Ajout proxy postgresql

README.md

@@ -76,6 +76,7 @@ Variable definies dans default/main.yml
 |db_name|Nom de la base de postgres des serveurs||
 |db_user|Nom de l'utilisateur de la base postgres serveurs||
 |db_passwd|Mot de passe l'utilisateur de la base postgres serveurs||
+|proxy_db_type|Type de base locale du proxy: mysql ou postgresql|Défaut: mysql. Sélectionnable par host via l'inventory ou host_vars|
 |proxy_db_name|Nom de la base des proxys||
 |proxy_db_user|Nom de l'utilisateur de la base des proxys||
 |proxy_db_passwd|Mot de passe de l'utilisateur de la base des proxys||
@@ -144,6 +145,7 @@ Exemple Inventory
           role: proxy
         proxy02.mondomain.com:
           role: proxy
+          proxy_db_type: postgresql
 
 Example Playbook
 -------------------

defaults/main.yml

@@ -8,6 +8,7 @@ db_name: zabbix
 db_user: zabbix
 db_passwd: zabbix
 
+proxy_db_type: mysql
 proxy_db_name: zabbix_proxy
 proxy_db_user: zabbix_proxy
 proxy_db_passwd: zabbix_proxy
@@ -16,3 +17,4 @@ zabbix_ca: zabbix_ca
 zabbix_server: zabbix_server
 zabbix_proxy: zabbix_proxy
 zabbix_agent: zabbix_agent
+zabbix_web: zabbix_web

tasks/Debian/instal-web.yml

@@ -0,0 +1,7 @@
+- name: Web - Install packages
+  ansible.builtin.apt:
+    name: "{{ item }}"
+    state: latest
+  loop: "{{ web.packages }}"
+  tags:
+    - install_web

tasks/Debian/install-proxy.yml

@@ -1,37 +1,82 @@
-- name: Proxy - Install Debian Proxy packages
+- name: Proxy - Install packages (mysql)
   ansible.builtin.apt:
     name: "{{ item }}"
     state: latest
-  loop: "{{ proxy.packages }}"
+  loop: "{{ proxy_mysql.packages }}"
+  when:
+    - ansible_os_family == "Debian"
+    - proxy_db_type == "mysql"
   tags:
     - install_proxy
-  when: ansible_os_family == "Debian" 
 
+- name: Proxy - Install packages (postgresql)
+  ansible.builtin.apt:
+    name: "{{ item }}"
+    state: latest
+  loop: "{{ proxy_postgresql.packages }}"
+  when:
+    - ansible_os_family == "Debian"
+    - proxy_db_type == "postgresql"
+  tags:
+    - install_proxy
 
-- name: Proxy - Enable and start service mariadb
+- name: Proxy - Setup mysql proxy database
+  when: proxy_db_type == "mysql"
+  tags:
+    - install_proxy
+  block:
+    - name: Proxy - Enable and start service mariadb
       ansible.builtin.service:
         name: mariadb
         state: started
         enabled: yes
-  tags:
-    - install_proxy
 
-- name: Proxy - Generate mariadb proxy creation script
+    - name: Proxy - Generate mariadb proxy creation script
       ansible.builtin.template:
         src: create_proxy_db.j2
         dest: /tmp/create_proxy_db.sql
-  tags:
-    - install_proxy
 
-- name: Proxy - Create mariadb proxy database
+    - name: Proxy - Create mariadb proxy database
       ansible.builtin.shell: mysql -uroot <  /tmp/create_proxy_db.sql
-  tags:
-   - install_proxy
 
-- name: Proxy - Populate mariadb proxy database
+    - name: Proxy - Populate mariadb proxy database
       ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/mysql/proxy.sql | mysql --default-character-set=utf8mb4 -u{{proxy_db_user}} --password={{proxy_db_passwd}} {{proxy_db_name}}'
+
+- name: Proxy - Setup postgresql proxy database
+  when: proxy_db_type == "postgresql"
   tags:
     - install_proxy
+  block:
+    - name: Proxy - Enable and start service postgresql
+      ansible.builtin.service:
+        name: postgresql
+        state: started
+        enabled: yes
+
+    - name: Proxy - Generate postgresql proxy creation script
+      ansible.builtin.template:
+        src: create_proxy_db_pg.j2
+        dest: /tmp/create_proxy_db_pg.sql
+        owner: postgres
+
+    - name: Proxy - Create postgresql proxy database
+      ansible.builtin.shell: su - postgres -c 'psql -f /tmp/create_proxy_db_pg.sql'
+
+    - name: Proxy - Add proxy user to pg_hba
+      ansible.builtin.lineinfile:
+        path: /etc/postgresql/{{ postgresql_version }}/main/pg_hba.conf
+        insertafter: '# Database administrative login by Unix domain socket'
+        line: "local   {{ proxy_db_name }}          {{ proxy_db_user }}           trust"
+        firstmatch: yes
+        state: present
+
+    - name: Proxy - Restart postgresql
+      ansible.builtin.service:
+        name: postgresql
+        state: restarted
+
+    - name: Proxy - Populate postgresql proxy database
+      ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/postgresql/proxy.sql | psql -U{{ proxy_db_user }} {{ proxy_db_name }}'
 
