +# +# Mandatory: no +# Default: +{% if zabbix_crypt=="tls" %} +TLSKeyFile=/etc/zabbix/certs/{{zabbix_web}}.key +{% else %} +# TLSKeyFile= +{% endif %} + +### Option: IgnoreURLCertErrors +# Ignore TLS certificate errors when accessing Frontend URL +# 0 - do not ignore +# 1 - ignore +# +# Mandatory: no +# Default: +IgnoreURLCertErrors=1 + +### Option: Include +# You may include individual files or all files in a directory in the configuration file. +# +# Mandatory: no +# Include= + + diff --git a/vars/Debian.yml b/vars/Debian.yml index 2aeca8d..9387f2a 100644 --- a/vars/Debian.yml +++ b/vars/Debian.yml @@ -20,12 +20,26 @@ front: - nginx - zabbix-agent2 - keepalived -proxy: +proxy_mysql: packages: - mariadb-server - - zabbix-proxy-mysql + - zabbix-proxy-mysql - zabbix-sql-scripts - zabbix-agent2 + +proxy_postgresql: + packages: + - postgresql + - postgresql-contrib + - python3-psycopg2 + - zabbix-proxy-pgsql + - zabbix-sql-scripts + - zabbix-agent2 +web: + packages: + - zabbix-web-service + - zabbix-agent2 + agent: packages: - zabbix-agent2 diff --git a/vars/RedHat.yml b/vars/RedHat.yml index c495932..a7c8f3e 100644 --- a/vars/RedHat.yml +++ b/vars/RedHat.yml @@ -24,10 +24,23 @@ front: - zabbix-agent2 - zabbix-selinux-policy - php-fpm -proxy: +proxy_mysql: packages: - mariadb-server - mariadb - - zabbix-proxy-mysql + - zabbix-proxy-mysql - zabbix-sql-scripts - zabbix-agent2 + +proxy_postgresql: + packages: + - postgresql-server + - postgresql-contrib + - postgresql + - zabbix-proxy-pgsql + - zabbix-sql-scripts + - zabbix-agent2 +web: + packages: + - zabbix-web-service + - zabbix-agent2 \ No newline at end of file