 - name: Find Group
   set_fact:

tasks/RedHat/install-agent2.yml

@@ -1,8 +1,8 @@
 
 - name: Agent2 -  Install packages
-  ansible.builtin.apt:
+  ansible.builtin.dnf:
     name: "{{ item }}"
-    state: latest
+    state: present
   loop: "{{ agent.packages }}"
   tags:
     - install_agent
@@ -10,7 +10,8 @@
 - name: Agent2 - Find Group
   set_fact:
     my_group:  "{{ group_names | first }}"
-
+  tags:
+    - install_agent
 - name: Agent2 - Créer la liste des hôtes correspondant aux rôles cibles
   set_fact:
     hotes_filtres: >-
@@ -19,15 +20,18 @@
       selectattr('role', 'in', roles_cibles) |
       map(attribute='inventory_hostname') |
       list }}
-
+  tags:
+    - install_agent
 - name: Agent2 - Generate Server List
   set_fact:
     Server: "{{ hotes_filtres | join(',') }}"
-
+  tags:
+    - install_agent
 - name: Agent2 - Generate ActiveServer List
   set_fact:
     ServerActive: "{{ hotes_filtres | join(';') }}"
-
+  tags:
+    - install_agent
 - name: Agent2 - Generate agent2 config
   ansible.builtin.template:
       src: zabbix_agent2.conf.j2
@@ -35,7 +39,8 @@
       owner: zabbix
       group: zabbix
       mode: 0640
-
+  tags:
+    - install_agent
 - name: Agent2 - Create cert directory if zabbix_crypt=="tls"
   ansible.builtin.file:
     path:  "/etc/zabbix/certs"
@@ -44,7 +49,8 @@
     owner: zabbix
     group: zabbix
   when: zabbix_crypt=="tls"
-   
+  tags:
+    - install_agent
 - name: Agent2 - Copy Certificats
   ansible.builtin.copy:
     src: "{{ item }}"
@@ -56,6 +62,8 @@
     - "{{ zabbix_agent }}.crt"
     - "{{ zabbix_agent }}.key"
   when: zabbix_crypt=="tls"
+  tags:
+    - install_agent
 
 - name: Enable and start service zabbix agent2
   ansible.builtin.service:
@@ -64,3 +72,5 @@
     enabled: true
   loop: 
     - zabbix-agent2
+  tags:
+    - install_agent

tasks/RedHat/install-proxy.yml

@@ -1,43 +1,89 @@
-- name: Proxy - Install Debian Proxy packages
+- name: Proxy - Install packages (mysql)
   ansible.builtin.dnf:
     name: "{{ item }}"
     state: present
-  loop: "{{ proxy.packages }}"
+  loop: "{{ proxy_mysql.packages }}"
+  when: proxy_db_type == "mysql"
   tags:
     - install_proxy
 
-- name: Proxy - Enable and start service mariadb
+- name: Proxy - Install packages (postgresql)
+  ansible.builtin.dnf:
+    name: "{{ item }}"
+    state: present
+  loop: "{{ proxy_postgresql.packages }}"
+  when: proxy_db_type == "postgresql"
+  tags:
+    - install_proxy
+
+- name: Proxy - Setup mysql proxy database
+  when: proxy_db_type == "mysql"
+  tags:
+    - install_proxy
+  block:
+    - name: Proxy - Enable and start service mariadb
       ansible.builtin.service:
         name: mariadb
         state: started
         enabled: yes
-  tags:
-    - install_proxy
 
-- name: Proxy - Generate mariadb proxy creation script
+    - name: Proxy - Generate mariadb proxy creation script
       ansible.builtin.template:
         src: create_proxy_db.j2
         dest: /tmp/create_proxy_db.sql
-  tags:
-    - install_proxy
 
-- name: Proxy - Create mariadb proxy database
+    - name: Proxy - Create mariadb proxy database
       ansible.builtin.shell: mysql -uroot <  /tmp/create_proxy_db.sql
-  tags:
-   - install_proxy
 
-- name: Proxy - Populate mariadb proxy database
+    - name: Proxy - Populate mariadb proxy database
       ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/mysql/proxy.sql | mysql --default-character-set=utf8mb4 -u{{proxy_db_user}} --password={{proxy_db_passwd}} {{proxy_db_name}}'
+
+- name: Proxy - Setup postgresql proxy database
+  when: proxy_db_type == "postgresql"
   tags:
     - install_proxy
+  block:
+    - name: Proxy - Check if postgresql is configured
+      ansible.builtin.stat:
+        path: /var/lib/pgsql/data/PG_VERSION
+      register: proxy_postgresqldata
 
-- name: Proxy - Enable and restart mariadb
-  ansible.builtin.systemd_service:
-    name: "{{ item }}"
+    - name: Proxy - Init DB
+      ansible.builtin.shell:
+        cmd: postgresql-setup --initdb
+      when: proxy_postgresqldata.stat.exists == false
+
+    - name: Proxy - Enable and start service postgresql
+      ansible.builtin.service:
+        name: postgresql
         state: started
-    enabled: true
-  loop: 
-    - mariadb
+        enabled: yes
+
+    - name: Proxy - Generate postgresql proxy creation script
+      ansible.builtin.template:
+        src: create_proxy_db_pg.j2
+        dest: /tmp/create_proxy_db_pg.sql
+        owner: postgres
+
+    - name: Proxy - Create postgresql proxy database
+      ansible.builtin.shell: su - postgres -c 'psql -f /tmp/create_proxy_db_pg.sql'
+
+    - name: Proxy - Add proxy user to pg_hba
+      ansible.builtin.lineinfile:
+        path: /var/lib/pgsql/data/pg_hba.conf
+        insertafter: '# "local" is for Unix domain socket connections only'
+        line: "local   {{ proxy_db_name }}          {{ proxy_db_user }}           trust"
+        firstmatch: yes
+        state: present
+
+    - name: Proxy - Restart postgresql
+      ansible.builtin.service:
+        name: postgresql
+        state: restarted
+        enabled: yes
+
+    - name: Proxy - Populate postgresql proxy database
+      ansible.builtin.shell: 'cat /usr/share/zabbix/sql-scripts/postgresql/proxy.sql | psql -U{{ proxy_db_user }} {{ proxy_db_name }}'
 
 - name: Find Group
   set_fact:

tasks/RedHat/install-web.yml

@@ -0,0 +1,76 @@
+# Web
+- name: Web - Install packages
+  ansible.builtin.dnf:
+    name: "{{ item }}"
+    state: present
+  loop: "{{ web.packages }}"
+  tags:
+    - install_web
+
+- name: Web - Find Group
+  set_fact:
+    my_group:  "{{ group_names | first }}"
+  tags:
+    - install_web
+- name: Web - Créer la liste des hôtes correspondant aux rôles cibles
+  set_fact:
+    hotes_filtres: >-
+      {{ groups[my_group] |
+      map('extract', hostvars) |
+      selectattr('role', 'in', roles_cibles) |
+      map(attribute='inventory_hostname') |
+      list }}
+  tags:
+    - install_web
+- name: Web - Generate Server List
+  set_fact:
+    Server: "{{ hotes_filtres | join(',') }}"
+  tags:
+    - install_web
+- name: Web - Generate config
+  ansible.builtin.template:
+      src: zabbix_web_service.conf.j2
+      dest: /etc/zabbix/zabbix_web_service.conf
+      owner: zabbix
+      group: zabbix
+      mode: 0640
+  tags:
+    - install_web
+
+- name: Web - Create cert directory if zabbix_crypt=="tls"
+  ansible.builtin.file:
+    path:  "/etc/zabbix/certs"
+    state: directory
+    recurse: yes
+    owner: zabbix
+    group: zabbix
+  when: zabbix_crypt=="tls"
+  tags:
+    - install_web 
+
+- name: Web - Copy Certificats
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/etc/zabbix/certs/{{ item }}"
+    owner: zabbix
+    group: zabbix
+  loop:
+    - "{{ zabbix_ca }}.crt"
+    - "{{ zabbix_web }}.crt"
+    - "{{ zabbix_web }}.key"
+    - "{{ zabbix_agent }}.crt"
+    - "{{ zabbix_agent }}.key"
+  when: zabbix_crypt=="tls"
+  tags:
+    - install_web
+    
+- name: Web -Enable and start service zabbix web
+  ansible.builtin.service:
+    name: "{{ item }}"
+    state: restarted
+    enabled: true
+  loop: 
+    - zabbix-web-service
+    - zabbix-agent2
+  tags:
+    - install_web

tasks/main.yml

@@ -2,7 +2,7 @@
 # tasks file for zabbix
 - name: check OS version
   debug: var=ansible_os_family
-
+  tags: always
 - name: include os variables
   include_vars: "{{ ansible_os_family }}.yml"
   tags: always
@@ -27,6 +27,7 @@
       ansible.builtin.dnf:
         name: "https://repo.zabbix.com/zabbix/{{ zabbix_version }}/release/alma/{{ ansible_distribution_major_version }}/noarch/zabbix-release-latest-{{ zabbix_version }}.el{{ ansible_distribution_major_version }}.noarch.rpm"
         state: present
+  tags: always
 
 - name: Prepare RH like
   when: ansible_os_family == "RedHat"
@@ -50,6 +51,7 @@
     - name: Reboot if necessary
       ansible.builtin.reboot:
       when: selinux.changed
+  tags: always
 
 - name: Prepare Debian
   when: ansible_os_family == "Debian"
@@ -60,6 +62,7 @@
     - name: Mise à jour le cache des paquets
       ansible.builtin.apt:
         update_cache: yes
+  tags: always
   
 - name: Database - Install
   when: role == "db"
@@ -90,6 +93,12 @@
   tags:
     - install_front
 
+- name: Web - Install
+  ansible.builtin.include_tasks: "{{ansible_os_family}}/install-web.yml"
+  when: role == "web" 
+  tags:
+    - install_web
+
 - name: Install Agent
   ansible.builtin.include_tasks: "{{ansible_os_family}}/install-agent2.yml"
   tags:

templates/create_proxy_db_pg.j2

@@ -0,0 +1,6 @@
+DROP DATABASE IF EXISTS {{ proxy_db_name }};
+DROP USER IF EXISTS {{ proxy_db_user }};
+CREATE DATABASE {{ proxy_db_name }};
+CREATE USER {{ proxy_db_user }} WITH ENCRYPTED PASSWORD '{{ proxy_db_passwd }}';
+GRANT ALL PRIVILEGES ON {{ proxy_db_name }} TO {{ proxy_db_user }};
+ALTER DATABASE {{ proxy_db_name }}  OWNER TO {{ proxy_db_user }};

templates/zabbix_proxy.conf.j2

@@ -152,6 +152,9 @@ SocketDir=/run/zabbix
 # Mandatory: no
 # Default:
 # DBHost=localhost
+{% if proxy_db_type == "postgresql" %}
+DBHost=
+{% endif %}
 
 ### Option: DBName
 #       Database name.

templates/zabbix_web_service.conf.j2

@@ -0,0 +1,143 @@
+# This is a configuration file for Zabbix web_service
+# To get more information about Zabbix, visit https://www.zabbix.com
+
+############ GENERAL PARAMETERS #################
+
+### Option: LogType
+#       Specifies where log messages are written to:
+#               system  - syslog
+#               file    - file specified with LogFile parameter
+#               console - standard output
+#
+# Mandatory: no
+# Default:
+# LogType=file
+
+### Option: LogFile
+#       Log file name for LogType 'file' parameter.
+#
+# Mandatory: yes, if LogType is set to file, otherwise no
+# Default:
+# LogFile=/tmp/zabbix_web_service.log
+
+LogFile=/var/log/zabbix/zabbix_web_service.log
+
+### Option: LogFileSize
+#       Maximum size of log file in MB.
+#       0 - disable automatic log rotation.
+#
+# Mandatory: no
+# Range: 0-1024
+# Default:
+# LogFileSize=1
+
+LogFileSize=0
+
+### Option: DebugLevel
+#       Specifies debug level:
+#       0 - basic information about starting and stopping of Zabbix processes
+#       1 - critical information
+#       2 - error information
+#       3 - warnings
+#       4 - for debugging (produces lots of information)
+#       5 - extended debugging (produces even more information)
+#
+# Mandatory: no
+# Range: 0-5
+# Default:
+# DebugLevel=3
+
+### Option: AllowedIP
+#       List of comma delimited IP addresses, optionally in CIDR notation, or DNS names of Zabbix servers and Zabbix proxies.
+#       Incoming connections will be accepted only from the hosts listed here.
+#       If IPv6 support is enabled then '127.0.0.1', '::127.0.0.1', '::ffff:127.0.0.1' are treated equally
+#       and '::/0' will allow any IPv4 or IPv6 address.
+#       '0.0.0.0/0' can be used to allow any IPv4 address.
+#       Example: AllowedIP=127.0.0.1,192.168.1.0/24,::1,2001:db8::/32,zabbix.example.com
+#
+# Mandatory: yes
+# Default:
+# AllowedIP=
+
+AllowedIP={{Server}}
+
+### Option: ListenPort
+#       Service will listen on this port for connections from the server.
+#
+# Mandatory: no
+# Range: 1024-32767
+# Default:
+# ListenPort=10053
+
+### Option: Timeout
+#       Spend no more than Timeout seconds on formatting dashboard as PDF
+#
+# Mandatory: no
+# Range: 1-30
+# Default:
+# Timeout=10
+
+### Option: TLSAccept
+#       What incoming connections to accept.
+#       Specifies what type of connection to use:
+#               unencrypted - accept connections without encryption
+#               cert        - accept connections secured with TLS and a certificate
+#
+# Mandatory: no
+# Default:
+{% if zabbix_crypt=="tls" %}
+TLSAccept=cert
+{% else %}
+TLSAccept=unencrypted
+{% endif %}
+
+### Option: TLSCAFile
+#       Full pathname of a file containing the top-level CA(s) certificates for
+#       peer certificate verification.
+#
+# Mandatory: no
+# Default:
+{% if zabbix_crypt=="tls" %}
+TLSCAFile=/etc/zabbix/certs/{{zabbix_ca}}.crt
+{% else %}
+# TLSCAFile=
+{% endif %}
+
+### Option: TLSCertFile
+#       Full pathname of a file containing the service certificate or certificate chain.
+#
+# Mandatory: no
+# Default:
+{% if zabbix_crypt=="tls" %}
+TLSCertFile=/etc/zabbix/certs/{{zabbix_web}}.crt
+{% else %}
+# TLSCertFile=
+{% endif %}
+
+### Option: TLSKeyFile
+#       Full pathname of a file containing the service private key.
+#
+# Mandatory: no
+# Default:
+{% if zabbix_crypt=="tls" %}
+TLSKeyFile=/etc/zabbix/certs/{{zabbix_web}}.key
+{% else %}
+# TLSKeyFile=
+{% endif %}
+
+### Option: IgnoreURLCertErrors
+#       Ignore TLS certificate errors when accessing Frontend URL
+#               0 - do not ignore
+#               1 - ignore
+#
+# Mandatory: no
+# Default:
+IgnoreURLCertErrors=1
+
+### Option: Include
+#       You may include individual files or all files in a directory in the configuration file.
+#
+# Mandatory: no
+# Include=
+
+

vars/Debian.yml

@@ -20,12 +20,26 @@ front:
     - nginx
     - zabbix-agent2
     - keepalived
-proxy:
+proxy_mysql:
   packages:
     - mariadb-server
     - zabbix-proxy-mysql
     - zabbix-sql-scripts
     - zabbix-agent2
+
+proxy_postgresql:
+  packages:
+    - postgresql
+    - postgresql-contrib
+    - python3-psycopg2
+    - zabbix-proxy-pgsql
+    - zabbix-sql-scripts
+    - zabbix-agent2
+web:
+  packages: 
+    - zabbix-web-service
+    - zabbix-agent2
+
 agent:
   packages: 
     - zabbix-agent2

vars/RedHat.yml

@@ -24,10 +24,23 @@ front:
     - zabbix-agent2
     - zabbix-selinux-policy
     - php-fpm
-proxy:
+proxy_mysql:
   packages:
     - mariadb-server
     - mariadb
     - zabbix-proxy-mysql
     - zabbix-sql-scripts
     - zabbix-agent2
+
+proxy_postgresql:
+  packages:
+    - postgresql-server
+    - postgresql-contrib
+    - postgresql
+    - zabbix-proxy-pgsql
+    - zabbix-sql-scripts
+    - zabbix-agent2
+web:
+  packages: 
+    - zabbix-web-service
+    - zabbix-agent2